fix(web): prevent duplicate skill autosaves

Signed-off-by: samzong <[email protected]>

.github/workflows/api-tests.yml

@@ -29,13 +29,13 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Setup UV and Python
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           enable-cache: true
           python-version: ${{ matrix.python-version }}
@@ -88,13 +88,13 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Setup UV and Python
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           enable-cache: true
           python-version: ${{ matrix.python-version }}
@@ -139,13 +139,13 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Setup UV and Python
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           enable-cache: true
           python-version: "3.12"

.github/workflows/autofix.yml

@@ -20,7 +20,7 @@ jobs:
         run: echo "autofix.ci updates pull request branches, not merge group refs."
 
       - if: github.event_name != 'merge_group'
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Check Docker Compose inputs
         if: github.event_name != 'merge_group'
@@ -84,12 +84,12 @@ jobs:
             dify-agent/pyproject.toml
             dify-agent/uv.lock
       - if: github.event_name != 'merge_group'
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.11"
 
       - if: github.event_name != 'merge_group'
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
 
       - name: Generate Docker Compose
         if: github.event_name != 'merge_group' && steps.docker-compose-changes.outputs.any_changed == 'true'

.github/workflows/build-push.yml

@@ -97,7 +97,7 @@ jobs:
           echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
 
       - name: Login to Docker Hub
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           username: ${{ env.DOCKERHUB_USER }}
           password: ${{ env.DOCKERHUB_TOKEN }}
@@ -199,7 +199,7 @@ jobs:
           merge-multiple: true
 
       - name: Login to Docker Hub
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           username: ${{ env.DOCKERHUB_USER }}
           password: ${{ env.DOCKERHUB_TOKEN }}

.github/workflows/cli-e2e.yml

@@ -79,7 +79,7 @@ jobs:
       ws2_app_id:                 ${{ steps.out.outputs.DIFY_E2E_WS2_APP_ID }}
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
         with:
           ref: ${{ inputs.cli_ref || github.ref }}
           persist-credentials: false
@@ -123,7 +123,7 @@ jobs:
         shell: bash
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
         with:
           ref: ${{ inputs.cli_ref || github.ref }}
           persist-credentials: false
@@ -170,7 +170,7 @@ jobs:
         shell: bash
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
         with:
           ref: ${{ inputs.cli_ref || github.ref }}
           persist-credentials: false
@@ -233,7 +233,7 @@ jobs:
         shell: bash
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
         with:
           ref: ${{ inputs.cli_ref || github.ref }}
           persist-credentials: false
@@ -295,7 +295,7 @@ jobs:
         shell: bash
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
         with:
           ref: ${{ inputs.cli_ref || github.ref }}
           persist-credentials: false
@@ -351,7 +351,7 @@ jobs:
         shell: bash
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
         with:
           ref: ${{ inputs.cli_ref || github.ref }}
           persist-credentials: false

.github/workflows/cli-edge.yml

@@ -23,7 +23,7 @@ jobs:
         working-directory: ./cli
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           fetch-depth: 0

.github/workflows/cli-release.yml

@@ -35,7 +35,7 @@ jobs:
       dify_tag: ${{ steps.resolve.outputs.dify_tag }}
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -98,7 +98,7 @@ jobs:
       DIFY_TAG: ${{ needs.validate.outputs.dify_tag }}
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           fetch-depth: 1

.github/workflows/cli-smoke.yml

@@ -24,7 +24,7 @@ jobs:
         shell: bash
     steps:
       - name: Checkout cli ref
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ inputs.cli_ref || github.ref }}
           persist-credentials: false

.github/workflows/cli-tests.yml

@@ -30,7 +30,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 

.github/workflows/db-migration-test.yml

@@ -13,13 +13,13 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Setup UV and Python
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           enable-cache: true
           python-version: "3.12"
@@ -63,13 +63,13 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Setup UV and Python
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           enable-cache: true
           python-version: "3.12"

.github/workflows/hotfix-cherry-pick.yml

@@ -24,7 +24,7 @@ jobs:
     name: Require cherry-pick provenance
     runs-on: depot-ubuntu-24.04
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 

.github/workflows/labeler.yml

@@ -9,6 +9,6 @@ jobs:
       pull-requests: write
     runs-on: depot-ubuntu-24.04
     steps:
-      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
+      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
         with:
           sync-labels: true

.github/workflows/main-ci.yml

@@ -47,7 +47,7 @@ jobs:
       migration-changed: ${{ steps.changes.outputs.migration }}
       sandbox-runtime-changed: ${{ steps.changes.outputs.sandbox-runtime }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
         id: changes
         with:

.github/workflows/post-merge.yml

@@ -18,7 +18,7 @@ jobs:
     outputs:
       external-e2e-changed: ${{ steps.changes.outputs.external_e2e }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
         id: changes
         with:

.github/workflows/pyrefly-diff.yml

@@ -17,12 +17,12 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout PR branch
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 
       - name: Setup Python & UV
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           enable-cache: true
 

.github/workflows/pyrefly-type-coverage-comment.yml

@@ -21,10 +21,10 @@ jobs:
     if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.pull_requests[0].head.repo.full_name != github.repository }}
     steps:
       - name: Checkout default branch (trusted code)
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup Python & UV
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           enable-cache: true
 

.github/workflows/pyrefly-type-coverage.yml

@@ -17,12 +17,12 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout PR branch
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 
       - name: Setup Python & UV
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           enable-cache: true
 

.github/workflows/sandbox-runtime-tests.yml

@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -45,7 +45,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -72,7 +72,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false

.github/workflows/style.yml

@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           fetch-depth: 0
@@ -45,7 +45,7 @@ jobs:
 
       - name: Setup UV and Python
         if: steps.changed-files.outputs.any_changed == 'true'
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           enable-cache: false
           python-version: "3.12"
@@ -93,7 +93,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -144,7 +144,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -186,7 +186,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false

.github/workflows/tool-test-sdks.yaml

@@ -24,7 +24,7 @@ jobs:
         working-directory: sdks/nodejs-client
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 

.github/workflows/translate-i18n-claude.yml

@@ -40,7 +40,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -158,7 +158,7 @@ jobs:
 
       - name: Run Claude Code for Translation Sync
         if: steps.context.outputs.CHANGED_FILES != ''
-        uses: anthropics/claude-code-action@be7b93b1907a4abad570368f3c74b6fe3807510b # v1.0.183
+        uses: anthropics/claude-code-action@af0559ee4f514d1ef21826982bed13f7edc3c35e # v1.0.178
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           github_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/trigger-i18n-sync.yml

@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 

.github/workflows/vdb-tests-full.yml

@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -36,7 +36,7 @@ jobs:
           remove_tool_cache: true
 
       - name: Setup UV and Python
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           enable-cache: true
           python-version: ${{ matrix.python-version }}

.github/workflows/vdb-tests.yml

@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -33,7 +33,7 @@ jobs:
           remove_tool_cache: true
 
       - name: Setup UV and Python
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           enable-cache: true
           python-version: ${{ matrix.python-version }}

.github/workflows/web-e2e.yml

@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -34,7 +34,7 @@ jobs:
         uses: ./.github/actions/setup-web
 
       - name: Setup UV and Python
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           enable-cache: true
           python-version: "3.12"

.github/workflows/web-tests.yml

@@ -29,7 +29,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -62,7 +62,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -100,7 +100,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -132,7 +132,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 

api/.env.example

@@ -729,6 +729,7 @@ OTEL_MAX_EXPORT_BATCH_SIZE=512
 OTEL_METRIC_EXPORT_INTERVAL=60000
 OTEL_BATCH_EXPORT_TIMEOUT=10000
 OTEL_METRIC_EXPORT_TIMEOUT=30000
+
 # Prevent Clickjacking
 ALLOW_EMBED=false
 

api/configs/feature/__init__.py

@@ -816,41 +816,6 @@ class UpdateConfig(BaseSettings):
     )
 
 
-class CommunityTelemetryConfig(BaseSettings):
-    """
-    Configuration for anonymous self-hosted community telemetry.
-    """
-
-    DISABLE_TELEMETRY: bool = Field(
-        description="Disable anonymous community telemetry",
-        default=False,
-    )
-    DO_NOT_TRACK: bool = Field(
-        description="Respect the standard do-not-track opt-out signal for telemetry",
-        default=False,
-    )
-    TELEMETRY_ENDPOINT: str = Field(
-        description="Endpoint for anonymous community telemetry events",
-        default="https://otel.dify.ai/v1/events",
-    )
-    TELEMETRY_FALLBACK_ENDPOINT: str = Field(
-        description="Fallback endpoint for anonymous community telemetry events",
-        default="https://otel.dify.cn/v1/events",
-    )
-    TELEMETRY_TIMEOUT_SECONDS: PositiveInt = Field(
-        description="HTTP timeout in seconds for anonymous community telemetry requests",
-        default=3,
-    )
-    TELEMETRY_HEARTBEAT_INTERVAL_MINUTES: PositiveInt = Field(
-        description="Celery beat interval in minutes for checking whether heartbeat telemetry is due",
-        default=30,
-    )
-    CI: bool = Field(
-        description="Whether the process is running in CI; telemetry is skipped when true",
-        default=False,
-    )
-
-
 class WorkflowVariableTruncationConfig(BaseSettings):
     WORKFLOW_VARIABLE_TRUNCATION_MAX_SIZE: PositiveInt = Field(
         # 1000 KiB
@@ -1634,7 +1599,6 @@ class FeatureConfig(
     TenantIsolatedTaskQueueConfig,
     ToolConfig,
     UpdateConfig,
-    CommunityTelemetryConfig,
     WorkflowConfig,
     WorkflowNodeExecutionConfig,
     WorkspaceConfig,

api/controllers/console/__init__.py

@@ -144,6 +144,7 @@ from .workspace import (
     models,
     plugin,
     rbac,
+    skills,
     snippets,
     tool_providers,
     trigger_providers,
@@ -225,6 +226,7 @@ __all__ = [
     "saved_message",
     "setup",
     "site",
+    "skills",
     "snippet_workflow",
     "snippet_workflow_draft_variable",
     "snippets",

api/controllers/console/agent/roster.py

@@ -257,6 +257,7 @@ class AgentAppDetailWithSite(GenericAppDetailWithSite):
     debug_conversation_has_messages: bool = False
     debug_conversation_message_count: int = 0
     role: str | None = None
+    active_config_is_published: bool = False
 
 
 class AgentDebugConversationRefreshResponse(BaseModel):
@@ -409,6 +410,10 @@ def _serialize_agent_app_detail(
     payload["debug_conversation_has_messages"] = message_count > 0
     payload["debug_conversation_message_count"] = message_count
     payload["role"] = agent.role or ""
+    payload["active_config_is_published"] = roster_service.active_config_is_published(
+        tenant_id=app_model.tenant_id,
+        agent=agent,
+    )
     return payload
 
 

api/controllers/console/tag/tags.py

@@ -59,7 +59,7 @@ class TagBindingRemovePayload(BaseModel):
 
 
 class TagListQueryParam(BaseModel):
-    type: Literal["knowledge", "app", "snippet", ""] = Field("", description="Tag type filter")
+    type: TagType | Literal[""] = Field("", description="Tag type filter")
     keyword: str | None = Field(None, description="Search keyword")
 
 

api/controllers/console/workspace/model_providers.py

@@ -26,11 +26,7 @@ from libs.helper import dump_response, uuid_value
 from libs.login import login_required
 from models import Account
 from services.billing_service import BillingService
-from services.entities.model_provider_entities import (
-    ModelProviderPluginSummaryResponse,
-    ModelProviderSummaryResponse,
-    ProviderResponse,
-)
+from services.entities.model_provider_entities import ProviderResponse
 from services.model_provider_service import ModelProviderService
 
 
@@ -95,11 +91,6 @@ class ModelProviderListResponse(ResponseModel):
     data: list[ProviderResponse]
 
 
-class ModelProviderSummaryListResponse(ResponseModel):
-    data: list[ModelProviderSummaryResponse]
-    plugins: dict[str, ModelProviderPluginSummaryResponse]
-
-
 class ProviderCredentialsResponse(ResponseModel):
     credentials: dict[str, Any] | None = None
 
@@ -123,7 +114,6 @@ register_response_schema_models(
     console_ns,
     SimpleResultResponse,
     ModelProviderListResponse,
-    ModelProviderSummaryListResponse,
     ProviderCredentialsResponse,
     ValidationResultResponse,
     ModelProviderPaymentCheckoutUrlResponse,
@@ -150,25 +140,6 @@ class ModelProviderListApi(Resource):
         return ModelProviderListResponse(data=provider_list).model_dump(mode="json")
 
 
-@console_ns.route("/workspaces/current/model-providers/summary")
-class ModelProviderSummaryListApi(Resource):
-    @console_ns.response(
-        200,
-        "Model provider summaries retrieved successfully",
-        console_ns.models[ModelProviderSummaryListResponse.__name__],
-    )
-    @setup_required
-    @login_required
-    @account_initialization_required
-    @with_current_tenant_id
-    def get(self, tenant_id: str):
-        providers, plugins = ModelProviderService().get_provider_summary_list(tenant_id=tenant_id)
-        return dump_response(
-            ModelProviderSummaryListResponse,
-            {"data": providers, "plugins": plugins},
-        )
-
-
 @console_ns.route("/workspaces/current/model-providers/<path:provider>/credentials")
 class ModelProviderCredentialApi(Resource):
     @console_ns.doc(params=query_params_from_model(ParserCredentialId))

api/controllers/console/workspace/plugin.py

@@ -1,5 +1,5 @@
 import io
-from collections.abc import Mapping, Sequence
+from collections.abc import Mapping
 from datetime import datetime
 from typing import Any, Literal, TypedDict
 
@@ -43,7 +43,6 @@ from core.plugin.entities.plugin_daemon import PluginDecodeResponse, PluginInsta
 from core.plugin.impl.exc import PluginDaemonClientSideError
 from core.plugin.plugin_service import PluginService
 from core.tools.builtin_tool.providers._positions import BuiltinToolProviderSort
-from core.tools.entities.api_entities import ToolProviderApiEntity
 from core.tools.entities.common_entities import I18nObject
 from core.tools.entities.tool_entities import ToolProviderType
 from core.tools.tool_manager import ToolManager
@@ -91,21 +90,9 @@ class ParserList(BaseModel):
     page_size: int = Field(default=256, ge=1, le=256, description="Page size (1-256)")
 
 
-type PluginCategoryListLanguage = Literal["en_US", "zh_Hans", "ja_JP", "pt_BR"]
-
-
 class PluginCategoryListQuery(BaseModel):
     page: int = Field(default=1, ge=1, description="Page number")
     page_size: int = Field(default=256, ge=1, le=256, description="Page size (1-256)")
-    query: str = Field(default="", max_length=256, description="Case-insensitive search query")
-    tags: list[str] = Field(default_factory=list, max_length=128, description="Match any plugin tag")
-    language: Literal["en_US", "zh_Hans", "ja_JP", "pt_BR"] = Field(
-        default="en_US", description="Language used for localized label and description search"
-    )
-
-
-class PluginInstalledIdsQuery(BaseModel):
-    category: PluginCategory = Field(description="Plugin category to include")
 
 
 class ParserLatest(BaseModel):
@@ -338,10 +325,6 @@ class PluginListResponse(ResponseModel):
     total: int
 
 
-class PluginInstalledIdsResponse(ResponseModel):
-    plugin_ids: list[str]
-
-
 class PluginVersionsResponse(ResponseModel):
     versions: Mapping[str, PluginService.LatestPluginCache | None]
 
@@ -401,7 +384,6 @@ register_schema_models(
     console_ns,
     ParserList,
     PluginCategoryListQuery,
-    PluginInstalledIdsQuery,
     PluginAutoUpgradeSettingsPayload,
     PluginPermissionSettingsPayload,
     ParserLatest,
@@ -438,7 +420,6 @@ register_response_schema_models(
     PluginDebuggingKeyResponse,
     PluginDynamicOptionsResponse,
     PluginInstallationsResponse,
-    PluginInstalledIdsResponse,
     PluginInstallTaskStartResponse,
     PluginListResponse,
     PluginManifestResponse,
@@ -496,39 +477,7 @@ def _read_upload_content(file: FileStorage, max_size: int) -> bytes:
     return content
 
 
-def _localized_builtin_tool_text(value: I18nObject, language: PluginCategoryListLanguage) -> str:
-    return value.to_dict()[language] or value.en_US
-
-
-def _builtin_tool_provider_matches_filters(
-    provider: ToolProviderApiEntity,
-    *,
-    query: str,
-    tags: Sequence[str],
-    language: PluginCategoryListLanguage,
-) -> bool:
-    if tags and not any(tag in provider.labels for tag in tags):
-        return False
-    if not query:
-        return True
-
-    lower_query = query.lower()
-    candidates = (
-        provider.name,
-        _localized_builtin_tool_text(provider.label, language),
-        _localized_builtin_tool_text(provider.description, language),
-    )
-    return any(lower_query in candidate.lower() for candidate in candidates)
-
-
-def _list_hardcoded_builtin_tool_providers(
-    tenant_id: str,
-    *,
-    query: str = "",
-    tags: Sequence[str] = (),
-    language: PluginCategoryListLanguage = "en_US",
-) -> list[dict[str, Any]]:
-    """List builtin providers using the same search and tag semantics as category plugins."""
+def _list_hardcoded_builtin_tool_providers(tenant_id: str) -> list[dict[str, Any]]:
     db_builtin_providers = {
         str(ToolProviderID(provider.provider)): provider
         for provider in ToolManager.list_default_builtin_providers(tenant_id)
@@ -549,13 +498,6 @@ def _list_hardcoded_builtin_tool_providers(
             db_provider=db_builtin_providers.get(provider.entity.identity.name),
             decrypt_credentials=False,
         )
-        if not _builtin_tool_provider_matches_filters(
-            user_provider,
-            query=query,
-            tags=tags,
-            language=language,
-        ):
-            continue
         ToolTransformService.repack_provider(tenant_id=tenant_id, provider=user_provider)
         builtin_providers.append(user_provider)
 
@@ -610,9 +552,7 @@ class PluginCategoryListApi(Resource):
     @account_initialization_required
     @with_current_tenant_id
     def get(self, tenant_id: str, category: str):
-        args = PluginCategoryListQuery.model_validate(
-            {**request.args.to_dict(flat=True), "tags": request.args.getlist("tags")}
-        )
+        args = PluginCategoryListQuery.model_validate(request.args.to_dict(flat=True))
 
         try:
             plugin_category = PluginCategory(category)
@@ -620,26 +560,13 @@ class PluginCategoryListApi(Resource):
             return {"code": "invalid_param", "message": "invalid plugin category"}, 400
 
         try:
-            plugins = PluginService.list_by_category(
-                tenant_id,
-                plugin_category,
-                args.page,
-                args.page_size,
-                query=args.query,
-                tags=args.tags,
-                language=args.language,
-            )
+            plugins = PluginService.list_by_category(tenant_id, plugin_category, args.page, args.page_size)
         except PluginDaemonClientSideError as e:
             return {"code": "plugin_error", "message": e.description}, 400
 
         builtin_tools = []
         if plugin_category == PluginCategory.Tool:
-            builtin_tools = _list_hardcoded_builtin_tool_providers(
-                tenant_id,
-                query=args.query,
-                tags=args.tags,
-                language=args.language,
-            )
+            builtin_tools = _list_hardcoded_builtin_tool_providers(tenant_id)
 
         return dump_response(
             PluginCategoryListResponse,
@@ -651,24 +578,6 @@ class PluginCategoryListApi(Resource):
         )
 
 
-@console_ns.route("/workspaces/current/plugin/installed-ids")
-class PluginInstalledIdsApi(Resource):
-    @console_ns.doc(params=query_params_from_model(PluginInstalledIdsQuery))
-    @console_ns.response(200, "Success", console_ns.models[PluginInstalledIdsResponse.__name__])
-    @setup_required
-    @login_required
-    @account_initialization_required
-    @with_current_tenant_id
-    def get(self, tenant_id: str):
-        args = PluginInstalledIdsQuery.model_validate(request.args.to_dict(flat=True))
-        try:
-            plugin_ids = PluginService.list_installed_plugin_ids(tenant_id, args.category)
-        except PluginDaemonClientSideError as e:
-            return {"code": "plugin_error", "message": e.description}, 400
-
-        return dump_response(PluginInstalledIdsResponse, {"plugin_ids": plugin_ids})
-
-
 @console_ns.route("/workspaces/current/plugin/list/latest-versions")
 class PluginListLatestVersionsApi(Resource):
     @console_ns.expect(console_ns.models[ParserLatest.__name__])

api/controllers/console/workspace/skills.py

@@ -0,0 +1,848 @@
+"""Console API for workspace-level Skill Management."""
+
+from __future__ import annotations
+
+import io
+
+from flask import request, send_file
+from flask_restx import Resource
+from pydantic import BaseModel, ConfigDict, Field, ValidationError
+
+from controllers.common.fields import BinaryFileResponse
+from controllers.common.schema import query_params_from_model, register_response_schema_models, register_schema_models
+from controllers.console import console_ns
+from controllers.console.wraps import (
+    account_initialization_required,
+    edit_permission_required,
+    setup_required,
+    with_current_tenant_id,
+    with_current_user,
+)
+from core.app.entities.app_invoke_entities import InvokeFrom
+from extensions.ext_database import db
+from fields.base import ResponseModel
+from libs import helper
+from libs.helper import dump_response
+from libs.login import login_required
+from models.account import Account
+from models.model import App
+from services.app_generate_service import AppGenerateService
+from services.skill_management_service import (
+    SkillAssistMessagePayload,
+    SkillCreatePayload,
+    SkillDraftFileOperationPayload,
+    SkillDraftTreePayload,
+    SkillImportPayload,
+    SkillManagementService,
+    SkillManagementServiceError,
+    SkillMetadataPayload,
+    SkillPublishPayload,
+    SkillRestorePayload,
+    SkillVersionUpdatePayload,
+)
+
+_FILE_UPLOAD_PARAMS = {
+    "file": {
+        "description": "Skill draft file payload",
+        "in": "formData",
+        "type": "file",
+        "required": True,
+    },
+}
+
+
+class WorkspaceSkillsQuery(BaseModel):
+    keyword: str | None = Field(default=None, description="Search keyword matching skill name or description.")
+    page: int = Field(default=1, ge=1, le=99999, description="Page number.")
+    limit: int = Field(default=20, ge=1, le=100, description="Number of items per page.")
+    tag: list[str] = Field(
+        default_factory=list,
+        description="Skill tag filters. Repeat the parameter for multiple tags.",
+    )
+
+
+class SkillDeletePayload(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    confirmation_name: str | None = Field(
+        default=None,
+        description="Required when deleting a referenced Skill. Must match the Skill name.",
+    )
+
+
+class AgentSkillBindingsPayload(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    skill_ids: list[str] = Field(default_factory=list, description="Ordered Skill IDs bound to the Agent.")
+
+
+class SkillFileQuery(BaseModel):
+    path: str = Field(description="Skill file path relative to the Skill root.")
+    version_id: str | None = Field(default=None, description="Optional published version ID. Omit for current draft.")
+
+
+class SkillResponse(ResponseModel):
+    id: str
+    name: str
+    display_name: str
+    icon: str
+    description: str
+    tags: list[str] = Field(default_factory=list)
+    name_manually_edited: bool = False
+    visibility: str
+    latest_published_version_id: str | None = None
+    reference_count: int = 0
+    created_by: str | None = None
+    created_by_name: str | None = None
+    updated_by: str | None = None
+    updated_by_name: str | None = None
+    created_at: int
+    updated_at: int
+
+
+class SkillFileResponse(ResponseModel):
+    id: str | None = None
+    path: str
+    kind: str
+    storage: str | None = None
+    mime_type: str | None = None
+    content: str | None = None
+    tool_file_id: str | None = None
+    size: int | None = None
+    hash: str | None = None
+
+
+class SkillFilePreviewResponse(ResponseModel):
+    path: str
+    mime_type: str
+    content: str
+    size: int
+    hash: str
+
+
+class SkillFileUploadResponse(ResponseModel):
+    id: str
+    name: str
+    mime_type: str
+    size: int
+    hash: str
+
+
+class SkillDetailResponse(SkillResponse):
+    files: list[SkillFileResponse] = Field(default_factory=list)
+
+
+class SkillListResponse(ResponseModel):
+    data: list[SkillResponse] = Field(default_factory=list)
+    has_more: bool = False
+    limit: int = 20
+    page: int = 1
+    total: int = 0
+
+
+class SkillTagResponse(ResponseModel):
+    tag: str
+    count: int
+
+
+class SkillTagListResponse(ResponseModel):
+    data: list[SkillTagResponse] = Field(default_factory=list)
+
+
+class SkillVersionResponse(ResponseModel):
+    id: str
+    skill_id: str
+    version_number: int
+    version_name: str
+    publish_note: str
+    hash_code: str
+    archive_size: int
+    published_by: str | None = None
+    published_by_name: str | None = None
+    is_latest: bool = False
+    created_at: int
+
+
+class SkillVersionListResponse(ResponseModel):
+    data: list[SkillVersionResponse] = Field(default_factory=list)
+
+
+class SkillVersionDetailResponse(SkillVersionResponse):
+    files: list[SkillFileResponse] = Field(default_factory=list)
+
+
+class SkillVersionDeleteResponse(ResponseModel):
+    id: str
+    deleted: bool
+    latest_published_version_id: str | None = None
+
+
+class SkillReferenceResponse(ResponseModel):
+    type: str
+    agent_id: str
+    agent_icon: str | None = None
+    agent_icon_background: str | None = None
+    agent_icon_type: str | None = None
+    app_id: str | None = None
+    name: str
+    display_name: str
+    workflow_id: str | None = None
+    workflow_name: str | None = None
+    workflow_icon: str | None = None
+    workflow_icon_background: str | None = None
+    workflow_icon_type: str | None = None
+    workflow_version: str | None = None
+    node_id: str | None = None
+    node_name: str | None = None
+
+
+class SkillReferenceListResponse(ResponseModel):
+    data: list[SkillReferenceResponse] = Field(default_factory=list)
+
+
+class SkillDeleteResponse(ResponseModel):
+    id: str
+    deleted: bool
+
+
+class AgentSkillBindingItemResponse(ResponseModel):
+    id: str
+    priority: int
+    name: str
+    display_name: str
+    icon: str
+    description: str
+    tags: list[str] = Field(default_factory=list)
+    status: str
+    file_count: int
+    latest_published_version_id: str | None = None
+    latest_published_at: int | None = None
+    updated_at: int
+
+
+class AgentSkillBindingsResponse(ResponseModel):
+    agent_id: str
+    skill_ids: list[str] = Field(default_factory=list)
+    data: list[AgentSkillBindingItemResponse] = Field(default_factory=list)
+
+
+register_schema_models(
+    console_ns,
+    WorkspaceSkillsQuery,
+    SkillCreatePayload,
+    SkillAssistMessagePayload,
+    SkillMetadataPayload,
+    SkillDraftFileOperationPayload,
+    SkillDraftTreePayload,
+    SkillPublishPayload,
+    SkillRestorePayload,
+    SkillVersionUpdatePayload,
+    SkillDeletePayload,
+    SkillFileQuery,
+    AgentSkillBindingsPayload,
+)
+
+register_response_schema_models(
+    console_ns,
+    SkillResponse,
+    SkillFileResponse,
+    SkillFilePreviewResponse,
+    SkillFileUploadResponse,
+    SkillDetailResponse,
+    SkillListResponse,
+    SkillTagResponse,
+    SkillTagListResponse,
+    SkillVersionResponse,
+    SkillVersionListResponse,
+    SkillVersionDetailResponse,
+    SkillVersionDeleteResponse,
+    SkillReferenceResponse,
+    SkillReferenceListResponse,
+    SkillDeleteResponse,
+    AgentSkillBindingItemResponse,
+    AgentSkillBindingsResponse,
+    BinaryFileResponse,
+)
+
+
+def _error_response(exc: SkillManagementServiceError) -> tuple[dict[str, object], int]:
+    body: dict[str, object] = {"code": exc.code, "message": exc.message}
+    if exc.details:
+        body["details"] = exc.details
+    return body, exc.status_code
+
+
+@console_ns.route("/workspaces/current/skills")
+class WorkspaceSkillsApi(Resource):
+    @console_ns.doc(params=query_params_from_model(WorkspaceSkillsQuery))
+    @console_ns.response(200, "Workspace skills", console_ns.models[SkillListResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_tenant_id
+    def get(self, current_tenant_id: str):
+        query_input: dict[str, object] = {
+            "keyword": request.args.get("keyword"),
+            "tag": request.args.getlist("tag"),
+        }
+        if "limit" in request.args:
+            query_input["limit"] = request.args.get("limit")
+        if "page" in request.args:
+            query_input["page"] = request.args.get("page")
+        query = WorkspaceSkillsQuery.model_validate(query_input)
+        result = SkillManagementService().list_skills(
+            tenant_id=current_tenant_id,
+            keyword=query.keyword,
+            page=query.page,
+            limit=query.limit,
+            tags=[tag for tag in query.tag if tag],
+        )
+        return dump_response(SkillListResponse, result)
+
+    @console_ns.expect(console_ns.models[SkillCreatePayload.__name__])
+    @console_ns.response(201, "Skill created", console_ns.models[SkillDetailResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def post(self, current_tenant_id: str, current_user: Account):
+        try:
+            payload = SkillCreatePayload.model_validate(console_ns.payload or {})
+            result = SkillManagementService().create_skill(
+                tenant_id=current_tenant_id,
+                user_id=current_user.id,
+                payload=payload,
+            )
+            return dump_response(SkillDetailResponse, result), 201
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except ValueError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/files/upload")
+class WorkspaceSkillFileUploadApi(Resource):
+    @console_ns.doc(consumes=["multipart/form-data"], params=_FILE_UPLOAD_PARAMS)
+    @console_ns.response(201, "Skill draft file uploaded", console_ns.models[SkillFileUploadResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def post(self, current_tenant_id: str, current_user: Account):
+        if "file" not in request.files:
+            return {"code": "no_file_uploaded", "message": "no file uploaded"}, 400
+
+        file = request.files["file"]
+        if not file.filename:
+            return {"code": "filename_missing", "message": "filename is required"}, 400
+
+        result = SkillManagementService().upload_file(
+            tenant_id=current_tenant_id,
+            user_id=current_user.id,
+            filename=file.filename,
+            content=file.stream.read(),
+            mime_type=file.mimetype,
+        )
+        return dump_response(SkillFileUploadResponse, result), 201
+
+
+@console_ns.route("/workspaces/current/skills/tags")
+class WorkspaceSkillTagsApi(Resource):
+    @console_ns.response(200, "Workspace Skill tags", console_ns.models[SkillTagListResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_tenant_id
+    def get(self, current_tenant_id: str):
+        result = SkillManagementService().list_tags(tenant_id=current_tenant_id)
+        return dump_response(SkillTagListResponse, result)
+
+
+@console_ns.route("/workspaces/current/skills/import")
+class WorkspaceSkillImportApi(Resource):
+    @console_ns.doc(description="Import a Skill zip package from multipart form field `file`.")
+    @console_ns.response(201, "Skill imported", console_ns.models[SkillDetailResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def post(self, current_tenant_id: str, current_user: Account):
+        upload = request.files.get("file")
+        if upload is None:
+            return {"code": "invalid_request", "message": "file is required"}, 400
+        try:
+            payload = SkillImportPayload(content=upload.read(), filename=upload.filename or "skill.zip")
+            result = SkillManagementService().import_skill(
+                tenant_id=current_tenant_id,
+                user_id=current_user.id,
+                payload=payload,
+            )
+            return dump_response(SkillDetailResponse, result), 201
+        except (ValidationError, ValueError) as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>")
+class WorkspaceSkillApi(Resource):
+    @console_ns.response(200, "Skill detail", console_ns.models[SkillDetailResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_tenant_id
+    def get(self, current_tenant_id: str, skill_id: str):
+        try:
+            result = SkillManagementService().get_skill(tenant_id=current_tenant_id, skill_id=skill_id)
+            return dump_response(SkillDetailResponse, result)
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+    @console_ns.expect(console_ns.models[SkillMetadataPayload.__name__])
+    @console_ns.response(200, "Skill updated", console_ns.models[SkillResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def patch(self, current_tenant_id: str, current_user: Account, skill_id: str):
+        try:
+            payload = SkillMetadataPayload.model_validate(console_ns.payload or {})
+            result = SkillManagementService().update_metadata(
+                tenant_id=current_tenant_id,
+                user_id=current_user.id,
+                skill_id=skill_id,
+                payload=payload,
+            )
+            return dump_response(SkillResponse, result)
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except ValueError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+    @console_ns.expect(console_ns.models[SkillDeletePayload.__name__])
+    @console_ns.response(200, "Skill deleted", console_ns.models[SkillDeleteResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_tenant_id
+    def delete(self, current_tenant_id: str, skill_id: str):
+        try:
+            payload = SkillDeletePayload.model_validate(console_ns.payload or {})
+            result = SkillManagementService().delete_skill(
+                tenant_id=current_tenant_id,
+                skill_id=skill_id,
+                confirmation_name=payload.confirmation_name,
+            )
+            return dump_response(SkillDeleteResponse, result)
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>/duplicate")
+class WorkspaceSkillDuplicateApi(Resource):
+    @console_ns.response(201, "Skill duplicated", console_ns.models[SkillDetailResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def post(self, current_tenant_id: str, current_user: Account, skill_id: str):
+        try:
+            result = SkillManagementService().duplicate_skill(
+                tenant_id=current_tenant_id,
+                user_id=current_user.id,
+                skill_id=skill_id,
+            )
+            return dump_response(SkillDetailResponse, result), 201
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>/export")
+class WorkspaceSkillExportApi(Resource):
+    @console_ns.response(200, "Published Skill zip archive")
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_tenant_id
+    def get(self, current_tenant_id: str, skill_id: str):
+        try:
+            result = SkillManagementService().pull_published_archive(tenant_id=current_tenant_id, skill_id=skill_id)
+            return send_file(
+                io.BytesIO(result.payload),
+                mimetype=result.mime_type,
+                as_attachment=True,
+                download_name=result.filename,
+            )
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>/assist/messages")
+class WorkspaceSkillAssistMessageApi(Resource):
+    """Stream read-only Skill Authoring suggestions from the default workspace model."""
+
+    @console_ns.expect(console_ns.models[SkillAssistMessagePayload.__name__])
+    @console_ns.response(200, "Skill Authoring assistant event stream")
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_user
+    @with_current_tenant_id
+    def post(self, current_tenant_id: str, current_user: Account, skill_id: str):
+        try:
+            payload = SkillAssistMessagePayload.model_validate(console_ns.payload or {})
+            assistant_app, query = SkillManagementService().get_or_create_assistant_app(
+                tenant_id=current_tenant_id,
+                skill_id=skill_id,
+                user_id=current_user.id,
+                message=payload.message,
+                attachments=payload.attachments,
+                model_payload=payload.model,
+            )
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+        app_model = db.session().get(App, assistant_app.id)
+        if app_model is None:
+            return {"code": "skill_assistant_unavailable", "message": "Skill Authoring Agent is unavailable"}, 503
+        response = AppGenerateService.generate(
+            session=db.session(),
+            app_model=app_model,
+            user=current_user,
+            args={"inputs": {}, "query": query, "auto_generate_name": False},
+            invoke_from=InvokeFrom.DEBUGGER,
+            streaming=True,
+        )
+        return helper.compact_generate_response(response)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>/files")
+class WorkspaceSkillFilesApi(Resource):
+    @console_ns.expect(console_ns.models[SkillDraftFileOperationPayload.__name__])
+    @console_ns.response(200, "Draft file operation applied", console_ns.models[SkillDetailResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def patch(self, current_tenant_id: str, current_user: Account, skill_id: str):
+        try:
+            payload = SkillDraftFileOperationPayload.model_validate(console_ns.payload or {})
+            result = SkillManagementService().apply_draft_file_operation(
+                tenant_id=current_tenant_id,
+                user_id=current_user.id,
+                skill_id=skill_id,
+                payload=payload,
+            )
+            return dump_response(SkillDetailResponse, result)
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except ValueError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+    @console_ns.expect(console_ns.models[SkillDraftTreePayload.__name__])
+    @console_ns.response(200, "Draft files replaced", console_ns.models[SkillDetailResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def put(self, current_tenant_id: str, current_user: Account, skill_id: str):
+        try:
+            payload = SkillDraftTreePayload.model_validate(console_ns.payload or {})
+            result = SkillManagementService().replace_draft_tree(
+                tenant_id=current_tenant_id,
+                user_id=current_user.id,
+                skill_id=skill_id,
+                payload=payload,
+            )
+            return dump_response(SkillDetailResponse, result)
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except ValueError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>/files/preview")
+class WorkspaceSkillFilePreviewApi(Resource):
+    @console_ns.doc(params=query_params_from_model(SkillFileQuery))
+    @console_ns.response(200, "Skill file text preview", console_ns.models[SkillFilePreviewResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_tenant_id
+    def get(self, current_tenant_id: str, skill_id: str):
+        try:
+            query = SkillFileQuery.model_validate(
+                {
+                    "path": request.args.get("path"),
+                    "version_id": request.args.get("version_id"),
+                }
+            )
+            result = SkillManagementService().preview_file(
+                tenant_id=current_tenant_id,
+                skill_id=skill_id,
+                path=query.path,
+                version_id=query.version_id,
+            )
+            return dump_response(SkillFilePreviewResponse, result)
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except ValueError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>/files/content")
+class WorkspaceSkillFileContentApi(Resource):
+    @console_ns.doc(params={**query_params_from_model(SkillFileQuery), "download": "Return as an attachment when 1."})
+    @console_ns.response(200, "Skill file content", console_ns.models[BinaryFileResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_tenant_id
+    def get(self, current_tenant_id: str, skill_id: str):
+        try:
+            query = SkillFileQuery.model_validate(
+                {
+                    "path": request.args.get("path"),
+                    "version_id": request.args.get("version_id"),
+                }
+            )
+            result = SkillManagementService().pull_file(
+                tenant_id=current_tenant_id,
+                skill_id=skill_id,
+                path=query.path,
+                version_id=query.version_id,
+            )
+            return send_file(
+                io.BytesIO(result.payload),
+                mimetype=result.mime_type,
+                as_attachment=request.args.get("download") == "1",
+                download_name=result.filename,
+            )
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except ValueError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>/publish")
+class WorkspaceSkillPublishApi(Resource):
+    @console_ns.expect(console_ns.models[SkillPublishPayload.__name__])
+    @console_ns.response(200, "Skill published", console_ns.models[SkillVersionResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def post(self, current_tenant_id: str, current_user: Account, skill_id: str):
+        try:
+            payload = SkillPublishPayload.model_validate(console_ns.payload or {})
+            result = SkillManagementService().publish_skill(
+                tenant_id=current_tenant_id,
+                user_id=current_user.id,
+                skill_id=skill_id,
+                payload=payload,
+            )
+            return dump_response(SkillVersionResponse, result)
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>/restore")
+class WorkspaceSkillRestoreApi(Resource):
+    @console_ns.expect(console_ns.models[SkillRestorePayload.__name__])
+    @console_ns.response(200, "Skill version restored", console_ns.models[SkillVersionResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def post(self, current_tenant_id: str, current_user: Account, skill_id: str):
+        try:
+            payload = SkillRestorePayload.model_validate(console_ns.payload or {})
+            result = SkillManagementService().restore_version(
+                tenant_id=current_tenant_id,
+                user_id=current_user.id,
+                skill_id=skill_id,
+                payload=payload,
+            )
+            return dump_response(SkillVersionResponse, result)
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>/references")
+class WorkspaceSkillReferencesApi(Resource):
+    @console_ns.response(200, "Skill references", console_ns.models[SkillReferenceListResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_tenant_id
+    def get(self, current_tenant_id: str, skill_id: str):
+        try:
+            result = SkillManagementService().list_skill_references(tenant_id=current_tenant_id, skill_id=skill_id)
+            return dump_response(SkillReferenceListResponse, result)
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>/versions")
+class WorkspaceSkillVersionsApi(Resource):
+    @console_ns.response(200, "Skill versions", console_ns.models[SkillVersionListResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_tenant_id
+    def get(self, current_tenant_id: str, skill_id: str):
+        try:
+            result = SkillManagementService().list_versions(tenant_id=current_tenant_id, skill_id=skill_id)
+            return dump_response(SkillVersionListResponse, result)
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>/versions/<string:version_id>")
+class WorkspaceSkillVersionApi(Resource):
+    @console_ns.response(200, "Skill version detail", console_ns.models[SkillVersionDetailResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_tenant_id
+    def get(self, current_tenant_id: str, skill_id: str, version_id: str):
+        try:
+            result = SkillManagementService().get_version(
+                tenant_id=current_tenant_id,
+                skill_id=skill_id,
+                version_id=version_id,
+            )
+            return dump_response(SkillVersionDetailResponse, result)
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+    @console_ns.expect(console_ns.models[SkillVersionUpdatePayload.__name__])
+    @console_ns.response(200, "Skill version updated", console_ns.models[SkillVersionResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_tenant_id
+    def patch(self, current_tenant_id: str, skill_id: str, version_id: str):
+        try:
+            payload = SkillVersionUpdatePayload.model_validate(console_ns.payload or {})
+            result = SkillManagementService().update_version(
+                tenant_id=current_tenant_id,
+                skill_id=skill_id,
+                version_id=version_id,
+                payload=payload,
+            )
+            return dump_response(SkillVersionResponse, result)
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+    @console_ns.response(200, "Skill version deleted", console_ns.models[SkillVersionDeleteResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def delete(self, current_tenant_id: str, current_user: Account, skill_id: str, version_id: str):
+        try:
+            result = SkillManagementService().delete_version(
+                tenant_id=current_tenant_id,
+                user_id=current_user.id,
+                skill_id=skill_id,
+                version_id=version_id,
+            )
+            return dump_response(SkillVersionDeleteResponse, result)
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/agents/<string:agent_id>/skills")
+class WorkspaceAgentSkillBindingsApi(Resource):
+    @console_ns.response(200, "Agent Skill bindings", console_ns.models[AgentSkillBindingsResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_tenant_id
+    def get(self, current_tenant_id: str, agent_id: str):
+        result = SkillManagementService().list_agent_bindings(tenant_id=current_tenant_id, agent_id=agent_id)
+        return dump_response(AgentSkillBindingsResponse, result)
+
+    @console_ns.expect(console_ns.models[AgentSkillBindingsPayload.__name__])
+    @console_ns.response(200, "Agent Skill bindings replaced", console_ns.models[AgentSkillBindingsResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def put(self, current_tenant_id: str, current_user: Account, agent_id: str):
+        try:
+            payload = AgentSkillBindingsPayload.model_validate(console_ns.payload or {})
+            result = SkillManagementService().replace_agent_bindings(
+                tenant_id=current_tenant_id,
+                user_id=current_user.id,
+                agent_id=agent_id,
+                skill_ids=payload.skill_ids,
+            )
+            return dump_response(AgentSkillBindingsResponse, result)
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+__all__ = [
+    "WorkspaceAgentSkillBindingsApi",
+    "WorkspaceSkillApi",
+    "WorkspaceSkillDuplicateApi",
+    "WorkspaceSkillExportApi",
+    "WorkspaceSkillFilesApi",
+    "WorkspaceSkillImportApi",
+    "WorkspaceSkillPublishApi",
+    "WorkspaceSkillReferencesApi",
+    "WorkspaceSkillRestoreApi",
+    "WorkspaceSkillTagsApi",
+    "WorkspaceSkillVersionApi",
+    "WorkspaceSkillVersionsApi",
+    "WorkspaceSkillsApi",
+]

api/controllers/inner_api/__init__.py

@@ -23,7 +23,7 @@ from .knowledge import retrieval as _knowledge_retrieval
 from .plugin import agent_config as _agent_config
 from .plugin import agent_drive as _agent_drive
 from .plugin import plugin as _plugin
-from .workspace import plugin_model_providers as _plugin_model_providers
+from .plugin import skills as _skills
 from .workspace import workspace as _workspace
 
 api.add_namespace(inner_api_ns)
@@ -36,8 +36,8 @@ __all__ = [
     "_knowledge_retrieval",
     "_mail",
     "_plugin",
-    "_plugin_model_providers",
     "_runtime_credentials",
+    "_skills",
     "_workspace",
     "api",
     "bp",

api/controllers/inner_api/plugin/skills.py

@@ -0,0 +1,54 @@
+"""Inner API for published workspace Skills.
+
+These endpoints are called by trusted runtime services. They expose only
+published Skill artifacts, never draft files or editable metadata.
+"""
+
+from __future__ import annotations
+
+import io
+
+from flask import request, send_file
+from flask_restx import Resource
+from pydantic import BaseModel, ValidationError
+
+from controllers.console.wraps import setup_required
+from controllers.inner_api import inner_api_ns
+from controllers.inner_api.wraps import plugin_inner_api_only
+from services.skill_management_service import SkillManagementService, SkillManagementServiceError
+
+
+class _SkillTargetQuery(BaseModel):
+    tenant_id: str
+
+
+def _target_query_from_request() -> _SkillTargetQuery:
+    return _SkillTargetQuery.model_validate({"tenant_id": request.args.get("tenant_id")})
+
+
+def _error_response(exc: SkillManagementServiceError) -> tuple[dict[str, str], int]:
+    return {"code": exc.code, "message": exc.message}, exc.status_code
+
+
+@inner_api_ns.route("/skills/<string:skill_id>/pull")
+class PublishedSkillPullApi(Resource):
+    @setup_required
+    @plugin_inner_api_only
+    @inner_api_ns.doc("published_skill_pull")
+    def get(self, skill_id: str):
+        try:
+            query = _target_query_from_request()
+            result = SkillManagementService().pull_published_archive(tenant_id=query.tenant_id, skill_id=skill_id)
+            return send_file(
+                io.BytesIO(result.payload),
+                mimetype=result.mime_type,
+                as_attachment=True,
+                download_name=result.filename,
+            )
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+__all__ = ["PublishedSkillPullApi"]

api/controllers/inner_api/workspace/plugin_model_providers.py

@@ -1,39 +0,0 @@
-from flask_restx import Resource
-from pydantic import BaseModel, ConfigDict, Field
-
-from controllers.common.schema import register_schema_model
-from controllers.console.wraps import setup_required
-from controllers.inner_api import inner_api_ns
-from controllers.inner_api.wraps import enterprise_inner_api_only
-from core.plugin.plugin_service import PluginService
-
-
-class InvalidatePluginModelProvidersCachePayload(BaseModel):
-    model_config = ConfigDict(extra="forbid")
-
-    tenant_ids: list[str] = Field(default_factory=list, description="Workspace ids whose cache should be invalidated")
-
-
-register_schema_model(inner_api_ns, InvalidatePluginModelProvidersCachePayload)
-
-
-@inner_api_ns.route("/enterprise/workspace/plugin-model-providers/invalidate")
-class EnterprisePluginModelProvidersCacheInvalidate(Resource):
-    @setup_required
-    @enterprise_inner_api_only
-    @inner_api_ns.doc(
-        "enterprise_invalidate_plugin_model_providers_cache",
-        responses={
-            200: "Cache invalidated",
-            400: "Invalid request",
-            401: "Unauthorized - invalid API key",
-        },
-    )
-    @inner_api_ns.expect(inner_api_ns.models[InvalidatePluginModelProvidersCachePayload.__name__])
-    def post(self):
-        args = InvalidatePluginModelProvidersCachePayload.model_validate(inner_api_ns.payload or {})
-
-        for tenant_id in args.tenant_ids:
-            PluginService.invalidate_plugin_model_providers_cache(tenant_id)
-
-        return {"result": "success"}, 200

api/controllers/web/human_input_form.py

@@ -24,7 +24,7 @@ from extensions.ext_database import db
 from fields.base import ResponseModel
 from libs.helper import RateLimiter, dump_response, extract_remote_ip, to_timestamp
 from models.account import TenantStatus
-from models.model import App, AppMode, Site
+from models.model import App, Site
 from repositories.factory import DifyAPIRepositoryFactory
 from services.feature_service import FeatureService
 from services.human_input_file_upload_service import HumanInputFileUploadService
@@ -207,7 +207,6 @@ class HumanInputFormApi(Resource):
                 site=WebAppSiteResponse.from_app_site(
                     tenant=tenant,
                     app_model=app_model,
-                    mode=AppMode.value_of(app_model.mode),
                     site=site,
                     end_user_id=None,
                     features=features,

api/controllers/web/site.py

@@ -14,7 +14,7 @@ from extensions.storage.storage_type import StorageType
 from fields.base import ResponseModel
 from libs.helper import build_icon_url
 from models.account import Tenant, TenantStatus
-from models.model import App, AppMode, EndUser, IconType, Site
+from models.model import App, EndUser, IconType, Site
 from services.feature_service import FeatureModel, FeatureService
 from services.file_service import FileService
 
@@ -67,7 +67,6 @@ class WebAppCustomConfigResponse(ResponseModel):
 
 class WebAppSiteResponse(ResponseModel):
     app_id: str
-    mode: AppMode
     end_user_id: str | None = None
     enable_site: bool
     site: WebSiteResponse
@@ -84,7 +83,6 @@ class WebAppSiteResponse(ResponseModel):
         *,
         tenant: Tenant,
         app_model: App,
-        mode: AppMode,
         site: Site,
         end_user_id: str | None,
         features: FeatureModel,
@@ -111,7 +109,6 @@ class WebAppSiteResponse(ResponseModel):
 
         return cls(
             app_id=app_model.id,
-            mode=mode,
             end_user_id=end_user_id,
             enable_site=app_model.enable_site,
             site=site_response,
@@ -170,7 +167,6 @@ class AppSiteApi(WebApiResource):
         return WebAppSiteResponse.from_app_site(
             tenant=tenant,
             app_model=app_model,
-            mode=AppMode.value_of(app_model.mode_compatible_with_agent_with_session(session=db.session())),
             site=site,
             end_user_id=end_user.id,
             features=features,

api/core/app/apps/advanced_chat/app_generator.py

@@ -616,34 +616,23 @@ class AdvancedChatAppGenerator(MessageBasedAppGenerator):
             message_snapshot = MessageSnapshot.from_message(message)
             session.close()
 
-            try:
-                response = self._handle_advanced_chat_response(
-                    application_generate_entity=application_generate_entity,
-                    workflow=workflow_snapshot,
-                    queue_manager=queue_manager,
-                    conversation=conversation_snapshot,
-                    message=message_snapshot,
-                    user=user,
-                    stream=stream,
-                    draft_var_saver_factory=self._get_draft_var_saver_factory(
-                        invoke_from,
-                        account=user,
-                        tenant_id=application_generate_entity.app_config.tenant_id,
-                    ),
-                )
-                converted_response = AdvancedChatAppGenerateResponseConverter.convert(
-                    response=response,
-                    invoke_from=invoke_from,
-                )
-            except BaseException:
-                self._join_worker_thread(worker_thread)
-                raise
+            # return response or stream generator
+            response = self._handle_advanced_chat_response(
+                application_generate_entity=application_generate_entity,
+                workflow=workflow_snapshot,
+                queue_manager=queue_manager,
+                conversation=conversation_snapshot,
+                message=message_snapshot,
+                user=user,
+                stream=stream,
+                draft_var_saver_factory=self._get_draft_var_saver_factory(
+                    invoke_from,
+                    account=user,
+                    tenant_id=application_generate_entity.app_config.tenant_id,
+                ),
+            )
 
-            if isinstance(converted_response, Generator):
-                return self._wrap_stream_with_worker_thread_join(converted_response, worker_thread)
-
-            self._join_worker_thread(worker_thread)
-            return converted_response
+            return AdvancedChatAppGenerateResponseConverter.convert(response=response, invoke_from=invoke_from)
 
     def _generate_worker(
         self,

api/core/app/apps/agent_app/runtime_request_builder.py

@@ -43,6 +43,7 @@ from core.workflow.nodes.agent_v2.runtime_request_builder import (
     build_config_layer_config,
     build_knowledge_layer_config,
     build_shell_layer_config,
+    load_runtime_agent_skill_configs,
 )
 from models.agent_config_entities import AgentSoulConfig, AgentSoulToolsConfig
 from models.provider_ids import ModelProviderID
@@ -125,14 +126,22 @@ class AgentAppRuntimeRequestBuilder:
                 "cli_tool_count": len(agent_soul.tools.cli_tools),
             }
 
+        runtime_config_skills = load_runtime_agent_skill_configs(
+            tenant_id=context.dify_context.tenant_id,
+            agent_id=context.agent_id,
+        )
         config_layer_config, config_warnings = build_config_layer_config(
             agent_soul,
             agent_id=context.agent_id,
             config_version_id=context.agent_config_snapshot_id,
             config_version_kind=context.agent_config_version_kind,
+            runtime_config_skills=runtime_config_skills,
         )
         append_runtime_warnings(metadata, config_warnings)
-        soul_prompt_resolver = build_config_aware_soul_mention_resolver(agent_soul)
+        soul_prompt_resolver = build_config_aware_soul_mention_resolver(
+            agent_soul,
+            runtime_config_skills=runtime_config_skills,
+        )
         knowledge_config = build_knowledge_layer_config(agent_soul)
 
         request = self._request_builder.build_for_agent_app(

api/core/app/apps/base_app_generator.py

@@ -1,5 +1,3 @@
-import logging
-import threading
 from collections.abc import Generator, Mapping, Sequence
 from contextlib import AbstractContextManager, nullcontext
 from typing import TYPE_CHECKING, Any, Union, final
@@ -25,10 +23,6 @@ from services.workflow_draft_variable_service import DraftVariableSaver as Draft
 if TYPE_CHECKING:
     from graphon.variables.input_entities import VariableEntity
 
-logger = logging.getLogger(__name__)
-
-_WORKER_THREAD_JOIN_TIMEOUT_SECONDS = 300
-
 
 @final
 class _DebuggerDraftVariableSaver:
@@ -70,29 +64,6 @@ class _DebuggerDraftVariableSaver:
 class BaseAppGenerator:
     _file_access_controller: DatabaseFileAccessController = DatabaseFileAccessController()
 
-    @staticmethod
-    def _join_worker_thread(worker_thread: threading.Thread) -> None:
-        # Bound the wait so a leaked app worker cannot occupy an execution slot indefinitely.
-        worker_thread.join(timeout=_WORKER_THREAD_JOIN_TIMEOUT_SECONDS)
-        if worker_thread.is_alive():
-            logger.warning(
-                "Possible app worker thread leak: thread_name=%s timeout_seconds=%s; "
-                "continuing without waiting further to avoid occupying an execution slot indefinitely",
-                worker_thread.name,
-                _WORKER_THREAD_JOIN_TIMEOUT_SECONDS,
-            )
-
-    @staticmethod
-    def _wrap_stream_with_worker_thread_join[ResponseT](
-        response_stream: Generator[ResponseT, None, None],
-        worker_thread: threading.Thread,
-    ) -> Generator[ResponseT, None, None]:
-        """Keep the producer owned by the response stream until both finish."""
-        try:
-            yield from response_stream
-        finally:
-            BaseAppGenerator._join_worker_thread(worker_thread)
-
     @staticmethod
     def _bind_file_access_scope(
         *,

api/core/app/apps/pipeline/pipeline_generator.py

@@ -351,28 +351,17 @@ class PipelineGenerator(BaseAppGenerator):
                 user,
                 tenant_id=pipeline.tenant_id,
             )
-            try:
-                response = self._handle_response(
-                    application_generate_entity=application_generate_entity,
-                    workflow=workflow,
-                    queue_manager=queue_manager,
-                    user=user,
-                    stream=streaming,
-                    draft_var_saver_factory=draft_var_saver_factory,
-                )
-                converted_response = WorkflowAppGenerateResponseConverter.convert(
-                    response=response,
-                    invoke_from=invoke_from,
-                )
-            except BaseException:
-                self._join_worker_thread(worker_thread)
-                raise
+            # return response or stream generator
+            response = self._handle_response(
+                application_generate_entity=application_generate_entity,
+                workflow=workflow,
+                queue_manager=queue_manager,
+                user=user,
+                stream=streaming,
+                draft_var_saver_factory=draft_var_saver_factory,
+            )
 
-            if isinstance(converted_response, Generator):
-                return self._wrap_stream_with_worker_thread_join(converted_response, worker_thread)
-
-            self._join_worker_thread(worker_thread)
-            return converted_response
+            return WorkflowAppGenerateResponseConverter.convert(response=response, invoke_from=invoke_from)
 
     def single_iteration_generate(
         self,

api/core/app/apps/workflow/app_generator.py

@@ -405,28 +405,17 @@ class WorkflowAppGenerator(BaseAppGenerator):
                 tenant_id=app_model.tenant_id,
             )
 
-            try:
-                response = self._handle_response(
-                    application_generate_entity=application_generate_entity,
-                    workflow=workflow,
-                    queue_manager=queue_manager,
-                    user=user,
-                    draft_var_saver_factory=draft_var_saver_factory,
-                    stream=streaming,
-                )
-                converted_response = WorkflowAppGenerateResponseConverter.convert(
-                    response=response,
-                    invoke_from=invoke_from,
-                )
-            except BaseException:
-                self._join_worker_thread(worker_thread)
-                raise
+            # return response or stream generator
+            response = self._handle_response(
+                application_generate_entity=application_generate_entity,
+                workflow=workflow,
+                queue_manager=queue_manager,
+                user=user,
+                draft_var_saver_factory=draft_var_saver_factory,
+                stream=streaming,
+            )
 
-            if isinstance(converted_response, Generator):
-                return self._wrap_stream_with_worker_thread_join(converted_response, worker_thread)
-
-            self._join_worker_thread(worker_thread)
-            return converted_response
+            return WorkflowAppGenerateResponseConverter.convert(response=response, invoke_from=invoke_from)
 
     def single_iteration_generate(
         self,

api/core/helper/code_executor/jinja2/jinja2_transformer.py

@@ -39,16 +39,15 @@ class Jinja2TemplateTransformer(TemplateTransformer):
     @override
     def get_runner_script(cls) -> str:
         runner_script = dedent(f"""
+            import jinja2
             import json
             from base64 import b64decode
-            from jinja2.sandbox import SandboxedEnvironment
 
             # declare main function
             def main(**inputs):
                 # Decode base64-encoded template to handle special characters safely
                 template_code = b64decode('{cls._template_b64_placeholder}').decode('utf-8')
-                env = SandboxedEnvironment()
-                template = env.from_string(template_code)
+                template = jinja2.Template(template_code)
                 return template.render(**inputs)
 
             # decode and prepare input dict
@@ -68,13 +67,12 @@ class Jinja2TemplateTransformer(TemplateTransformer):
     @override
     def get_preload_script(cls) -> str:
         preload_script = dedent("""
-            from jinja2.sandbox import SandboxedEnvironment
+            import jinja2
             from base64 import b64decode
 
             def _jinja2_preload_():
-                # prepare jinja2 sandboxed environment, load template and render
-                env = SandboxedEnvironment()
-                template = env.from_string('{{s}}')
+                # prepare jinja2 environment, load template and render before to avoid sandbox issue
+                template = jinja2.Template('{{s}}')
                 template.render(s='a')
 
             if __name__ == '__main__':

api/core/indexing_runner.py

@@ -519,7 +519,7 @@ class IndexingRunner:
     def filter_string(text):
         text = re.sub(r"<\|", "<", text)
         text = re.sub(r"\|>", ">", text)
-        text = re.sub(r"[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]", "", text)
+        text = re.sub(r"[\x00-\x08\x0B\x0C\x0E-\x1F\x7F\xEF\xBF\xBE]", "", text)
         # Unicode  U+FFFE
         text = re.sub("\ufffe", "", text)
         return text

api/core/plugin/entities/plugin_daemon.py

@@ -12,7 +12,7 @@ from core.agent.plugin_entities import AgentProviderEntityWithPlugin
 from core.datasource.entities.datasource_entities import DatasourceProviderEntityWithPlugin
 from core.plugin.entities.base import BasePluginEntity
 from core.plugin.entities.parameters import PluginParameterOption
-from core.plugin.entities.plugin import PluginDeclaration, PluginEntity, PluginInstallationSource
+from core.plugin.entities.plugin import PluginDeclaration, PluginEntity
 from core.tools.entities.common_entities import I18nObject
 from core.tools.entities.tool_entities import ToolProviderEntityWithPlugin
 from core.trigger.entities.entities import TriggerProviderEntity
@@ -94,18 +94,6 @@ class PluginModelProviderEntity(BaseModel):
     declaration: ProviderEntity = Field(description="The declaration of the model provider.")
 
 
-class PluginModelProviderBinding(BaseModel):
-    """Lightweight installation metadata for one model provider."""
-
-    provider: str
-    installation_id: str
-    plugin_id: str
-    plugin_unique_identifier: str
-    runtime_type: str
-    source: PluginInstallationSource
-    version: str
-
-
 class PluginTextEmbeddingNumTokensResponse(BaseModel):
     """
     Response for number of tokens.
@@ -219,10 +207,6 @@ class PluginListResponse(BaseModel):
     total: int
 
 
-class PluginInstalledIdsDaemonResponse(BaseModel):
-    plugin_ids: list[str]
-
-
 class PluginListWithoutTotalResponse(BaseModel):
     list: list[PluginEntity]
     has_more: bool

api/core/plugin/impl/model.py

@@ -6,7 +6,6 @@ from core.plugin.entities.plugin_daemon import (
     PluginBasicBooleanResponse,
     PluginDaemonInnerError,
     PluginLLMNumTokensResponse,
-    PluginModelProviderBinding,
     PluginModelProviderEntity,
     PluginModelSchemaEntity,
     PluginStringResultResponse,
@@ -48,14 +47,6 @@ class PluginModelClient(BasePluginClient):
         )
         return response
 
-    def fetch_model_provider_bindings(self, tenant_id: str) -> Sequence[PluginModelProviderBinding]:
-        """Fetch only model-provider installation identities from the daemon."""
-        return self._request_with_plugin_daemon_response(
-            "GET",
-            f"plugin/{tenant_id}/management/models/bindings",
-            list[PluginModelProviderBinding],
-        )
-
     def get_model_schema(
         self,
         tenant_id: str,

api/core/plugin/impl/plugin.py

@@ -14,7 +14,6 @@ from core.plugin.entities.plugin import (
 )
 from core.plugin.entities.plugin_daemon import (
     PluginDecodeResponse,
-    PluginInstalledIdsDaemonResponse,
     PluginInstallTask,
     PluginInstallTaskStartResponse,
     PluginListResponse,
@@ -69,16 +68,6 @@ class PluginInstaller(BasePluginClient):
         )
         return result.list
 
-    def list_installed_plugin_ids(self, tenant_id: str, category: PluginCategory) -> list[str]:
-        """List all currently installed plugin IDs in one category."""
-        result = self._request_with_plugin_daemon_response(
-            "GET",
-            f"plugin/{tenant_id}/management/installation/ids",
-            PluginInstalledIdsDaemonResponse,
-            params={"category": category.value},
-        )
-        return result.plugin_ids
-
     def list_plugins_with_total(self, tenant_id: str, page: int, page_size: int) -> PluginListResponse:
         return self._request_with_plugin_daemon_response(
             "GET",
@@ -88,28 +77,13 @@ class PluginInstaller(BasePluginClient):
         )
 
     def list_plugins_by_category(
-        self,
-        tenant_id: str,
-        category: PluginCategory,
-        page: int,
-        page_size: int,
-        *,
-        query: str = "",
-        tags: Sequence[str] = (),
-        language: str = "en_US",
+        self, tenant_id: str, category: PluginCategory, page: int, page_size: int
     ) -> PluginListWithoutTotalResponse:
         return self._request_with_plugin_daemon_response(
             "GET",
             f"plugin/{tenant_id}/management/{category.value}/list",
             PluginListWithoutTotalResponse,
-            params={
-                "page": page,
-                "page_size": page_size,
-                "response_type": "paged",
-                "query": query,
-                "tags": list(tags),
-                "language": language,
-            },
+            params={"page": page, "page_size": page_size, "response_type": "paged"},
         )
 
     def upload_pkg(

api/core/plugin/plugin_service.py

@@ -48,7 +48,6 @@ from core.plugin.entities.plugin_daemon import (
     PluginInstallTaskStatus,
     PluginListResponse,
     PluginListWithoutTotalResponse,
-    PluginModelProviderBinding,
     PluginModelProviderEntity,
     PluginVerification,
 )
@@ -79,12 +78,6 @@ class _RedisLock(Protocol):
     def release(self) -> None: ...
 
 
-class _ModelPluginIdentity(Protocol):
-    plugin_id: str
-    plugin_unique_identifier: str
-    source: PluginInstallationSource
-
-
 class PluginService:
     class LatestPluginCache(BaseModel):
         plugin_id: str
@@ -272,7 +265,7 @@ class PluginService:
             logger.warning("Failed to cache plugin model providers for tenant %s.", tenant_id, exc_info=True)
 
     @classmethod
-    def _get_remote_model_plugin_cache_marker(cls, plugins: Sequence[_ModelPluginIdentity]) -> str | None:
+    def _get_remote_model_plugin_cache_marker(cls, plugins: Sequence[PluginEntity]) -> str | None:
         remote_model_plugins = sorted(
             f"{plugin.plugin_id}:{plugin.plugin_unique_identifier}"
             for plugin in plugins
@@ -357,7 +350,7 @@ class PluginService:
     def _should_invalidate_model_provider_cache_for_remote_model_plugins(
         cls,
         tenant_id: str,
-        plugins: Sequence[_ModelPluginIdentity],
+        plugins: Sequence[PluginEntity],
     ) -> bool:
         remote_model_plugin_marker = cls._get_remote_model_plugin_cache_marker(plugins)
         cached_remote_model_plugin_marker = cls._load_cached_remote_model_plugin_marker(tenant_id)
@@ -663,26 +656,6 @@ class PluginService:
         plugins = manager.list_plugins(tenant_id)
         return plugins
 
-    @staticmethod
-    def list_installed_plugin_ids(tenant_id: str, category: PluginCategory) -> Sequence[str]:
-        """List all currently installed plugin IDs in one category through the daemon's lightweight query."""
-        manager = PluginInstaller()
-        return manager.list_installed_plugin_ids(tenant_id, category)
-
-    @staticmethod
-    def list_model_provider_bindings(
-        tenant_id: str, *, client: PluginModelClient | None = None
-    ) -> Sequence[PluginModelProviderBinding]:
-        """Return fresh model bindings and reconcile remote-debug provider metadata before it is read."""
-        model_client = client or PluginModelClient()
-        bindings = model_client.fetch_model_provider_bindings(tenant_id)
-        if PluginService._should_invalidate_model_provider_cache_for_remote_model_plugins(tenant_id, bindings):
-            PluginService.invalidate_plugin_model_providers_cache(tenant_id)
-
-        marker = PluginService._get_remote_model_plugin_cache_marker(bindings)
-        PluginService._store_cached_remote_model_plugin_marker(tenant_id, marker)
-        return bindings
-
     @staticmethod
     def list_with_total(tenant_id: str, user_id: str, page: int, page_size: int) -> PluginListResponse:
         """List tenant plugins with endpoint counts reconciled from live records.
@@ -699,33 +672,17 @@ class PluginService:
 
     @staticmethod
     def list_by_category(
-        tenant_id: str,
-        category: PluginCategory,
-        page: int,
-        page_size: int,
-        *,
-        query: str = "",
-        tags: Sequence[str] = (),
-        language: str = "en_US",
+        tenant_id: str, category: PluginCategory, page: int, page_size: int
     ) -> PluginListWithoutTotalResponse:
         """
         List plugins in one category with a has-more cursor signal and without calculating total.
 
-        The daemon applies category, search, and tag filters before pagination, then stops once it finds one extra
-        match. Only a complete, unfiltered first page may reconcile the model-provider cache; the unpaginated model
-        binding read is the authoritative marker source for larger result sets.
+        The daemon scans tenant installations in the existing list order and stops once it finds one extra match.
+        This keeps pagination usable before category is persisted on installation rows.
         """
         manager = PluginInstaller()
-        plugins = manager.list_plugins_by_category(
-            tenant_id,
-            category,
-            page,
-            page_size,
-            query=query,
-            tags=tags,
-            language=language,
-        )
-        if category == PluginCategory.Model and page == 1 and not plugins.has_more and not query and not tags:
+        plugins = manager.list_plugins_by_category(tenant_id, category, page, page_size)
+        if category == PluginCategory.Model:
             should_invalidate_model_provider_cache = (
                 PluginService._should_invalidate_model_provider_cache_for_remote_model_plugins(
                     tenant_id,

api/core/rag/cleaner/clean_processor.py

@@ -9,7 +9,7 @@ class CleanProcessor:
         # remove invalid symbol
         text = re.sub(r"<\|", "<", text)
         text = re.sub(r"\|>", ">", text)
-        text = re.sub(r"[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]", "", text)
+        text = re.sub(r"[\x00-\x08\x0B\x0C\x0E-\x1F\x7F\xEF\xBF\xBE]", "", text)
         # Unicode  U+FFFE
         text = re.sub("\ufffe", "", text)
 

api/core/rag/splitter/fixed_text_splitter.py

@@ -91,8 +91,8 @@ class FixedRecursiveCharacterTextSplitter(EnhanceRecursiveCharacterTextSplitter)
                 splits = re.split(r" +", text)
             else:
                 splits = text.split(separator)
-            if self._keep_separator:
-                splits = [s + separator for s in splits[:-1]] + splits[-1:]
+                if self._keep_separator:
+                    splits = [s + separator for s in splits[:-1]] + splits[-1:]
         else:
             splits = list(text)
         if separator == "\n":

api/core/workflow/nodes/agent_v2/runtime_request_builder.py

@@ -38,6 +38,7 @@ from dify_agent.layers.shell import (
 )
 from dify_agent.protocol import CreateRunRequest, DeferredToolResultsPayload
 from pydantic import BaseModel, ValidationError
+from sqlalchemy.exc import OperationalError
 
 from clients.agent_backend import (
     AgentBackendModelConfig,
@@ -206,14 +207,22 @@ class WorkflowAgentRuntimeRequestBuilder:
                 "cli_tool_count": len(agent_soul.tools.cli_tools),
             }
 
+        runtime_config_skills = load_runtime_agent_skill_configs(
+            tenant_id=context.dify_context.tenant_id,
+            agent_id=context.agent.id,
+        )
         config_layer_config, config_warnings = build_config_layer_config(
             agent_soul,
             agent_id=context.agent.id,
             config_version_id=context.snapshot.id,
             config_version_kind="snapshot",
+            runtime_config_skills=runtime_config_skills,
         )
         append_runtime_warnings(metadata, config_warnings)
-        soul_prompt_resolver = build_config_aware_soul_mention_resolver(agent_soul)
+        soul_prompt_resolver = build_config_aware_soul_mention_resolver(
+            agent_soul,
+            runtime_config_skills=runtime_config_skills,
+        )
         soul_prompt = expand_prompt_mentions(agent_soul.prompt.system_prompt, soul_prompt_resolver).strip()
         knowledge_config = build_knowledge_layer_config(agent_soul)
 
@@ -883,11 +892,16 @@ def append_runtime_warnings(metadata: dict[str, Any], warnings: list[dict[str, s
             existing.extend(warnings)
 
 
-def build_config_aware_soul_mention_resolver(agent_soul: AgentSoulConfig):
+def build_config_aware_soul_mention_resolver(
+    agent_soul: AgentSoulConfig,
+    *,
+    runtime_config_skills: Sequence[DifyConfigSkillConfig] = (),
+):
     """Resolve config skill/file mentions and delegate the rest to Agent Soul."""
 
     base_resolver = build_soul_mention_resolver(agent_soul)
     skill_names = {item.name for item in agent_soul.config_skills if not item.is_missing}
+    skill_names.update(item.name for item in runtime_config_skills)
     file_names = {item.name for item in agent_soul.config_files if not item.is_missing}
 
     def _resolve(mention: object) -> str | None:
@@ -905,12 +919,34 @@ def build_config_aware_soul_mention_resolver(agent_soul: AgentSoulConfig):
     return _resolve
 
 
+def load_runtime_agent_skill_configs(*, tenant_id: str, agent_id: str) -> list[DifyConfigSkillConfig]:
+    """Return workspace-bound Skills as prompt-safe runtime config skills."""
+    from services.skill_management_service import SkillManagementService
+
+    try:
+        runtime_skills = SkillManagementService().list_runtime_agent_skills(tenant_id=tenant_id, agent_id=agent_id)
+    except OperationalError as exc:
+        if "no such table: agent_skill_bindings" not in str(exc.orig):
+            raise
+        runtime_skills = []
+    return [
+        DifyConfigSkillConfig(
+            name=str(item["name"]),
+            description=str(item.get("description") or ""),
+            size=cast(int | None, item.get("size")),
+            mime_type=cast(str | None, item.get("mime_type")),
+        )
+        for item in runtime_skills
+    ]
+
+
 def build_config_layer_config(
     agent_soul: AgentSoulConfig,
     *,
     agent_id: str | None = None,
     config_version_id: str | None = None,
     config_version_kind: Literal["snapshot", "draft", "build_draft"] = "snapshot",
+    runtime_config_skills: Sequence[DifyConfigSkillConfig] = (),
 ) -> tuple[DifyConfigLayerConfig, list[dict[str, str]]]:
     """Build the always-present Agent config layer from Agent Soul state.
 
@@ -927,8 +963,23 @@ def build_config_layer_config(
         )
     )
     available_skills = [skill for skill in agent_soul.config_skills if not skill.is_missing]
+    skill_configs = [
+        DifyConfigSkillConfig(
+            name=skill.name,
+            description=skill.description,
+            size=skill.size,
+            mime_type=skill.mime_type,
+        )
+        for skill in available_skills
+    ]
+    seen_skill_names = {skill.name for skill in skill_configs}
+    for skill in runtime_config_skills:
+        if skill.name in seen_skill_names:
+            continue
+        seen_skill_names.add(skill.name)
+        skill_configs.append(skill)
     available_files = [file_ref for file_ref in agent_soul.config_files if not file_ref.is_missing]
-    skill_names = {skill.name for skill in available_skills}
+    skill_names = {skill.name for skill in skill_configs}
     file_names = {file_ref.name for file_ref in available_files}
     warnings: list[dict[str, str]] = [
         {
@@ -965,15 +1016,7 @@ def build_config_layer_config(
                 kind=config_version_kind,
                 writable=config_version_kind == "build_draft",
             ),
-            skills=[
-                DifyConfigSkillConfig(
-                    name=skill.name,
-                    description=skill.description,
-                    size=skill.size,
-                    mime_type=skill.mime_type,
-                )
-                for skill in available_skills
-            ],
+            skills=skill_configs,
             files=[
                 DifyConfigFileConfig(
                     name=file_ref.name,

api/extensions/ext_celery.py

@@ -5,7 +5,6 @@ from typing import Any
 import pytz  # type: ignore[import-untyped]
 from celery import Celery, Task
 from celery.schedules import crontab
-from celery.signals import beat_init
 from typing_extensions import TypedDict
 
 from configs import dify_config
@@ -37,19 +36,6 @@ class CeleryBeatScheduleEntry(TypedDict):
     schedule: crontab | timedelta
 
 
-def _enqueue_initial_community_telemetry_heartbeat(sender: Any, **_: Any) -> None:
-    task_name = "community_telemetry.send_heartbeat"
-    if "community_telemetry_heartbeat" not in sender.app.conf.beat_schedule:
-        return
-
-    task = sender.app.tasks.get(task_name)
-    if task is not None:
-        task.apply_async()
-
-
-beat_init.connect(_enqueue_initial_community_telemetry_heartbeat, weak=False)
-
-
 def get_celery_ssl_options() -> CelerySSLOptionsDict | None:
     """Get SSL configuration for Celery broker/backend connections."""
     # Only apply SSL if we're using Redis as broker/backend
@@ -274,19 +260,6 @@ def init_app(app: DifyApp) -> Celery:
             "schedule": timedelta(minutes=dify_config.API_TOKEN_LAST_USED_UPDATE_INTERVAL),
         }
 
-    if (
-        dify_config.EDITION == "SELF_HOSTED"
-        and not dify_config.ENTERPRISE_ENABLED
-        and not dify_config.DISABLE_TELEMETRY
-        and not dify_config.DO_NOT_TRACK
-        and not dify_config.CI
-    ):
-        imports.append("tasks.community_telemetry_task")
-        beat_schedule["community_telemetry_heartbeat"] = {
-            "task": "community_telemetry.send_heartbeat",
-            "schedule": timedelta(minutes=dify_config.TELEMETRY_HEARTBEAT_INTERVAL_MINUTES),
-        }
-
     if dify_config.ENTERPRISE_ENABLED and dify_config.ENTERPRISE_TELEMETRY_ENABLED:
         imports.append("tasks.enterprise_telemetry_task")
     celery_app.conf.update(beat_schedule=beat_schedule, imports=imports)

api/fields/agent_fields.py

@@ -383,7 +383,6 @@ class AgentAppComposerResponse(ResponseModel):
     variant: Literal[ComposerVariant.AGENT_APP]
     agent: AgentComposerAgentResponse
     active_config_snapshot: AgentConfigSnapshotSummaryResponse | None = None
-    active_config_is_published: bool
     draft: AgentConfigDraftSummaryResponse | None = None
     agent_soul: AgentSoulConfig
     save_options: list[ComposerSaveStrategy]

api/migrations/versions/2026_07_09_1200-a4f8d2c9e1b0_add_workspace_skill_management.py

@@ -0,0 +1,114 @@
+"""add workspace skill management
+
+Revision ID: a4f8d2c9e1b0
+Revises: d2825e7b9c10
+Create Date: 2026-07-09 12:00:00.000000
+
+"""
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.dialects import mysql
+
+from models.types import StringUUID
+
+# revision identifiers, used by Alembic.
+revision = "a4f8d2c9e1b0"
+down_revision = "d2825e7b9c10"
+branch_labels = None
+depends_on = None
+
+
+def _uuid_column(name: str, *, nullable: bool = False) -> sa.Column:
+    return sa.Column(name, StringUUID(), nullable=nullable)
+
+
+def _long_text() -> sa.types.TypeEngine:
+    return sa.Text().with_variant(mysql.LONGTEXT(), "mysql")
+
+
+def upgrade() -> None:
+    op.create_table(
+        "skills",
+        _uuid_column("id"),
+        _uuid_column("tenant_id"),
+        sa.Column("name", sa.String(length=64), nullable=False),
+        sa.Column("display_name", sa.String(length=128), nullable=False),
+        sa.Column("icon", sa.String(length=16), nullable=False, server_default="📄"),
+        sa.Column("description", sa.String(length=1024), nullable=False, server_default=""),
+        sa.Column("name_manually_edited", sa.Boolean(), nullable=False, server_default=sa.false()),
+        sa.Column("visibility", sa.String(length=32), nullable=False, server_default="workspace"),
+        _uuid_column("latest_published_version_id", nullable=True),
+        _uuid_column("created_by", nullable=True),
+        _uuid_column("updated_by", nullable=True),
+        sa.Column("created_at", sa.DateTime(), nullable=False, server_default=sa.func.current_timestamp()),
+        sa.Column("updated_at", sa.DateTime(), nullable=False, server_default=sa.func.current_timestamp()),
+        sa.PrimaryKeyConstraint("id", name="skill_pkey"),
+        sa.UniqueConstraint("tenant_id", "name", name="skill_tenant_name_unique"),
+    )
+    op.create_index("skills_tenant_updated_at_idx", "skills", ["tenant_id", "updated_at"])
+
+    op.create_table(
+        "skill_draft_files",
+        _uuid_column("id"),
+        _uuid_column("skill_id"),
+        sa.Column("path", sa.String(length=512), nullable=False),
+        sa.Column("kind", sa.String(length=32), nullable=False),
+        sa.Column("storage", sa.String(length=32), nullable=True),
+        sa.Column("mime_type", sa.String(length=255), nullable=True),
+        sa.Column("content_text", _long_text(), nullable=True),
+        _uuid_column("tool_file_id", nullable=True),
+        sa.Column("size", sa.BigInteger(), nullable=True),
+        sa.Column("hash", sa.String(length=255), nullable=True),
+        sa.Column("created_at", sa.DateTime(), nullable=False, server_default=sa.func.current_timestamp()),
+        sa.Column("updated_at", sa.DateTime(), nullable=False, server_default=sa.func.current_timestamp()),
+        sa.PrimaryKeyConstraint("id", name="skill_draft_file_pkey"),
+        sa.UniqueConstraint("skill_id", "path", name="skill_draft_file_skill_path_unique"),
+    )
+    op.create_index("skill_draft_files_skill_path_idx", "skill_draft_files", ["skill_id", "path"])
+
+    op.create_table(
+        "skill_versions",
+        _uuid_column("id"),
+        _uuid_column("skill_id"),
+        sa.Column("version_number", sa.Integer(), nullable=False),
+        sa.Column("version_name", sa.String(length=128), nullable=False, server_default=""),
+        sa.Column("publish_note", sa.String(length=1024), nullable=False, server_default=""),
+        sa.Column("manifest", _long_text(), nullable=False),
+        _uuid_column("archive_tool_file_id"),
+        sa.Column("hash_code", sa.String(length=255), nullable=False),
+        sa.Column("archive_size", sa.BigInteger(), nullable=False),
+        _uuid_column("published_by", nullable=True),
+        sa.Column("created_at", sa.DateTime(), nullable=False, server_default=sa.func.current_timestamp()),
+        sa.Column("updated_at", sa.DateTime(), nullable=False, server_default=sa.func.current_timestamp()),
+        sa.PrimaryKeyConstraint("id", name="skill_version_pkey"),
+        sa.UniqueConstraint("skill_id", "version_number", name="skill_version_skill_number_unique"),
+    )
+    op.create_index("skill_versions_skill_created_at_idx", "skill_versions", ["skill_id", "created_at"])
+
+    op.create_table(
+        "agent_skill_bindings",
+        _uuid_column("id"),
+        _uuid_column("tenant_id"),
+        _uuid_column("agent_id"),
+        _uuid_column("skill_id"),
+        sa.Column("priority", sa.Integer(), nullable=False),
+        _uuid_column("created_by", nullable=True),
+        sa.Column("created_at", sa.DateTime(), nullable=False, server_default=sa.func.current_timestamp()),
+        sa.Column("updated_at", sa.DateTime(), nullable=False, server_default=sa.func.current_timestamp()),
+        sa.PrimaryKeyConstraint("id", name="agent_skill_binding_pkey"),
+        sa.UniqueConstraint("tenant_id", "agent_id", "skill_id", name="agent_skill_binding_unique"),
+        sa.UniqueConstraint("tenant_id", "agent_id", "priority", name="agent_skill_binding_priority_unique"),
+    )
+    op.create_index("agent_skill_bindings_skill_idx", "agent_skill_bindings", ["tenant_id", "skill_id"])
+
+
+def downgrade() -> None:
+    op.drop_index("agent_skill_bindings_skill_idx", table_name="agent_skill_bindings")
+    op.drop_table("agent_skill_bindings")
+    op.drop_index("skill_versions_skill_created_at_idx", table_name="skill_versions")
+    op.drop_table("skill_versions")
+    op.drop_index("skill_draft_files_skill_path_idx", table_name="skill_draft_files")
+    op.drop_table("skill_draft_files")
+    op.drop_index("skills_tenant_updated_at_idx", table_name="skills")
+    op.drop_table("skills")

api/migrations/versions/2026_07_22_1500-d2825e7b9c10_scope_agent_debug_conversations.py

@@ -18,31 +18,109 @@ branch_labels = None
 depends_on = None
 
 
+def _is_pg(conn) -> bool:
+    return conn.dialect.name == "postgresql"
+
+
+def _uuid_column(name: str, *, nullable: bool = False, primary_key: bool = False) -> sa.Column:
+    kwargs = {"nullable": nullable, "primary_key": primary_key}
+    if primary_key and _is_pg(op.get_bind()):
+        kwargs["server_default"] = sa.text("uuidv7()")
+    return sa.Column(name, models.types.StringUUID(), **kwargs)
+
+
+def _has_table(table_name: str) -> bool:
+    return sa.inspect(op.get_bind()).has_table(table_name)
+
+
+def _has_column(table_name: str, column_name: str) -> bool:
+    return any(
+        column["name"] == column_name for column in sa.inspect(op.get_bind()).get_columns(table_name)
+    )
+
+
+def _has_unique_constraint(table_name: str, constraint_name: str) -> bool:
+    return any(
+        constraint["name"] == constraint_name
+        for constraint in sa.inspect(op.get_bind()).get_unique_constraints(table_name)
+    )
+
+
 def upgrade():
+    if not _has_table("agent_debug_conversations"):
+        op.create_table(
+            "agent_debug_conversations",
+            _uuid_column("id", primary_key=True),
+            sa.Column("tenant_id", models.types.StringUUID(), nullable=False),
+            sa.Column("agent_id", models.types.StringUUID(), nullable=False),
+            sa.Column("app_id", models.types.StringUUID(), nullable=False),
+            sa.Column("account_id", models.types.StringUUID(), nullable=False),
+            sa.Column("conversation_id", models.types.StringUUID(), nullable=False),
+            sa.Column(
+                "draft_type",
+                sa.String(length=32),
+                nullable=False,
+                server_default=sa.text("'debug_build'"),
+            ),
+            sa.Column("created_at", sa.DateTime(), server_default=sa.func.current_timestamp(), nullable=False),
+            sa.Column("updated_at", sa.DateTime(), server_default=sa.func.current_timestamp(), nullable=False),
+            sa.PrimaryKeyConstraint("id", name=op.f("agent_debug_conversation_pkey")),
+            sa.UniqueConstraint(
+                "tenant_id",
+                "agent_id",
+                "account_id",
+                "draft_type",
+                name=op.f("agent_debug_conversation_agent_account_draft_type_unique"),
+            ),
+        )
+        op.create_index(
+            "agent_debug_conversation_conversation_idx",
+            "agent_debug_conversations",
+            ["conversation_id"],
+        )
+        op.create_index(
+            "agent_debug_conversation_account_idx",
+            "agent_debug_conversations",
+            ["tenant_id", "account_id"],
+        )
+        return
+
     # Existing pointers have always represented Build chat because the Agent
     # detail API exposes them as ``debug_conversation_id`` for that surface.
-    op.add_column(
+    if not _has_column("agent_debug_conversations", "draft_type"):
+        op.add_column(
+            "agent_debug_conversations",
+            sa.Column(
+                "draft_type",
+                sa.String(length=32),
+                nullable=False,
+                server_default=sa.text("'debug_build'"),
+            ),
+        )
+    if _has_unique_constraint(
         "agent_debug_conversations",
-        sa.Column(
-            "draft_type",
-            sa.String(length=32),
-            nullable=False,
-            server_default=sa.text("'debug_build'"),
-        ),
-    )
-    op.drop_constraint(
         "agent_debug_conversation_agent_account_unique",
+    ):
+        op.drop_constraint(
+            "agent_debug_conversation_agent_account_unique",
+            "agent_debug_conversations",
+            type_="unique",
+        )
+    if not _has_unique_constraint(
         "agent_debug_conversations",
-        type_="unique",
-    )
-    op.create_unique_constraint(
         "agent_debug_conversation_agent_account_draft_type_unique",
-        "agent_debug_conversations",
-        ["tenant_id", "agent_id", "account_id", "draft_type"],
-    )
+    ):
+        op.create_unique_constraint(
+            "agent_debug_conversation_agent_account_draft_type_unique",
+            "agent_debug_conversations",
+            ["tenant_id", "agent_id", "account_id", "draft_type"],
+        )
 
 
 def downgrade():
+    if not _has_table("agent_debug_conversations"):
+        return
+
     debug_conversations = sa.table(
         "agent_debug_conversations",
         sa.column("tenant_id", models.types.StringUUID()),
@@ -64,14 +142,23 @@ def downgrade():
             ),
         )
     )
-    op.drop_constraint(
+    if _has_unique_constraint(
+        "agent_debug_conversations",
         "agent_debug_conversation_agent_account_draft_type_unique",
+    ):
+        op.drop_constraint(
+            "agent_debug_conversation_agent_account_draft_type_unique",
+            "agent_debug_conversations",
+            type_="unique",
+        )
+    if not _has_unique_constraint(
         "agent_debug_conversations",
-        type_="unique",
-    )
-    op.create_unique_constraint(
         "agent_debug_conversation_agent_account_unique",
-        "agent_debug_conversations",
-        ["tenant_id", "agent_id", "account_id"],
-    )
-    op.drop_column("agent_debug_conversations", "draft_type")
+    ):
+        op.create_unique_constraint(
+            "agent_debug_conversation_agent_account_unique",
+            "agent_debug_conversations",
+            ["tenant_id", "agent_id", "account_id"],
+        )
+    if _has_column("agent_debug_conversations", "draft_type"):
+        op.drop_column("agent_debug_conversations", "draft_type")

api/migrations/versions/2026_07_23_1200-6f5a9c2d8e1b_add_telemetry_fields_to_dify_setups.py

@@ -1,30 +0,0 @@
-"""add telemetry fields to dify_setups
-
-Revision ID: 6f5a9c2d8e1b
-Revises: d2825e7b9c10
-Create Date: 2026-07-23 12:00:00.000000
-
-"""
-
-import sqlalchemy as sa
-from alembic import op
-
-# revision identifiers, used by Alembic.
-revision = "6f5a9c2d8e1b"
-down_revision = "d2825e7b9c10"
-branch_labels = None
-depends_on = None
-
-
-def upgrade():
-    with op.batch_alter_table("dify_setups", schema=None) as batch_op:
-        batch_op.add_column(sa.Column("instance_id", sa.String(length=255), nullable=True))
-        batch_op.add_column(sa.Column("install_reported_at", sa.DateTime(), nullable=True))
-        batch_op.add_column(sa.Column("last_heartbeat_at", sa.DateTime(), nullable=True))
-
-
-def downgrade():
-    with op.batch_alter_table("dify_setups", schema=None) as batch_op:
-        batch_op.drop_column("last_heartbeat_at")
-        batch_op.drop_column("install_reported_at")
-        batch_op.drop_column("instance_id")

api/migrations/versions/2026_07_23_1500-e9f4a1b2c3d5_merge_skill_and_agent_debug_heads.py

@@ -0,0 +1,21 @@
+"""merge skill and agent debug conversation heads
+
+Revision ID: e9f4a1b2c3d5
+Revises: a4f8d2c9e1b0, d2825e7b9c10
+Create Date: 2026-07-23 15:00:00.000000
+
+"""
+
+# revision identifiers, used by Alembic.
+revision = "e9f4a1b2c3d5"
+down_revision = ("a4f8d2c9e1b0", "d2825e7b9c10")
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    pass
+
+
+def downgrade():
+    pass

api/models/__init__.py

@@ -113,6 +113,7 @@ from .provider import (
     TenantDefaultModel,
     TenantPreferredModelProvider,
 )
+from .skill import AgentSkillBinding, Skill, SkillDraftFile, SkillFileKind, SkillFileStorage, SkillVersion
 from .snippet import CustomizedSnippet, SnippetType
 from .source import DataSourceApiKeyAuthBinding, DataSourceOauthBinding
 from .task import CeleryTask, CeleryTaskSet
@@ -173,6 +174,7 @@ __all__ = [
     "AgentRuntimeSessionOwnerType",
     "AgentRuntimeSessionStatus",
     "AgentScope",
+    "AgentSkillBinding",
     "AgentSource",
     "AgentStatus",
     "ApiRequest",
@@ -246,6 +248,11 @@ __all__ = [
     "RecommendedApp",
     "SavedMessage",
     "Site",
+    "Skill",
+    "SkillDraftFile",
+    "SkillFileKind",
+    "SkillFileStorage",
+    "SkillVersion",
     "SnippetType",
     "Tag",
     "TagBinding",

api/models/enums.py

@@ -249,6 +249,7 @@ class TagType(StrEnum):
     KNOWLEDGE = "knowledge"
     APP = "app"
     SNIPPET = "snippet"
+    SKILL = "skill"
 
 
 class DatasetMetadataType(StrEnum):

api/models/model.py

@@ -362,9 +362,6 @@ class DifySetup(TypeBase):
     __table_args__ = (sa.PrimaryKeyConstraint("version", name="dify_setup_pkey"),)
 
     version: Mapped[str] = mapped_column(String(255), nullable=False)
-    instance_id: Mapped[str | None] = mapped_column(String(255), nullable=True, default=None)
-    install_reported_at: Mapped[datetime | None] = mapped_column(sa.DateTime, nullable=True, default=None)
-    last_heartbeat_at: Mapped[datetime | None] = mapped_column(sa.DateTime, nullable=True, default=None)
     setup_at: Mapped[datetime] = mapped_column(
         sa.DateTime, nullable=False, server_default=func.current_timestamp(), init=False
     )
@@ -2667,7 +2664,7 @@ class Tag(TypeBase):
         sa.Index("tag_name_idx", "name"),
     )
 
-    TAG_TYPE_LIST = ["knowledge", "app", "snippet"]
+    TAG_TYPE_LIST = ["knowledge", "app", "snippet", "skill"]
 
     id: Mapped[str] = mapped_column(
         StringUUID, insert_default=lambda: str(uuid4()), default_factory=lambda: str(uuid4()), init=False

api/models/skill.py

@@ -0,0 +1,164 @@
+"""Workspace-level Skill Management models.
+
+These tables are the source of truth for reusable workspace Skills. Agent Soul
+``config_skills`` and Agent Drive skill rows remain per-agent runtime/config
+assets; they may consume a published Skill snapshot but do not own the Skill's
+draft, metadata, version history, or Agent binding priority.
+"""
+
+from enum import StrEnum
+
+import sqlalchemy as sa
+from pydantic import BaseModel, ConfigDict
+from sqlalchemy import Index, UniqueConstraint
+from sqlalchemy.orm import Mapped, mapped_column
+
+from models.base import Base, DefaultFieldsMixin
+from models.types import EnumText, JSONModelColumn, LongText, StringUUID
+
+
+class SkillFileKind(StrEnum):
+    """Draft file entry kind."""
+
+    FILE = "file"
+    DIRECTORY = "directory"
+
+
+class SkillFileStorage(StrEnum):
+    """How a draft file's content is stored."""
+
+    TEXT = "text"
+    TOOL_FILE = "tool_file"
+
+
+class SkillVersionManifestFile(BaseModel):
+    """One file entry captured in a published Skill snapshot manifest."""
+
+    path: str
+    mime_type: str | None = None
+    size: int
+    hash: str
+
+    model_config = ConfigDict(extra="forbid")
+
+
+class SkillVersionManifest(BaseModel):
+    """Published Skill snapshot file index."""
+
+    files: list[SkillVersionManifestFile]
+
+    model_config = ConfigDict(extra="forbid")
+
+
+class Skill(DefaultFieldsMixin, Base):
+    """Workspace-level reusable Skill metadata and draft status."""
+
+    __tablename__ = "skills"
+    __table_args__ = (
+        sa.PrimaryKeyConstraint("id", name="skill_pkey"),
+        UniqueConstraint("tenant_id", "name", name="skill_tenant_name_unique"),
+        Index("skills_tenant_updated_at_idx", "tenant_id", "updated_at"),
+    )
+
+    tenant_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
+    name: Mapped[str] = mapped_column(sa.String(64), nullable=False)
+    display_name: Mapped[str] = mapped_column(sa.String(128), nullable=False)
+    icon: Mapped[str] = mapped_column(sa.String(16), nullable=False, default="📄", server_default="📄")
+    description: Mapped[str] = mapped_column(sa.String(1024), nullable=False, default="", server_default="")
+    name_manually_edited: Mapped[bool] = mapped_column(
+        sa.Boolean,
+        nullable=False,
+        default=False,
+        server_default=sa.false(),
+    )
+    visibility: Mapped[str] = mapped_column(
+        sa.String(32),
+        nullable=False,
+        default="workspace",
+        server_default="workspace",
+    )
+    latest_published_version_id: Mapped[str | None] = mapped_column(StringUUID, nullable=True)
+    created_by: Mapped[str | None] = mapped_column(StringUUID, nullable=True)
+    updated_by: Mapped[str | None] = mapped_column(StringUUID, nullable=True)
+
+
+class SkillDraftFile(DefaultFieldsMixin, Base):
+    """One draft file or directory in a workspace Skill."""
+
+    __tablename__ = "skill_draft_files"
+    __table_args__ = (
+        sa.PrimaryKeyConstraint("id", name="skill_draft_file_pkey"),
+        UniqueConstraint("skill_id", "path", name="skill_draft_file_skill_path_unique"),
+        Index("skill_draft_files_skill_path_idx", "skill_id", "path"),
+    )
+
+    skill_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
+    path: Mapped[str] = mapped_column(sa.String(512), nullable=False)
+    kind: Mapped[SkillFileKind] = mapped_column(EnumText(SkillFileKind, length=32), nullable=False)
+    storage: Mapped[SkillFileStorage | None] = mapped_column(EnumText(SkillFileStorage, length=32), nullable=True)
+    mime_type: Mapped[str | None] = mapped_column(sa.String(255), nullable=True)
+    content_text: Mapped[str | None] = mapped_column(LongText, nullable=True)
+    tool_file_id: Mapped[str | None] = mapped_column(StringUUID, nullable=True)
+    size: Mapped[int | None] = mapped_column(sa.BigInteger, nullable=True)
+    hash: Mapped[str | None] = mapped_column(sa.String(255), nullable=True)
+
+
+class SkillVersion(DefaultFieldsMixin, Base):
+    """Immutable published Skill snapshot.
+
+    ``hash_code`` uniquely identifies a published version for downstream
+    execution audit. It includes Skill identity, version number, and archive
+    content digest instead of being only the archive content hash.
+    """
+
+    __tablename__ = "skill_versions"
+    __table_args__ = (
+        sa.PrimaryKeyConstraint("id", name="skill_version_pkey"),
+        UniqueConstraint("skill_id", "version_number", name="skill_version_skill_number_unique"),
+        Index("skill_versions_skill_created_at_idx", "skill_id", "created_at"),
+    )
+
+    skill_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
+    version_number: Mapped[int] = mapped_column(sa.Integer, nullable=False)
+    version_name: Mapped[str] = mapped_column(sa.String(128), nullable=False, default="", server_default="")
+    publish_note: Mapped[str] = mapped_column(sa.String(1024), nullable=False, default="", server_default="")
+    manifest: Mapped[SkillVersionManifest] = mapped_column(JSONModelColumn(SkillVersionManifest), nullable=False)
+    archive_tool_file_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
+    hash_code: Mapped[str] = mapped_column(sa.String(255), nullable=False)
+    archive_size: Mapped[int] = mapped_column(sa.BigInteger, nullable=False)
+    published_by: Mapped[str | None] = mapped_column(StringUUID, nullable=True)
+
+
+class AgentSkillBinding(DefaultFieldsMixin, Base):
+    """Direct Agent-to-workspace-Skill binding.
+
+    ``priority`` is retained as an internal ordering column for the current
+    schema constraints. Runtime Skill selection is Agent-driven and must not
+    treat it as a matching priority.
+    """
+
+    __tablename__ = "agent_skill_bindings"
+    __table_args__ = (
+        sa.PrimaryKeyConstraint("id", name="agent_skill_binding_pkey"),
+        UniqueConstraint("tenant_id", "agent_id", "skill_id", name="agent_skill_binding_unique"),
+        UniqueConstraint("tenant_id", "agent_id", "priority", name="agent_skill_binding_priority_unique"),
+        Index("agent_skill_bindings_skill_idx", "tenant_id", "skill_id"),
+    )
+
+    tenant_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
+    agent_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
+    skill_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
+    priority: Mapped[int] = mapped_column(sa.Integer, nullable=False)
+    created_by: Mapped[str | None] = mapped_column(StringUUID, nullable=True)
+
+
+__all__ = [
+    "AgentSkillBinding",
+    "Skill",
+    "SkillDraftFile",
+    "SkillFileKind",
+    "SkillFileStorage",
+    "SkillVersion",
+    "SkillVersionManifest",
+    "SkillVersionManifestFile",
+]

api/openapi/markdown/console-openapi.md

@@ -10567,13 +10567,6 @@ Update a plugin endpoint
 | ---- | ----------- | ------ |
 | 200 | Model providers retrieved successfully | **application/json**: [ModelProviderListResponse](#modelproviderlistresponse)<br> |
 
-### [GET] /workspaces/current/model-providers/summary
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Model provider summaries retrieved successfully | **application/json**: [ModelProviderSummaryListResponse](#modelprovidersummarylistresponse)<br> |
-
 ### [GET] /workspaces/current/model-providers/{provider}/checkout-url
 #### Parameters
 
@@ -11119,19 +11112,6 @@ Returns permission flags that control workspace features like member invitations
 | ---- | ----------- | ------ |
 | 200 | Success | **application/json**: [PluginInstallTaskStartResponse](#plugininstalltaskstartresponse)<br> |
 
-### [GET] /workspaces/current/plugin/installed-ids
-#### Parameters
-
-| Name | Located in | Description | Required | Schema |
-| ---- | ---------- | ----------- | -------- | ------ |
-| category | query | Plugin category to include | Yes | string, <br>**Available values:** "agent-strategy", "datasource", "extension", "model", "tool", "trigger" |
-
-#### Responses
-
-| Code | Description | Schema |
-| ---- | ----------- | ------ |
-| 200 | Success | **application/json**: [PluginInstalledIdsResponse](#plugininstalledidsresponse)<br> |
-
 ### [GET] /workspaces/current/plugin/list
 #### Parameters
 
@@ -11390,11 +11370,8 @@ Returns permission flags that control workspace features like member invitations
 
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
-| language | query | Language used for localized label and description search | No | string, <br>**Available values:** "en_US", "ja_JP", "pt_BR", "zh_Hans", <br>**Default:** en_US |
 | page | query | Page number | No | integer, <br>**Default:** 1 |
 | page_size | query | Page size (1-256) | No | integer, <br>**Default:** 256 |
-| query | query | Case-insensitive search query | No | string |
-| tags | query | Match any plugin tag | No | [ string ] |
 | category | path |  | Yes | string |
 
 #### Responses
@@ -13266,7 +13243,6 @@ Model class for AI model.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| active_config_is_published | boolean |  | Yes |
 | active_config_snapshot | [AgentConfigSnapshotSummaryResponse](#agentconfigsnapshotsummaryresponse) |  | No |
 | agent | [AgentComposerAgentResponse](#agentcomposeragentresponse) |  | Yes |
 | agent_soul | [AgentSoulConfig](#agentsoulconfig) |  | Yes |
@@ -13306,6 +13282,7 @@ Model class for AI model.
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
 | access_mode | string |  | No |
+| active_config_is_published | boolean |  | No |
 | api_base_url | string |  | No |
 | app_id | string |  | No |
 | backing_app_id | string |  | No |
@@ -19330,16 +19307,6 @@ Enum class for model property key.
 | ---- | ---- | ----------- | -------- |
 | ModelPropertyKey | string | Enum class for model property key. |  |
 
-#### ModelProviderCustomConfigurationSummaryResponse
-
-| Name | Type | Description | Required |
-| ---- | ---- | ----------- | -------- |
-| available_credentials | [ [CredentialConfiguration](#credentialconfiguration) ] |  | Yes |
-| current_credential_id | string |  | No |
-| current_credential_name | string |  | No |
-| current_credential_usable | boolean |  | Yes |
-| status | [CustomConfigurationStatus](#customconfigurationstatus) |  | Yes |
-
 #### ModelProviderListResponse
 
 | Name | Type | Description | Required |
@@ -19352,49 +19319,6 @@ Enum class for model property key.
 | ---- | ---- | ----------- | -------- |
 | payment_link | string |  | Yes |
 
-#### ModelProviderPluginSummaryResponse
-
-| Name | Type | Description | Required |
-| ---- | ---- | ----------- | -------- |
-| installation_id | string |  | Yes |
-| plugin_id | string |  | Yes |
-| plugin_unique_identifier | string |  | Yes |
-| runtime_type | string |  | Yes |
-| source | [PluginInstallationSource](#plugininstallationsource) |  | Yes |
-| version | string |  | Yes |
-
-#### ModelProviderSummaryListResponse
-
-| Name | Type | Description | Required |
-| ---- | ---- | ----------- | -------- |
-| data | [ [ModelProviderSummaryResponse](#modelprovidersummaryresponse) ] |  | Yes |
-| plugins | object |  | Yes |
-
-#### ModelProviderSummaryResponse
-
-Fields required to render the collapsed model-provider list.
-
-| Name | Type | Description | Required |
-| ---- | ---- | ----------- | -------- |
-| configurate_methods | [ [ConfigurateMethod](#configuratemethod) ] |  | Yes |
-| custom_configuration | [ModelProviderCustomConfigurationSummaryResponse](#modelprovidercustomconfigurationsummaryresponse) |  | Yes |
-| description | [I18nObject](#i18nobject) |  | No |
-| icon_small | [I18nObject](#i18nobject) |  | No |
-| icon_small_dark | [I18nObject](#i18nobject) |  | No |
-| is_configured | boolean |  | Yes |
-| label | [I18nObject](#i18nobject) |  | Yes |
-| plugin_id | string |  | Yes |
-| preferred_provider_type | [ProviderType](#providertype) |  | Yes |
-| provider | string |  | Yes |
-| supported_model_types | [ [ModelType](#modeltype) ] |  | Yes |
-| system_configuration | [ModelProviderSystemConfigurationSummaryResponse](#modelprovidersystemconfigurationsummaryresponse) |  | Yes |
-
-#### ModelProviderSystemConfigurationSummaryResponse
-
-| Name | Type | Description | Required |
-| ---- | ---- | ----------- | -------- |
-| enabled | boolean |  | Yes |
-
 #### ModelSelectorScope
 
 | Name | Type | Description | Required |
@@ -20383,11 +20307,8 @@ Shared permission levels for resources (datasets, credentials, etc.)
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| language | string, <br>**Available values:** "en_US", "ja_JP", "pt_BR", "zh_Hans", <br>**Default:** en_US | Language used for localized label and description search<br>*Enum:* `"en_US"`, `"ja_JP"`, `"pt_BR"`, `"zh_Hans"` | No |
 | page | integer, <br>**Default:** 1 | Page number | No |
 | page_size | integer, <br>**Default:** 256 | Page size (1-256) | No |
-| query | string | Case-insensitive search query | No |
-| tags | [ string ] | Match any plugin tag | No |
 
 #### PluginCategoryListResponse
 
@@ -20588,18 +20509,6 @@ Shared permission levels for resources (datasets, credentials, etc.)
 | ---- | ---- | ----------- | -------- |
 | plugins | [ [PluginInstallationItemResponse](#plugininstallationitemresponse) ] |  | Yes |
 
-#### PluginInstalledIdsQuery
-
-| Name | Type | Description | Required |
-| ---- | ---- | ----------- | -------- |
-| category | [PluginCategory](#plugincategory) | Plugin category to include | Yes |
-
-#### PluginInstalledIdsResponse
-
-| Name | Type | Description | Required |
-| ---- | ---- | ----------- | -------- |
-| plugin_ids | [ string ] |  | Yes |
-
 #### PluginListResponse
 
 | Name | Type | Description | Required |

api/openapi/markdown/web-openapi.md

@@ -965,12 +965,6 @@ Returns Server-Sent Events stream.
 | ---- | ---- | ----------- | -------- |
 | tool_icons | object | Tool icon metadata keyed by tool name | No |
 
-#### AppMode
-
-| Name | Type | Description | Required |
-| ---- | ---- | ----------- | -------- |
-| AppMode | string |  |  |
-
 #### AppPermissionQuery
 
 | Name | Type | Description | Required |
@@ -1652,7 +1646,6 @@ in form definition, or a variable while the workflow is running.
 | custom_config | [WebAppCustomConfigResponse](#webappcustomconfigresponse) |  | No |
 | enable_site | boolean |  | Yes |
 | end_user_id | string |  | No |
-| mode | [AppMode](#appmode) |  | Yes |
 | model_config | [WebModelConfigResponse](#webmodelconfigresponse) |  | No |
 | plan | string |  | Yes |
 | site | [WebSiteResponse](#websiteresponse) |  | Yes |

api/services/account_service.py

@@ -75,7 +75,6 @@ from services.errors.account import (
 from services.errors.workspace import WorkSpaceNotAllowedCreateError, WorkspacesLimitExceededError
 from services.feature_service import FeatureService
 from services.plugin.plugin_auto_upgrade_service import PluginAutoUpgradeService
-from services.telemetry_service import CommunityTelemetryService
 from tasks.delete_account_task import delete_account_task
 from tasks.mail_account_deletion_task import send_account_deletion_verification_code
 from tasks.mail_change_mail_task import (
@@ -1599,7 +1598,9 @@ class TenantService:
         return updated_accounts
 
     @staticmethod
-    def iter_member_account_id_batches(tenant_id: str, batch_size: int, *, session: Session) -> Iterator[list[str]]:
+    def iter_member_account_id_batches(
+        tenant_id: str, batch_size: int, *, session: Session
+    ) -> Iterator[list[str]]:
         """Yield workspace member account ids in bounded, ordered batches."""
         offset = 0
         while True:
@@ -1954,7 +1955,7 @@ class RegisterService:
 
             TenantService.create_owner_tenant_if_not_exist(account=account, is_setup=True, session=session)
 
-            dify_setup = DifySetup(version=dify_config.project.version, instance_id=str(uuid.uuid4()))
+            dify_setup = DifySetup(version=dify_config.project.version)
             session.add(dify_setup)
             session.commit()
         except Exception as e:
@@ -1967,11 +1968,6 @@ class RegisterService:
             logger.exception("Setup account failed, email: %s, name: %s", email, name)
             raise ValueError(f"Setup failed: {e}")
 
-        try:
-            CommunityTelemetryService.report_install(session=session)
-        except Exception:
-            logger.debug("Failed to report install telemetry", exc_info=True)
-
     @classmethod
     def register(
         cls,

api/services/agent/composer_service.py

@@ -405,7 +405,6 @@ class AgentComposerService:
             "variant": ComposerVariant.AGENT_APP.value,
             "agent": cls._serialize_agent(agent),
             "active_config_snapshot": cls._serialize_version(version),
-            "active_config_is_published": bool(agent.active_config_snapshot_id and agent.active_config_is_published),
             "draft": cls._serialize_draft(draft),
             "agent_soul": draft.config_snapshot_dict,
             "save_options": [ComposerSaveStrategy.SAVE_TO_CURRENT_VERSION.value],

api/services/agent/skill_package_service.py

@@ -19,12 +19,11 @@ from __future__ import annotations
 import hashlib
 import io
 import posixpath
-import re
 import zipfile
 import zlib
 
 import yaml
-from pydantic import BaseModel
+from pydantic import BaseModel, Field, ValidationError, field_validator
 
 # Bounds — generous but finite so a hostile upload can't exhaust memory/disk.
 _MAX_ARCHIVE_BYTES = 50 * 1024 * 1024
@@ -33,7 +32,8 @@ _MAX_SKILL_MD_BYTES = 1 * 1024 * 1024
 _MAX_ENTRIES = 5000
 _ALLOWED_EXTENSIONS = (".zip", ".skill")
 _SKILL_MD_NAME = "SKILL.md"
-_HEADING_RE = re.compile(r"^\s*#\s+(.+?)\s*$", re.MULTILINE)
+_SKILL_NAME_PATTERN = r"^[a-z0-9]+(?:-[a-z0-9]+)*$"
+_MAX_SKILL_DESCRIPTION_LENGTH = 1024
 
 
 class SkillPackageError(Exception):
@@ -53,13 +53,18 @@ class SkillPackageError(Exception):
 class SkillManifest(BaseModel):
     """Validated metadata extracted from a Skill package."""
 
-    name: str
-    description: str
+    name: str = Field(min_length=1, max_length=64, pattern=_SKILL_NAME_PATTERN)
+    description: str = Field(min_length=1, max_length=_MAX_SKILL_DESCRIPTION_LENGTH)
     entry_path: str  # path of SKILL.md inside the archive
     files: list[str]  # all (safe) file paths inside the archive
     size: int  # total uncompressed bytes
     hash: str  # sha256 of the archive bytes
 
+    @field_validator("name", "description", mode="before")
+    @classmethod
+    def _strip_required_string(cls, value: object) -> object:
+        return value.strip() if isinstance(value, str) else value
+
 
 class NormalizedSkillPackage(BaseModel):
     """Canonical skill package bytes and metadata ready to store in agent drive."""
@@ -108,14 +113,17 @@ class SkillPackageService:
             normalized_size = sum(max(info.file_size, 0) for info in normalized_members.values())
 
         name, description = self._parse_skill_md(skill_md)
-        manifest = SkillManifest(
-            name=name,
-            description=description,
-            entry_path=_SKILL_MD_NAME,
-            files=sorted(normalized_members),
-            size=normalized_size,
-            hash=hashlib.sha256(normalized_archive_bytes).hexdigest(),
-        )
+        try:
+            manifest = SkillManifest(
+                name=name,
+                description=description,
+                entry_path=_SKILL_MD_NAME,
+                files=sorted(normalized_members),
+                size=normalized_size,
+                hash=hashlib.sha256(normalized_archive_bytes).hexdigest(),
+            )
+        except ValidationError as exc:
+            raise self._manifest_validation_error(exc) from exc
         return NormalizedSkillPackage(
             manifest=manifest,
             archive_bytes=normalized_archive_bytes,
@@ -123,6 +131,31 @@ class SkillPackageService:
             strip_prefix=strip_prefix,
         )
 
+    @staticmethod
+    def _manifest_validation_error(exc: ValidationError) -> SkillPackageError:
+        first_error = exc.errors()[0]
+        loc = first_error["loc"]
+        field = loc[0] if loc else "manifest"
+        error_type = first_error["type"]
+        if field == "name":
+            code = "missing_skill_name" if error_type == "string_too_short" else "invalid_skill_name"
+            message = (
+                "SKILL.md frontmatter name is required"
+                if code == "missing_skill_name"
+                else "SKILL.md frontmatter name must be lowercase letters, numbers, and hyphens only, "
+                "must not start or end with a hyphen, and must be at most 64 characters"
+            )
+            return SkillPackageError(code, message, status_code=400)
+        if field == "description":
+            code = "missing_skill_description" if error_type == "string_too_short" else "invalid_skill_description"
+            message = (
+                "SKILL.md frontmatter description is required"
+                if code == "missing_skill_description"
+                else f"SKILL.md frontmatter description must be at most {_MAX_SKILL_DESCRIPTION_LENGTH} characters"
+            )
+            return SkillPackageError(code, message, status_code=400)
+        return SkillPackageError("invalid_skill_manifest", "SKILL.md frontmatter is invalid", status_code=400)
+
     def _open_archive(self, *, content: bytes, filename: str) -> zipfile.ZipFile:
         self._check_extension(filename)
         if not content:
@@ -280,13 +313,6 @@ class SkillPackageService:
         frontmatter = cls._parse_frontmatter(content)
         name = str(frontmatter.get("name") or "").strip()
         description = str(frontmatter.get("description") or "").strip()
-        if not name:
-            heading = _HEADING_RE.search(content)
-            name = heading.group(1).strip() if heading else ""
-        if not name:
-            raise SkillPackageError(
-                "missing_skill_name", "SKILL.md must declare a name (frontmatter or top heading)", status_code=400
-            )
         return name, description
 
     @staticmethod

api/services/agent_config_service.py

@@ -46,6 +46,7 @@ from models.tools import ToolFile
 from services.agent.config_skill_normalize_service import ConfigSkillNormalizeService
 from services.agent.skill_package_service import SkillPackageError
 from services.agent_drive_service import DriveFileRef
+from services.skill_management_service import SkillManagementService, SkillManagementServiceError
 
 
 class AgentConfigVersionKind(StrEnum):
@@ -98,6 +99,7 @@ class ConfigPushPayload(BaseModel):
 
 @dataclass(slots=True)
 class AgentConfigTarget:
+    tenant_id: str
     agent_id: str
     version_id: str
     kind: AgentConfigVersionKind
@@ -146,6 +148,7 @@ class AgentConfigService:
                 user_id=user_id,
             )
             return AgentConfigTarget(
+                tenant_id=tenant_id,
                 agent_id=target.agent_id,
                 version_id=target.version_id,
                 kind=target.kind,
@@ -191,7 +194,7 @@ class AgentConfigService:
         return {
             "agent_id": target.agent_id,
             "config_version": self._config_version_payload(target),
-            "items": [self._serialize_skill_item(skill) for skill in target.agent_soul.config_skills],
+            "items": self._skill_items_for_target(target),
         }
 
     def list_files(
@@ -233,10 +236,27 @@ class AgentConfigService:
             config_version_kind=config_version_kind,
             user_id=user_id,
         )
-        skill = self._require_skill(target.agent_soul, name=name)
-        file_id = self._available_skill_file_id(skill)
-        payload, mime_type = self._load_tool_file_bytes(tenant_id=tenant_id, file_id=file_id)
-        return ConfigDownload(filename=f"{skill.name}.zip", mime_type=mime_type or "application/zip", payload=payload)
+        try:
+            skill = self._require_skill(target.agent_soul, name=name)
+            file_id = self._available_skill_file_id(skill)
+            payload, mime_type = self._load_tool_file_bytes(tenant_id=tenant_id, file_id=file_id)
+            return ConfigDownload(
+                filename=f"{skill.name}.zip",
+                mime_type=mime_type or "application/zip",
+                payload=payload,
+            )
+        except AgentConfigServiceError as exc:
+            if exc.code != "config_skill_not_found":
+                raise
+        try:
+            result = SkillManagementService().pull_runtime_agent_skill(
+                tenant_id=tenant_id,
+                agent_id=agent_id,
+                name=name,
+            )
+            return ConfigDownload(filename=result.filename, mime_type=result.mime_type, payload=result.payload)
+        except SkillManagementServiceError as exc:
+            raise AgentConfigServiceError("config_skill_not_found", "config skill not found", status_code=404) from exc
 
     def download_skill_url(
         self,
@@ -279,9 +299,45 @@ class AgentConfigService:
             config_version_kind=config_version_kind,
             user_id=user_id,
         )
-        skill = self._require_skill(target.agent_soul, name=name)
-        file_id = self._available_skill_file_id(skill)
-        archive_bytes, _mime_type = self._load_tool_file_bytes(tenant_id=tenant_id, file_id=file_id)
+        try:
+            skill = self._require_skill(target.agent_soul, name=name)
+            file_id = self._available_skill_file_id(skill)
+            archive_bytes, _mime_type = self._load_tool_file_bytes(tenant_id=tenant_id, file_id=file_id)
+            skill_item = self._serialize_skill_item(skill)
+        except AgentConfigServiceError as exc:
+            if exc.code != "config_skill_not_found":
+                raise
+            try:
+                workspace_archive = SkillManagementService().pull_runtime_agent_skill(
+                    tenant_id=tenant_id,
+                    agent_id=agent_id,
+                    name=name,
+                )
+            except SkillManagementServiceError as skill_exc:
+                raise AgentConfigServiceError(
+                    "config_skill_not_found",
+                    "config skill not found",
+                    status_code=404,
+                ) from skill_exc
+            archive_bytes = workspace_archive.payload
+            skill_item = next(
+                (
+                    item
+                    for item in SkillManagementService().list_runtime_agent_skills(
+                        tenant_id=tenant_id,
+                        agent_id=agent_id,
+                    )
+                    if item["name"] == name
+                ),
+                {
+                    "id": name,
+                    "name": name,
+                    "description": "",
+                    "size": None,
+                    "hash": None,
+                    "mime_type": "application/zip",
+                },
+            )
         try:
             archive_items, skill_md = self._inspect_skill_archive(archive_bytes)
         except (OSError, ValueError, zipfile.BadZipFile) as exc:
@@ -291,7 +347,7 @@ class AgentConfigService:
                 status_code=500,
             ) from exc
         return {
-            **self._serialize_skill_item(skill),
+            **skill_item,
             "source": "config_skill_zip",
             "files": archive_items,
             "skill_md": skill_md,
@@ -839,6 +895,7 @@ class AgentConfigService:
                 status_code=404,
             )
         return AgentConfigTarget(
+            tenant_id=tenant_id,
             agent_id=agent_id,
             version_id=version.id,
             kind=config_version_kind,
@@ -1133,9 +1190,7 @@ class AgentConfigService:
         return {
             "agent_id": target.agent_id,
             "config_version": AgentConfigService._config_version_payload(target),
-            "skills": {
-                "items": [AgentConfigService._serialize_skill_item(skill) for skill in target.agent_soul.config_skills]
-            },
+            "skills": {"items": AgentConfigService._skill_items_for_target(target)},
             "files": {
                 "items": [
                     AgentConfigService._serialize_file_item(file_ref) for file_ref in target.agent_soul.config_files
@@ -1145,6 +1200,20 @@ class AgentConfigService:
             "note": target.agent_soul.config_note,
         }
 
+    @staticmethod
+    def _skill_items_for_target(target: AgentConfigTarget) -> list[dict[str, object]]:
+        items = [AgentConfigService._serialize_skill_item(skill) for skill in target.agent_soul.config_skills]
+        seen_names = {str(item["name"]) for item in items}
+        for item in SkillManagementService().list_runtime_agent_skills(
+            tenant_id=target.tenant_id,
+            agent_id=target.agent_id,
+        ):
+            if item["name"] in seen_names:
+                continue
+            seen_names.add(str(item["name"]))
+            items.append(item)
+        return items
+
     @staticmethod
     def _config_version_payload(target: AgentConfigTarget) -> dict[str, object]:
         return {

api/services/entities/model_provider_entities.py

@@ -17,7 +17,6 @@ from core.entities.provider_entities import (
     QuotaConfiguration,
     UnaddedModelConfiguration,
 )
-from core.plugin.entities.plugin import PluginInstallationSource
 from graphon.model_runtime.entities.common_entities import I18nObject
 from graphon.model_runtime.entities.model_entities import (
     FetchFrom,
@@ -70,64 +69,6 @@ class SystemConfigurationResponse(BaseModel):
     quota_configurations: list[QuotaConfiguration] = []
 
 
-class ModelProviderCustomConfigurationSummaryResponse(BaseModel):
-    status: CustomConfigurationStatus
-    available_credentials: list[CredentialConfiguration]
-    current_credential_id: str | None = None
-    current_credential_name: str | None = None
-    current_credential_usable: bool
-
-
-class ModelProviderSystemConfigurationSummaryResponse(BaseModel):
-    enabled: bool
-
-
-class ModelProviderPluginSummaryResponse(BaseModel):
-    installation_id: str
-    plugin_id: str
-    plugin_unique_identifier: str
-    runtime_type: str
-    source: PluginInstallationSource
-    version: str
-
-
-class ModelProviderSummaryResponse(BaseModel):
-    """Fields required to render the collapsed model-provider list."""
-
-    tenant_id: str = Field(exclude=True)
-    provider: str
-    plugin_id: str
-    label: I18nObject
-    description: I18nObject | None = None
-    icon_small: I18nObject | None = None
-    icon_small_dark: I18nObject | None = None
-    supported_model_types: Sequence[ModelType]
-    configurate_methods: list[ConfigurateMethod]
-    preferred_provider_type: ProviderType
-    is_configured: bool
-    custom_configuration: ModelProviderCustomConfigurationSummaryResponse
-    system_configuration: ModelProviderSystemConfigurationSummaryResponse
-
-    model_config = ConfigDict(protected_namespaces=())
-
-    @model_validator(mode="after")
-    def build_icon_urls(self):
-        url_prefix = (
-            dify_config.CONSOLE_API_URL + f"/console/api/workspaces/{self.tenant_id}/model-providers/{self.provider}"
-        )
-        if self.icon_small is not None:
-            self.icon_small = I18nObject(
-                en_US=f"{url_prefix}/icon_small/en_US",
-                zh_Hans=f"{url_prefix}/icon_small/zh_Hans",
-            )
-        if self.icon_small_dark is not None:
-            self.icon_small_dark = I18nObject(
-                en_US=f"{url_prefix}/icon_small_dark/en_US",
-                zh_Hans=f"{url_prefix}/icon_small_dark/zh_Hans",
-            )
-        return self
-
-
 class ProviderResponse(BaseModel):
     """
     Model class for provider response.

api/services/model_provider_service.py

@@ -1,42 +1,18 @@
 import logging
-from collections import defaultdict
-from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, Any
 
-from sqlalchemy import and_, select
-
 if TYPE_CHECKING:
     from models.account import Account
 
-from configs import dify_config
-from core.db.session_factory import session_factory
 from core.entities.model_entities import ModelWithProviderEntity, ProviderModelWithStatusEntity
-from core.entities.provider_entities import CredentialConfiguration
-from core.helper.position_helper import is_filtered
-from core.plugin.entities.plugin import PluginInstallationSource
-from core.plugin.entities.plugin_daemon import PluginModelProviderBinding
 from core.plugin.impl.model_runtime_factory import create_plugin_model_provider_factory, create_plugin_provider_manager
-from core.plugin.plugin_service import PluginService
 from core.provider_manager import ProviderManager
-from extensions import ext_hosting_provider
 from graphon.model_runtime.entities.model_entities import ModelType, ParameterRule
-from models.provider import (
-    Provider,
-    ProviderCredential,
-    ProviderModel,
-    ProviderModelCredential,
-    ProviderType,
-    TenantPreferredModelProvider,
-)
-from models.provider_ids import ModelProviderID
+from models.provider import ProviderType
 from services.entities.model_provider_entities import (
     CustomConfigurationResponse,
     CustomConfigurationStatus,
     DefaultModelResponse,
-    ModelProviderCustomConfigurationSummaryResponse,
-    ModelProviderPluginSummaryResponse,
-    ModelProviderSummaryResponse,
-    ModelProviderSystemConfigurationSummaryResponse,
     ModelWithProviderEntityResponse,
     ProviderResponse,
     ProviderWithModelsResponse,
@@ -48,17 +24,6 @@ from services.errors.app_model_config import ProviderNotFoundError
 logger = logging.getLogger(__name__)
 
 
-@dataclass(slots=True)
-class _ProviderSummaryState:
-    has_custom_provider: bool = False
-    available_credentials: list[CredentialConfiguration] = field(default_factory=list)
-    has_custom_models: bool = False
-    current_credential_id: str | None = None
-    current_credential_name: str | None = None
-    current_credential_usable: bool = False
-    preferred_provider_type: ProviderType | None = None
-
-
 class ModelProviderService:
     """
     Model Provider Service
@@ -167,242 +132,6 @@ class ModelProviderService:
 
         return provider_responses
 
-    @staticmethod
-    def _load_provider_summary_states(tenant_id: str) -> dict[str, _ProviderSummaryState]:
-        """Load only the workspace columns required by the collapsed provider list."""
-        with session_factory.create_session() as session:
-            custom_provider_rows = session.execute(
-                select(
-                    Provider.provider_name,
-                    Provider.credential_id,
-                    ProviderCredential.provider_name.label("credential_provider_name"),
-                    ProviderCredential.credential_name,
-                )
-                .outerjoin(
-                    ProviderCredential,
-                    and_(
-                        ProviderCredential.id == Provider.credential_id,
-                        ProviderCredential.tenant_id == tenant_id,
-                    ),
-                )
-                .where(
-                    Provider.tenant_id == tenant_id,
-                    Provider.provider_type == ProviderType.CUSTOM,
-                    Provider.is_valid.is_(True),
-                )
-            ).all()
-            credential_rows = session.execute(
-                select(
-                    ProviderCredential.id,
-                    ProviderCredential.provider_name,
-                    ProviderCredential.credential_name,
-                )
-                .where(ProviderCredential.tenant_id == tenant_id)
-                .order_by(
-                    ProviderCredential.created_at.desc(),
-                    ProviderCredential.id.desc(),
-                )
-            ).all()
-            custom_model_rows = session.execute(
-                select(ProviderModel.provider_name.label("provider_name"))
-                .where(
-                    ProviderModel.tenant_id == tenant_id,
-                    ProviderModel.is_valid.is_(True),
-                )
-                .union(
-                    select(ProviderModelCredential.provider_name.label("provider_name")).where(
-                        ProviderModelCredential.tenant_id == tenant_id
-                    )
-                )
-            ).all()
-            preferred_provider_rows = session.execute(
-                select(
-                    TenantPreferredModelProvider.provider_name,
-                    TenantPreferredModelProvider.preferred_provider_type,
-                ).where(TenantPreferredModelProvider.tenant_id == tenant_id)
-            ).all()
-
-        states: defaultdict[str, _ProviderSummaryState] = defaultdict(_ProviderSummaryState)
-        for credential in credential_rows:
-            provider_name = str(ModelProviderID(credential.provider_name))
-            states[provider_name].available_credentials.append(
-                CredentialConfiguration(
-                    credential_id=credential.id,
-                    credential_name=credential.credential_name,
-                )
-            )
-
-        selected_provider_priorities: dict[str, bool] = {}
-        for provider in custom_provider_rows:
-            provider_name = str(ModelProviderID(provider.provider_name))
-            state = states[provider_name]
-            state.has_custom_provider = True
-
-            is_canonical_row = provider.provider_name == provider_name
-            if provider_name in selected_provider_priorities and not is_canonical_row:
-                continue
-            selected_provider_priorities[provider_name] = is_canonical_row
-            state.current_credential_id = provider.credential_id
-            if (
-                provider.credential_provider_name is not None
-                and str(ModelProviderID(provider.credential_provider_name)) == provider_name
-            ):
-                state.current_credential_name = provider.credential_name
-                state.current_credential_usable = True
-            else:
-                state.current_credential_name = None
-                state.current_credential_usable = False
-
-        for model in custom_model_rows:
-            states[str(ModelProviderID(model.provider_name))].has_custom_models = True
-
-        preferred_provider_priorities: dict[str, bool] = {}
-        for preferred_provider in preferred_provider_rows:
-            provider_name = str(ModelProviderID(preferred_provider.provider_name))
-            is_canonical_row = preferred_provider.provider_name == provider_name
-            if provider_name in preferred_provider_priorities and not is_canonical_row:
-                continue
-            preferred_provider_priorities[provider_name] = is_canonical_row
-            states[provider_name].preferred_provider_type = preferred_provider.preferred_provider_type
-
-        return dict(states)
-
-    @staticmethod
-    def _is_system_provider_enabled(provider: str) -> bool:
-        configuration = ext_hosting_provider.hosting_configuration.provider_map.get(provider)
-        return bool(configuration and configuration.enabled and configuration.quotas)
-
-    @staticmethod
-    def _select_binding(
-        current_binding: PluginModelProviderBinding | None,
-        candidate_binding: PluginModelProviderBinding,
-    ) -> PluginModelProviderBinding:
-        """Prefer a remote-debug runtime when one shadows an installed plugin."""
-        if current_binding is None:
-            return candidate_binding
-        if (
-            candidate_binding.source == PluginInstallationSource.Remote
-            and current_binding.source != PluginInstallationSource.Remote
-        ):
-            return candidate_binding
-        return current_binding
-
-    @staticmethod
-    def _get_preferred_provider_type(
-        state: _ProviderSummaryState,
-        *,
-        custom_present: bool,
-        system_enabled: bool,
-    ) -> ProviderType:
-        if state.preferred_provider_type is not None:
-            return state.preferred_provider_type
-        if dify_config.EDITION == "CLOUD" and system_enabled:
-            return ProviderType.SYSTEM
-        if custom_present:
-            return ProviderType.CUSTOM
-        if system_enabled:
-            return ProviderType.SYSTEM
-        return ProviderType.CUSTOM
-
-    def get_provider_summary_list(
-        self, tenant_id: str
-    ) -> tuple[list[ModelProviderSummaryResponse], dict[str, ModelProviderPluginSummaryResponse]]:
-        """Build the complete first-screen provider projection without assembling provider configurations."""
-        # Read bindings first: remote-debug identity changes invalidate provider metadata
-        # before the provider cache is consulted.
-        bindings = PluginService.list_model_provider_bindings(tenant_id)
-        provider_entities = PluginService.fetch_plugin_model_providers(tenant_id=tenant_id)
-        states = self._load_provider_summary_states(tenant_id)
-
-        bindings_by_provider: dict[str, PluginModelProviderBinding] = {}
-        for binding in bindings:
-            provider_name = (
-                str(ModelProviderID(binding.provider))
-                if binding.provider.count("/") == 2
-                else str(ModelProviderID(f"{binding.plugin_id}/{binding.provider}"))
-            )
-            bindings_by_provider[provider_name] = self._select_binding(
-                bindings_by_provider.get(provider_name),
-                binding,
-            )
-
-        provider_summaries: list[ModelProviderSummaryResponse] = []
-        emitted_provider_names: set[str] = set()
-        for provider_entity in provider_entities:
-            if is_filtered(
-                include_set=dify_config.POSITION_PROVIDER_INCLUDES_SET,
-                exclude_set=dify_config.POSITION_PROVIDER_EXCLUDES_SET,
-                data=provider_entity,
-                name_func=lambda provider: provider.provider,
-            ):
-                continue
-
-            provider_id = ModelProviderID(provider_entity.provider)
-            provider_name = str(provider_id)
-            if provider_name in emitted_provider_names:
-                continue
-            emitted_provider_names.add(provider_name)
-
-            state = states.get(provider_name, _ProviderSummaryState())
-            custom_configured = (
-                state.has_custom_provider and bool(state.available_credentials)
-            ) or state.has_custom_models
-            custom_present = state.has_custom_provider or state.has_custom_models
-            system_enabled = self._is_system_provider_enabled(provider_name)
-            preferred_provider_type = self._get_preferred_provider_type(
-                state,
-                custom_present=custom_present,
-                system_enabled=system_enabled,
-            )
-
-            provider_summaries.append(
-                ModelProviderSummaryResponse(
-                    tenant_id=tenant_id,
-                    provider=provider_name,
-                    plugin_id=provider_id.plugin_id,
-                    label=provider_entity.label,
-                    description=provider_entity.description,
-                    icon_small=provider_entity.icon_small,
-                    icon_small_dark=provider_entity.icon_small_dark,
-                    supported_model_types=provider_entity.supported_model_types,
-                    configurate_methods=provider_entity.configurate_methods,
-                    preferred_provider_type=preferred_provider_type,
-                    is_configured=custom_configured or system_enabled,
-                    custom_configuration=ModelProviderCustomConfigurationSummaryResponse(
-                        status=CustomConfigurationStatus.ACTIVE
-                        if custom_configured
-                        else CustomConfigurationStatus.NO_CONFIGURE,
-                        available_credentials=state.available_credentials,
-                        current_credential_id=state.current_credential_id,
-                        current_credential_name=state.current_credential_name,
-                        current_credential_usable=state.current_credential_usable,
-                    ),
-                    system_configuration=ModelProviderSystemConfigurationSummaryResponse(
-                        enabled=system_enabled,
-                    ),
-                )
-            )
-
-        plugin_bindings: dict[str, PluginModelProviderBinding] = {}
-        for binding in bindings_by_provider.values():
-            plugin_bindings[binding.plugin_id] = self._select_binding(
-                plugin_bindings.get(binding.plugin_id),
-                binding,
-            )
-
-        plugin_summaries = {
-            plugin_id: ModelProviderPluginSummaryResponse(
-                installation_id=binding.installation_id,
-                plugin_id=binding.plugin_id,
-                plugin_unique_identifier=binding.plugin_unique_identifier,
-                runtime_type=binding.runtime_type,
-                source=binding.source,
-                version=binding.version,
-            )
-            for plugin_id, binding in plugin_bindings.items()
-        }
-        return provider_summaries, plugin_summaries
-
     def get_models_by_provider(self, tenant_id: str, provider: str) -> list[ModelWithProviderEntityResponse]:
         """
         get provider models.

api/services/tag_service.py

@@ -12,6 +12,7 @@ from werkzeug.exceptions import NotFound
 from models.dataset import Dataset
 from models.enums import TagType
 from models.model import App, Tag, TagBinding
+from models.skill import Skill
 from models.snippet import CustomizedSnippet
 
 type _TagTypeLike = TagType | str
@@ -282,5 +283,13 @@ class TagService:
             )
             if not snippet:
                 raise NotFound("Snippet not found")
+        elif type == "skill":
+            skill = session.scalar(
+                select(Skill)
+                .where(Skill.tenant_id == current_user.current_tenant_id, Skill.id == target_id)
+                .limit(1)
+            )
+            if not skill:
+                raise NotFound("Skill not found")
         else:
             raise NotFound("Invalid binding type")

api/services/telemetry_service.py

@@ -1,165 +0,0 @@
-import logging
-import platform
-import uuid
-from datetime import datetime
-from typing import Literal
-
-import httpx
-from sqlalchemy import select
-from sqlalchemy.orm import Session
-
-from configs import dify_config
-from libs.datetime_utils import naive_utc_now
-from models.model import DifySetup
-
-logger = logging.getLogger(__name__)
-
-TelemetryEvent = Literal["install", "heartbeat"]
-
-SCHEMA_VERSION = 1
-
-
-class CommunityTelemetryService:
-    @classmethod
-    def report_install(cls, *, session: Session) -> bool:
-        setup = cls._get_setup(session)
-        if setup is None:
-            return False
-
-        if setup.instance_id is None:
-            setup.instance_id = str(uuid.uuid4())
-            session.add(setup)
-            session.commit()
-
-        payload = cls._build_payload(setup, "install")
-        if not cls._send_event(payload):
-            return False
-
-        setup.install_reported_at = naive_utc_now()
-        session.add(setup)
-        session.commit()
-        return True
-
-    @classmethod
-    def report_heartbeat(cls, *, session: Session, now: datetime | None = None) -> bool:
-        setup = cls._get_setup(session)
-        if setup is None:
-            return False
-
-        if setup.instance_id is None:
-            setup.instance_id = str(uuid.uuid4())
-            session.add(setup)
-            session.commit()
-
-        now = now or naive_utc_now()
-        if not cls._is_heartbeat_due(setup, now):
-            return False
-
-        if setup.install_reported_at is None:
-            cls.report_install(session=session)
-
-        payload = cls._build_payload(setup, "heartbeat")
-        if not cls._send_event(payload):
-            return False
-
-        setup.last_heartbeat_at = now
-        session.add(setup)
-        session.commit()
-        return True
-
-    @classmethod
-    def _get_setup(cls, session: Session) -> DifySetup | None:
-        return session.scalar(select(DifySetup).order_by(DifySetup.setup_at.asc()).limit(1))
-
-    @classmethod
-    def _is_enabled(cls) -> bool:
-        return (
-            dify_config.EDITION == "SELF_HOSTED"
-            and not dify_config.ENTERPRISE_ENABLED
-            and not dify_config.DISABLE_TELEMETRY
-            and not dify_config.DO_NOT_TRACK
-            and not dify_config.CI
-            and bool(dify_config.TELEMETRY_ENDPOINT)
-        )
-
-    @classmethod
-    def _build_payload(cls, setup: DifySetup, event: TelemetryEvent) -> dict[str, str | int]:
-        payload: dict[str, str | int] = {
-            "event": event,
-            "instance_id": setup.instance_id or "",
-            "version": setup.version if event == "install" else dify_config.project.version,
-            "edition": dify_config.EDITION,
-            "deployment_type": "unknown",
-            "schema_version": SCHEMA_VERSION,
-            "os": cls._normalize_os(platform.system()),
-            "arch": cls._normalize_arch(platform.machine()),
-            "sent_at": cls._format_datetime(naive_utc_now()),
-        }
-
-        if event == "install":
-            payload["installed_at"] = cls._format_datetime(setup.setup_at)
-
-        return payload
-
-    @classmethod
-    def _send_event(cls, payload: dict[str, str | int]) -> bool:
-        if not cls._is_enabled():
-            return False
-
-        endpoints = [dify_config.TELEMETRY_ENDPOINT]
-        if dify_config.TELEMETRY_FALLBACK_ENDPOINT not in endpoints:
-            endpoints.append(dify_config.TELEMETRY_FALLBACK_ENDPOINT)
-
-        for endpoint in endpoints:
-            if not endpoint:
-                continue
-
-            try:
-                response = httpx.post(
-                    endpoint,
-                    json=payload,
-                    timeout=dify_config.TELEMETRY_TIMEOUT_SECONDS,
-                )
-                response.raise_for_status()
-                return True
-            except httpx.RequestError:
-                logger.debug("Failed to send community telemetry event to %s", endpoint, exc_info=True)
-            except httpx.HTTPStatusError:
-                logger.debug("Community telemetry endpoint returned an error: %s", endpoint, exc_info=True)
-                return False
-
-        return False
-
-    @classmethod
-    def _is_heartbeat_due(cls, setup: DifySetup, now: datetime) -> bool:
-        if setup.instance_id is None:
-            return False
-
-        if setup.last_heartbeat_at is not None and setup.last_heartbeat_at.date() >= now.date():
-            return False
-
-        return True
-
-    @staticmethod
-    def _format_datetime(value: datetime) -> str:
-        return value.replace(microsecond=0).isoformat() + "Z"
-
-    @staticmethod
-    def _normalize_os(value: str) -> str:
-        os_name = value.lower()
-        if os_name in {"linux", "darwin", "windows"}:
-            return os_name
-        return "unknown"
-
-    @staticmethod
-    def _normalize_arch(value: str) -> str:
-        arch = value.lower()
-        if arch in {"x86_64", "amd64"}:
-            return "amd64"
-        if arch in {"aarch64", "arm64"}:
-            return "arm64"
-        if arch.startswith("arm"):
-            return "arm"
-        if arch in {"i386", "i686", "x86"}:
-            return "386"
-        return "unknown"

api/services/variable_truncator.py

@@ -278,14 +278,14 @@ class VariableTruncator(BaseTruncator):
         target_length = self._array_element_limit
 
         for i, item in enumerate(value):
-            # ``File`` is routed through ``_truncate_json_primitives`` (whose
-            # dedicated ``File`` branch returns the file as-is with its real
-            # serialized size). That preserves the count cap
-            # (``array_element_limit``) and the byte budget (``target_size``)
-            # for ``list[File]`` — the original "Dirty fix" branch above this
-            # loop bypassed both guarantees and reported ``used_size=2`` even
-            # when the returned array serialized to well over the budget.
-            # See https://github.com/langgenius/dify/issues/39218.
+            # Dirty fix:
+            # The output of `Start` node may contain list of `File` elements,
+            # causing `AssertionError` while invoking `_truncate_json_primitives`.
+            #
+            # This check ensures that `list[File]` are handled separately
+            if isinstance(item, File):
+                truncated_value.append(item)
+                continue
             if i >= target_length:
                 return _PartResult(truncated_value, used_size, True)
             if i > 0:
@@ -295,7 +295,7 @@ class VariableTruncator(BaseTruncator):
                 break
 
             remaining_budget = target_size - used_size
-            if item is None or isinstance(item, (str, list, dict, bool, int, float, File, UpdatedVariable)):
+            if item is None or isinstance(item, (str, list, dict, bool, int, float, UpdatedVariable)):
                 part_result = self._truncate_json_primitives(item, remaining_budget)
             else:
                 raise UnknownTypeError(f"got unknown type {type(item)} in array truncation")

api/services/webapp_auth_service.py

@@ -116,7 +116,7 @@ class WebAppAuthService:
 
     @classmethod
     def _get_account_jwt_token(cls, account: Account) -> str:
-        exp_dt = datetime.now(UTC) + timedelta(minutes=dify_config.ACCESS_TOKEN_EXPIRE_MINUTES)
+        exp_dt = datetime.now(UTC) + timedelta(minutes=dify_config.ACCESS_TOKEN_EXPIRE_MINUTES * 24)
         exp = int(exp_dt.timestamp())
 
         payload = {

api/services/workspace_service.py

@@ -27,6 +27,7 @@ class WorkspaceService:
         tenant_info: dict[str, object] = {
             "id": tenant.id,
             "name": tenant.name,
+            "plan": tenant.plan,
             "status": tenant.status,
             "created_at": tenant.created_at,
             "trial_end_reason": None,
@@ -43,7 +44,6 @@ class WorkspaceService:
         tenant_info["role"] = tenant_account_join.role
 
         feature = FeatureService.get_features(tenant.id, exclude_vector_space=True)
-        tenant_info["plan"] = feature.billing.subscription.plan if feature.billing.enabled else None
         can_replace_logo = feature.can_replace_logo
 
         if can_replace_logo and TenantService.has_roles(

api/tasks/app_generate/workflow_execute_task.py

@@ -457,7 +457,7 @@ def _publish_streaming_response(
 @shared_task(queue=WORKFLOW_BASED_APP_EXECUTION_QUEUE)
 def workflow_based_app_execution_task(
     payload: str,
-) -> Mapping[str, Any] | None:
+) -> Generator[Mapping[str, Any] | str, None, None] | Mapping[str, Any] | None:
     exec_params = AppExecutionParams.model_validate_json(payload)
 
     logger.info("workflow_based_app_execution_task run with params: %s", exec_params)

api/tasks/community_telemetry_task.py

@@ -1,19 +0,0 @@
-import logging
-
-from celery import shared_task
-from sqlalchemy.orm import sessionmaker
-
-from extensions.ext_database import db
-from services.telemetry_service import CommunityTelemetryService
-
-logger = logging.getLogger(__name__)
-
-
-@shared_task(name="community_telemetry.send_heartbeat", queue="schedule_executor")
-def send_community_telemetry_heartbeat() -> None:
-    session_factory = sessionmaker(bind=db.engine, expire_on_commit=False)
-    with session_factory() as session:
-        try:
-            CommunityTelemetryService.report_heartbeat(session=session)
-        except Exception:
-            logger.debug("Failed to process community telemetry heartbeat", exc_info=True)

api/tests/integration_tests/workflow/nodes/test_template_transform.py

@@ -17,11 +17,10 @@ class _SimpleJinja2Renderer:
     """Minimal Jinja2-based renderer for integration tests (no code executor)."""
 
     def render_template(self, template: str, variables: dict[str, object]) -> str:
-        from jinja2.sandbox import SandboxedEnvironment
+        from jinja2 import Template
 
         try:
-            env = SandboxedEnvironment()
-            return env.from_string(template).render(**variables)
+            return Template(template).render(**variables)
         except Exception as exc:
             raise TemplateRenderError(str(exc)) from exc
 

api/tests/test_containers_integration_tests/controllers/web/test_site.py

@@ -97,7 +97,6 @@ class TestAppSiteApi:
         assert result["end_user_id"] == end_user.id
         assert result["plan"] == "basic"
         assert result["enable_site"] is True
-        assert result["mode"] == AppMode.CHAT
 
     @patch("controllers.web.site.FileService.get_file_presigned_url")
     @patch("controllers.web.site.FeatureService.get_features")
@@ -179,7 +178,6 @@ class TestWebAppSiteResponse:
         response = WebAppSiteResponse.from_app_site(
             tenant=tenant,
             app_model=app_model,
-            mode=AppMode.CHAT,
             site=_site_model(app_id=app_model.id),
             end_user_id="eu-1",
             features=FeatureModel(can_replace_logo=False, webapp_copyright_enabled=True),
@@ -187,7 +185,6 @@ class TestWebAppSiteResponse:
         )
 
         assert response.app_id == app_model.id
-        assert response.mode == AppMode.CHAT
         assert response.end_user_id == "eu-1"
         assert response.enable_site is True
         assert response.plan == "basic"
@@ -212,7 +209,6 @@ class TestWebAppSiteResponse:
         response = WebAppSiteResponse.from_app_site(
             tenant=tenant,
             app_model=app_model,
-            mode=AppMode.CHAT,
             site=site,
             end_user_id=None,
             features=FeatureModel(can_replace_logo=False, webapp_copyright_enabled=True),
@@ -240,7 +236,6 @@ class TestWebAppSiteResponse:
         response = WebAppSiteResponse.from_app_site(
             tenant=tenant,
             app_model=app_model,
-            mode=AppMode.CHAT,
             site=_site_model(app_id=app_model.id),
             end_user_id="eu-1",
             features=FeatureModel(can_replace_logo=True, webapp_copyright_enabled=True),

api/tests/test_containers_integration_tests/services/test_workspace_service.py

@@ -24,10 +24,7 @@ class TestWorkspaceService:
             patch("services.workspace_service.dify_config") as mock_dify_config,
         ):
             # Setup default mock returns
-            feature = mock_feature_service.get_features.return_value
-            feature.can_replace_logo = True
-            feature.billing.enabled = True
-            feature.billing.subscription.plan = "professional"
+            mock_feature_service.get_features.return_value.can_replace_logo = True
             mock_tenant_service.has_roles.return_value = True
             mock_dify_config.FILES_URL = "https://example.com/files"
 
@@ -115,7 +112,7 @@ class TestWorkspaceService:
             assert result is not None
             assert result["id"] == tenant.id
             assert result["name"] == tenant.name
-            assert result["plan"] == "professional"
+            assert result["plan"] == tenant.plan
             assert result["status"] == tenant.status
             assert result["role"] == TenantAccountRole.OWNER
             assert result["created_at"] == tenant.created_at
@@ -162,7 +159,7 @@ class TestWorkspaceService:
             assert result is not None
             assert result["id"] == tenant.id
             assert result["name"] == tenant.name
-            assert result["plan"] == "professional"
+            assert result["plan"] == tenant.plan
             assert result["status"] == tenant.status
             assert result["role"] == TenantAccountRole.OWNER
             assert result["created_at"] == tenant.created_at
@@ -217,7 +214,7 @@ class TestWorkspaceService:
             assert result is not None
             assert result["id"] == tenant.id
             assert result["name"] == tenant.name
-            assert result["plan"] == "professional"
+            assert result["plan"] == tenant.plan
             assert result["status"] == tenant.status
             assert result["role"] == TenantAccountRole.NORMAL
             assert result["created_at"] == tenant.created_at
@@ -609,23 +606,20 @@ class TestWorkspaceService:
     def test_get_tenant_info_should_not_include_cloud_fields_in_self_hosted(
         self, db_session_with_containers: Session, mock_external_service_dependencies
     ):
-        """Cloud-only billing data should not appear in SELF_HOSTED mode."""
+        """next_credit_reset_date and trial_credits should NOT appear in SELF_HOSTED mode."""
         fake = Faker()
         account, tenant = self._create_test_account_and_tenant(
             db_session_with_containers, mock_external_service_dependencies
         )
 
         mock_external_service_dependencies["dify_config"].DEPLOYMENT_EDITION = DeploymentEdition.COMMUNITY
-        feature = mock_external_service_dependencies["feature_service"].get_features.return_value
-        feature.can_replace_logo = False
-        feature.billing.enabled = False
+        mock_external_service_dependencies["feature_service"].get_features.return_value.can_replace_logo = False
         mock_external_service_dependencies["tenant_service"].has_roles.return_value = False
 
         with patch("services.workspace_service.current_user", account):
             result = WorkspaceService.get_tenant_info(tenant, db_session_with_containers)
 
         assert result is not None
-        assert result["plan"] is None
         assert "next_credit_reset_date" not in result
         assert "trial_credits" not in result
         assert "trial_credits_used" not in result

api/tests/unit_tests/controllers/console/agent/test_agent_controllers.py

@@ -115,7 +115,6 @@ def _agent_app_composer_response() -> dict:
             "active_config_snapshot_id": "version-1",
         },
         "active_config_snapshot": _version_response(),
-        "active_config_is_published": True,
         "agent_soul": {},
         "save_options": ["save_to_current_version"],
     }
@@ -377,7 +376,7 @@ def test_agent_app_list_and_create_use_agent_route(
     assert created["app_id"] == "app-created"
     assert created["debug_conversation_id"] == "debug-conversation-created"
     assert created["role"] == "Created role"
-    assert "active_config_is_published" not in created
+    assert created["active_config_is_published"] is False
     assert "bound_agent_id" not in created
     create_call = cast(dict[str, object], captured["create"])
     create_params = cast(Any, create_call["params"])
@@ -488,7 +487,7 @@ def test_agent_app_detail_update_delete_resolve_app_from_agent_id(
     assert detail["debug_conversation_has_messages"] is True
     assert detail["debug_conversation_message_count"] == 2
     assert detail["role"] == "Resolved role"
-    assert "active_config_is_published" not in detail
+    assert detail["active_config_is_published"] is False
     assert "bound_agent_id" not in detail
     assert captured["get_app"] == {"app": app_model, "session": session}
     with app.test_request_context(
@@ -503,7 +502,7 @@ def test_agent_app_detail_update_delete_resolve_app_from_agent_id(
     assert updated["debug_conversation_has_messages"] is True
     assert updated["debug_conversation_message_count"] == 2
     assert updated["role"] == "Resolved role"
-    assert "active_config_is_published" not in updated
+    assert updated["active_config_is_published"] is False
     assert "bound_agent_id" not in updated
     update_call = cast(dict[str, object], captured["update"])
     assert update_call["app"] is app_model
@@ -846,6 +845,9 @@ def test_agent_app_update_allows_empty_role(app: Flask, monkeypatch: pytest.Monk
     monkeypatch.setattr(
         roster_controller.AgentRosterService, "count_agent_app_debug_conversation_messages", lambda _self, **kwargs: 0
     )
+    monkeypatch.setattr(
+        roster_controller.AgentRosterService, "active_config_is_published", lambda _self, **kwargs: False
+    )
     monkeypatch.setattr(
         roster_controller.FeatureService,
         "get_system_features",
@@ -1297,14 +1299,13 @@ def test_agent_composer_routes_resolve_app_from_agent_id(
         composer_controller.AgentComposerService, "collect_validation_findings", collect_validation_findings
     )
     monkeypatch.setattr(composer_controller.AgentComposerService, "get_agent_app_candidates", get_agent_app_candidates)
-    composer = unwrap(AgentComposerApi.get)(AgentComposerApi(), MagicMock(), "tenant-1", agent_id)
-    assert composer["variant"] == "agent_app"
-    assert composer["active_config_is_published"] is True
+    assert unwrap(AgentComposerApi.get)(AgentComposerApi(), MagicMock(), "tenant-1", agent_id)["variant"] == "agent_app"
     assert cast(dict[str, object], captured["load"])["agent_id"] == agent_id
     with app.test_request_context(json=payload):
-        saved_composer = unwrap(AgentComposerApi.put)(AgentComposerApi(), MagicMock(), "tenant-1", account_id, agent_id)
-        assert saved_composer["variant"] == "agent_app"
-        assert saved_composer["active_config_is_published"] is True
+        assert (
+            unwrap(AgentComposerApi.put)(AgentComposerApi(), MagicMock(), "tenant-1", account_id, agent_id)["variant"]
+            == "agent_app"
+        )
         assert cast(dict[str, object], captured["save"])["agent_id"] == agent_id
         assert unwrap(AgentComposerValidateApi.post)(AgentComposerValidateApi(), MagicMock(), "tenant-1", agent_id) == {
             "result": "success",

api/tests/unit_tests/controllers/console/workspace/test_model_providers.py

@@ -15,11 +15,9 @@ from controllers.console.workspace.model_providers import (
     ModelProviderIconApi,
     ModelProviderListApi,
     ModelProviderPaymentCheckoutUrlApi,
-    ModelProviderSummaryListApi,
     ModelProviderValidateApi,
     PreferredProviderTypeUpdateApi,
 )
-from core.entities.provider_entities import CredentialConfiguration
 from graphon.model_runtime.entities.common_entities import I18nObject
 from graphon.model_runtime.entities.model_entities import ModelType
 from graphon.model_runtime.entities.provider_entities import ConfigurateMethod
@@ -29,10 +27,6 @@ from models.provider import ProviderType
 from services.entities.model_provider_entities import (
     CustomConfigurationResponse,
     CustomConfigurationStatus,
-    ModelProviderCustomConfigurationSummaryResponse,
-    ModelProviderPluginSummaryResponse,
-    ModelProviderSummaryResponse,
-    ModelProviderSystemConfigurationSummaryResponse,
     ProviderResponse,
     SystemConfigurationResponse,
 )
@@ -146,80 +140,6 @@ class TestModelProviderListApi:
         assert result == {"data": []}
 
 
-class TestModelProviderSummaryListApi:
-    def test_get_success(self, app: Flask):
-        api = ModelProviderSummaryListApi()
-        method = unwrap(api.get)
-        provider = ModelProviderSummaryResponse(
-            tenant_id="tenant1",
-            provider="langgenius/openai/openai",
-            plugin_id="langgenius/openai",
-            label=I18nObject(en_US="OpenAI"),
-            description=I18nObject(en_US="OpenAI models"),
-            icon_small=I18nObject(en_US="icon.svg"),
-            icon_small_dark=None,
-            supported_model_types=[ModelType.LLM],
-            configurate_methods=[ConfigurateMethod.PREDEFINED_MODEL],
-            preferred_provider_type=ProviderType.CUSTOM,
-            is_configured=True,
-            custom_configuration=ModelProviderCustomConfigurationSummaryResponse(
-                status=CustomConfigurationStatus.ACTIVE,
-                available_credentials=[
-                    CredentialConfiguration(
-                        credential_id=VALID_UUID,
-                        credential_name="production",
-                    ),
-                    CredentialConfiguration(
-                        credential_id="223e4567-e89b-12d3-a456-426614174000",
-                        credential_name="backup",
-                    ),
-                ],
-                current_credential_id=VALID_UUID,
-                current_credential_name="production",
-                current_credential_usable=True,
-            ),
-            system_configuration=ModelProviderSystemConfigurationSummaryResponse(enabled=False),
-        )
-        plugin = ModelProviderPluginSummaryResponse(
-            installation_id="installation-1",
-            plugin_id="langgenius/openai",
-            plugin_unique_identifier="langgenius/openai:1.0.0@checksum",
-            runtime_type="local",
-            source="marketplace",
-            version="1.0.0",
-        )
-
-        with (
-            app.test_request_context("/"),
-            patch(
-                "controllers.console.workspace.model_providers.ModelProviderService.get_provider_summary_list",
-                return_value=([provider], {"langgenius/openai": plugin}),
-            ) as get_provider_summary_list,
-        ):
-            result = method(api, "tenant1")
-
-        get_provider_summary_list.assert_called_once_with(tenant_id="tenant1")
-        assert result["data"][0]["provider"] == "langgenius/openai/openai"
-        assert "tenant_id" not in result["data"][0]
-        assert result["data"][0]["custom_configuration"] == {
-            "status": "active",
-            "available_credentials": [
-                {
-                    "credential_id": VALID_UUID,
-                    "credential_name": "production",
-                },
-                {
-                    "credential_id": "223e4567-e89b-12d3-a456-426614174000",
-                    "credential_name": "backup",
-                },
-            ],
-            "current_credential_id": VALID_UUID,
-            "current_credential_name": "production",
-            "current_credential_usable": True,
-        }
-        assert result["plugins"]["langgenius/openai"]["installation_id"] == "installation-1"
-
-
 class TestModelProviderCredentialApi:
     def test_get_success(self, app: Flask):
         api = ModelProviderCredentialApi()

api/tests/unit_tests/controllers/console/workspace/test_plugin.py

@@ -28,7 +28,6 @@ from controllers.console.workspace.plugin import (
     PluginFetchMarketplacePkgApi,
     PluginFetchPermissionApi,
     PluginIconApi,
-    PluginInstalledIdsApi,
     PluginInstallFromGithubApi,
     PluginInstallFromMarketplaceApi,
     PluginInstallFromPkgApi,
@@ -42,16 +41,12 @@ from controllers.console.workspace.plugin import (
     PluginUploadFromBundleApi,
     PluginUploadFromGithubApi,
     PluginUploadFromPkgApi,
-    _list_hardcoded_builtin_tool_providers,
 )
 from core.plugin.entities.parameters import PluginParameterOption
-from core.plugin.entities.plugin import PluginCategory, PluginDeclaration, PluginEntity, PluginInstallation
+from core.plugin.entities.plugin import PluginDeclaration, PluginEntity, PluginInstallation
 from core.plugin.entities.plugin_daemon import PluginInstallTask
 from core.plugin.impl.exc import PluginDaemonClientSideError
 from core.plugin.plugin_service import PluginService
-from core.tools.entities.api_entities import ToolProviderApiEntity
-from core.tools.entities.common_entities import I18nObject
-from core.tools.entities.tool_entities import ToolProviderType
 from models.account import (
     Account,
     TenantAccountRole,
@@ -450,7 +445,7 @@ class TestPluginCategoryListApi:
         mock_list = MagicMock(list=[plugin_item], has_more=True)
 
         with (
-            app.test_request_context("/?page=2&page_size=10&query=weather&tags=search&tags=rag&language=zh_Hans"),
+            app.test_request_context("/?page=2&page_size=10"),
             patch(
                 "controllers.console.workspace.plugin.PluginService.list_by_category", return_value=mock_list
             ) as list_mock,
@@ -461,75 +456,18 @@ class TestPluginCategoryListApi:
         ):
             result = method(api, "t1", "tool")
 
-        list_mock.assert_called_once_with(
-            "t1",
-            "tool",
-            2,
-            10,
-            query="weather",
-            tags=["search", "rag"],
-            language="zh_Hans",
-        )
+        list_mock.assert_called_once()
+        assert list_mock.call_args.args[0] == "t1"
+        assert list_mock.call_args.args[1] == "tool"
+        assert list_mock.call_args.args[2] == 2
+        assert list_mock.call_args.args[3] == 10
         assert result["plugins"][0]["id"] == "entity-1"
         assert result["plugins"][0]["plugin_unique_identifier"] == "test-author/test-plugin:1.0.0@checksum"
         assert result["builtin_tools"][0]["id"] == "builtin"
         assert result["builtin_tools"][0]["type"] == "builtin"
         assert result["has_more"] is True
         assert "total" not in result
-        builtin_mock.assert_called_once_with(
-            "t1",
-            query="weather",
-            tags=["search", "rag"],
-            language="zh_Hans",
-        )
-
-    def test_builtin_tool_providers_use_the_category_list_filters(self):
-        search_provider = ToolProviderApiEntity(
-            id="search-provider",
-            author="dify",
-            name="search-provider",
-            description=I18nObject(en_US="Search provider", zh_Hans="搜索工具"),
-            icon="icon.svg",
-            label=I18nObject(en_US="Search", zh_Hans="搜索"),
-            type=ToolProviderType.BUILT_IN,
-            labels=["search"],
-        )
-        rag_provider = ToolProviderApiEntity(
-            id="rag-provider",
-            author="dify",
-            name="rag-provider",
-            description=I18nObject(en_US="RAG provider", zh_Hans="知识库工具"),
-            icon="icon.svg",
-            label=I18nObject(en_US="RAG", zh_Hans="知识库"),
-            type=ToolProviderType.BUILT_IN,
-            labels=["rag"],
-        )
-
-        with (
-            patch("controllers.console.workspace.plugin.ToolManager.list_default_builtin_providers", return_value=[]),
-            patch(
-                "controllers.console.workspace.plugin.ToolManager.list_hardcoded_providers",
-                return_value=[MagicMock(), MagicMock()],
-            ),
-            patch("controllers.console.workspace.plugin.is_filtered", return_value=False),
-            patch(
-                "controllers.console.workspace.plugin.ToolTransformService.builtin_provider_to_user_provider",
-                side_effect=[search_provider, rag_provider],
-            ),
-            patch("controllers.console.workspace.plugin.ToolTransformService.repack_provider"),
-            patch(
-                "controllers.console.workspace.plugin.BuiltinToolProviderSort.sort",
-                side_effect=lambda providers: providers,
-            ),
-        ):
-            result = _list_hardcoded_builtin_tool_providers(
-                "t1",
-                query="搜索",
-                tags=["search", "weather"],
-                language="zh_Hans",
-            )
-
-        assert [provider["id"] for provider in result] == ["search-provider"]
+        builtin_mock.assert_called_once_with("t1")
 
     def test_non_tool_category_does_not_include_builtin_tools(self, app: Flask):
         api = PluginCategoryListApi()
@@ -792,39 +730,6 @@ class TestPluginListInstallationsFromIdsApi:
             assert result == ({"code": "plugin_error", "message": "error"}, 400)
 
 
-class TestPluginInstalledIdsApi:
-    def test_success(self, app: Flask):
-        api = PluginInstalledIdsApi()
-        method = unwrap(api.get)
-
-        with (
-            app.test_request_context("/?category=tool"),
-            patch(
-                "controllers.console.workspace.plugin.PluginService.list_installed_plugin_ids",
-                return_value=["langgenius/openai", "langgenius/anthropic"],
-            ) as list_installed_plugin_ids,
-        ):
-            result = method(api, "t1")
-
-        assert result == {"plugin_ids": ["langgenius/openai", "langgenius/anthropic"]}
-        list_installed_plugin_ids.assert_called_once_with("t1", PluginCategory.Tool)
-
-    def test_daemon_error(self, app: Flask):
-        api = PluginInstalledIdsApi()
-        method = unwrap(api.get)
-
-        with (
-            app.test_request_context("/?category=tool"),
-            patch(
-                "controllers.console.workspace.plugin.PluginService.list_installed_plugin_ids",
-                side_effect=PluginDaemonClientSideError("error"),
-            ),
-        ):
-            result = method(api, "t1")
-
-        assert result == ({"code": "plugin_error", "message": "error"}, 400)
-
-
 class TestPluginUploadFromGithubApi:
     def test_success(self, app: Flask, user):
         api = PluginUploadFromGithubApi()

api/tests/unit_tests/controllers/console/workspace/test_skills.py

@@ -0,0 +1,394 @@
+from __future__ import annotations
+
+from inspect import unwrap
+from unittest.mock import MagicMock, PropertyMock, patch
+
+import pytest
+from flask import Flask
+
+from controllers.console import console_ns
+from controllers.console.workspace.skills import (
+    WorkspaceAgentSkillBindingsApi,
+    WorkspaceSkillAssistMessageApi,
+    WorkspaceSkillFilesApi,
+    WorkspaceSkillsApi,
+    WorkspaceSkillTagsApi,
+    WorkspaceSkillVersionApi,
+)
+from models.account import Account
+from services.skill_management_service import SkillAssistAttachmentPayload, SkillManagementServiceError
+
+
+@pytest.fixture
+def app() -> Flask:
+    flask_app = Flask("test_workspace_skills")
+    flask_app.config["TESTING"] = True
+    return flask_app
+
+
+@pytest.fixture
+def current_user() -> Account:
+    user = Account(name="Test User", email="[email protected]")
+    user.id = "user-1"
+    return user
+
+
+def _skill_detail() -> dict:
+    return {
+        "id": "skill-1",
+        "name": "finance-sop",
+        "display_name": "Finance SOP",
+        "icon": "📄",
+        "description": "",
+        "tags": [],
+        "name_manually_edited": False,
+        "visibility": "workspace",
+        "latest_published_version_id": None,
+        "reference_count": 0,
+        "created_by": "user-1",
+        "created_by_name": "Test User",
+        "updated_by": "user-1",
+        "updated_by_name": "Test User",
+        "created_at": 1,
+        "updated_at": 1,
+        "files": [
+            {
+                "id": "file-1",
+                "path": "SKILL.md",
+                "kind": "file",
+                "storage": "text",
+                "mime_type": "text/markdown",
+                "content": "---\nname: finance-sop\n---\n# Body",
+                "tool_file_id": None,
+                "size": 32,
+                "hash": "hash",
+            }
+        ],
+    }
+
+
+def test_create_skill_validates_payload_and_returns_detail(app: Flask, current_user: Account) -> None:
+    api = WorkspaceSkillsApi()
+    method = unwrap(api.post)
+    service = MagicMock()
+    service.create_skill.return_value = _skill_detail()
+
+    with (
+        app.test_request_context("/", method="POST"),
+        patch.object(type(console_ns), "payload", new_callable=PropertyMock, return_value={}),
+        patch("controllers.console.workspace.skills.SkillManagementService", return_value=service),
+    ):
+        payload, status = method(api, "tenant-1", current_user)
+
+    assert status == 201
+    assert payload["id"] == "skill-1"
+    assert payload["files"][0]["path"] == "SKILL.md"
+    service.create_skill.assert_called_once()
+    assert service.create_skill.call_args.kwargs["tenant_id"] == "tenant-1"
+    assert service.create_skill.call_args.kwargs["user_id"] == "user-1"
+
+
+def test_list_skills_uses_default_pagination_when_query_omits_page_and_limit(app: Flask) -> None:
+    api = WorkspaceSkillsApi()
+    method = unwrap(api.get)
+    service = MagicMock()
+    service.list_skills.return_value = {
+        "data": [],
+        "has_more": False,
+        "limit": 20,
+        "page": 1,
+        "total": 0,
+    }
+
+    with (
+        app.test_request_context("/?keyword=finance&tag=ops&tag=", method="GET"),
+        patch("controllers.console.workspace.skills.SkillManagementService", return_value=service),
+    ):
+        payload = method(api, "tenant-1")
+
+    assert payload == {
+        "data": [],
+        "has_more": False,
+        "limit": 20,
+        "page": 1,
+        "total": 0,
+    }
+    service.list_skills.assert_called_once_with(
+        tenant_id="tenant-1",
+        keyword="finance",
+        page=1,
+        limit=20,
+        tags=["ops"],
+    )
+
+
+def test_get_agent_skill_bindings_returns_card_data(app: Flask) -> None:
+    api = WorkspaceAgentSkillBindingsApi()
+    method = unwrap(api.get)
+    service = MagicMock()
+    service.list_agent_bindings.return_value = {
+        "agent_id": "agent-1",
+        "skill_ids": ["skill-1"],
+        "data": [
+            {
+                "id": "skill-1",
+                "priority": 0,
+                "name": "finance-sop",
+                "display_name": "Finance SOP",
+                "icon": "📄",
+                "description": "Handle finance.",
+                "tags": ["Finance"],
+                "status": "published",
+                "file_count": 2,
+                "latest_published_version_id": "version-1",
+                "latest_published_at": 123,
+                "updated_at": 124,
+            }
+        ],
+    }
+
+    with (
+        app.test_request_context("/", method="GET"),
+        patch("controllers.console.workspace.skills.SkillManagementService", return_value=service),
+    ):
+        payload = method(api, "tenant-1", "agent-1")
+
+    assert payload["skill_ids"] == ["skill-1"]
+    assert payload["data"][0]["display_name"] == "Finance SOP"
+    assert payload["data"][0]["file_count"] == 2
+    service.list_agent_bindings.assert_called_once_with(tenant_id="tenant-1", agent_id="agent-1")
+
+
+def test_patch_skill_file_operation_validates_payload_and_returns_detail(app: Flask, current_user: Account) -> None:
+    api = WorkspaceSkillFilesApi()
+    method = unwrap(api.patch)
+    service = MagicMock()
+    service.apply_draft_file_operation.return_value = _skill_detail()
+    request_payload = {
+        "operation": "upsert_text",
+        "path": "references/policy.md",
+        "content": "Policy",
+    }
+
+    with (
+        app.test_request_context("/", method="PATCH"),
+        patch.object(type(console_ns), "payload", new_callable=PropertyMock, return_value=request_payload),
+        patch("controllers.console.workspace.skills.SkillManagementService", return_value=service),
+    ):
+        payload = method(api, "tenant-1", current_user, "skill-1")
+
+    assert payload["id"] == "skill-1"
+    service.apply_draft_file_operation.assert_called_once()
+    call = service.apply_draft_file_operation.call_args.kwargs
+    assert call["tenant_id"] == "tenant-1"
+    assert call["user_id"] == "user-1"
+    assert call["skill_id"] == "skill-1"
+    assert call["payload"].operation == "upsert_text"
+
+
+def test_patch_skill_file_operation_returns_error_details(app: Flask, current_user: Account) -> None:
+    api = WorkspaceSkillFilesApi()
+    method = unwrap(api.patch)
+    service = MagicMock()
+    service.apply_draft_file_operation.side_effect = SkillManagementServiceError(
+        "missing_skill_name",
+        "SKILL.md frontmatter name is required",
+        details={"path": "SKILL.md", "field": "name", "line": 2},
+    )
+
+    with (
+        app.test_request_context("/", method="PATCH"),
+        patch.object(
+            type(console_ns),
+            "payload",
+            new_callable=PropertyMock,
+            return_value={"operation": "delete", "path": "SKILL.md"},
+        ),
+        patch("controllers.console.workspace.skills.SkillManagementService", return_value=service),
+    ):
+        payload, status = method(api, "tenant-1", current_user, "skill-1")
+
+    assert status == 400
+    assert payload == {
+        "code": "missing_skill_name",
+        "message": "SKILL.md frontmatter name is required",
+        "details": {"path": "SKILL.md", "field": "name", "line": 2},
+    }
+
+
+def test_list_skill_tags_returns_filter_options(app: Flask) -> None:
+    api = WorkspaceSkillTagsApi()
+    method = unwrap(api.get)
+    service = MagicMock()
+    service.list_tags.return_value = {"data": [{"tag": "finance", "count": 2}]}
+
+    with (
+        app.test_request_context("/", method="GET"),
+        patch("controllers.console.workspace.skills.SkillManagementService", return_value=service),
+    ):
+        payload = method(api, "tenant-1")
+
+    assert payload == {"data": [{"tag": "finance", "count": 2}]}
+    service.list_tags.assert_called_once_with(tenant_id="tenant-1")
+
+
+def test_get_skill_version_returns_version_detail(app: Flask) -> None:
+    api = WorkspaceSkillVersionApi()
+    method = unwrap(api.get)
+    service = MagicMock()
+    service.get_version.return_value = {
+        "id": "version-1",
+        "skill_id": "skill-1",
+        "version_number": 1,
+        "version_name": "Initial finance policy",
+        "publish_note": "Initial finance policy",
+        "hash_code": "hash-code",
+        "archive_size": 123,
+        "published_by": "user-1",
+        "published_by_name": "Li Wei",
+        "is_latest": True,
+        "created_at": 1,
+        "files": [
+            {
+                "id": None,
+                "path": "SKILL.md",
+                "kind": "file",
+                "storage": "text",
+                "mime_type": "text/markdown",
+                "content": "# Version",
+                "tool_file_id": None,
+                "size": 9,
+                "hash": "file-hash",
+            }
+        ],
+    }
+
+    with (
+        app.test_request_context("/", method="GET"),
+        patch("controllers.console.workspace.skills.SkillManagementService", return_value=service),
+    ):
+        payload = method(api, "tenant-1", "skill-1", "version-1")
+
+    assert payload["files"][0]["content"] == "# Version"
+    service.get_version.assert_called_once_with(
+        tenant_id="tenant-1",
+        skill_id="skill-1",
+        version_id="version-1",
+    )
+
+
+def test_patch_skill_version_renames_version(app: Flask) -> None:
+    api = WorkspaceSkillVersionApi()
+    method = unwrap(api.patch)
+    service = MagicMock()
+    service.update_version.return_value = {
+        "id": "version-1",
+        "skill_id": "skill-1",
+        "version_number": 1,
+        "version_name": "Approval threshold",
+        "publish_note": "",
+        "hash_code": "hash-code",
+        "archive_size": 123,
+        "published_by": "user-1",
+        "published_by_name": "Li Wei",
+        "is_latest": True,
+        "created_at": 1,
+    }
+
+    with (
+        app.test_request_context("/", method="PATCH"),
+        patch.object(
+            type(console_ns),
+            "payload",
+            new_callable=PropertyMock,
+            return_value={"version_name": "Approval threshold"},
+        ),
+        patch("controllers.console.workspace.skills.SkillManagementService", return_value=service),
+    ):
+        payload = method(api, "tenant-1", "skill-1", "version-1")
+
+    assert payload["version_name"] == "Approval threshold"
+    service.update_version.assert_called_once()
+    assert service.update_version.call_args.kwargs["payload"].version_name == "Approval threshold"
+
+
+def test_delete_skill_version_returns_new_latest(app: Flask, current_user: Account) -> None:
+    api = WorkspaceSkillVersionApi()
+    method = unwrap(api.delete)
+    service = MagicMock()
+    service.delete_version.return_value = {
+        "id": "version-2",
+        "deleted": True,
+        "latest_published_version_id": "version-1",
+    }
+
+    with (
+        app.test_request_context("/", method="DELETE"),
+        patch("controllers.console.workspace.skills.SkillManagementService", return_value=service),
+    ):
+        payload = method(api, "tenant-1", current_user, "skill-1", "version-2")
+
+    assert payload == {"id": "version-2", "deleted": True, "latest_published_version_id": "version-1"}
+    service.delete_version.assert_called_once_with(
+        tenant_id="tenant-1",
+        user_id="user-1",
+        skill_id="skill-1",
+        version_id="version-2",
+    )
+
+
+def test_skill_assistant_runs_agent_app_stream(app: Flask, current_user: Account) -> None:
+    api = WorkspaceSkillAssistMessageApi()
+    method = unwrap(api.post)
+    service = MagicMock()
+    assistant_app = MagicMock()
+    assistant_app.id = "assistant-app-1"
+    service.get_or_create_assistant_app.return_value = (assistant_app, "<skill_draft>draft</skill_draft>")
+    app_model = MagicMock()
+    app_response = MagicMock()
+    compact_response = MagicMock()
+
+    with (
+        app.test_request_context("/", method="POST"),
+        patch.object(
+            type(console_ns),
+            "payload",
+            new_callable=PropertyMock,
+            return_value={
+                "attachments": [
+                    {
+                        "tool_file_id": "tool-file-1",
+                        "name": "requirements.md",
+                        "mime_type": "text/markdown",
+                        "size": 128,
+                    }
+                ],
+                "message": "Create an approval checklist.",
+            },
+        ),
+        patch("controllers.console.workspace.skills.SkillManagementService", return_value=service),
+        patch(
+            "controllers.console.workspace.skills.db.session",
+            return_value=MagicMock(get=MagicMock(return_value=app_model)),
+        ),
+        patch("controllers.console.workspace.skills.AppGenerateService.generate", return_value=app_response),
+        patch("controllers.console.workspace.skills.helper.compact_generate_response", return_value=compact_response),
+    ):
+        response = method(api, "tenant-1", current_user, "skill-1")
+
+    assert response is compact_response
+    service.get_or_create_assistant_app.assert_called_once_with(
+        tenant_id="tenant-1",
+        skill_id="skill-1",
+        user_id="user-1",
+        attachments=[
+            SkillAssistAttachmentPayload(
+                tool_file_id="tool-file-1",
+                name="requirements.md",
+                mime_type="text/markdown",
+                size=128,
+            )
+        ],
+        message="Create an approval checklist.",
+        model_payload=None,
+    )

api/tests/unit_tests/controllers/inner_api/workspace/test_plugin_model_providers.py

@@ -1,64 +0,0 @@
-import inspect
-from unittest.mock import call, patch
-
-import pytest
-from flask import Flask
-from pydantic import ValidationError
-
-from controllers.inner_api.workspace.plugin_model_providers import (
-    EnterprisePluginModelProvidersCacheInvalidate,
-    InvalidatePluginModelProvidersCachePayload,
-)
-
-
-class TestInvalidatePluginModelProvidersCachePayload:
-    def test_valid_payload(self):
-        payload = InvalidatePluginModelProvidersCachePayload.model_validate(
-            {"tenant_ids": ["tenant-alpha", "tenant-beta"]}
-        )
-        assert payload.tenant_ids == ["tenant-alpha", "tenant-beta"]
-
-    def test_missing_tenant_ids_defaults_to_empty(self):
-        payload = InvalidatePluginModelProvidersCachePayload.model_validate({})
-        assert payload.tenant_ids == []
-
-    def test_unknown_field_rejected(self):
-        with pytest.raises(ValidationError):
-            InvalidatePluginModelProvidersCachePayload.model_validate({"tenant_ids": ["tenant-alpha"], "generation": 7})
-
-
-class TestEnterprisePluginModelProvidersCacheInvalidate:
-    @pytest.fixture
-    def api_instance(self):
-        return EnterprisePluginModelProvidersCacheInvalidate()
-
-    def _post(self, api_instance, app: Flask, payload):
-        unwrapped_post = inspect.unwrap(api_instance.post)
-        with app.test_request_context():
-            with patch("controllers.inner_api.workspace.plugin_model_providers.inner_api_ns") as mock_ns:
-                mock_ns.payload = payload
-                return unwrapped_post(api_instance)
-
-    @patch("controllers.inner_api.workspace.plugin_model_providers.PluginService")
-    def test_post_invalidates_once_per_tenant(self, mock_plugin_service, api_instance, app: Flask):
-        result = self._post(api_instance, app, {"tenant_ids": ["tenant-alpha", "tenant-beta"]})
-
-        assert result == ({"result": "success"}, 200)
-        assert mock_plugin_service.invalidate_plugin_model_providers_cache.call_args_list == [
-            call("tenant-alpha"),
-            call("tenant-beta"),
-        ]
-
-    @patch("controllers.inner_api.workspace.plugin_model_providers.PluginService")
-    def test_post_with_empty_list_is_a_no_op(self, mock_plugin_service, api_instance, app: Flask):
-        result = self._post(api_instance, app, {"tenant_ids": []})
-
-        assert result == ({"result": "success"}, 200)
-        mock_plugin_service.invalidate_plugin_model_providers_cache.assert_not_called()
-
-    @patch("controllers.inner_api.workspace.plugin_model_providers.PluginService")
-    def test_post_with_missing_payload_is_a_no_op(self, mock_plugin_service, api_instance, app: Flask):
-        result = self._post(api_instance, app, None)
-
-        assert result == ({"result": "success"}, 200)
-        mock_plugin_service.invalidate_plugin_model_providers_cache.assert_not_called()

api/tests/unit_tests/controllers/test_swagger.py

@@ -634,11 +634,6 @@ def test_console_plugin_category_list_exported_schema_uses_typed_items(tmp_path)
     console_openapi_path = next(path for path in written_paths if path.name == "console-openapi.json")
     payload = json.loads(console_openapi_path.read_text(encoding="utf-8"))
     operation = payload["paths"]["/workspaces/current/plugin/{category}/list"]["get"]
-    parameters = {parameter["name"]: parameter for parameter in operation["parameters"]}
-    assert parameters["query"]["in"] == "query"
-    assert parameters["tags"]["in"] == "query"
-    assert parameters["tags"]["schema"]["type"] == "array"
-    assert parameters["language"]["in"] == "query"
     response_ref = operation["responses"]["200"]["content"]["application/json"]["schema"]["$ref"].removeprefix(
         "#/components/schemas/"
     )
@@ -666,112 +661,3 @@ def test_console_plugin_category_list_exported_schema_uses_typed_items(tmp_path)
     builtin_tool_schema = schemas["PluginCategoryBuiltinToolProviderResponse"]
     for field in ("plugin_unique_identifier", "team_credentials", "type", "tools"):
         assert field in builtin_tool_schema["properties"]
-
-
-def test_console_installed_plugin_ids_exported_schema_is_lightweight(tmp_path):
-    from dev.generate_swagger_specs import generate_specs
-
-    written_paths = generate_specs(tmp_path)
-    console_openapi_path = next(path for path in written_paths if path.name == "console-openapi.json")
-    payload = json.loads(console_openapi_path.read_text(encoding="utf-8"))
-    operation = payload["paths"]["/workspaces/current/plugin/installed-ids"]["get"]
-    parameters = {parameter["name"]: parameter for parameter in operation["parameters"]}
-    assert parameters["category"]["in"] == "query"
-    assert parameters["category"]["required"] is True
-    assert parameters["category"]["schema"]["enum"] == [
-        "agent-strategy",
-        "datasource",
-        "extension",
-        "model",
-        "tool",
-        "trigger",
-    ]
-    response_ref = operation["responses"]["200"]["content"]["application/json"]["schema"]["$ref"].removeprefix(
-        "#/components/schemas/"
-    )
-    response_schema = payload["components"]["schemas"][response_ref]
-
-    assert response_schema["required"] == ["plugin_ids"]
-    assert response_schema["properties"] == {
-        "plugin_ids": {
-            "items": {"type": "string"},
-            "title": "Plugin Ids",
-            "type": "array",
-        }
-    }
-
-
-def test_console_model_provider_summary_exported_schema_is_lightweight(tmp_path):
-    from dev.generate_swagger_specs import generate_specs
-
-    written_paths = generate_specs(tmp_path)
-    console_openapi_path = next(path for path in written_paths if path.name == "console-openapi.json")
-    payload = json.loads(console_openapi_path.read_text(encoding="utf-8"))
-    operation = payload["paths"]["/workspaces/current/model-providers/summary"]["get"]
-    assert operation.get("parameters", []) == []
-
-    response_ref = operation["responses"]["200"]["content"]["application/json"]["schema"]["$ref"].removeprefix(
-        "#/components/schemas/"
-    )
-    response_schema = payload["components"]["schemas"][response_ref]
-    assert response_schema["required"] == ["data", "plugins"]
-    assert response_schema["properties"]["data"]["items"]["$ref"] == (
-        "#/components/schemas/ModelProviderSummaryResponse"
-    )
-    assert response_schema["properties"]["plugins"]["additionalProperties"]["$ref"] == (
-        "#/components/schemas/ModelProviderPluginSummaryResponse"
-    )
-
-    provider_properties = payload["components"]["schemas"]["ModelProviderSummaryResponse"]["properties"]
-    assert set(provider_properties) == {
-        "configurate_methods",
-        "custom_configuration",
-        "description",
-        "icon_small",
-        "icon_small_dark",
-        "is_configured",
-        "label",
-        "plugin_id",
-        "preferred_provider_type",
-        "provider",
-        "supported_model_types",
-        "system_configuration",
-    }
-    assert "provider_credential_schema" not in provider_properties
-    assert "model_credential_schema" not in provider_properties
-
-    custom_configuration_schema = payload["components"]["schemas"]["ModelProviderCustomConfigurationSummaryResponse"]
-    custom_configuration_properties = custom_configuration_schema["properties"]
-    assert set(custom_configuration_schema["required"]) == {
-        "available_credentials",
-        "current_credential_usable",
-        "status",
-    }
-    assert set(custom_configuration_properties) == {
-        "available_credentials",
-        "current_credential_id",
-        "current_credential_name",
-        "current_credential_usable",
-        "status",
-    }
-    assert custom_configuration_properties["available_credentials"]["items"]["$ref"] == (
-        "#/components/schemas/CredentialConfiguration"
-    )
-    assert "has_credentials" not in custom_configuration_properties
-
-    credential_properties = payload["components"]["schemas"]["CredentialConfiguration"]["properties"]
-    assert set(credential_properties) == {
-        "credential_id",
-        "credential_name",
-    }
-    assert "encrypted_config" not in credential_properties
-
-    plugin_properties = payload["components"]["schemas"]["ModelProviderPluginSummaryResponse"]["properties"]
-    assert set(plugin_properties) == {
-        "installation_id",
-        "plugin_id",
-        "plugin_unique_identifier",
-        "runtime_type",
-        "source",
-        "version",
-    }

api/tests/unit_tests/controllers/web/test_human_input_form.py

@@ -163,7 +163,6 @@ def test_get_form_includes_site(monkeypatch: pytest.MonkeyPatch, app: Flask, dat
     assert body["expiration_time"] == int(expiration_time.timestamp())
     assert body["site"] == {
         "app_id": app_model.id,
-        "mode": "chat",
         "end_user_id": None,
         "enable_site": True,
         "site": {
@@ -384,7 +383,6 @@ def test_get_form_allows_backstage_token(monkeypatch: pytest.MonkeyPatch, app: F
     assert body["expiration_time"] == int(expiration_time.timestamp())
     assert body["site"] == {
         "app_id": app_model.id,
-        "mode": "chat",
         "end_user_id": None,
         "enable_site": True,
         "site": {

api/tests/unit_tests/controllers/web/test_site.py

@@ -3,42 +3,7 @@ from unittest.mock import MagicMock, patch
 from configs import dify_config
 from controllers.web import site as site_module
 from extensions.storage.storage_type import StorageType
-from models.model import AppMode, IconType, Site
-from services.feature_service import FeatureModel
-
-
-def test_app_site_api_returns_legacy_agent_compatible_mode() -> None:
-    app_model = MagicMock()
-    app_model.id = "app-id"
-    app_model.tenant_id = "tenant-id"
-    app_model.tenant = MagicMock(id="tenant-id", status="normal")
-    app_model.mode_compatible_with_agent_with_session.return_value = AppMode.AGENT_CHAT
-    end_user = MagicMock(id="end-user-id")
-    site = MagicMock(spec=Site)
-    response = MagicMock()
-    response.model_dump.return_value = {"mode": AppMode.AGENT_CHAT}
-
-    with (
-        patch.object(site_module, "db") as mock_db,
-        patch.object(site_module.FeatureService, "get_features", return_value=FeatureModel(can_replace_logo=False)),
-        patch.object(site_module, "_build_site_icon_url", return_value=None),
-        patch.object(site_module.WebAppSiteResponse, "from_app_site", return_value=response) as mock_from_app_site,
-    ):
-        mock_db.session.scalar.return_value = site
-        result = site_module.AppSiteApi().get(app_model, end_user)
-
-    assert result["mode"] == AppMode.AGENT_CHAT
-    app_model.mode_compatible_with_agent_with_session.assert_called_once_with(session=mock_db.session())
-    mock_from_app_site.assert_called_once_with(
-        tenant=app_model.tenant,
-        app_model=app_model,
-        mode=AppMode.AGENT_CHAT,
-        site=site,
-        end_user_id=end_user.id,
-        features=FeatureModel(can_replace_logo=False),
-        can_replace_logo=False,
-        icon_url=None,
-    )
+from models.model import IconType, Site
 
 
 def test_build_site_icon_url_uses_s3_presigned_url() -> None:

api/tests/unit_tests/core/app/apps/advanced_chat/test_app_generator.py

@@ -442,13 +442,6 @@ class TestAdvancedChatAppGeneratorInternals:
             def start(self):
                 thread_data["started"] = True
 
-            def join(self, timeout):
-                thread_data["joined"] = True
-                thread_data["join_timeout"] = timeout
-
-            def is_alive(self):
-                return False
-
         monkeypatch.setattr("core.app.apps.advanced_chat.app_generator.threading.Thread", _Thread)
         monkeypatch.setattr(
             "core.app.apps.advanced_chat.app_generator.db", SimpleNamespace(engine=object(), session=db_session)
@@ -482,8 +475,6 @@ class TestAdvancedChatAppGeneratorInternals:
 
         assert response["response"] == {"raw": True}
         assert thread_data["started"] is True
-        assert thread_data["joined"] is True
-        assert thread_data["join_timeout"] == 300
         assert "pause-layer" in thread_data["kwargs"]["graph_engine_layers"]
         assert generator._dialogue_count == 3
         assert init_records.call_args.kwargs["session"] is db_session
@@ -551,13 +542,6 @@ class TestAdvancedChatAppGeneratorInternals:
             def start(self):
                 thread_data["started"] = True
 
-            def join(self, timeout):
-                thread_data["joined"] = True
-                thread_data["join_timeout"] = timeout
-
-            def is_alive(self):
-                return False
-
         monkeypatch.setattr("core.app.apps.advanced_chat.app_generator.threading.Thread", _Thread)
         monkeypatch.setattr(
             "core.app.apps.advanced_chat.app_generator.db", SimpleNamespace(engine=object(), session=db_session)
@@ -590,8 +574,6 @@ class TestAdvancedChatAppGeneratorInternals:
         init_records.assert_not_called()
         get_thread_messages_length.assert_called_once_with(conversation.id, session=db_session)
         assert thread_data["started"] is True
-        assert thread_data["joined"] is True
-        assert thread_data["join_timeout"] == 300
         db_session.commit.assert_not_called()
         db_session.refresh.assert_not_called()
         db_session.close.assert_called_once()

api/tests/unit_tests/core/app/apps/agent_app/test_runtime_request_builder.py

@@ -7,6 +7,7 @@ from types import SimpleNamespace
 from typing import Any
 
 import pytest
+from dify_agent.layers.config import DifyConfigSkillConfig
 from dify_agent.layers.dify_core_tools import DifyCoreToolConfig, DifyCoreToolsLayerConfig
 from dify_agent.layers.dify_plugin import DifyPluginToolConfig, DifyPluginToolsLayerConfig
 from dify_agent.layers.execution_context import DifyExecutionContextLayerConfig
@@ -29,6 +30,14 @@ from core.app.entities.app_invoke_entities import InvokeFrom, UserFrom
 from models.agent_config_entities import AgentSoulConfig
 
 
+@pytest.fixture(autouse=True)
+def _no_runtime_agent_skills(monkeypatch: pytest.MonkeyPatch):
+    monkeypatch.setattr(
+        "core.app.apps.agent_app.runtime_request_builder.load_runtime_agent_skill_configs",
+        lambda *, tenant_id, agent_id: [],
+    )
+
+
 def _exec_ctx() -> DifyExecutionContextLayerConfig:
     return DifyExecutionContextLayerConfig(
         tenant_id="tenant-1",
@@ -514,6 +523,33 @@ class TestAgentAppConfigLayer:
             "mentioned_file_names": [],
         }
 
+    def test_config_layer_includes_bound_workspace_skills(self, monkeypatch: pytest.MonkeyPatch):
+        monkeypatch.setattr(
+            "core.app.apps.agent_app.runtime_request_builder.load_runtime_agent_skill_configs",
+            lambda *, tenant_id, agent_id: [
+                DifyConfigSkillConfig(
+                    name="workspace-skill",
+                    description="Bound workspace skill.",
+                    size=123,
+                    mime_type="application/zip",
+                )
+            ],
+        )
+        soul = _soul_with_model()
+        soul.prompt.system_prompt = "Use [§skill:workspace-skill:Workspace Skill§]."
+        builder = AgentAppRuntimeRequestBuilder(
+            credentials_provider=_FakeCredentialsProvider(),
+            dify_tools_builder=_NoToolsBuilder(),  # type: ignore[arg-type]
+        )
+
+        result = builder.build(_ctx(soul))
+
+        config = next(layer for layer in result.request.composition.layers if layer.name == DIFY_CONFIG_LAYER_ID)
+        assert [skill.name for skill in config.config.skills] == ["workspace-skill"]
+        assert config.config.mentioned_skill_names == ["workspace-skill"]
+        prompt_layer = next(layer for layer in result.request.composition.layers if layer.name == "agent_soul_prompt")
+        assert prompt_layer.config.prefix == "Use workspace-skill."
+
     @pytest.mark.parametrize(
         ("system_prompt", "expected_prefix"),
         [

api/tests/unit_tests/core/app/apps/pipeline/test_pipeline_generator.py

@@ -435,7 +435,6 @@ def test_generate_success_returns_converted(generator, mocker: MockerFixture):
     mocker.patch.object(module, "PipelineQueueManager", return_value=queue_manager)
 
     worker_thread = MagicMock()
-    worker_thread.is_alive.return_value = False
     mocker.patch.object(module.threading, "Thread", return_value=worker_thread)
 
     mocker.patch.object(generator, "_get_draft_var_saver_factory", return_value=MagicMock())
@@ -462,7 +461,6 @@ def test_generate_success_returns_converted(generator, mocker: MockerFixture):
     )
 
     assert result == "converted"
-    worker_thread.join.assert_called_once_with(timeout=300)
 
 
 def test_single_iteration_generate_validates_inputs(generator, mocker: MockerFixture):

api/tests/unit_tests/core/app/apps/test_base_app_generator.py

@@ -1,6 +1,3 @@
-import logging
-from unittest.mock import Mock
-
 import pytest
 
 from core.app.apps.base_app_generator import BaseAppGenerator
@@ -372,58 +369,6 @@ def test_validate_inputs_optional_file_with_empty_string_ignores_default():
 
 
 class TestBaseAppGeneratorExtras:
-    def test_wrap_stream_joins_worker_after_stream_exhaustion(self):
-        base_app_generator = BaseAppGenerator()
-        worker_thread = Mock()
-        worker_thread.is_alive.return_value = False
-
-        def response_stream():
-            yield {"event": "workflow_finished"}
-
-        managed_stream = base_app_generator._wrap_stream_with_worker_thread_join(
-            response_stream(),
-            worker_thread,
-        )
-
-        assert next(managed_stream) == {"event": "workflow_finished"}
-        worker_thread.join.assert_not_called()
-
-        with pytest.raises(StopIteration):
-            next(managed_stream)
-
-        worker_thread.join.assert_called_once_with(timeout=300)
-
-    def test_wrap_stream_joins_worker_when_stream_closes(self):
-        base_app_generator = BaseAppGenerator()
-        worker_thread = Mock()
-        worker_thread.is_alive.return_value = False
-
-        def response_stream():
-            yield {"event": "workflow_started"}
-            yield {"event": "workflow_finished"}
-
-        managed_stream = base_app_generator._wrap_stream_with_worker_thread_join(
-            response_stream(),
-            worker_thread,
-        )
-
-        assert next(managed_stream) == {"event": "workflow_started"}
-        managed_stream.close()
-
-        worker_thread.join.assert_called_once_with(timeout=300)
-
-    def test_join_worker_thread_warns_when_thread_remains_alive(self, caplog: pytest.LogCaptureFixture):
-        worker_thread = Mock()
-        worker_thread.name = "leaked-app-worker"
-        worker_thread.is_alive.return_value = True
-
-        with caplog.at_level(logging.WARNING, logger="core.app.apps.base_app_generator"):
-            BaseAppGenerator._join_worker_thread(worker_thread)
-
-        worker_thread.join.assert_called_once_with(timeout=300)
-        assert "Possible app worker thread leak" in caplog.text
-        assert "leaked-app-worker" in caplog.text
-
     def test_prepare_user_inputs_converts_files_and_lists(self, monkeypatch: pytest.MonkeyPatch):
         base_app_generator = BaseAppGenerator()
 

api/tests/unit_tests/core/app/apps/test_workflow_app_generator.py

@@ -211,13 +211,6 @@ def test_generate_appends_pause_layer_and_forwards_state(mocker: MockerFixture):
         def start(self):
             return None
 
-        def join(self, timeout):
-            worker_kwargs["joined"] = True
-            worker_kwargs["join_timeout"] = timeout
-
-        def is_alive(self):
-            return False
-
     mocker.patch("core.app.apps.workflow.app_generator.threading.Thread", DummyThread)
 
     app_model = SimpleNamespace(mode="workflow", tenant_id="tenant")
@@ -251,8 +244,6 @@ def test_generate_appends_pause_layer_and_forwards_state(mocker: MockerFixture):
     assert result == "converted"
     assert worker_kwargs["kwargs"]["graph_engine_layers"] == ("base-layer", pause_layer)
     assert worker_kwargs["kwargs"]["graph_runtime_state"] is graph_runtime_state
-    assert worker_kwargs["joined"] is True
-    assert worker_kwargs["join_timeout"] == 300
     assert draft_saver_factory.call_args.kwargs["tenant_id"] == app_model.tenant_id
 
 
@@ -295,8 +286,6 @@ def test_resume_path_runs_worker_with_runtime_state(mocker: MockerFixture):
 
     mocker.patch("core.app.apps.workflow.app_generator.WorkflowAppRunner", side_effect=runner_ctor)
 
-    worker_lifecycle: dict[str, bool] = {}
-
     class ImmediateThread:
         def __init__(self, target, kwargs):
             target(**kwargs)
@@ -304,13 +293,6 @@ def test_resume_path_runs_worker_with_runtime_state(mocker: MockerFixture):
         def start(self):
             return None
 
-        def join(self, timeout):
-            worker_lifecycle["joined"] = True
-            worker_lifecycle["join_timeout"] = timeout
-
-        def is_alive(self):
-            return False
-
     mocker.patch("core.app.apps.workflow.app_generator.threading.Thread", ImmediateThread)
 
     mocker.patch(
@@ -349,7 +331,5 @@ def test_resume_path_runs_worker_with_runtime_state(mocker: MockerFixture):
     )
 
     assert result == "raw-response"
-    assert worker_lifecycle["joined"] is True
-    assert worker_lifecycle["join_timeout"] == 300
     runner_instance.run.assert_called_once()
     queue_manager.graph_runtime_state = runtime_state

api/tests/unit_tests/core/app/apps/workflow/test_active_workflow_tasks.py

@@ -1,9 +1,5 @@
-import threading
-from collections.abc import Generator
-
 import pytest
 
-from core.app.apps.base_app_generator import BaseAppGenerator
 from core.app.apps.workflow.active_workflow_tasks import (
     active_workflow_task,
     get_active_workflow_task_count,
@@ -32,51 +28,3 @@ def test_active_workflow_task_rejects_duplicate_task_id() -> None:
         with pytest.raises(ValueError, match="already active"):
             with active_workflow_task("task-a"):
                 pass
-
-
-def test_managed_stream_waits_for_active_worker_cleanup() -> None:
-    worker_started = threading.Event()
-    release_worker = threading.Event()
-    stream_exhausted = threading.Event()
-    consumer_finished = threading.Event()
-    consumer_errors: list[BaseException] = []
-
-    def run_worker() -> None:
-        with active_workflow_task("task-a"):
-            worker_started.set()
-            release_worker.wait()
-
-    def response_stream() -> Generator[dict[str, str], None, None]:
-        yield {"event": "workflow_finished"}
-        stream_exhausted.set()
-
-    worker_thread = threading.Thread(target=run_worker)
-    worker_thread.start()
-    assert worker_started.wait(timeout=2)
-
-    managed_stream = BaseAppGenerator._wrap_stream_with_worker_thread_join(response_stream(), worker_thread)
-    assert next(managed_stream) == {"event": "workflow_finished"}
-
-    def finish_stream() -> None:
-        try:
-            list(managed_stream)
-        except BaseException as exc:
-            consumer_errors.append(exc)
-        finally:
-            consumer_finished.set()
-
-    consumer_thread = threading.Thread(target=finish_stream)
-    consumer_thread.start()
-    try:
-        assert stream_exhausted.wait(timeout=2)
-        assert not consumer_finished.is_set()
-        assert get_active_workflow_task_count() == 1
-    finally:
-        release_worker.set()
-        consumer_thread.join(timeout=2)
-        worker_thread.join(timeout=2)
-
-    assert not consumer_thread.is_alive()
-    assert not worker_thread.is_alive()
-    assert consumer_errors == []
-    assert get_active_workflow_task_count() == 0

api/tests/unit_tests/core/app/apps/workflow/test_app_generator_extra.py

@@ -15,70 +15,6 @@ from models.model import AppMode
 
 
 class TestWorkflowAppGeneratorValidation:
-    def test_generate_stream_joins_worker_after_response_exhaustion(self, monkeypatch: pytest.MonkeyPatch):
-        generator = WorkflowAppGenerator()
-        worker_thread = Mock()
-        worker_thread.is_alive.return_value = False
-        app_config = WorkflowUIBasedAppConfig(
-            tenant_id="tenant",
-            app_id="app",
-            app_mode=AppMode.WORKFLOW,
-            additional_features=AppAdditionalFeatures(),
-            variables=[],
-            workflow_id="workflow-id",
-        )
-        application_generate_entity = WorkflowAppGenerateEntity.model_construct(
-            task_id="task",
-            app_config=app_config,
-            inputs={},
-            files=[],
-            user_id="user",
-            stream=True,
-            invoke_from=InvokeFrom.WEB_APP,
-            extras={},
-        )
-
-        def response_stream():
-            yield {"event": "workflow_finished"}
-
-        monkeypatch.setattr(generator, "_bind_file_access_scope", lambda **kwargs: contextlib.nullcontext())
-        monkeypatch.setattr(
-            "core.app.apps.workflow.app_generator.WorkflowAppQueueManager",
-            lambda **kwargs: SimpleNamespace(**kwargs),
-        )
-        monkeypatch.setattr(
-            "core.app.apps.workflow.app_generator.current_app",
-            SimpleNamespace(_get_current_object=lambda: SimpleNamespace(name="flask")),
-        )
-        monkeypatch.setattr("core.app.apps.workflow.app_generator.contextvars.copy_context", lambda: "ctx")
-        monkeypatch.setattr("core.app.apps.workflow.app_generator.threading.Thread", lambda **kwargs: worker_thread)
-        monkeypatch.setattr(
-            "core.app.apps.workflow.app_generator.db",
-            SimpleNamespace(session=SimpleNamespace(close=Mock())),
-        )
-        monkeypatch.setattr(generator, "_get_draft_var_saver_factory", lambda *args, **kwargs: "draft-factory")
-        monkeypatch.setattr(generator, "_handle_response", lambda **kwargs: response_stream())
-        monkeypatch.setattr(
-            "core.app.apps.workflow.app_generator.WorkflowAppGenerateResponseConverter.convert",
-            lambda response, invoke_from: response,
-        )
-
-        managed_stream = generator._generate(
-            app_model=SimpleNamespace(mode=AppMode.WORKFLOW, tenant_id="tenant"),
-            workflow=SimpleNamespace(id="workflow-id"),
-            user=SimpleNamespace(id="user"),
-            application_generate_entity=application_generate_entity,
-            invoke_from=InvokeFrom.WEB_APP,
-            workflow_execution_repository=SimpleNamespace(),
-            workflow_node_execution_repository=SimpleNamespace(),
-            streaming=True,
-        )
-
-        worker_thread.start.assert_called_once_with()
-        worker_thread.join.assert_not_called()
-        assert list(managed_stream) == [{"event": "workflow_finished"}]
-        worker_thread.join.assert_called_once_with(timeout=300)
-
     def test_ensure_snippet_start_node_returns_original_for_non_snippet_workflow(self):
         workflow = SimpleNamespace(kind_or_standard="workflow")
         session = SimpleNamespace(scalar=Mock())

api/tests/unit_tests/core/helper/code_executor/jinja2/test_jinja2_sandbox.py

@@ -1,67 +0,0 @@
-"""Verify that Jinja2 transform_caller scripts block unsafe template attacks via SandboxedEnvironment."""
-
-import io
-import sys
-
-import pytest
-
-from core.helper.code_executor.jinja2.jinja2_transformer import Jinja2TemplateTransformer
-
-MALICIOUS_TEMPLATES = [
-    pytest.param(
-        "{{ lipsum.__globals__.__builtins__.__import__('os').popen('id').read() }}",
-        id="lipsum_globals_builtins",
-    ),
-    pytest.param(
-        "{{ ''.__class__.__mro__[1].__subclasses__() }}",
-        id="string_class_mro",
-    ),
-    pytest.param(
-        "{{ cycler.__init__.__globals__.os.popen('whoami').read() }}",
-        id="cycler_init_globals",
-    ),
-    pytest.param(
-        "{{ namespace.__init__.__globals__['__builtins__']['__import__']('os').system('id') }}",
-        id="namespace_init_globals",
-    ),
-]
-
-
-def _exec_scripts(runner: str, preload: str) -> str:
-    """Execute preload then runner in a shared namespace, return captured stdout."""
-    ns: dict = {}
-    exec(compile(preload, "<preload>", "exec"), ns)  # noqa: S102
-    captured = io.StringIO()
-    old_stdout = sys.stdout
-    sys.stdout = captured
-    try:
-        exec(compile(runner, "<runner>", "exec"), ns)  # noqa: S102
-    finally:
-        sys.stdout = old_stdout
-    return captured.getvalue()
-
-
-class TestJinja2TransformCallerSandbox:
-    """Test transform_caller output (runner + preload) blocks attacks and allows safe templates."""
-
-    @pytest.mark.parametrize("malicious_template", MALICIOUS_TEMPLATES)
-    def test_blocks_unsafe_template(self, malicious_template: str) -> None:
-        runner, preload = Jinja2TemplateTransformer.transform_caller(malicious_template, {})
-        ns: dict = {}
-        exec(compile(preload, "<preload>", "exec"), ns)  # noqa: S102
-        with pytest.raises(Exception) as exc_info:
-            exec(compile(runner, "<runner>", "exec"), ns)  # noqa: S102
-        assert "unsafe" in str(exc_info.value).lower() or "security" in str(exc_info.value).lower()
-
-    def test_renders_safe_template(self) -> None:
-        runner, preload = Jinja2TemplateTransformer.transform_caller(
-            "Hello {{ name }}, you are {{ age }} years old!",
-            {"name": "Alice", "age": 30},
-        )
-        output = _exec_scripts(runner, preload)
-        assert "Hello Alice, you are 30 years old!" in output
-
-    def test_scripts_use_sandboxed_environment(self) -> None:
-        runner, preload = Jinja2TemplateTransformer.transform_caller("{{ x }}", {"x": 1})
-        assert "SandboxedEnvironment" in runner
-        assert "SandboxedEnvironment" in preload

api/tests/unit_tests/core/plugin/impl/test_model_client.py

@@ -28,19 +28,6 @@ class TestPluginModelClient:
         )
         assert request_mock.call_args.kwargs["params"] == {"page": 1, "page_size": 256}
 
-    def test_fetch_model_provider_bindings(self, mocker: MockerFixture):
-        client = PluginModelClient()
-        request_mock = mocker.patch.object(client, "_request_with_plugin_daemon_response", return_value=["binding-a"])
-
-        result = client.fetch_model_provider_bindings("tenant-1")
-
-        assert result == ["binding-a"]
-        assert request_mock.call_args.args[:2] == (
-            "GET",
-            "plugin/tenant-1/management/models/bindings",
-        )
-        assert "params" not in request_mock.call_args.kwargs
-
     def test_get_model_schema(self, mocker: MockerFixture):
         client = PluginModelClient()
         schema = SimpleNamespace(name="schema")

api/tests/unit_tests/core/plugin/test_plugin_manager.py

@@ -29,7 +29,6 @@ from core.plugin.entities.plugin import (
 )
 from core.plugin.entities.plugin_daemon import (
     PluginDecodeResponse,
-    PluginInstalledIdsDaemonResponse,
     PluginInstallTask,
     PluginInstallTaskStartResponse,
     PluginInstallTaskStatus,
@@ -133,13 +132,7 @@ class TestPluginDiscovery:
             plugin_installer, "_request_with_plugin_daemon_response", return_value=mock_response
         ) as mock_request:
             result = plugin_installer.list_plugins_by_category(
-                "test-tenant",
-                category=PluginCategory.Tool,
-                page=2,
-                page_size=10,
-                query="weather",
-                tags=["search", "rag"],
-                language="zh_Hans",
+                "test-tenant", category=PluginCategory.Tool, page=2, page_size=10
             )
 
             mock_request.assert_called_once()
@@ -148,9 +141,6 @@ class TestPluginDiscovery:
             assert call_args.args[2] is PluginListWithoutTotalResponse
             assert call_args.kwargs["params"]["page"] == 2
             assert call_args.kwargs["params"]["page_size"] == 10
-            assert call_args.kwargs["params"]["query"] == "weather"
-            assert call_args.kwargs["params"]["tags"] == ["search", "rag"]
-            assert call_args.kwargs["params"]["language"] == "zh_Hans"
             assert result.list == [mock_plugin_entity]
             assert result.has_more is True
 
@@ -166,23 +156,6 @@ class TestPluginDiscovery:
             # Assert: Verify empty list is returned
             assert len(result) == 0
 
-    def test_list_installed_plugin_ids(self, plugin_installer):
-        """The lightweight ID endpoint is unpaginated and does not request plugin details."""
-        mock_response = PluginInstalledIdsDaemonResponse(plugin_ids=["langgenius/openai", "langgenius/anthropic"])
-
-        with patch.object(
-            plugin_installer, "_request_with_plugin_daemon_response", return_value=mock_response
-        ) as mock_request:
-            result = plugin_installer.list_installed_plugin_ids("test-tenant", PluginCategory.Tool)
-
-        mock_request.assert_called_once_with(
-            "GET",
-            "plugin/test-tenant/management/installation/ids",
-            PluginInstalledIdsDaemonResponse,
-            params={"category": "tool"},
-        )
-        assert result == ["langgenius/openai", "langgenius/anthropic"]
-
     def test_fetch_plugin_by_identifier_found(self, plugin_installer):
         """Test fetching a plugin by its unique identifier when it exists."""
         # Arrange: Mock successful fetch

api/tests/unit_tests/core/rag/cleaner/test_clean_processor.py

@@ -22,23 +22,6 @@ class TestCleanProcessor:
         expected = "normalpadding"
         assert CleanProcessor.clean(text_with_ufffe, None) == expected
 
-    def test_clean_preserves_valid_extended_characters(self):
-        """Default cleaning must not strip valid printable characters.
-
-        The invalid-symbol filter used to include the UTF-8 bytes of U+FFFE
-        (0xEF 0xBF 0xBE) inside a character class. On a decoded string those
-        bytes are the code points U+00EF, U+00BF and U+00BE, i.e. the valid
-        characters 'ï', '¿' and '¾', so words like "naïve" and Spanish
-        questions like "¿Cómo?" were being silently corrupted on ingest.
-        """
-        assert CleanProcessor.clean("naïve", None) == "naïve"
-        assert CleanProcessor.clean("¿Cómo estás?", None) == "¿Cómo estás?"
-        assert CleanProcessor.clean("¾ cup sugar", None) == "¾ cup sugar"
-        assert CleanProcessor.clean("￾", None) == "￾"
-
-        # The U+FFFE noncharacter is still stripped by its dedicated substitution.
-        assert CleanProcessor.clean("keep\ufffedrop", None) == "keepdrop"
-
     def test_clean_with_none_process_rule(self):
         """Test cleaning with None process_rule - only default cleaning applied."""
         text = "Hello<|World\x00"