Merge remote-tracking branch 'origin/main' into feat/model-provider-refactor

test: improve Jotai atom test quality and add model-provider atoms tests
2026-03-06 14:57:48 +08:00 · 2026-03-06 14:47:56 +08:00 · 2026-03-05 22:49:09 +08:00 · 2026-03-05 21:22:03 +08:00 · 2026-03-05 20:25:53 +08:00 · 2026-03-05 20:25:29 +08:00
570 changed files with 15854 additions and 81231 deletions
@@ -1,33 +0,0 @@
-name: Setup Web Environment
-description: Setup pnpm, Node.js, and install web dependencies.
-
-inputs:
-  node-version:
-    description: Node.js version to use
-    required: false
-    default: "22"
-  install-dependencies:
-    description: Whether to install web dependencies after setting up Node.js
-    required: false
-    default: "true"
-
-runs:
-  using: composite
-  steps:
-    - name: Install pnpm
-      uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
-      with:
-        package_json_file: web/package.json
-        run_install: false
-
-    - name: Setup Node.js
-      uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
-      with:
-        node-version: ${{ inputs.node-version }}
-        cache: pnpm
-        cache-dependency-path: ./web/pnpm-lock.yaml
-
-    - name: Install dependencies
-      if: ${{ inputs.install-dependencies == 'true' }}
-      shell: bash
-      run: pnpm --dir web install --frozen-lockfile
@@ -24,33 +24,14 @@ updates:
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 2
-    ignore:
-      - dependency-name: "tailwind-merge"
-        update-types: ["version-update:semver-major"]
-      - dependency-name: "tailwindcss"
-        update-types: ["version-update:semver-major"]
-      - dependency-name: "react-syntax-highlighter"
-        update-types: ["version-update:semver-major"]
-      - dependency-name: "react-window"
-        update-types: ["version-update:semver-major"]
    groups:
-      lexical:
-        patterns:
-          - "lexical"
-          - "@lexical/*"
      storybook:
        patterns:
          - "storybook"
          - "@storybook/*"
-      eslint-group:
-        patterns:
-          - "*eslint*"
      npm-dependencies:
        patterns:
          - "*"
        exclude-patterns:
-          - "lexical"
-          - "@lexical/*"
          - "storybook"
          - "@storybook/*"
-          - "*eslint*"
@@ -1,17 +0,0 @@
-name: Anti-Slop PR Check
-
-on:
-  pull_request_target:
-    types: [opened, edited, synchronize]
-
-permissions:
-  pull-requests: write
-  contents: read
-
-jobs:
-  anti-slop:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: peakoss/anti-slop@v0
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -22,12 +22,12 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Setup UV and Python
-        uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
+        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
          python-version: ${{ matrix.python-version }}
@@ -51,7 +51,7 @@ jobs:
        run: sh .github/workflows/expose_service_ports.sh

      - name: Set up Sandbox
-        uses: hoverkraft-tech/compose-action@4894d2492015c1774ee5a13a95b1072093087ec3 # v2.5.0
+        uses: hoverkraft-tech/compose-action@v2
        with:
          compose-file: |
            docker/docker-compose.middleware.yaml
@@ -12,34 +12,22 @@ jobs:
    if: github.repository == 'langgenius/dify'
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@v6

      - name: Check Docker Compose inputs
        id: docker-compose-changes
-        uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323 # v47.0.5
+        uses: tj-actions/changed-files@v47
        with:
          files: |
            docker/generate_docker_compose
            docker/.env.example
            docker/docker-compose-template.yaml
            docker/docker-compose.yaml
-      - name: Check web inputs
-        id: web-changes
-        uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323 # v47.0.5
-        with:
-          files: |
-            web/**
-      - name: Check api inputs
-        id: api-changes
-        uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323 # v47.0.5
-        with:
-          files: |
-            api/**
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/setup-python@v6
        with:
          python-version: "3.11"

-      - uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
+      - uses: astral-sh/setup-uv@v7

      - name: Generate Docker Compose
        if: steps.docker-compose-changes.outputs.any_changed == 'true'
@@ -47,8 +35,7 @@ jobs:
          cd docker
          ./generate_docker_compose

-      - if: steps.api-changes.outputs.any_changed == 'true'
-        run: |
+      - run: |
          cd api
          uv sync --dev
          # fmt first to avoid line too long
@@ -59,13 +46,11 @@ jobs:
          uv run ruff format ..

      - name: count migration progress
-        if: steps.api-changes.outputs.any_changed == 'true'
        run: |
          cd api
          ./cnt_base.sh

      - name: ast-grep
-        if: steps.api-changes.outputs.any_changed == 'true'
        run: |
          # ast-grep exits 1 if no matches are found; allow idempotent runs.
          uvx --from ast-grep-cli ast-grep --pattern 'db.session.query($WHATEVER).filter($HERE)' --rewrite 'db.session.query($WHATEVER).where($HERE)' -l py --update-all || true
@@ -99,16 +84,4 @@ jobs:
        run: |
          uvx --python 3.13 mdformat . --exclude ".agents/skills/**"

-      - name: Setup web environment
-        if: steps.web-changes.outputs.any_changed == 'true'
-        uses: ./.github/actions/setup-web
-        with:
-          node-version: "24"
-
-      - name: ESLint autofix
-        if: steps.web-changes.outputs.any_changed == 'true'
-        run: |
-          cd web
-          pnpm eslint --concurrency=2 --prune-suppressions --quiet || true
-
-      - uses: autofix-ci/action@7a166d7532b277f34e16238930461bf77f9d7ed8 # v1.3.3
+      - uses: autofix-ci/action@635ffb0c9798bd160680f18fd73371e355b85f27
@@ -53,26 +53,26 @@ jobs:
          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV

      - name: Login to Docker Hub
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+        uses: docker/login-action@v3
        with:
          username: ${{ env.DOCKERHUB_USER }}
          password: ${{ env.DOCKERHUB_TOKEN }}

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@v3

      - name: Extract metadata for Docker
        id: meta
-        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
+        uses: docker/metadata-action@v5
        with:
          images: ${{ env[matrix.image_name_env] }}

      - name: Build Docker image
        id: build
-        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
+        uses: docker/build-push-action@v6
        with:
          context: "{{defaultContext}}:${{ matrix.context }}"
          platforms: ${{ matrix.platform }}
@@ -91,7 +91,7 @@ jobs:
          touch "/tmp/digests/${sanitized_digest}"

      - name: Upload digest
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@v6
        with:
          name: digests-${{ matrix.context }}-${{ env.PLATFORM_PAIR }}
          path: /tmp/digests/*
@@ -113,21 +113,21 @@ jobs:
            context: "web"
    steps:
      - name: Download digests
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+        uses: actions/download-artifact@v7
        with:
          path: /tmp/digests
          pattern: digests-${{ matrix.context }}-*
          merge-multiple: true

      - name: Login to Docker Hub
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+        uses: docker/login-action@v3
        with:
          username: ${{ env.DOCKERHUB_USER }}
          password: ${{ env.DOCKERHUB_TOKEN }}

      - name: Extract metadata for Docker
        id: meta
-        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
+        uses: docker/metadata-action@v5
        with:
          images: ${{ env[matrix.image_name_env] }}
          tags: |
@@ -13,13 +13,13 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Setup UV and Python
-        uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
+        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
          python-version: "3.12"
@@ -40,7 +40,7 @@ jobs:
          cp middleware.env.example middleware.env

      - name: Set up Middlewares
-        uses: hoverkraft-tech/compose-action@4894d2492015c1774ee5a13a95b1072093087ec3 # v2.5.0
+        uses: hoverkraft-tech/compose-action@v2.0.2
        with:
          compose-file: |
            docker/docker-compose.middleware.yaml
@@ -63,13 +63,13 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Setup UV and Python
-        uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
+        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
          python-version: "3.12"
@@ -94,7 +94,7 @@ jobs:
          sed -i 's/DB_USERNAME=postgres/DB_USERNAME=mysql/' middleware.env

      - name: Set up Middlewares
-        uses: hoverkraft-tech/compose-action@4894d2492015c1774ee5a13a95b1072093087ec3 # v2.5.0
+        uses: hoverkraft-tech/compose-action@v2.0.2
        with:
          compose-file: |
            docker/docker-compose.middleware.yaml
@@ -19,7 +19,7 @@ jobs:
      github.event.workflow_run.head_branch == 'deploy/agent-dev'
    steps:
      - name: Deploy to server
-        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
+        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.AGENT_DEV_SSH_HOST }}
          username: ${{ secrets.SSH_USER }}
@@ -16,7 +16,7 @@ jobs:
      github.event.workflow_run.head_branch == 'deploy/dev'
    steps:
      - name: Deploy to server
-        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
+        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.SSH_HOST }}
          username: ${{ secrets.SSH_USER }}
@@ -16,7 +16,7 @@ jobs:
      github.event.workflow_run.head_branch == 'build/feat/hitl'
    steps:
      - name: Deploy to server
-        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
+        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.HITL_SSH_HOST }}
          username: ${{ secrets.SSH_USER }}
@@ -32,13 +32,13 @@ jobs:
            context: "web"
    steps:
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@v3

      - name: Build Docker Image
-        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
+        uses: docker/build-push-action@v6
        with:
          push: false
          context: "{{defaultContext}}:${{ matrix.context }}"
@@ -9,6 +9,6 @@ jobs:
      pull-requests: write
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
+      - uses: actions/labeler@v6
        with:
          sync-labels: true
@@ -27,8 +27,8 @@ jobs:
      vdb-changed: ${{ steps.changes.outputs.vdb }}
      migration-changed: ${{ steps.changes.outputs.migration }}
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+      - uses: actions/checkout@v6
+      - uses: dorny/paths-filter@v3
        id: changes
        with:
          filters: |
@@ -39,7 +39,6 @@ jobs:
            web:
              - 'web/**'
              - '.github/workflows/web-tests.yml'
-              - '.github/actions/setup-web/**'
            vdb:
              - 'api/core/rag/datasource/**'
              - 'docker/**'
@@ -21,7 +21,7 @@ jobs:
    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.pull_requests[0].head.repo.full_name != github.repository }}
    steps:
      - name: Download pyrefly diff artifact
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@v8
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
@@ -49,7 +49,7 @@ jobs:
        run: unzip -o pyrefly_diff.zip

      - name: Post comment
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@v8
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
@@ -17,12 +17,12 @@ jobs:
      pull-requests: write
    steps:
      - name: Checkout PR branch
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Setup Python & UV
-        uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
+        uses: astral-sh/setup-uv@v5
        with:
          enable-cache: true

@@ -55,7 +55,7 @@ jobs:
          echo ${{ github.event.pull_request.number }} > pr_number.txt

      - name: Upload pyrefly diff
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@v4
        with:
          name: pyrefly_diff
          path: |
@@ -64,7 +64,7 @@ jobs:

      - name: Comment PR with pyrefly diff
        if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@v8
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
@@ -16,6 +16,6 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Check title
-        uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
+        uses: amannn/[email protected]
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -18,7 +18,7 @@ jobs:
      pull-requests: write

    steps:
-      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
+      - uses: actions/stale@v10
        with:
          days-before-issue-stale: 15
          days-before-issue-close: 3
@@ -19,13 +19,13 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Check changed files
        id: changed-files
-        uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323 # v47.0.5
+        uses: tj-actions/changed-files@v47
        with:
          files: |
            api/**
@@ -33,7 +33,7 @@ jobs:

      - name: Setup UV and Python
        if: steps.changed-files.outputs.any_changed == 'true'
-        uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
+        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: false
          python-version: "3.12"
@@ -67,22 +67,36 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Check changed files
        id: changed-files
-        uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323 # v47.0.5
+        uses: tj-actions/changed-files@v47
        with:
          files: |
            web/**
            .github/workflows/style.yml
-            .github/actions/setup-web/**

-      - name: Setup web environment
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          package_json_file: web/package.json
+          run_install: false
+
+      - name: Setup NodeJS
+        uses: actions/setup-node@v6
        if: steps.changed-files.outputs.any_changed == 'true'
-        uses: ./.github/actions/setup-web
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: ./web/pnpm-lock.yaml
+
+      - name: Web dependencies
+        if: steps.changed-files.outputs.any_changed == 'true'
+        working-directory: ./web
+        run: pnpm install --frozen-lockfile

      - name: Web style check
        if: steps.changed-files.outputs.any_changed == 'true'
@@ -120,14 +134,14 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Check changed files
        id: changed-files
-        uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323 # v47.0.5
+        uses: tj-actions/changed-files@v47
        with:
          files: |
            **.sh
@@ -138,7 +152,7 @@ jobs:
            .editorconfig

      - name: Super-linter
-        uses: super-linter/super-linter/slim@61abc07d755095a68f4987d1c2c3d1d64408f1f9 # v8.5.0
+        uses: super-linter/super-linter/slim@v8
        if: steps.changed-files.outputs.any_changed == 'true'
        env:
          BASH_SEVERITY: warning
@@ -21,12 +21,12 @@ jobs:
        working-directory: sdks/nodejs-client

    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Use Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: ''
@@ -38,7 +38,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}
@@ -48,10 +48,18 @@ jobs:
          git config --global user.name "github-actions[bot]"
          git config --global user.email "github-actions[bot]@users.noreply.github.com"

-      - name: Setup web environment
-        uses: ./.github/actions/setup-web
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
        with:
-          install-dependencies: "false"
+          package_json_file: web/package.json
+          run_install: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: ./web/pnpm-lock.yaml

      - name: Detect changed files and generate diff
        id: detect_changes
@@ -122,7 +130,7 @@ jobs:

      - name: Run Claude Code for Translation Sync
        if: steps.detect_changes.outputs.CHANGED_FILES != ''
-        uses: anthropics/claude-code-action@26ec041249acb0a944c0a47b6c0c13f05dbc5b44 # v1.0.70
+        uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -21,7 +21,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6
        with:
          fetch-depth: 0

@@ -59,7 +59,7 @@ jobs:

      - name: Trigger i18n sync workflow
        if: steps.detect.outputs.has_changes == 'true'
-        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
+        uses: peter-evans/repository-dispatch@v3
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          event-type: i18n-sync
@@ -19,19 +19,19 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Free Disk Space
-        uses: endersonmenezes/free-disk-space@7901478139cff6e9d44df5972fd8ab8fcade4db1 # v3.2.2
+        uses: endersonmenezes/free-disk-space@v3
        with:
          remove_dotnet: true
          remove_haskell: true
          remove_tool_cache: true

      - name: Setup UV and Python
-        uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
+        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
          python-version: ${{ matrix.python-version }}
@@ -60,7 +60,7 @@ jobs:
 #            tiflash

      - name: Set up Vector Stores (Weaviate, Qdrant, PGVector, Milvus, PgVecto-RS, Chroma, MyScale, ElasticSearch, Couchbase, OceanBase)
-        uses: hoverkraft-tech/compose-action@4894d2492015c1774ee5a13a95b1072093087ec3 # v2.5.0
+        uses: hoverkraft-tech/compose-action@v2.0.2
        with:
          compose-file: |
            docker/docker-compose.yaml
@@ -26,19 +26,32 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6
        with:
          persist-credentials: false

-      - name: Setup web environment
-        uses: ./.github/actions/setup-web
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          package_json_file: web/package.json
+          run_install: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: ./web/pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile

      - name: Run tests
        run: pnpm vitest run --reporter=blob --shard=${{ matrix.shardIndex }}/${{ matrix.shardTotal }} --coverage

      - name: Upload blob report
        if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@v6
        with:
          name: blob-report-${{ matrix.shardIndex }}
          path: web/.vitest-reports/*
@@ -57,15 +70,28 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6
        with:
          persist-credentials: false

-      - name: Setup web environment
-        uses: ./.github/actions/setup-web
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          package_json_file: web/package.json
+          run_install: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: ./web/pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile

      - name: Download blob reports
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+        uses: actions/download-artifact@v6
        with:
          path: web/.vitest-reports
          pattern: blob-report-*
@@ -393,7 +419,7 @@ jobs:

      - name: Upload Coverage Artifact
        if: steps.coverage-summary.outputs.has_coverage == 'true'
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@v6
        with:
          name: web-coverage-report
          path: web/coverage
@@ -409,22 +435,36 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Check changed files
        id: changed-files
-        uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323 # v47.0.5
+        uses: tj-actions/changed-files@v47
        with:
          files: |
            web/**
            .github/workflows/web-tests.yml
-            .github/actions/setup-web/**

-      - name: Setup web environment
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          package_json_file: web/package.json
+          run_install: false
+
+      - name: Setup NodeJS
+        uses: actions/setup-node@v6
        if: steps.changed-files.outputs.any_changed == 'true'
-        uses: ./.github/actions/setup-web
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: ./web/pnpm-lock.yaml
+
+      - name: Web dependencies
+        if: steps.changed-files.outputs.any_changed == 'true'
+        working-directory: ./web
+        run: pnpm install --frozen-lockfile

      - name: Web build check
        if: steps.changed-files.outputs.any_changed == 'true'
@@ -56,7 +56,7 @@
  <a href="./docs/bn-BD/README.md"><img alt="README in বাংলা" src="https://img.shields.io/badge/বাংলা-d9d9d9"></a>
 </p>

-Dify is an open-source LLM app development platform. Its intuitive interface combines AI workflow, RAG pipeline, agent capabilities, model management, observability features (including [Opik](https://www.comet.com/docs/opik/integrations/dify), [Langfuse](https://docs.langfuse.com), and [Arize Phoenix](https://docs.arize.com/phoenix)) and more, letting you quickly go from prototype to production. Here's a list of the core features:
+Dify is an open-source platform for developing LLM applications. Its intuitive interface combines agentic AI workflows, RAG pipelines, agent capabilities, model management, observability features, and more—allowing you to quickly move from prototype to production.

 ## Quick start

@@ -133,7 +133,7 @@ Star Dify on GitHub and be instantly notified of new releases.

 ### Custom configurations

-If you need to customize the configuration, please refer to the comments in our [.env.example](docker/.env.example) file and update the corresponding values in your `.env` file. Additionally, you might need to make adjustments to the `docker-compose.yaml` file itself, such as changing image versions, port mappings, or volume mounts, based on your specific deployment environment and requirements. After making any changes, please re-run `docker compose up -d`. You can find the full list of available environment variables [here](https://docs.dify.ai/getting-started/install-self-hosted/environments).
+If you need to customize the configuration, please refer to the comments in our [.env.example](docker/.env.example) file and update the corresponding values in your `.env` file. Additionally, you might need to make adjustments to the `docker-compose.yaml` file itself, such as changing image versions, port mappings, or volume mounts, based on your specific deployment environment and requirements. After making any changes, please re-run `docker-compose up -d`. You can find the full list of available environment variables [here](https://docs.dify.ai/getting-started/install-self-hosted/environments).

 #### Customizing Suggested Questions

@@ -44,7 +44,9 @@ forbidden_modules =
 allow_indirect_imports = True
 ignore_imports =
    dify_graph.nodes.agent.agent_node -> extensions.ext_database
+    dify_graph.nodes.llm.file_saver -> extensions.ext_database
    dify_graph.nodes.llm.node -> extensions.ext_database
+    dify_graph.nodes.tool.tool_node -> extensions.ext_database
    dify_graph.model_runtime.model_providers.__base.ai_model -> extensions.ext_redis
    dify_graph.model_runtime.model_providers.model_provider_factory -> extensions.ext_redis

@@ -110,7 +112,9 @@ ignore_imports =
    dify_graph.nodes.parameter_extractor.parameter_extractor_node -> core.model_manager
    dify_graph.nodes.question_classifier.question_classifier_node -> core.model_manager
    dify_graph.nodes.tool.tool_node -> core.tools.utils.message_transformer
+    dify_graph.nodes.tool.tool_node -> models
    dify_graph.nodes.agent.agent_node -> models.model
+    dify_graph.nodes.llm.file_saver -> core.helper.ssrf_proxy
    dify_graph.nodes.llm.node -> core.helper.code_executor
    dify_graph.nodes.llm.node -> core.llm_generator.output_parser.errors
    dify_graph.nodes.llm.node -> core.llm_generator.output_parser.structured_output
@@ -131,7 +135,9 @@ ignore_imports =
    dify_graph.nodes.llm.file_saver -> core.tools.tool_file_manager
    dify_graph.nodes.tool.tool_node -> core.tools.errors
    dify_graph.nodes.agent.agent_node -> extensions.ext_database
+    dify_graph.nodes.llm.file_saver -> extensions.ext_database
    dify_graph.nodes.llm.node -> extensions.ext_database
+    dify_graph.nodes.tool.tool_node -> extensions.ext_database
    dify_graph.nodes.agent.agent_node -> models
    dify_graph.nodes.llm.node -> models.model
    dify_graph.nodes.agent.agent_node -> services
@@ -62,22 +62,6 @@ This is the default standard for backend code in this repo. Follow it for new co

 - Code should usually include type annotations that match the repo’s current Python version (avoid untyped public APIs and “mystery” values).
 - Prefer modern typing forms (e.g. `list[str]`, `dict[str, int]`) and avoid `Any` unless there’s a strong reason.
- For dictionary-like data with known keys and value types, prefer `TypedDict` over `dict[...]` or `Mapping[...]`.
- For optional keys in typed payloads, use `NotRequired[...]` (or `total=False` when most fields are optional).
- Keep `dict[...]` / `Mapping[...]` for truly dynamic key spaces where the key set is unknown.
-
-```python
-from datetime import datetime
-from typing import NotRequired, TypedDict
-
-
-class UserProfile(TypedDict):
-    user_id: str
-    email: str
-    created_at: datetime
-    nickname: NotRequired[str]
-```
-
 - For classes, declare member variables at the top of the class body (before `__init__`) so the class shape is obvious at a glance:

 ```python
@@ -1,71 +0,0 @@
-"""
-CLI command modules extracted from `commands.py`.
-"""
-
-from .account import create_tenant, reset_email, reset_password
-from .plugin import (
-    extract_plugins,
-    extract_unique_plugins,
-    install_plugins,
-    install_rag_pipeline_plugins,
-    migrate_data_for_plugin,
-    setup_datasource_oauth_client,
-    setup_system_tool_oauth_client,
-    setup_system_trigger_oauth_client,
-    transform_datasource_credentials,
-)
-from .retention import (
-    archive_workflow_runs,
-    clean_expired_messages,
-    clean_workflow_runs,
-    cleanup_orphaned_draft_variables,
-    clear_free_plan_tenant_expired_logs,
-    delete_archived_workflow_runs,
-    export_app_messages,
-    restore_workflow_runs,
-)
-from .storage import clear_orphaned_file_records, file_usage, migrate_oss, remove_orphaned_files_on_storage
-from .system import convert_to_agent_apps, fix_app_site_missing, reset_encrypt_key_pair, upgrade_db
-from .vector import (
-    add_qdrant_index,
-    migrate_annotation_vector_database,
-    migrate_knowledge_vector_database,
-    old_metadata_migration,
-    vdb_migrate,
-)
-
-__all__ = [
-    "add_qdrant_index",
-    "archive_workflow_runs",
-    "clean_expired_messages",
-    "clean_workflow_runs",
-    "cleanup_orphaned_draft_variables",
-    "clear_free_plan_tenant_expired_logs",
-    "clear_orphaned_file_records",
-    "convert_to_agent_apps",
-    "create_tenant",
-    "delete_archived_workflow_runs",
-    "export_app_messages",
-    "extract_plugins",
-    "extract_unique_plugins",
-    "file_usage",
-    "fix_app_site_missing",
-    "install_plugins",
-    "install_rag_pipeline_plugins",
-    "migrate_annotation_vector_database",
-    "migrate_data_for_plugin",
-    "migrate_knowledge_vector_database",
-    "migrate_oss",
-    "old_metadata_migration",
-    "remove_orphaned_files_on_storage",
-    "reset_email",
-    "reset_encrypt_key_pair",
-    "reset_password",
-    "restore_workflow_runs",
-    "setup_datasource_oauth_client",
-    "setup_system_tool_oauth_client",
-    "setup_system_trigger_oauth_client",
-    "transform_datasource_credentials",
-    "upgrade_db",
-    "vdb_migrate",
-]
@@ -1,130 +0,0 @@
-import base64
-import secrets
-
-import click
-from sqlalchemy.orm import sessionmaker
-
-from constants.languages import languages
-from extensions.ext_database import db
-from libs.helper import email as email_validate
-from libs.password import hash_password, password_pattern, valid_password
-from services.account_service import AccountService, RegisterService, TenantService
-
-
-@click.command("reset-password", help="Reset the account password.")
-@click.option("--email", prompt=True, help="Account email to reset password for")
-@click.option("--new-password", prompt=True, help="New password")
-@click.option("--password-confirm", prompt=True, help="Confirm new password")
-def reset_password(email, new_password, password_confirm):
-    """
-    Reset password of owner account
-    Only available in SELF_HOSTED mode
-    """
-    if str(new_password).strip() != str(password_confirm).strip():
-        click.echo(click.style("Passwords do not match.", fg="red"))
-        return
-    normalized_email = email.strip().lower()
-
-    with sessionmaker(db.engine, expire_on_commit=False).begin() as session:
-        account = AccountService.get_account_by_email_with_case_fallback(email.strip(), session=session)
-
-        if not account:
-            click.echo(click.style(f"Account not found for email: {email}", fg="red"))
-            return
-
-        try:
-            valid_password(new_password)
-        except:
-            click.echo(click.style(f"Invalid password. Must match {password_pattern}", fg="red"))
-            return
-
-        # generate password salt
-        salt = secrets.token_bytes(16)
-        base64_salt = base64.b64encode(salt).decode()
-
-        # encrypt password with salt
-        password_hashed = hash_password(new_password, salt)
-        base64_password_hashed = base64.b64encode(password_hashed).decode()
-        account.password = base64_password_hashed
-        account.password_salt = base64_salt
-        AccountService.reset_login_error_rate_limit(normalized_email)
-        click.echo(click.style("Password reset successfully.", fg="green"))
-
-
-@click.command("reset-email", help="Reset the account email.")
-@click.option("--email", prompt=True, help="Current account email")
-@click.option("--new-email", prompt=True, help="New email")
-@click.option("--email-confirm", prompt=True, help="Confirm new email")
-def reset_email(email, new_email, email_confirm):
-    """
-    Replace account email
-    :return:
-    """
-    if str(new_email).strip() != str(email_confirm).strip():
-        click.echo(click.style("New emails do not match.", fg="red"))
-        return
-    normalized_new_email = new_email.strip().lower()
-
-    with sessionmaker(db.engine, expire_on_commit=False).begin() as session:
-        account = AccountService.get_account_by_email_with_case_fallback(email.strip(), session=session)
-
-        if not account:
-            click.echo(click.style(f"Account not found for email: {email}", fg="red"))
-            return
-
-        try:
-            email_validate(normalized_new_email)
-        except:
-            click.echo(click.style(f"Invalid email: {new_email}", fg="red"))
-            return
-
-        account.email = normalized_new_email
-        click.echo(click.style("Email updated successfully.", fg="green"))
-
-
-@click.command("create-tenant", help="Create account and tenant.")
-@click.option("--email", prompt=True, help="Tenant account email.")
-@click.option("--name", prompt=True, help="Workspace name.")
-@click.option("--language", prompt=True, help="Account language, default: en-US.")
-def create_tenant(email: str, language: str | None = None, name: str | None = None):
-    """
-    Create tenant account
-    """
-    if not email:
-        click.echo(click.style("Email is required.", fg="red"))
-        return
-
-    # Create account
-    email = email.strip().lower()
-
-    if "@" not in email:
-        click.echo(click.style("Invalid email address.", fg="red"))
-        return
-
-    account_name = email.split("@")[0]
-
-    if language not in languages:
-        language = "en-US"
-
-    # Validates name encoding for non-Latin characters.
-    name = name.strip().encode("utf-8").decode("utf-8") if name else None
-
-    # generate random password
-    new_password = secrets.token_urlsafe(16)
-
-    # register account
-    account = RegisterService.register(
-        email=email,
-        name=account_name,
-        password=new_password,
-        language=language,
-        create_workspace_required=False,
-    )
-    TenantService.create_owner_tenant_if_not_exist(account, name)
-
-    click.echo(
-        click.style(
-            f"Account and tenant created.\nAccount: {email}\nPassword: {new_password}",
-            fg="green",
-        )
-    )
@@ -1,467 +0,0 @@
-import json
-import logging
-from typing import Any
-
-import click
-from pydantic import TypeAdapter
-
-from configs import dify_config
-from core.helper import encrypter
-from core.plugin.entities.plugin_daemon import CredentialType
-from core.plugin.impl.plugin import PluginInstaller
-from core.tools.utils.system_oauth_encryption import encrypt_system_oauth_params
-from extensions.ext_database import db
-from models import Tenant
-from models.oauth import DatasourceOauthParamConfig, DatasourceProvider
-from models.provider_ids import DatasourceProviderID, ToolProviderID
-from models.source import DataSourceApiKeyAuthBinding, DataSourceOauthBinding
-from models.tools import ToolOAuthSystemClient
-from services.plugin.data_migration import PluginDataMigration
-from services.plugin.plugin_migration import PluginMigration
-from services.plugin.plugin_service import PluginService
-
-logger = logging.getLogger(__name__)
-
-
-@click.command("setup-system-tool-oauth-client", help="Setup system tool oauth client.")
-@click.option("--provider", prompt=True, help="Provider name")
-@click.option("--client-params", prompt=True, help="Client Params")
-def setup_system_tool_oauth_client(provider, client_params):
-    """
-    Setup system tool oauth client
-    """
-    provider_id = ToolProviderID(provider)
-    provider_name = provider_id.provider_name
-    plugin_id = provider_id.plugin_id
-
-    try:
-        # json validate
-        click.echo(click.style(f"Validating client params: {client_params}", fg="yellow"))
-        client_params_dict = TypeAdapter(dict[str, Any]).validate_json(client_params)
-        click.echo(click.style("Client params validated successfully.", fg="green"))
-
-        click.echo(click.style(f"Encrypting client params: {client_params}", fg="yellow"))
-        click.echo(click.style(f"Using SECRET_KEY: `{dify_config.SECRET_KEY}`", fg="yellow"))
-        oauth_client_params = encrypt_system_oauth_params(client_params_dict)
-        click.echo(click.style("Client params encrypted successfully.", fg="green"))
-    except Exception as e:
-        click.echo(click.style(f"Error parsing client params: {str(e)}", fg="red"))
-        return
-
-    deleted_count = (
-        db.session.query(ToolOAuthSystemClient)
-        .filter_by(
-            provider=provider_name,
-            plugin_id=plugin_id,
-        )
-        .delete()
-    )
-    if deleted_count > 0:
-        click.echo(click.style(f"Deleted {deleted_count} existing oauth client params.", fg="yellow"))
-
-    oauth_client = ToolOAuthSystemClient(
-        provider=provider_name,
-        plugin_id=plugin_id,
-        encrypted_oauth_params=oauth_client_params,
-    )
-    db.session.add(oauth_client)
-    db.session.commit()
-    click.echo(click.style(f"OAuth client params setup successfully. id: {oauth_client.id}", fg="green"))
-
-
-@click.command("setup-system-trigger-oauth-client", help="Setup system trigger oauth client.")
-@click.option("--provider", prompt=True, help="Provider name")
-@click.option("--client-params", prompt=True, help="Client Params")
-def setup_system_trigger_oauth_client(provider, client_params):
-    """
-    Setup system trigger oauth client
-    """
-    from models.provider_ids import TriggerProviderID
-    from models.trigger import TriggerOAuthSystemClient
-
-    provider_id = TriggerProviderID(provider)
-    provider_name = provider_id.provider_name
-    plugin_id = provider_id.plugin_id
-
-    try:
-        # json validate
-        click.echo(click.style(f"Validating client params: {client_params}", fg="yellow"))
-        client_params_dict = TypeAdapter(dict[str, Any]).validate_json(client_params)
-        click.echo(click.style("Client params validated successfully.", fg="green"))
-
-        click.echo(click.style(f"Encrypting client params: {client_params}", fg="yellow"))
-        click.echo(click.style(f"Using SECRET_KEY: `{dify_config.SECRET_KEY}`", fg="yellow"))
-        oauth_client_params = encrypt_system_oauth_params(client_params_dict)
-        click.echo(click.style("Client params encrypted successfully.", fg="green"))
-    except Exception as e:
-        click.echo(click.style(f"Error parsing client params: {str(e)}", fg="red"))
-        return
-
-    deleted_count = (
-        db.session.query(TriggerOAuthSystemClient)
-        .filter_by(
-            provider=provider_name,
-            plugin_id=plugin_id,
-        )
-        .delete()
-    )
-    if deleted_count > 0:
-        click.echo(click.style(f"Deleted {deleted_count} existing oauth client params.", fg="yellow"))
-
-    oauth_client = TriggerOAuthSystemClient(
-        provider=provider_name,
-        plugin_id=plugin_id,
-        encrypted_oauth_params=oauth_client_params,
-    )
-    db.session.add(oauth_client)
-    db.session.commit()
-    click.echo(click.style(f"OAuth client params setup successfully. id: {oauth_client.id}", fg="green"))
-
-
-@click.command("setup-datasource-oauth-client", help="Setup datasource oauth client.")
-@click.option("--provider", prompt=True, help="Provider name")
-@click.option("--client-params", prompt=True, help="Client Params")
-def setup_datasource_oauth_client(provider, client_params):
-    """
-    Setup datasource oauth client
-    """
-    provider_id = DatasourceProviderID(provider)
-    provider_name = provider_id.provider_name
-    plugin_id = provider_id.plugin_id
-
-    try:
-        # json validate
-        click.echo(click.style(f"Validating client params: {client_params}", fg="yellow"))
-        client_params_dict = TypeAdapter(dict[str, Any]).validate_json(client_params)
-        click.echo(click.style("Client params validated successfully.", fg="green"))
-    except Exception as e:
-        click.echo(click.style(f"Error parsing client params: {str(e)}", fg="red"))
-        return
-
-    click.echo(click.style(f"Ready to delete existing oauth client params: {provider_name}", fg="yellow"))
-    deleted_count = (
-        db.session.query(DatasourceOauthParamConfig)
-        .filter_by(
-            provider=provider_name,
-            plugin_id=plugin_id,
-        )
-        .delete()
-    )
-    if deleted_count > 0:
-        click.echo(click.style(f"Deleted {deleted_count} existing oauth client params.", fg="yellow"))
-
-    click.echo(click.style(f"Ready to setup datasource oauth client: {provider_name}", fg="yellow"))
-    oauth_client = DatasourceOauthParamConfig(
-        provider=provider_name,
-        plugin_id=plugin_id,
-        system_credentials=client_params_dict,
-    )
-    db.session.add(oauth_client)
-    db.session.commit()
-    click.echo(click.style(f"provider: {provider_name}", fg="green"))
-    click.echo(click.style(f"plugin_id: {plugin_id}", fg="green"))
-    click.echo(click.style(f"params: {json.dumps(client_params_dict, indent=2, ensure_ascii=False)}", fg="green"))
-    click.echo(click.style(f"Datasource oauth client setup successfully. id: {oauth_client.id}", fg="green"))
-
-
-@click.command("transform-datasource-credentials", help="Transform datasource credentials.")
-@click.option(
-    "--environment", prompt=True, help="the environment to transform datasource credentials", default="online"
-)
-def transform_datasource_credentials(environment: str):
-    """
-    Transform datasource credentials
-    """
-    try:
-        installer_manager = PluginInstaller()
-        plugin_migration = PluginMigration()
-
-        notion_plugin_id = "langgenius/notion_datasource"
-        firecrawl_plugin_id = "langgenius/firecrawl_datasource"
-        jina_plugin_id = "langgenius/jina_datasource"
-        if environment == "online":
-            notion_plugin_unique_identifier = plugin_migration._fetch_plugin_unique_identifier(notion_plugin_id)  # pyright: ignore[reportPrivateUsage]
-            firecrawl_plugin_unique_identifier = plugin_migration._fetch_plugin_unique_identifier(firecrawl_plugin_id)  # pyright: ignore[reportPrivateUsage]
-            jina_plugin_unique_identifier = plugin_migration._fetch_plugin_unique_identifier(jina_plugin_id)  # pyright: ignore[reportPrivateUsage]
-        else:
-            notion_plugin_unique_identifier = None
-            firecrawl_plugin_unique_identifier = None
-            jina_plugin_unique_identifier = None
-        oauth_credential_type = CredentialType.OAUTH2
-        api_key_credential_type = CredentialType.API_KEY
-
-        # deal notion credentials
-        deal_notion_count = 0
-        notion_credentials = db.session.query(DataSourceOauthBinding).filter_by(provider="notion").all()
-        if notion_credentials:
-            notion_credentials_tenant_mapping: dict[str, list[DataSourceOauthBinding]] = {}
-            for notion_credential in notion_credentials:
-                tenant_id = notion_credential.tenant_id
-                if tenant_id not in notion_credentials_tenant_mapping:
-                    notion_credentials_tenant_mapping[tenant_id] = []
-                notion_credentials_tenant_mapping[tenant_id].append(notion_credential)
-            for tenant_id, notion_tenant_credentials in notion_credentials_tenant_mapping.items():
-                tenant = db.session.query(Tenant).filter_by(id=tenant_id).first()
-                if not tenant:
-                    continue
-                try:
-                    # check notion plugin is installed
-                    installed_plugins = installer_manager.list_plugins(tenant_id)
-                    installed_plugins_ids = [plugin.plugin_id for plugin in installed_plugins]
-                    if notion_plugin_id not in installed_plugins_ids:
-                        if notion_plugin_unique_identifier:
-                            # install notion plugin
-                            PluginService.install_from_marketplace_pkg(tenant_id, [notion_plugin_unique_identifier])
-                    auth_count = 0
-                    for notion_tenant_credential in notion_tenant_credentials:
-                        auth_count += 1
-                        # get credential oauth params
-                        access_token = notion_tenant_credential.access_token
-                        # notion info
-                        notion_info = notion_tenant_credential.source_info
-                        workspace_id = notion_info.get("workspace_id")
-                        workspace_name = notion_info.get("workspace_name")
-                        workspace_icon = notion_info.get("workspace_icon")
-                        new_credentials = {
-                            "integration_secret": encrypter.encrypt_token(tenant_id, access_token),
-                            "workspace_id": workspace_id,
-                            "workspace_name": workspace_name,
-                            "workspace_icon": workspace_icon,
-                        }
-                        datasource_provider = DatasourceProvider(
-                            provider="notion_datasource",
-                            tenant_id=tenant_id,
-                            plugin_id=notion_plugin_id,
-                            auth_type=oauth_credential_type.value,
-                            encrypted_credentials=new_credentials,
-                            name=f"Auth {auth_count}",
-                            avatar_url=workspace_icon or "default",
-                            is_default=False,
-                        )
-                        db.session.add(datasource_provider)
-                        deal_notion_count += 1
-                except Exception as e:
-                    click.echo(
-                        click.style(
-                            f"Error transforming notion credentials: {str(e)}, tenant_id: {tenant_id}", fg="red"
-                        )
-                    )
-                    continue
-                db.session.commit()
-        # deal firecrawl credentials
-        deal_firecrawl_count = 0
-        firecrawl_credentials = db.session.query(DataSourceApiKeyAuthBinding).filter_by(provider="firecrawl").all()
-        if firecrawl_credentials:
-            firecrawl_credentials_tenant_mapping: dict[str, list[DataSourceApiKeyAuthBinding]] = {}
-            for firecrawl_credential in firecrawl_credentials:
-                tenant_id = firecrawl_credential.tenant_id
-                if tenant_id not in firecrawl_credentials_tenant_mapping:
-                    firecrawl_credentials_tenant_mapping[tenant_id] = []
-                firecrawl_credentials_tenant_mapping[tenant_id].append(firecrawl_credential)
-            for tenant_id, firecrawl_tenant_credentials in firecrawl_credentials_tenant_mapping.items():
-                tenant = db.session.query(Tenant).filter_by(id=tenant_id).first()
-                if not tenant:
-                    continue
-                try:
-                    # check firecrawl plugin is installed
-                    installed_plugins = installer_manager.list_plugins(tenant_id)
-                    installed_plugins_ids = [plugin.plugin_id for plugin in installed_plugins]
-                    if firecrawl_plugin_id not in installed_plugins_ids:
-                        if firecrawl_plugin_unique_identifier:
-                            # install firecrawl plugin
-                            PluginService.install_from_marketplace_pkg(tenant_id, [firecrawl_plugin_unique_identifier])
-
-                    auth_count = 0
-                    for firecrawl_tenant_credential in firecrawl_tenant_credentials:
-                        auth_count += 1
-                        if not firecrawl_tenant_credential.credentials:
-                            click.echo(
-                                click.style(
-                                    f"Skipping firecrawl credential for tenant {tenant_id} due to missing credentials.",
-                                    fg="yellow",
-                                )
-                            )
-                            continue
-                        # get credential api key
-                        credentials_json = json.loads(firecrawl_tenant_credential.credentials)
-                        api_key = credentials_json.get("config", {}).get("api_key")
-                        base_url = credentials_json.get("config", {}).get("base_url")
-                        new_credentials = {
-                            "firecrawl_api_key": api_key,
-                            "base_url": base_url,
-                        }
-                        datasource_provider = DatasourceProvider(
-                            provider="firecrawl",
-                            tenant_id=tenant_id,
-                            plugin_id=firecrawl_plugin_id,
-                            auth_type=api_key_credential_type.value,
-                            encrypted_credentials=new_credentials,
-                            name=f"Auth {auth_count}",
-                            avatar_url="default",
-                            is_default=False,
-                        )
-                        db.session.add(datasource_provider)
-                        deal_firecrawl_count += 1
-                except Exception as e:
-                    click.echo(
-                        click.style(
-                            f"Error transforming firecrawl credentials: {str(e)}, tenant_id: {tenant_id}", fg="red"
-                        )
-                    )
-                    continue
-                db.session.commit()
-        # deal jina credentials
-        deal_jina_count = 0
-        jina_credentials = db.session.query(DataSourceApiKeyAuthBinding).filter_by(provider="jinareader").all()
-        if jina_credentials:
-            jina_credentials_tenant_mapping: dict[str, list[DataSourceApiKeyAuthBinding]] = {}
-            for jina_credential in jina_credentials:
-                tenant_id = jina_credential.tenant_id
-                if tenant_id not in jina_credentials_tenant_mapping:
-                    jina_credentials_tenant_mapping[tenant_id] = []
-                jina_credentials_tenant_mapping[tenant_id].append(jina_credential)
-            for tenant_id, jina_tenant_credentials in jina_credentials_tenant_mapping.items():
-                tenant = db.session.query(Tenant).filter_by(id=tenant_id).first()
-                if not tenant:
-                    continue
-                try:
-                    # check jina plugin is installed
-                    installed_plugins = installer_manager.list_plugins(tenant_id)
-                    installed_plugins_ids = [plugin.plugin_id for plugin in installed_plugins]
-                    if jina_plugin_id not in installed_plugins_ids:
-                        if jina_plugin_unique_identifier:
-                            # install jina plugin
-                            logger.debug("Installing Jina plugin %s", jina_plugin_unique_identifier)
-                            PluginService.install_from_marketplace_pkg(tenant_id, [jina_plugin_unique_identifier])
-
-                    auth_count = 0
-                    for jina_tenant_credential in jina_tenant_credentials:
-                        auth_count += 1
-                        if not jina_tenant_credential.credentials:
-                            click.echo(
-                                click.style(
-                                    f"Skipping jina credential for tenant {tenant_id} due to missing credentials.",
-                                    fg="yellow",
-                                )
-                            )
-                            continue
-                        # get credential api key
-                        credentials_json = json.loads(jina_tenant_credential.credentials)
-                        api_key = credentials_json.get("config", {}).get("api_key")
-                        new_credentials = {
-                            "integration_secret": api_key,
-                        }
-                        datasource_provider = DatasourceProvider(
-                            provider="jinareader",
-                            tenant_id=tenant_id,
-                            plugin_id=jina_plugin_id,
-                            auth_type=api_key_credential_type.value,
-                            encrypted_credentials=new_credentials,
-                            name=f"Auth {auth_count}",
-                            avatar_url="default",
-                            is_default=False,
-                        )
-                        db.session.add(datasource_provider)
-                        deal_jina_count += 1
-                except Exception as e:
-                    click.echo(
-                        click.style(f"Error transforming jina credentials: {str(e)}, tenant_id: {tenant_id}", fg="red")
-                    )
-                    continue
-                db.session.commit()
-    except Exception as e:
-        click.echo(click.style(f"Error parsing client params: {str(e)}", fg="red"))
-        return
-    click.echo(click.style(f"Transforming notion successfully. deal_notion_count: {deal_notion_count}", fg="green"))
-    click.echo(
-        click.style(f"Transforming firecrawl successfully. deal_firecrawl_count: {deal_firecrawl_count}", fg="green")
-    )
-    click.echo(click.style(f"Transforming jina successfully. deal_jina_count: {deal_jina_count}", fg="green"))
-
-
-@click.command("migrate-data-for-plugin", help="Migrate data for plugin.")
-def migrate_data_for_plugin():
-    """
-    Migrate data for plugin.
-    """
-    click.echo(click.style("Starting migrate data for plugin.", fg="white"))
-
-    PluginDataMigration.migrate()
-
-    click.echo(click.style("Migrate data for plugin completed.", fg="green"))
-
-
-@click.command("extract-plugins", help="Extract plugins.")
-@click.option("--output_file", prompt=True, help="The file to store the extracted plugins.", default="plugins.jsonl")
-@click.option("--workers", prompt=True, help="The number of workers to extract plugins.", default=10)
-def extract_plugins(output_file: str, workers: int):
-    """
-    Extract plugins.
-    """
-    click.echo(click.style("Starting extract plugins.", fg="white"))
-
-    PluginMigration.extract_plugins(output_file, workers)
-
-    click.echo(click.style("Extract plugins completed.", fg="green"))
-
-
-@click.command("extract-unique-identifiers", help="Extract unique identifiers.")
-@click.option(
-    "--output_file",
-    prompt=True,
-    help="The file to store the extracted unique identifiers.",
-    default="unique_identifiers.json",
-)
-@click.option(
-    "--input_file", prompt=True, help="The file to store the extracted unique identifiers.", default="plugins.jsonl"
-)
-def extract_unique_plugins(output_file: str, input_file: str):
-    """
-    Extract unique plugins.
-    """
-    click.echo(click.style("Starting extract unique plugins.", fg="white"))
-
-    PluginMigration.extract_unique_plugins_to_file(input_file, output_file)
-
-    click.echo(click.style("Extract unique plugins completed.", fg="green"))
-
-
-@click.command("install-plugins", help="Install plugins.")
-@click.option(
-    "--input_file", prompt=True, help="The file to store the extracted unique identifiers.", default="plugins.jsonl"
-)
-@click.option(
-    "--output_file", prompt=True, help="The file to store the installed plugins.", default="installed_plugins.jsonl"
-)
-@click.option("--workers", prompt=True, help="The number of workers to install plugins.", default=100)
-def install_plugins(input_file: str, output_file: str, workers: int):
-    """
-    Install plugins.
-    """
-    click.echo(click.style("Starting install plugins.", fg="white"))
-
-    PluginMigration.install_plugins(input_file, output_file, workers)
-
-    click.echo(click.style("Install plugins completed.", fg="green"))
-
-
-@click.command("install-rag-pipeline-plugins", help="Install rag pipeline plugins.")
-@click.option(
-    "--input_file", prompt=True, help="The file to store the extracted unique identifiers.", default="plugins.jsonl"
-)
-@click.option(
-    "--output_file", prompt=True, help="The file to store the installed plugins.", default="installed_plugins.jsonl"
-)
-@click.option("--workers", prompt=True, help="The number of workers to install plugins.", default=100)
-def install_rag_pipeline_plugins(input_file, output_file, workers):
-    """
-    Install rag pipeline plugins
-    """
-    click.echo(click.style("Installing rag pipeline plugins", fg="yellow"))
-    plugin_migration = PluginMigration()
-    plugin_migration.install_rag_pipeline_plugins(
-        input_file,
-        output_file,
-        workers,
-    )
-    click.echo(click.style("Installing rag pipeline plugins successfully", fg="green"))
@@ -1,830 +0,0 @@
-import datetime
-import logging
-import time
-from typing import Any
-
-import click
-import sqlalchemy as sa
-
-from extensions.ext_database import db
-from libs.datetime_utils import naive_utc_now
-from services.clear_free_plan_tenant_expired_logs import ClearFreePlanTenantExpiredLogs
-from services.retention.conversation.messages_clean_policy import create_message_clean_policy
-from services.retention.conversation.messages_clean_service import MessagesCleanService
-from services.retention.workflow_run.clear_free_plan_expired_workflow_run_logs import WorkflowRunCleanup
-from tasks.remove_app_and_related_data_task import delete_draft_variables_batch
-
-logger = logging.getLogger(__name__)
-
-
-@click.command("clear-free-plan-tenant-expired-logs", help="Clear free plan tenant expired logs.")
-@click.option("--days", prompt=True, help="The days to clear free plan tenant expired logs.", default=30)
-@click.option("--batch", prompt=True, help="The batch size to clear free plan tenant expired logs.", default=100)
-@click.option(
-    "--tenant_ids",
-    prompt=True,
-    multiple=True,
-    help="The tenant ids to clear free plan tenant expired logs.",
-)
-def clear_free_plan_tenant_expired_logs(days: int, batch: int, tenant_ids: list[str]):
-    """
-    Clear free plan tenant expired logs.
-    """
-    click.echo(click.style("Starting clear free plan tenant expired logs.", fg="white"))
-
-    ClearFreePlanTenantExpiredLogs.process(days, batch, tenant_ids)
-
-    click.echo(click.style("Clear free plan tenant expired logs completed.", fg="green"))
-
-
-@click.command("clean-workflow-runs", help="Clean expired workflow runs and related data for free tenants.")
-@click.option(
-    "--before-days",
-    "--days",
-    default=30,
-    show_default=True,
-    type=click.IntRange(min=0),
-    help="Delete workflow runs created before N days ago.",
-)
-@click.option("--batch-size", default=200, show_default=True, help="Batch size for selecting workflow runs.")
-@click.option(
-    "--from-days-ago",
-    default=None,
-    type=click.IntRange(min=0),
-    help="Lower bound in days ago (older). Must be paired with --to-days-ago.",
-)
-@click.option(
-    "--to-days-ago",
-    default=None,
-    type=click.IntRange(min=0),
-    help="Upper bound in days ago (newer). Must be paired with --from-days-ago.",
-)
-@click.option(
-    "--start-from",
-    type=click.DateTime(formats=["%Y-%m-%d", "%Y-%m-%dT%H:%M:%S"]),
-    default=None,
-    help="Optional lower bound (inclusive) for created_at; must be paired with --end-before.",
-)
-@click.option(
-    "--end-before",
-    type=click.DateTime(formats=["%Y-%m-%d", "%Y-%m-%dT%H:%M:%S"]),
-    default=None,
-    help="Optional upper bound (exclusive) for created_at; must be paired with --start-from.",
-)
-@click.option(
-    "--dry-run",
-    is_flag=True,
-    help="Preview cleanup results without deleting any workflow run data.",
-)
-def clean_workflow_runs(
-    before_days: int,
-    batch_size: int,
-    from_days_ago: int | None,
-    to_days_ago: int | None,
-    start_from: datetime.datetime | None,
-    end_before: datetime.datetime | None,
-    dry_run: bool,
-):
-    """
-    Clean workflow runs and related workflow data for free tenants.
-    """
-    if (start_from is None) ^ (end_before is None):
-        raise click.UsageError("--start-from and --end-before must be provided together.")
-
-    if (from_days_ago is None) ^ (to_days_ago is None):
-        raise click.UsageError("--from-days-ago and --to-days-ago must be provided together.")
-
-    if from_days_ago is not None and to_days_ago is not None:
-        if start_from or end_before:
-            raise click.UsageError("Choose either day offsets or explicit dates, not both.")
-        if from_days_ago <= to_days_ago:
-            raise click.UsageError("--from-days-ago must be greater than --to-days-ago.")
-        now = datetime.datetime.now()
-        start_from = now - datetime.timedelta(days=from_days_ago)
-        end_before = now - datetime.timedelta(days=to_days_ago)
-        before_days = 0
-
-    start_time = datetime.datetime.now(datetime.UTC)
-    click.echo(click.style(f"Starting workflow run cleanup at {start_time.isoformat()}.", fg="white"))
-
-    WorkflowRunCleanup(
-        days=before_days,
-        batch_size=batch_size,
-        start_from=start_from,
-        end_before=end_before,
-        dry_run=dry_run,
-    ).run()
-
-    end_time = datetime.datetime.now(datetime.UTC)
-    elapsed = end_time - start_time
-    click.echo(
-        click.style(
-            f"Workflow run cleanup completed. start={start_time.isoformat()} "
-            f"end={end_time.isoformat()} duration={elapsed}",
-            fg="green",
-        )
-    )
-
-
-@click.command(
-    "archive-workflow-runs",
-    help="Archive workflow runs for paid plan tenants to S3-compatible storage.",
-)
-@click.option("--tenant-ids", default=None, help="Optional comma-separated tenant IDs for grayscale rollout.")
-@click.option("--before-days", default=90, show_default=True, help="Archive runs older than N days.")
-@click.option(
-    "--from-days-ago",
-    default=None,
-    type=click.IntRange(min=0),
-    help="Lower bound in days ago (older). Must be paired with --to-days-ago.",
-)
-@click.option(
-    "--to-days-ago",
-    default=None,
-    type=click.IntRange(min=0),
-    help="Upper bound in days ago (newer). Must be paired with --from-days-ago.",
-)
-@click.option(
-    "--start-from",
-    type=click.DateTime(formats=["%Y-%m-%d", "%Y-%m-%dT%H:%M:%S"]),
-    default=None,
-    help="Archive runs created at or after this timestamp (UTC if no timezone).",
-)
-@click.option(
-    "--end-before",
-    type=click.DateTime(formats=["%Y-%m-%d", "%Y-%m-%dT%H:%M:%S"]),
-    default=None,
-    help="Archive runs created before this timestamp (UTC if no timezone).",
-)
-@click.option("--batch-size", default=100, show_default=True, help="Batch size for processing.")
-@click.option("--workers", default=1, show_default=True, type=int, help="Concurrent workflow runs to archive.")
-@click.option("--limit", default=None, type=int, help="Maximum number of runs to archive.")
-@click.option("--dry-run", is_flag=True, help="Preview without archiving.")
-@click.option("--delete-after-archive", is_flag=True, help="Delete runs and related data after archiving.")
-def archive_workflow_runs(
-    tenant_ids: str | None,
-    before_days: int,
-    from_days_ago: int | None,
-    to_days_ago: int | None,
-    start_from: datetime.datetime | None,
-    end_before: datetime.datetime | None,
-    batch_size: int,
-    workers: int,
-    limit: int | None,
-    dry_run: bool,
-    delete_after_archive: bool,
-):
-    """
-    Archive workflow runs for paid plan tenants older than the specified days.
-
-    This command archives the following tables to storage:
-    - workflow_node_executions
-    - workflow_node_execution_offload
-    - workflow_pauses
-    - workflow_pause_reasons
-    - workflow_trigger_logs
-
-    The workflow_runs and workflow_app_logs tables are preserved for UI listing.
-    """
-    from services.retention.workflow_run.archive_paid_plan_workflow_run import WorkflowRunArchiver
-
-    run_started_at = datetime.datetime.now(datetime.UTC)
-    click.echo(
-        click.style(
-            f"Starting workflow run archiving at {run_started_at.isoformat()}.",
-            fg="white",
-        )
-    )
-
-    if (start_from is None) ^ (end_before is None):
-        click.echo(click.style("start-from and end-before must be provided together.", fg="red"))
-        return
-
-    if (from_days_ago is None) ^ (to_days_ago is None):
-        click.echo(click.style("from-days-ago and to-days-ago must be provided together.", fg="red"))
-        return
-
-    if from_days_ago is not None and to_days_ago is not None:
-        if start_from or end_before:
-            click.echo(click.style("Choose either day offsets or explicit dates, not both.", fg="red"))
-            return
-        if from_days_ago <= to_days_ago:
-            click.echo(click.style("from-days-ago must be greater than to-days-ago.", fg="red"))
-            return
-        now = datetime.datetime.now()
-        start_from = now - datetime.timedelta(days=from_days_ago)
-        end_before = now - datetime.timedelta(days=to_days_ago)
-        before_days = 0
-
-    if start_from and end_before and start_from >= end_before:
-        click.echo(click.style("start-from must be earlier than end-before.", fg="red"))
-        return
-    if workers < 1:
-        click.echo(click.style("workers must be at least 1.", fg="red"))
-        return
-
-    archiver = WorkflowRunArchiver(
-        days=before_days,
-        batch_size=batch_size,
-        start_from=start_from,
-        end_before=end_before,
-        workers=workers,
-        tenant_ids=[tid.strip() for tid in tenant_ids.split(",")] if tenant_ids else None,
-        limit=limit,
-        dry_run=dry_run,
-        delete_after_archive=delete_after_archive,
-    )
-    summary = archiver.run()
-    click.echo(
-        click.style(
-            f"Summary: processed={summary.total_runs_processed}, archived={summary.runs_archived}, "
-            f"skipped={summary.runs_skipped}, failed={summary.runs_failed}, "
-            f"time={summary.total_elapsed_time:.2f}s",
-            fg="cyan",
-        )
-    )
-
-    run_finished_at = datetime.datetime.now(datetime.UTC)
-    elapsed = run_finished_at - run_started_at
-    click.echo(
-        click.style(
-            f"Workflow run archiving completed. start={run_started_at.isoformat()} "
-            f"end={run_finished_at.isoformat()} duration={elapsed}",
-            fg="green",
-        )
-    )
-
-
-@click.command(
-    "restore-workflow-runs",
-    help="Restore archived workflow runs from S3-compatible storage.",
-)
-@click.option(
-    "--tenant-ids",
-    required=False,
-    help="Tenant IDs (comma-separated).",
-)
-@click.option("--run-id", required=False, help="Workflow run ID to restore.")
-@click.option(
-    "--start-from",
-    type=click.DateTime(formats=["%Y-%m-%d", "%Y-%m-%dT%H:%M:%S"]),
-    default=None,
-    help="Optional lower bound (inclusive) for created_at; must be paired with --end-before.",
-)
-@click.option(
-    "--end-before",
-    type=click.DateTime(formats=["%Y-%m-%d", "%Y-%m-%dT%H:%M:%S"]),
-    default=None,
-    help="Optional upper bound (exclusive) for created_at; must be paired with --start-from.",
-)
-@click.option("--workers", default=1, show_default=True, type=int, help="Concurrent workflow runs to restore.")
-@click.option("--limit", type=int, default=100, show_default=True, help="Maximum number of runs to restore.")
-@click.option("--dry-run", is_flag=True, help="Preview without restoring.")
-def restore_workflow_runs(
-    tenant_ids: str | None,
-    run_id: str | None,
-    start_from: datetime.datetime | None,
-    end_before: datetime.datetime | None,
-    workers: int,
-    limit: int,
-    dry_run: bool,
-):
-    """
-    Restore an archived workflow run from storage to the database.
-
-    This restores the following tables:
-    - workflow_node_executions
-    - workflow_node_execution_offload
-    - workflow_pauses
-    - workflow_pause_reasons
-    - workflow_trigger_logs
-    """
-    from services.retention.workflow_run.restore_archived_workflow_run import WorkflowRunRestore
-
-    parsed_tenant_ids = None
-    if tenant_ids:
-        parsed_tenant_ids = [tid.strip() for tid in tenant_ids.split(",") if tid.strip()]
-        if not parsed_tenant_ids:
-            raise click.BadParameter("tenant-ids must not be empty")
-
-    if (start_from is None) ^ (end_before is None):
-        raise click.UsageError("--start-from and --end-before must be provided together.")
-    if run_id is None and (start_from is None or end_before is None):
-        raise click.UsageError("--start-from and --end-before are required for batch restore.")
-    if workers < 1:
-        raise click.BadParameter("workers must be at least 1")
-
-    start_time = datetime.datetime.now(datetime.UTC)
-    click.echo(
-        click.style(
-            f"Starting restore of workflow run {run_id} at {start_time.isoformat()}.",
-            fg="white",
-        )
-    )
-
-    restorer = WorkflowRunRestore(dry_run=dry_run, workers=workers)
-    if run_id:
-        results = [restorer.restore_by_run_id(run_id)]
-    else:
-        assert start_from is not None
-        assert end_before is not None
-        results = restorer.restore_batch(
-            parsed_tenant_ids,
-            start_date=start_from,
-            end_date=end_before,
-            limit=limit,
-        )
-
-    end_time = datetime.datetime.now(datetime.UTC)
-    elapsed = end_time - start_time
-
-    successes = sum(1 for result in results if result.success)
-    failures = len(results) - successes
-
-    if failures == 0:
-        click.echo(
-            click.style(
-                f"Restore completed successfully. success={successes} duration={elapsed}",
-                fg="green",
-            )
-        )
-    else:
-        click.echo(
-            click.style(
-                f"Restore completed with failures. success={successes} failed={failures} duration={elapsed}",
-                fg="red",
-            )
-        )
-
-
-@click.command(
-    "delete-archived-workflow-runs",
-    help="Delete archived workflow runs from the database.",
-)
-@click.option(
-    "--tenant-ids",
-    required=False,
-    help="Tenant IDs (comma-separated).",
-)
-@click.option("--run-id", required=False, help="Workflow run ID to delete.")
-@click.option(
-    "--start-from",
-    type=click.DateTime(formats=["%Y-%m-%d", "%Y-%m-%dT%H:%M:%S"]),
-    default=None,
-    help="Optional lower bound (inclusive) for created_at; must be paired with --end-before.",
-)
-@click.option(
-    "--end-before",
-    type=click.DateTime(formats=["%Y-%m-%d", "%Y-%m-%dT%H:%M:%S"]),
-    default=None,
-    help="Optional upper bound (exclusive) for created_at; must be paired with --start-from.",
-)
-@click.option("--limit", type=int, default=100, show_default=True, help="Maximum number of runs to delete.")
-@click.option("--dry-run", is_flag=True, help="Preview without deleting.")
-def delete_archived_workflow_runs(
-    tenant_ids: str | None,
-    run_id: str | None,
-    start_from: datetime.datetime | None,
-    end_before: datetime.datetime | None,
-    limit: int,
-    dry_run: bool,
-):
-    """
-    Delete archived workflow runs from the database.
-    """
-    from services.retention.workflow_run.delete_archived_workflow_run import ArchivedWorkflowRunDeletion
-
-    parsed_tenant_ids = None
-    if tenant_ids:
-        parsed_tenant_ids = [tid.strip() for tid in tenant_ids.split(",") if tid.strip()]
-        if not parsed_tenant_ids:
-            raise click.BadParameter("tenant-ids must not be empty")
-
-    if (start_from is None) ^ (end_before is None):
-        raise click.UsageError("--start-from and --end-before must be provided together.")
-    if run_id is None and (start_from is None or end_before is None):
-        raise click.UsageError("--start-from and --end-before are required for batch delete.")
-
-    start_time = datetime.datetime.now(datetime.UTC)
-    target_desc = f"workflow run {run_id}" if run_id else "workflow runs"
-    click.echo(
-        click.style(
-            f"Starting delete of {target_desc} at {start_time.isoformat()}.",
-            fg="white",
-        )
-    )
-
-    deleter = ArchivedWorkflowRunDeletion(dry_run=dry_run)
-    if run_id:
-        results = [deleter.delete_by_run_id(run_id)]
-    else:
-        assert start_from is not None
-        assert end_before is not None
-        results = deleter.delete_batch(
-            parsed_tenant_ids,
-            start_date=start_from,
-            end_date=end_before,
-            limit=limit,
-        )
-
-    for result in results:
-        if result.success:
-            click.echo(
-                click.style(
-                    f"{'[DRY RUN] Would delete' if dry_run else 'Deleted'} "
-                    f"workflow run {result.run_id} (tenant={result.tenant_id})",
-                    fg="green",
-                )
-            )
-        else:
-            click.echo(
-                click.style(
-                    f"Failed to delete workflow run {result.run_id}: {result.error}",
-                    fg="red",
-                )
-            )
-
-    end_time = datetime.datetime.now(datetime.UTC)
-    elapsed = end_time - start_time
-
-    successes = sum(1 for result in results if result.success)
-    failures = len(results) - successes
-
-    if failures == 0:
-        click.echo(
-            click.style(
-                f"Delete completed successfully. success={successes} duration={elapsed}",
-                fg="green",
-            )
-        )
-    else:
-        click.echo(
-            click.style(
-                f"Delete completed with failures. success={successes} failed={failures} duration={elapsed}",
-                fg="red",
-            )
-        )
-
-
-def _find_orphaned_draft_variables(batch_size: int = 1000) -> list[str]:
-    """
-    Find draft variables that reference non-existent apps.
-
-    Args:
-        batch_size: Maximum number of orphaned app IDs to return
-
-    Returns:
-        List of app IDs that have draft variables but don't exist in the apps table
-    """
-    query = """
-        SELECT DISTINCT wdv.app_id
-        FROM workflow_draft_variables AS wdv
-        WHERE NOT EXISTS(
-            SELECT 1 FROM apps WHERE apps.id = wdv.app_id
-        )
-        LIMIT :batch_size
-    """
-
-    with db.engine.connect() as conn:
-        result = conn.execute(sa.text(query), {"batch_size": batch_size})
-        return [row[0] for row in result]
-
-
-def _count_orphaned_draft_variables() -> dict[str, Any]:
-    """
-    Count orphaned draft variables by app, including associated file counts.
-
-    Returns:
-        Dictionary with statistics about orphaned variables and files
-    """
-    # Count orphaned variables by app
-    variables_query = """
-        SELECT
-            wdv.app_id,
-            COUNT(*) as variable_count,
-            COUNT(wdv.file_id) as file_count
-        FROM workflow_draft_variables AS wdv
-        WHERE NOT EXISTS(
-            SELECT 1 FROM apps WHERE apps.id = wdv.app_id
-        )
-        GROUP BY wdv.app_id
-        ORDER BY variable_count DESC
-    """
-
-    with db.engine.connect() as conn:
-        result = conn.execute(sa.text(variables_query))
-        orphaned_by_app = {}
-        total_files = 0
-
-        for row in result:
-            app_id, variable_count, file_count = row
-            orphaned_by_app[app_id] = {"variables": variable_count, "files": file_count}
-            total_files += file_count
-
-        total_orphaned = sum(app_data["variables"] for app_data in orphaned_by_app.values())
-        app_count = len(orphaned_by_app)
-
-        return {
-            "total_orphaned_variables": total_orphaned,
-            "total_orphaned_files": total_files,
-            "orphaned_app_count": app_count,
-            "orphaned_by_app": orphaned_by_app,
-        }
-
-
-@click.command()
-@click.option("--dry-run", is_flag=True, help="Show what would be deleted without actually deleting")
-@click.option("--batch-size", default=1000, help="Number of records to process per batch (default 1000)")
-@click.option("--max-apps", default=None, type=int, help="Maximum number of apps to process (default: no limit)")
-@click.option("-f", "--force", is_flag=True, help="Skip user confirmation and force the command to execute.")
-def cleanup_orphaned_draft_variables(
-    dry_run: bool,
-    batch_size: int,
-    max_apps: int | None,
-    force: bool = False,
-):
-    """
-    Clean up orphaned draft variables from the database.
-
-    This script finds and removes draft variables that belong to apps
-    that no longer exist in the database.
-    """
-    logger = logging.getLogger(__name__)
-
-    # Get statistics
-    stats = _count_orphaned_draft_variables()
-
-    logger.info("Found %s orphaned draft variables", stats["total_orphaned_variables"])
-    logger.info("Found %s associated offload files", stats["total_orphaned_files"])
-    logger.info("Across %s non-existent apps", stats["orphaned_app_count"])
-
-    if stats["total_orphaned_variables"] == 0:
-        logger.info("No orphaned draft variables found. Exiting.")
-        return
-
-    if dry_run:
-        logger.info("DRY RUN: Would delete the following:")
-        for app_id, data in sorted(stats["orphaned_by_app"].items(), key=lambda x: x[1]["variables"], reverse=True)[
-            :10
-        ]:  # Show top 10
-            logger.info("  App %s: %s variables, %s files", app_id, data["variables"], data["files"])
-        if len(stats["orphaned_by_app"]) > 10:
-            logger.info("  ... and %s more apps", len(stats["orphaned_by_app"]) - 10)
-        return
-
-    # Confirm deletion
-    if not force:
-        click.confirm(
-            f"Are you sure you want to delete {stats['total_orphaned_variables']} "
-            f"orphaned draft variables and {stats['total_orphaned_files']} associated files "
-            f"from {stats['orphaned_app_count']} apps?",
-            abort=True,
-        )
-
-    total_deleted = 0
-    processed_apps = 0
-
-    while True:
-        if max_apps and processed_apps >= max_apps:
-            logger.info("Reached maximum app limit (%s). Stopping.", max_apps)
-            break
-
-        orphaned_app_ids = _find_orphaned_draft_variables(batch_size=10)
-        if not orphaned_app_ids:
-            logger.info("No more orphaned draft variables found.")
-            break
-
-        for app_id in orphaned_app_ids:
-            if max_apps and processed_apps >= max_apps:
-                break
-
-            try:
-                deleted_count = delete_draft_variables_batch(app_id, batch_size)
-                total_deleted += deleted_count
-                processed_apps += 1
-
-                logger.info("Deleted %s variables for app %s", deleted_count, app_id)
-
-            except Exception:
-                logger.exception("Error processing app %s", app_id)
-                continue
-
-    logger.info("Cleanup completed. Total deleted: %s variables across %s apps", total_deleted, processed_apps)
-
-
-@click.command("clean-expired-messages", help="Clean expired messages.")
-@click.option(
-    "--start-from",
-    type=click.DateTime(formats=["%Y-%m-%d", "%Y-%m-%dT%H:%M:%S"]),
-    required=False,
-    default=None,
-    help="Lower bound (inclusive) for created_at.",
-)
-@click.option(
-    "--end-before",
-    type=click.DateTime(formats=["%Y-%m-%d", "%Y-%m-%dT%H:%M:%S"]),
-    required=False,
-    default=None,
-    help="Upper bound (exclusive) for created_at.",
-)
-@click.option(
-    "--from-days-ago",
-    type=int,
-    default=None,
-    help="Relative lower bound in days ago (inclusive). Must be used with --before-days.",
-)
-@click.option(
-    "--before-days",
-    type=int,
-    default=None,
-    help="Relative upper bound in days ago (exclusive). Required for relative mode.",
-)
-@click.option("--batch-size", default=1000, show_default=True, help="Batch size for selecting messages.")
-@click.option(
-    "--graceful-period",
-    default=21,
-    show_default=True,
-    help="Graceful period in days after subscription expiration, will be ignored when billing is disabled.",
-)
-@click.option("--dry-run", is_flag=True, default=False, help="Show messages logs would be cleaned without deleting")
-def clean_expired_messages(
-    batch_size: int,
-    graceful_period: int,
-    start_from: datetime.datetime | None,
-    end_before: datetime.datetime | None,
-    from_days_ago: int | None,
-    before_days: int | None,
-    dry_run: bool,
-):
-    """
-    Clean expired messages and related data for tenants based on clean policy.
-    """
-    click.echo(click.style("clean_messages: start clean messages.", fg="green"))
-
-    start_at = time.perf_counter()
-
-    try:
-        abs_mode = start_from is not None and end_before is not None
-        rel_mode = before_days is not None
-
-        if abs_mode and rel_mode:
-            raise click.UsageError(
-                "Options are mutually exclusive: use either (--start-from,--end-before) "
-                "or (--from-days-ago,--before-days)."
-            )
-
-        if from_days_ago is not None and before_days is None:
-            raise click.UsageError("--from-days-ago must be used together with --before-days.")
-
-        if (start_from is None) ^ (end_before is None):
-            raise click.UsageError("Both --start-from and --end-before are required when using absolute time range.")
-
-        if not abs_mode and not rel_mode:
-            raise click.UsageError(
-                "You must provide either (--start-from,--end-before) or (--before-days [--from-days-ago])."
-            )
-
-        if rel_mode:
-            assert before_days is not None
-            if before_days < 0:
-                raise click.UsageError("--before-days must be >= 0.")
-            if from_days_ago is not None:
-                if from_days_ago < 0:
-                    raise click.UsageError("--from-days-ago must be >= 0.")
-                if from_days_ago <= before_days:
-                    raise click.UsageError("--from-days-ago must be greater than --before-days.")
-
-        # Create policy based on billing configuration
-        # NOTE: graceful_period will be ignored when billing is disabled.
-        policy = create_message_clean_policy(graceful_period_days=graceful_period)
-
-        # Create and run the cleanup service
-        if abs_mode:
-            assert start_from is not None
-            assert end_before is not None
-            service = MessagesCleanService.from_time_range(
-                policy=policy,
-                start_from=start_from,
-                end_before=end_before,
-                batch_size=batch_size,
-                dry_run=dry_run,
-            )
-        elif from_days_ago is None:
-            assert before_days is not None
-            service = MessagesCleanService.from_days(
-                policy=policy,
-                days=before_days,
-                batch_size=batch_size,
-                dry_run=dry_run,
-            )
-        else:
-            assert before_days is not None
-            assert from_days_ago is not None
-            now = naive_utc_now()
-            service = MessagesCleanService.from_time_range(
-                policy=policy,
-                start_from=now - datetime.timedelta(days=from_days_ago),
-                end_before=now - datetime.timedelta(days=before_days),
-                batch_size=batch_size,
-                dry_run=dry_run,
-            )
-        stats = service.run()
-
-        end_at = time.perf_counter()
-        click.echo(
-            click.style(
-                f"clean_messages: completed successfully\n"
-                f"  - Latency: {end_at - start_at:.2f}s\n"
-                f"  - Batches processed: {stats['batches']}\n"
-                f"  - Total messages scanned: {stats['total_messages']}\n"
-                f"  - Messages filtered: {stats['filtered_messages']}\n"
-                f"  - Messages deleted: {stats['total_deleted']}",
-                fg="green",
-            )
-        )
-    except Exception as e:
-        end_at = time.perf_counter()
-        logger.exception("clean_messages failed")
-        click.echo(
-            click.style(
-                f"clean_messages: failed after {end_at - start_at:.2f}s - {str(e)}",
-                fg="red",
-            )
-        )
-        raise
-
-    click.echo(click.style("messages cleanup completed.", fg="green"))
-
-
-@click.command("export-app-messages", help="Export messages for an app to JSONL.GZ.")
-@click.option("--app-id", required=True, help="Application ID to export messages for.")
-@click.option(
-    "--start-from",
-    type=click.DateTime(formats=["%Y-%m-%d", "%Y-%m-%dT%H:%M:%S"]),
-    default=None,
-    help="Optional lower bound (inclusive) for created_at.",
-)
-@click.option(
-    "--end-before",
-    type=click.DateTime(formats=["%Y-%m-%d", "%Y-%m-%dT%H:%M:%S"]),
-    required=True,
-    help="Upper bound (exclusive) for created_at.",
-)
-@click.option(
-    "--filename",
-    required=True,
-    help="Base filename (relative path). Do not include suffix like .jsonl.gz.",
-)
-@click.option("--use-cloud-storage", is_flag=True, default=False, help="Upload to cloud storage instead of local file.")
-@click.option("--batch-size", default=1000, show_default=True, help="Batch size for cursor pagination.")
-@click.option("--dry-run", is_flag=True, default=False, help="Scan only, print stats without writing any file.")
-def export_app_messages(
-    app_id: str,
-    start_from: datetime.datetime | None,
-    end_before: datetime.datetime,
-    filename: str,
-    use_cloud_storage: bool,
-    batch_size: int,
-    dry_run: bool,
-):
-    if start_from and start_from >= end_before:
-        raise click.UsageError("--start-from must be before --end-before.")
-
-    from services.retention.conversation.message_export_service import AppMessageExportService
-
-    try:
-        validated_filename = AppMessageExportService.validate_export_filename(filename)
-    except ValueError as e:
-        raise click.BadParameter(str(e), param_hint="--filename") from e
-
-    click.echo(click.style(f"export_app_messages: starting export for app {app_id}.", fg="green"))
-    start_at = time.perf_counter()
-
-    try:
-        service = AppMessageExportService(
-            app_id=app_id,
-            end_before=end_before,
-            filename=validated_filename,
-            start_from=start_from,
-            batch_size=batch_size,
-            use_cloud_storage=use_cloud_storage,
-            dry_run=dry_run,
-        )
-        stats = service.run()
-
-        elapsed = time.perf_counter() - start_at
-        click.echo(
-            click.style(
-                f"export_app_messages: completed in {elapsed:.2f}s\n"
-                f"  - Batches: {stats.batches}\n"
-                f"  - Total messages: {stats.total_messages}\n"
-                f"  - Messages with feedback: {stats.messages_with_feedback}\n"
-                f"  - Total feedbacks: {stats.total_feedbacks}",
-                fg="green",
-            )
-        )
-    except Exception as e:
-        elapsed = time.perf_counter() - start_at
-        logger.exception("export_app_messages failed")
-        click.echo(click.style(f"export_app_messages: failed after {elapsed:.2f}s - {e}", fg="red"))
-        raise
@@ -1,755 +0,0 @@
-import json
-
-import click
-import sqlalchemy as sa
-
-from configs import dify_config
-from extensions.ext_database import db
-from extensions.ext_storage import storage
-from extensions.storage.opendal_storage import OpenDALStorage
-from extensions.storage.storage_type import StorageType
-from models.model import UploadFile
-
-
-@click.option("-f", "--force", is_flag=True, help="Skip user confirmation and force the command to execute.")
-@click.command("clear-orphaned-file-records", help="Clear orphaned file records.")
-def clear_orphaned_file_records(force: bool):
-    """
-    Clear orphaned file records in the database.
-    """
-
-    # define tables and columns to process
-    files_tables = [
-        {"table": "upload_files", "id_column": "id", "key_column": "key"},
-        {"table": "tool_files", "id_column": "id", "key_column": "file_key"},
-    ]
-    ids_tables = [
-        {"type": "uuid", "table": "message_files", "column": "upload_file_id"},
-        {"type": "text", "table": "documents", "column": "data_source_info"},
-        {"type": "text", "table": "document_segments", "column": "content"},
-        {"type": "text", "table": "messages", "column": "answer"},
-        {"type": "text", "table": "workflow_node_executions", "column": "inputs"},
-        {"type": "text", "table": "workflow_node_executions", "column": "process_data"},
-        {"type": "text", "table": "workflow_node_executions", "column": "outputs"},
-        {"type": "text", "table": "conversations", "column": "introduction"},
-        {"type": "text", "table": "conversations", "column": "system_instruction"},
-        {"type": "text", "table": "accounts", "column": "avatar"},
-        {"type": "text", "table": "apps", "column": "icon"},
-        {"type": "text", "table": "sites", "column": "icon"},
-        {"type": "json", "table": "messages", "column": "inputs"},
-        {"type": "json", "table": "messages", "column": "message"},
-    ]
-
-    # notify user and ask for confirmation
-    click.echo(
-        click.style(
-            "This command will first find and delete orphaned file records from the message_files table,", fg="yellow"
-        )
-    )
-    click.echo(
-        click.style(
-            "and then it will find and delete orphaned file records in the following tables:",
-            fg="yellow",
-        )
-    )
-    for files_table in files_tables:
-        click.echo(click.style(f"- {files_table['table']}", fg="yellow"))
-    click.echo(
-        click.style("The following tables and columns will be scanned to find orphaned file records:", fg="yellow")
-    )
-    for ids_table in ids_tables:
-        click.echo(click.style(f"- {ids_table['table']} ({ids_table['column']})", fg="yellow"))
-    click.echo("")
-
-    click.echo(click.style("!!! USE WITH CAUTION !!!", fg="red"))
-    click.echo(
-        click.style(
-            (
-                "Since not all patterns have been fully tested, "
-                "please note that this command may delete unintended file records."
-            ),
-            fg="yellow",
-        )
-    )
-    click.echo(
-        click.style("This cannot be undone. Please make sure to back up your database before proceeding.", fg="yellow")
-    )
-    click.echo(
-        click.style(
-            (
-                "It is also recommended to run this during the maintenance window, "
-                "as this may cause high load on your instance."
-            ),
-            fg="yellow",
-        )
-    )
-    if not force:
-        click.confirm("Do you want to proceed?", abort=True)
-
-    # start the cleanup process
-    click.echo(click.style("Starting orphaned file records cleanup.", fg="white"))
-
-    # clean up the orphaned records in the message_files table where message_id doesn't exist in messages table
-    try:
-        click.echo(
-            click.style("- Listing message_files records where message_id doesn't exist in messages table", fg="white")
-        )
-        query = (
-            "SELECT mf.id, mf.message_id "
-            "FROM message_files mf LEFT JOIN messages m ON mf.message_id = m.id "
-            "WHERE m.id IS NULL"
-        )
-        orphaned_message_files = []
-        with db.engine.begin() as conn:
-            rs = conn.execute(sa.text(query))
-            for i in rs:
-                orphaned_message_files.append({"id": str(i[0]), "message_id": str(i[1])})
-
-        if orphaned_message_files:
-            click.echo(click.style(f"Found {len(orphaned_message_files)} orphaned message_files records:", fg="white"))
-            for record in orphaned_message_files:
-                click.echo(click.style(f"  - id: {record['id']}, message_id: {record['message_id']}", fg="black"))
-
-            if not force:
-                click.confirm(
-                    (
-                        f"Do you want to proceed "
-                        f"to delete all {len(orphaned_message_files)} orphaned message_files records?"
-                    ),
-                    abort=True,
-                )
-
-            click.echo(click.style("- Deleting orphaned message_files records", fg="white"))
-            query = "DELETE FROM message_files WHERE id IN :ids"
-            with db.engine.begin() as conn:
-                conn.execute(sa.text(query), {"ids": tuple(record["id"] for record in orphaned_message_files)})
-            click.echo(
-                click.style(f"Removed {len(orphaned_message_files)} orphaned message_files records.", fg="green")
-            )
-        else:
-            click.echo(click.style("No orphaned message_files records found. There is nothing to delete.", fg="green"))
-    except Exception as e:
-        click.echo(click.style(f"Error deleting orphaned message_files records: {str(e)}", fg="red"))
-
-    # clean up the orphaned records in the rest of the *_files tables
-    try:
-        # fetch file id and keys from each table
-        all_files_in_tables = []
-        for files_table in files_tables:
-            click.echo(click.style(f"- Listing file records in table {files_table['table']}", fg="white"))
-            query = f"SELECT {files_table['id_column']}, {files_table['key_column']} FROM {files_table['table']}"
-            with db.engine.begin() as conn:
-                rs = conn.execute(sa.text(query))
-            for i in rs:
-                all_files_in_tables.append({"table": files_table["table"], "id": str(i[0]), "key": i[1]})
-        click.echo(click.style(f"Found {len(all_files_in_tables)} files in tables.", fg="white"))
-
-        # fetch referred table and columns
-        guid_regexp = "[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}"
-        all_ids_in_tables = []
-        for ids_table in ids_tables:
-            query = ""
-            match ids_table["type"]:
-                case "uuid":
-                    click.echo(
-                        click.style(
-                            f"- Listing file ids in column {ids_table['column']} in table {ids_table['table']}",
-                            fg="white",
-                        )
-                    )
-                    c = ids_table["column"]
-                    query = f"SELECT {c} FROM {ids_table['table']} WHERE {c} IS NOT NULL"
-                    with db.engine.begin() as conn:
-                        rs = conn.execute(sa.text(query))
-                    for i in rs:
-                        all_ids_in_tables.append({"table": ids_table["table"], "id": str(i[0])})
-                case "text":
-                    t = ids_table["table"]
-                    click.echo(
-                        click.style(
-                            f"- Listing file-id-like strings in column {ids_table['column']} in table {t}",
-                            fg="white",
-                        )
-                    )
-                    query = (
-                        f"SELECT regexp_matches({ids_table['column']}, '{guid_regexp}', 'g') AS extracted_id "
-                        f"FROM {ids_table['table']}"
-                    )
-                    with db.engine.begin() as conn:
-                        rs = conn.execute(sa.text(query))
-                    for i in rs:
-                        for j in i[0]:
-                            all_ids_in_tables.append({"table": ids_table["table"], "id": j})
-                case "json":
-                    click.echo(
-                        click.style(
-                            (
-                                f"- Listing file-id-like JSON string in column {ids_table['column']} "
-                                f"in table {ids_table['table']}"
-                            ),
-                            fg="white",
-                        )
-                    )
-                    query = (
-                        f"SELECT regexp_matches({ids_table['column']}::text, '{guid_regexp}', 'g') AS extracted_id "
-                        f"FROM {ids_table['table']}"
-                    )
-                    with db.engine.begin() as conn:
-                        rs = conn.execute(sa.text(query))
-                    for i in rs:
-                        for j in i[0]:
-                            all_ids_in_tables.append({"table": ids_table["table"], "id": j})
-                case _:
-                    pass
-        click.echo(click.style(f"Found {len(all_ids_in_tables)} file ids in tables.", fg="white"))
-
-    except Exception as e:
-        click.echo(click.style(f"Error fetching keys: {str(e)}", fg="red"))
-        return
-
-    # find orphaned files
-    all_files = [file["id"] for file in all_files_in_tables]
-    all_ids = [file["id"] for file in all_ids_in_tables]
-    orphaned_files = list(set(all_files) - set(all_ids))
-    if not orphaned_files:
-        click.echo(click.style("No orphaned file records found. There is nothing to delete.", fg="green"))
-        return
-    click.echo(click.style(f"Found {len(orphaned_files)} orphaned file records.", fg="white"))
-    for file in orphaned_files:
-        click.echo(click.style(f"- orphaned file id: {file}", fg="black"))
-    if not force:
-        click.confirm(f"Do you want to proceed to delete all {len(orphaned_files)} orphaned file records?", abort=True)
-
-    # delete orphaned records for each file
-    try:
-        for files_table in files_tables:
-            click.echo(click.style(f"- Deleting orphaned file records in table {files_table['table']}", fg="white"))
-            query = f"DELETE FROM {files_table['table']} WHERE {files_table['id_column']} IN :ids"
-            with db.engine.begin() as conn:
-                conn.execute(sa.text(query), {"ids": tuple(orphaned_files)})
-    except Exception as e:
-        click.echo(click.style(f"Error deleting orphaned file records: {str(e)}", fg="red"))
-        return
-    click.echo(click.style(f"Removed {len(orphaned_files)} orphaned file records.", fg="green"))
-
-
-@click.option("-f", "--force", is_flag=True, help="Skip user confirmation and force the command to execute.")
-@click.command("remove-orphaned-files-on-storage", help="Remove orphaned files on the storage.")
-def remove_orphaned_files_on_storage(force: bool):
-    """
-    Remove orphaned files on the storage.
-    """
-
-    # define tables and columns to process
-    files_tables = [
-        {"table": "upload_files", "key_column": "key"},
-        {"table": "tool_files", "key_column": "file_key"},
-    ]
-    storage_paths = ["image_files", "tools", "upload_files"]
-
-    # notify user and ask for confirmation
-    click.echo(click.style("This command will find and remove orphaned files on the storage,", fg="yellow"))
-    click.echo(
-        click.style("by comparing the files on the storage with the records in the following tables:", fg="yellow")
-    )
-    for files_table in files_tables:
-        click.echo(click.style(f"- {files_table['table']}", fg="yellow"))
-    click.echo(click.style("The following paths on the storage will be scanned to find orphaned files:", fg="yellow"))
-    for storage_path in storage_paths:
-        click.echo(click.style(f"- {storage_path}", fg="yellow"))
-    click.echo("")
-
-    click.echo(click.style("!!! USE WITH CAUTION !!!", fg="red"))
-    click.echo(
-        click.style(
-            "Currently, this command will work only for opendal based storage (STORAGE_TYPE=opendal).", fg="yellow"
-        )
-    )
-    click.echo(
-        click.style(
-            "Since not all patterns have been fully tested, please note that this command may delete unintended files.",
-            fg="yellow",
-        )
-    )
-    click.echo(
-        click.style("This cannot be undone. Please make sure to back up your storage before proceeding.", fg="yellow")
-    )
-    click.echo(
-        click.style(
-            (
-                "It is also recommended to run this during the maintenance window, "
-                "as this may cause high load on your instance."
-            ),
-            fg="yellow",
-        )
-    )
-    if not force:
-        click.confirm("Do you want to proceed?", abort=True)
-
-    # start the cleanup process
-    click.echo(click.style("Starting orphaned files cleanup.", fg="white"))
-
-    # fetch file id and keys from each table
-    all_files_in_tables = []
-    try:
-        for files_table in files_tables:
-            click.echo(click.style(f"- Listing files from table {files_table['table']}", fg="white"))
-            query = f"SELECT {files_table['key_column']} FROM {files_table['table']}"
-            with db.engine.begin() as conn:
-                rs = conn.execute(sa.text(query))
-            for i in rs:
-                all_files_in_tables.append(str(i[0]))
-        click.echo(click.style(f"Found {len(all_files_in_tables)} files in tables.", fg="white"))
-    except Exception as e:
-        click.echo(click.style(f"Error fetching keys: {str(e)}", fg="red"))
-        return
-
-    all_files_on_storage = []
-    for storage_path in storage_paths:
-        try:
-            click.echo(click.style(f"- Scanning files on storage path {storage_path}", fg="white"))
-            files = storage.scan(path=storage_path, files=True, directories=False)
-            all_files_on_storage.extend(files)
-        except FileNotFoundError:
-            click.echo(click.style(f"  -> Skipping path {storage_path} as it does not exist.", fg="yellow"))
-            continue
-        except Exception as e:
-            click.echo(click.style(f"  -> Error scanning files on storage path {storage_path}: {str(e)}", fg="red"))
-            continue
-    click.echo(click.style(f"Found {len(all_files_on_storage)} files on storage.", fg="white"))
-
-    # find orphaned files
-    orphaned_files = list(set(all_files_on_storage) - set(all_files_in_tables))
-    if not orphaned_files:
-        click.echo(click.style("No orphaned files found. There is nothing to remove.", fg="green"))
-        return
-    click.echo(click.style(f"Found {len(orphaned_files)} orphaned files.", fg="white"))
-    for file in orphaned_files:
-        click.echo(click.style(f"- orphaned file: {file}", fg="black"))
-    if not force:
-        click.confirm(f"Do you want to proceed to remove all {len(orphaned_files)} orphaned files?", abort=True)
-
-    # delete orphaned files
-    removed_files = 0
-    error_files = 0
-    for file in orphaned_files:
-        try:
-            storage.delete(file)
-            removed_files += 1
-            click.echo(click.style(f"- Removing orphaned file: {file}", fg="white"))
-        except Exception as e:
-            error_files += 1
-            click.echo(click.style(f"- Error deleting orphaned file {file}: {str(e)}", fg="red"))
-            continue
-    if error_files == 0:
-        click.echo(click.style(f"Removed {removed_files} orphaned files without errors.", fg="green"))
-    else:
-        click.echo(click.style(f"Removed {removed_files} orphaned files, with {error_files} errors.", fg="yellow"))
-
-
-@click.command("file-usage", help="Query file usages and show where files are referenced.")
-@click.option("--file-id", type=str, default=None, help="Filter by file UUID.")
-@click.option("--key", type=str, default=None, help="Filter by storage key.")
-@click.option("--src", type=str, default=None, help="Filter by table.column pattern (e.g., 'documents.%' or '%.icon').")
-@click.option("--limit", type=int, default=100, help="Limit number of results (default: 100).")
-@click.option("--offset", type=int, default=0, help="Offset for pagination (default: 0).")
-@click.option("--json", "output_json", is_flag=True, help="Output results in JSON format.")
-def file_usage(
-    file_id: str | None,
-    key: str | None,
-    src: str | None,
-    limit: int,
-    offset: int,
-    output_json: bool,
-):
-    """
-    Query file usages and show where files are referenced in the database.
-
-    This command reuses the same reference checking logic as clear-orphaned-file-records
-    and displays detailed information about where each file is referenced.
-    """
-    # define tables and columns to process
-    files_tables = [
-        {"table": "upload_files", "id_column": "id", "key_column": "key"},
-        {"table": "tool_files", "id_column": "id", "key_column": "file_key"},
-    ]
-    ids_tables = [
-        {"type": "uuid", "table": "message_files", "column": "upload_file_id", "pk_column": "id"},
-        {"type": "text", "table": "documents", "column": "data_source_info", "pk_column": "id"},
-        {"type": "text", "table": "document_segments", "column": "content", "pk_column": "id"},
-        {"type": "text", "table": "messages", "column": "answer", "pk_column": "id"},
-        {"type": "text", "table": "workflow_node_executions", "column": "inputs", "pk_column": "id"},
-        {"type": "text", "table": "workflow_node_executions", "column": "process_data", "pk_column": "id"},
-        {"type": "text", "table": "workflow_node_executions", "column": "outputs", "pk_column": "id"},
-        {"type": "text", "table": "conversations", "column": "introduction", "pk_column": "id"},
-        {"type": "text", "table": "conversations", "column": "system_instruction", "pk_column": "id"},
-        {"type": "text", "table": "accounts", "column": "avatar", "pk_column": "id"},
-        {"type": "text", "table": "apps", "column": "icon", "pk_column": "id"},
-        {"type": "text", "table": "sites", "column": "icon", "pk_column": "id"},
-        {"type": "json", "table": "messages", "column": "inputs", "pk_column": "id"},
-        {"type": "json", "table": "messages", "column": "message", "pk_column": "id"},
-    ]
-
-    # Stream file usages with pagination to avoid holding all results in memory
-    paginated_usages = []
-    total_count = 0
-
-    # First, build a mapping of file_id -> storage_key from the base tables
-    file_key_map = {}
-    for files_table in files_tables:
-        query = f"SELECT {files_table['id_column']}, {files_table['key_column']} FROM {files_table['table']}"
-        with db.engine.begin() as conn:
-            rs = conn.execute(sa.text(query))
-            for row in rs:
-                file_key_map[str(row[0])] = f"{files_table['table']}:{row[1]}"
-
-    # If filtering by key or file_id, verify it exists
-    if file_id and file_id not in file_key_map:
-        if output_json:
-            click.echo(json.dumps({"error": f"File ID {file_id} not found in base tables"}))
-        else:
-            click.echo(click.style(f"File ID {file_id} not found in base tables.", fg="red"))
-        return
-
-    if key:
-        valid_prefixes = {f"upload_files:{key}", f"tool_files:{key}"}
-        matching_file_ids = [fid for fid, fkey in file_key_map.items() if fkey in valid_prefixes]
-        if not matching_file_ids:
-            if output_json:
-                click.echo(json.dumps({"error": f"Key {key} not found in base tables"}))
-            else:
-                click.echo(click.style(f"Key {key} not found in base tables.", fg="red"))
-            return
-
-    guid_regexp = "[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}"
-
-    # For each reference table/column, find matching file IDs and record the references
-    for ids_table in ids_tables:
-        src_filter = f"{ids_table['table']}.{ids_table['column']}"
-
-        # Skip if src filter doesn't match (use fnmatch for wildcard patterns)
-        if src:
-            if "%" in src or "_" in src:
-                import fnmatch
-
-                # Convert SQL LIKE wildcards to fnmatch wildcards (% -> *, _ -> ?)
-                pattern = src.replace("%", "*").replace("_", "?")
-                if not fnmatch.fnmatch(src_filter, pattern):
-                    continue
-            else:
-                if src_filter != src:
-                    continue
-
-        match ids_table["type"]:
-            case "uuid":
-                # Direct UUID match
-                query = (
-                    f"SELECT {ids_table['pk_column']}, {ids_table['column']} "
-                    f"FROM {ids_table['table']} WHERE {ids_table['column']} IS NOT NULL"
-                )
-                with db.engine.begin() as conn:
-                    rs = conn.execute(sa.text(query))
-                    for row in rs:
-                        record_id = str(row[0])
-                        ref_file_id = str(row[1])
-                        if ref_file_id not in file_key_map:
-                            continue
-                        storage_key = file_key_map[ref_file_id]
-
-                        # Apply filters
-                        if file_id and ref_file_id != file_id:
-                            continue
-                        if key and not storage_key.endswith(key):
-                            continue
-
-                        # Only collect items within the requested page range
-                        if offset <= total_count < offset + limit:
-                            paginated_usages.append(
-                                {
-                                    "src": f"{ids_table['table']}.{ids_table['column']}",
-                                    "record_id": record_id,
-                                    "file_id": ref_file_id,
-                                    "key": storage_key,
-                                }
-                            )
-                        total_count += 1
-
-            case "text" | "json":
-                # Extract UUIDs from text/json content
-                column_cast = f"{ids_table['column']}::text" if ids_table["type"] == "json" else ids_table["column"]
-                query = (
-                    f"SELECT {ids_table['pk_column']}, {column_cast} "
-                    f"FROM {ids_table['table']} WHERE {ids_table['column']} IS NOT NULL"
-                )
-                with db.engine.begin() as conn:
-                    rs = conn.execute(sa.text(query))
-                    for row in rs:
-                        record_id = str(row[0])
-                        content = str(row[1])
-
-                        # Find all UUIDs in the content
-                        import re
-
-                        uuid_pattern = re.compile(guid_regexp, re.IGNORECASE)
-                        matches = uuid_pattern.findall(content)
-
-                        for ref_file_id in matches:
-                            if ref_file_id not in file_key_map:
-                                continue
-                            storage_key = file_key_map[ref_file_id]
-
-                            # Apply filters
-                            if file_id and ref_file_id != file_id:
-                                continue
-                            if key and not storage_key.endswith(key):
-                                continue
-
-                            # Only collect items within the requested page range
-                            if offset <= total_count < offset + limit:
-                                paginated_usages.append(
-                                    {
-                                        "src": f"{ids_table['table']}.{ids_table['column']}",
-                                        "record_id": record_id,
-                                        "file_id": ref_file_id,
-                                        "key": storage_key,
-                                    }
-                                )
-                            total_count += 1
-            case _:
-                pass
-
-    # Output results
-    if output_json:
-        result = {
-            "total": total_count,
-            "offset": offset,
-            "limit": limit,
-            "usages": paginated_usages,
-        }
-        click.echo(json.dumps(result, indent=2))
-    else:
-        click.echo(
-            click.style(f"Found {total_count} file usages (showing {len(paginated_usages)} results)", fg="white")
-        )
-        click.echo("")
-
-        if not paginated_usages:
-            click.echo(click.style("No file usages found matching the specified criteria.", fg="yellow"))
-            return
-
-        # Print table header
-        click.echo(
-            click.style(
-                f"{'Src (Table.Column)':<50} {'Record ID':<40} {'File ID':<40} {'Storage Key':<60}",
-                fg="cyan",
-            )
-        )
-        click.echo(click.style("-" * 190, fg="white"))
-
-        # Print each usage
-        for usage in paginated_usages:
-            click.echo(f"{usage['src']:<50} {usage['record_id']:<40} {usage['file_id']:<40} {usage['key']:<60}")
-
-        # Show pagination info
-        if offset + limit < total_count:
-            click.echo("")
-            click.echo(
-                click.style(
-                    f"Showing {offset + 1}-{offset + len(paginated_usages)} of {total_count} results", fg="white"
-                )
-            )
-            click.echo(click.style(f"Use --offset {offset + limit} to see next page", fg="white"))
-
-
-@click.command(
-    "migrate-oss",
-    help="Migrate files from Local or OpenDAL source to a cloud OSS storage (destination must NOT be local/opendal).",
-)
-@click.option(
-    "--path",
-    "paths",
-    multiple=True,
-    help="Storage path prefixes to migrate (repeatable). Defaults: privkeys, upload_files, image_files,"
-    " tools, website_files, keyword_files, ops_trace",
-)
-@click.option(
-    "--source",
-    type=click.Choice(["local", "opendal"], case_sensitive=False),
-    default="opendal",
-    show_default=True,
-    help="Source storage type to read from",
-)
-@click.option("--overwrite", is_flag=True, default=False, help="Overwrite destination if file already exists")
-@click.option("--dry-run", is_flag=True, default=False, help="Show what would be migrated without uploading")
-@click.option("-f", "--force", is_flag=True, help="Skip confirmation and run without prompts")
-@click.option(
-    "--update-db/--no-update-db",
-    default=True,
-    help="Update upload_files.storage_type from source type to current storage after migration",
-)
-def migrate_oss(
-    paths: tuple[str, ...],
-    source: str,
-    overwrite: bool,
-    dry_run: bool,
-    force: bool,
-    update_db: bool,
-):
-    """
-    Copy all files under selected prefixes from a source storage
-    (Local filesystem or OpenDAL-backed) into the currently configured
-    destination storage backend, then optionally update DB records.
-
-    Expected usage: set STORAGE_TYPE (and its credentials) to your target backend.
-    """
-    # Ensure target storage is not local/opendal
-    if dify_config.STORAGE_TYPE in (StorageType.LOCAL, StorageType.OPENDAL):
-        click.echo(
-            click.style(
-                "Target STORAGE_TYPE must be a cloud OSS (not 'local' or 'opendal').\n"
-                "Please set STORAGE_TYPE to one of: s3, aliyun-oss, azure-blob, google-storage, tencent-cos, \n"
-                "volcengine-tos, supabase, oci-storage, huawei-obs, baidu-obs, clickzetta-volume.",
-                fg="red",
-            )
-        )
-        return
-
-    # Default paths if none specified
-    default_paths = ("privkeys", "upload_files", "image_files", "tools", "website_files", "keyword_files", "ops_trace")
-    path_list = list(paths) if paths else list(default_paths)
-    is_source_local = source.lower() == "local"
-
-    click.echo(click.style("Preparing migration to target storage.", fg="yellow"))
-    click.echo(click.style(f"Target storage type: {dify_config.STORAGE_TYPE}", fg="white"))
-    if is_source_local:
-        src_root = dify_config.STORAGE_LOCAL_PATH
-        click.echo(click.style(f"Source: local fs, root: {src_root}", fg="white"))
-    else:
-        click.echo(click.style(f"Source: opendal scheme={dify_config.OPENDAL_SCHEME}", fg="white"))
-    click.echo(click.style(f"Paths to migrate: {', '.join(path_list)}", fg="white"))
-    click.echo("")
-
-    if not force:
-        click.confirm("Proceed with migration?", abort=True)
-
-    # Instantiate source storage
-    try:
-        if is_source_local:
-            src_root = dify_config.STORAGE_LOCAL_PATH
-            source_storage = OpenDALStorage(scheme="fs", root=src_root)
-        else:
-            source_storage = OpenDALStorage(scheme=dify_config.OPENDAL_SCHEME)
-    except Exception as e:
-        click.echo(click.style(f"Failed to initialize source storage: {str(e)}", fg="red"))
-        return
-
-    total_files = 0
-    copied_files = 0
-    skipped_files = 0
-    errored_files = 0
-    copied_upload_file_keys: list[str] = []
-
-    for prefix in path_list:
-        click.echo(click.style(f"Scanning source path: {prefix}", fg="white"))
-        try:
-            keys = source_storage.scan(path=prefix, files=True, directories=False)
-        except FileNotFoundError:
-            click.echo(click.style(f"  -> Skipping missing path: {prefix}", fg="yellow"))
-            continue
-        except NotImplementedError:
-            click.echo(click.style("  -> Source storage does not support scanning.", fg="red"))
-            return
-        except Exception as e:
-            click.echo(click.style(f"  -> Error scanning '{prefix}': {str(e)}", fg="red"))
-            continue
-
-        click.echo(click.style(f"Found {len(keys)} files under {prefix}", fg="white"))
-
-        for key in keys:
-            total_files += 1
-
-            # check destination existence
-            if not overwrite:
-                try:
-                    if storage.exists(key):
-                        skipped_files += 1
-                        continue
-                except Exception as e:
-                    # existence check failures should not block migration attempt
-                    # but should be surfaced to user as a warning for visibility
-                    click.echo(
-                        click.style(
-                            f"  -> Warning: failed target existence check for {key}: {str(e)}",
-                            fg="yellow",
-                        )
-                    )
-
-            if dry_run:
-                copied_files += 1
-                continue
-
-            # read from source and write to destination
-            try:
-                data = source_storage.load_once(key)
-            except FileNotFoundError:
-                errored_files += 1
-                click.echo(click.style(f"  -> Missing on source: {key}", fg="yellow"))
-                continue
-            except Exception as e:
-                errored_files += 1
-                click.echo(click.style(f"  -> Error reading {key}: {str(e)}", fg="red"))
-                continue
-
-            try:
-                storage.save(key, data)
-                copied_files += 1
-                if prefix == "upload_files":
-                    copied_upload_file_keys.append(key)
-            except Exception as e:
-                errored_files += 1
-                click.echo(click.style(f"  -> Error writing {key} to target: {str(e)}", fg="red"))
-                continue
-
-    click.echo("")
-    click.echo(click.style("Migration summary:", fg="yellow"))
-    click.echo(click.style(f"  Total:   {total_files}", fg="white"))
-    click.echo(click.style(f"  Copied:  {copied_files}", fg="green"))
-    click.echo(click.style(f"  Skipped: {skipped_files}", fg="white"))
-    if errored_files:
-        click.echo(click.style(f"  Errors:  {errored_files}", fg="red"))
-
-    if dry_run:
-        click.echo(click.style("Dry-run complete. No changes were made.", fg="green"))
-        return
-
-    if errored_files:
-        click.echo(
-            click.style(
-                "Some files failed to migrate. Review errors above before updating DB records.",
-                fg="yellow",
-            )
-        )
-        if update_db and not force:
-            if not click.confirm("Proceed to update DB storage_type despite errors?", default=False):
-                update_db = False
-
-    # Optionally update DB records for upload_files.storage_type (only for successfully copied upload_files)
-    if update_db:
-        if not copied_upload_file_keys:
-            click.echo(click.style("No upload_files copied. Skipping DB storage_type update.", fg="yellow"))
-        else:
-            try:
-                source_storage_type = StorageType.LOCAL if is_source_local else StorageType.OPENDAL
-                updated = (
-                    db.session.query(UploadFile)
-                    .where(
-                        UploadFile.storage_type == source_storage_type,
-                        UploadFile.key.in_(copied_upload_file_keys),
-                    )
-                    .update({UploadFile.storage_type: dify_config.STORAGE_TYPE}, synchronize_session=False)
-                )
-                db.session.commit()
-                click.echo(click.style(f"Updated storage_type for {updated} upload_files records.", fg="green"))
-            except Exception as e:
-                db.session.rollback()
-                click.echo(click.style(f"Failed to update DB storage_type: {str(e)}", fg="red"))
@@ -1,204 +0,0 @@
-import logging
-
-import click
-import sqlalchemy as sa
-from sqlalchemy.orm import sessionmaker
-
-from configs import dify_config
-from events.app_event import app_was_created
-from extensions.ext_database import db
-from extensions.ext_redis import redis_client
-from libs.db_migration_lock import DbMigrationAutoRenewLock
-from libs.rsa import generate_key_pair
-from models import Tenant
-from models.model import App, AppMode, Conversation
-from models.provider import Provider, ProviderModel
-
-logger = logging.getLogger(__name__)
-
-DB_UPGRADE_LOCK_TTL_SECONDS = 60
-
-
-@click.command(
-    "reset-encrypt-key-pair",
-    help="Reset the asymmetric key pair of workspace for encrypt LLM credentials. "
-    "After the reset, all LLM credentials will become invalid, "
-    "requiring re-entry."
-    "Only support SELF_HOSTED mode.",
-)
-@click.confirmation_option(
-    prompt=click.style(
-        "Are you sure you want to reset encrypt key pair? This operation cannot be rolled back!", fg="red"
-    )
-)
-def reset_encrypt_key_pair():
-    """
-    Reset the encrypted key pair of workspace for encrypt LLM credentials.
-    After the reset, all LLM credentials will become invalid, requiring re-entry.
-    Only support SELF_HOSTED mode.
-    """
-    if dify_config.EDITION != "SELF_HOSTED":
-        click.echo(click.style("This command is only for SELF_HOSTED installations.", fg="red"))
-        return
-    with sessionmaker(db.engine, expire_on_commit=False).begin() as session:
-        tenants = session.query(Tenant).all()
-        for tenant in tenants:
-            if not tenant:
-                click.echo(click.style("No workspaces found. Run /install first.", fg="red"))
-                return
-
-            tenant.encrypt_public_key = generate_key_pair(tenant.id)
-
-            session.query(Provider).where(Provider.provider_type == "custom", Provider.tenant_id == tenant.id).delete()
-            session.query(ProviderModel).where(ProviderModel.tenant_id == tenant.id).delete()
-
-            click.echo(
-                click.style(
-                    f"Congratulations! The asymmetric key pair of workspace {tenant.id} has been reset.",
-                    fg="green",
-                )
-            )
-
-
-@click.command("convert-to-agent-apps", help="Convert Agent Assistant to Agent App.")
-def convert_to_agent_apps():
-    """
-    Convert Agent Assistant to Agent App.
-    """
-    click.echo(click.style("Starting convert to agent apps.", fg="green"))
-
-    proceeded_app_ids = []
-
-    while True:
-        # fetch first 1000 apps
-        sql_query = """SELECT a.id AS id FROM apps a
-            INNER JOIN app_model_configs am ON a.app_model_config_id=am.id
-            WHERE a.mode = 'chat'
-            AND am.agent_mode is not null
-            AND (
-                am.agent_mode like '%"strategy": "function_call"%'
-                OR am.agent_mode  like '%"strategy": "react"%'
-            )
-            AND (
-                am.agent_mode like '{"enabled": true%'
-                OR am.agent_mode like '{"max_iteration": %'
-            ) ORDER BY a.created_at DESC LIMIT 1000
-        """
-
-        with db.engine.begin() as conn:
-            rs = conn.execute(sa.text(sql_query))
-
-            apps = []
-            for i in rs:
-                app_id = str(i.id)
-                if app_id not in proceeded_app_ids:
-                    proceeded_app_ids.append(app_id)
-                    app = db.session.query(App).where(App.id == app_id).first()
-                    if app is not None:
-                        apps.append(app)
-
-            if len(apps) == 0:
-                break
-
-        for app in apps:
-            click.echo(f"Converting app: {app.id}")
-
-            try:
-                app.mode = AppMode.AGENT_CHAT
-                db.session.commit()
-
-                # update conversation mode to agent
-                db.session.query(Conversation).where(Conversation.app_id == app.id).update(
-                    {Conversation.mode: AppMode.AGENT_CHAT}
-                )
-
-                db.session.commit()
-                click.echo(click.style(f"Converted app: {app.id}", fg="green"))
-            except Exception as e:
-                click.echo(click.style(f"Convert app error: {e.__class__.__name__} {str(e)}", fg="red"))
-
-    click.echo(click.style(f"Conversion complete. Converted {len(proceeded_app_ids)} agent apps.", fg="green"))
-
-
-@click.command("upgrade-db", help="Upgrade the database")
-def upgrade_db():
-    click.echo("Preparing database migration...")
-    lock = DbMigrationAutoRenewLock(
-        redis_client=redis_client,
-        name="db_upgrade_lock",
-        ttl_seconds=DB_UPGRADE_LOCK_TTL_SECONDS,
-        logger=logger,
-        log_context="db_migration",
-    )
-    if lock.acquire(blocking=False):
-        migration_succeeded = False
-        try:
-            click.echo(click.style("Starting database migration.", fg="green"))
-
-            # run db migration
-            import flask_migrate
-
-            flask_migrate.upgrade()
-
-            migration_succeeded = True
-            click.echo(click.style("Database migration successful!", fg="green"))
-
-        except Exception as e:
-            logger.exception("Failed to execute database migration")
-            click.echo(click.style(f"Database migration failed: {e}", fg="red"))
-            raise SystemExit(1)
-        finally:
-            status = "successful" if migration_succeeded else "failed"
-            lock.release_safely(status=status)
-    else:
-        click.echo("Database migration skipped")
-
-
-@click.command("fix-app-site-missing", help="Fix app related site missing issue.")
-def fix_app_site_missing():
-    """
-    Fix app related site missing issue.
-    """
-    click.echo(click.style("Starting fix for missing app-related sites.", fg="green"))
-
-    failed_app_ids = []
-    while True:
-        sql = """select apps.id as id from apps left join sites on sites.app_id=apps.id
-where sites.id is null limit 1000"""
-        with db.engine.begin() as conn:
-            rs = conn.execute(sa.text(sql))
-
-            processed_count = 0
-            for i in rs:
-                processed_count += 1
-                app_id = str(i.id)
-
-                if app_id in failed_app_ids:
-                    continue
-
-                try:
-                    app = db.session.query(App).where(App.id == app_id).first()
-                    if not app:
-                        logger.info("App %s not found", app_id)
-                        continue
-
-                    tenant = app.tenant
-                    if tenant:
-                        accounts = tenant.get_accounts()
-                        if not accounts:
-                            logger.info("Fix failed for app %s", app.id)
-                            continue
-
-                        account = accounts[0]
-                        logger.info("Fixing missing site for app %s", app.id)
-                        app_was_created.send(app, account=account)
-                except Exception:
-                    failed_app_ids.append(app_id)
-                    click.echo(click.style(f"Failed to fix missing site for app {app_id}", fg="red"))
-                    logger.exception("Failed to fix app related site missing issue, app_id: %s", app_id)
-                    continue
-
-            if not processed_count:
-                break
-
-    click.echo(click.style("Fix for missing app-related sites completed successfully!", fg="green"))
@@ -1,466 +0,0 @@
-import json
-
-import click
-from flask import current_app
-from sqlalchemy import select
-from sqlalchemy.exc import SQLAlchemyError
-from sqlalchemy.orm import sessionmaker
-
-from configs import dify_config
-from core.rag.datasource.vdb.vector_factory import Vector
-from core.rag.datasource.vdb.vector_type import VectorType
-from core.rag.index_processor.constant.built_in_field import BuiltInField
-from core.rag.models.document import ChildDocument, Document
-from extensions.ext_database import db
-from models.dataset import Dataset, DatasetCollectionBinding, DatasetMetadata, DatasetMetadataBinding, DocumentSegment
-from models.dataset import Document as DatasetDocument
-from models.model import App, AppAnnotationSetting, MessageAnnotation
-
-
-@click.command("vdb-migrate", help="Migrate vector db.")
-@click.option("--scope", default="all", prompt=False, help="The scope of vector database to migrate, Default is All.")
-def vdb_migrate(scope: str):
-    if scope in {"knowledge", "all"}:
-        migrate_knowledge_vector_database()
-    if scope in {"annotation", "all"}:
-        migrate_annotation_vector_database()
-
-
-def migrate_annotation_vector_database():
-    """
-    Migrate annotation datas to target vector database .
-    """
-    click.echo(click.style("Starting annotation data migration.", fg="green"))
-    create_count = 0
-    skipped_count = 0
-    total_count = 0
-    page = 1
-    while True:
-        try:
-            # get apps info
-            per_page = 50
-            with sessionmaker(db.engine, expire_on_commit=False).begin() as session:
-                apps = (
-                    session.query(App)
-                    .where(App.status == "normal")
-                    .order_by(App.created_at.desc())
-                    .limit(per_page)
-                    .offset((page - 1) * per_page)
-                    .all()
-                )
-            if not apps:
-                break
-        except SQLAlchemyError:
-            raise
-
-        page += 1
-        for app in apps:
-            total_count = total_count + 1
-            click.echo(
-                f"Processing the {total_count} app {app.id}. " + f"{create_count} created, {skipped_count} skipped."
-            )
-            try:
-                click.echo(f"Creating app annotation index: {app.id}")
-                with sessionmaker(db.engine, expire_on_commit=False).begin() as session:
-                    app_annotation_setting = (
-                        session.query(AppAnnotationSetting).where(AppAnnotationSetting.app_id == app.id).first()
-                    )
-
-                    if not app_annotation_setting:
-                        skipped_count = skipped_count + 1
-                        click.echo(f"App annotation setting disabled: {app.id}")
-                        continue
-                    # get dataset_collection_binding info
-                    dataset_collection_binding = (
-                        session.query(DatasetCollectionBinding)
-                        .where(DatasetCollectionBinding.id == app_annotation_setting.collection_binding_id)
-                        .first()
-                    )
-                    if not dataset_collection_binding:
-                        click.echo(f"App annotation collection binding not found: {app.id}")
-                        continue
-                    annotations = session.scalars(
-                        select(MessageAnnotation).where(MessageAnnotation.app_id == app.id)
-                    ).all()
-                dataset = Dataset(
-                    id=app.id,
-                    tenant_id=app.tenant_id,
-                    indexing_technique="high_quality",
-                    embedding_model_provider=dataset_collection_binding.provider_name,
-                    embedding_model=dataset_collection_binding.model_name,
-                    collection_binding_id=dataset_collection_binding.id,
-                )
-                documents = []
-                if annotations:
-                    for annotation in annotations:
-                        document = Document(
-                            page_content=annotation.question_text,
-                            metadata={"annotation_id": annotation.id, "app_id": app.id, "doc_id": annotation.id},
-                        )
-                        documents.append(document)
-
-                vector = Vector(dataset, attributes=["doc_id", "annotation_id", "app_id"])
-                click.echo(f"Migrating annotations for app: {app.id}.")
-
-                try:
-                    vector.delete()
-                    click.echo(click.style(f"Deleted vector index for app {app.id}.", fg="green"))
-                except Exception as e:
-                    click.echo(click.style(f"Failed to delete vector index for app {app.id}.", fg="red"))
-                    raise e
-                if documents:
-                    try:
-                        click.echo(
-                            click.style(
-                                f"Creating vector index with {len(documents)} annotations for app {app.id}.",
-                                fg="green",
-                            )
-                        )
-                        vector.create(documents)
-                        click.echo(click.style(f"Created vector index for app {app.id}.", fg="green"))
-                    except Exception as e:
-                        click.echo(click.style(f"Failed to created vector index for app {app.id}.", fg="red"))
-                        raise e
-                click.echo(f"Successfully migrated app annotation {app.id}.")
-                create_count += 1
-            except Exception as e:
-                click.echo(
-                    click.style(f"Error creating app annotation index: {e.__class__.__name__} {str(e)}", fg="red")
-                )
-                continue
-
-    click.echo(
-        click.style(
-            f"Migration complete. Created {create_count} app annotation indexes. Skipped {skipped_count} apps.",
-            fg="green",
-        )
-    )
-
-
-def migrate_knowledge_vector_database():
-    """
-    Migrate vector database datas to target vector database .
-    """
-    click.echo(click.style("Starting vector database migration.", fg="green"))
-    create_count = 0
-    skipped_count = 0
-    total_count = 0
-    vector_type = dify_config.VECTOR_STORE
-    upper_collection_vector_types = {
-        VectorType.MILVUS,
-        VectorType.PGVECTOR,
-        VectorType.VASTBASE,
-        VectorType.RELYT,
-        VectorType.WEAVIATE,
-        VectorType.ORACLE,
-        VectorType.ELASTICSEARCH,
-        VectorType.OPENGAUSS,
-        VectorType.TABLESTORE,
-        VectorType.MATRIXONE,
-    }
-    lower_collection_vector_types = {
-        VectorType.ANALYTICDB,
-        VectorType.CHROMA,
-        VectorType.MYSCALE,
-        VectorType.PGVECTO_RS,
-        VectorType.TIDB_VECTOR,
-        VectorType.OPENSEARCH,
-        VectorType.TENCENT,
-        VectorType.BAIDU,
-        VectorType.VIKINGDB,
-        VectorType.UPSTASH,
-        VectorType.COUCHBASE,
-        VectorType.OCEANBASE,
-    }
-    page = 1
-    while True:
-        try:
-            stmt = (
-                select(Dataset).where(Dataset.indexing_technique == "high_quality").order_by(Dataset.created_at.desc())
-            )
-
-            datasets = db.paginate(select=stmt, page=page, per_page=50, max_per_page=50, error_out=False)
-            if not datasets.items:
-                break
-        except SQLAlchemyError:
-            raise
-
-        page += 1
-        for dataset in datasets:
-            total_count = total_count + 1
-            click.echo(
-                f"Processing the {total_count} dataset {dataset.id}. {create_count} created, {skipped_count} skipped."
-            )
-            try:
-                click.echo(f"Creating dataset vector database index: {dataset.id}")
-                if dataset.index_struct_dict:
-                    if dataset.index_struct_dict["type"] == vector_type:
-                        skipped_count = skipped_count + 1
-                        continue
-                collection_name = ""
-                dataset_id = dataset.id
-                if vector_type in upper_collection_vector_types:
-                    collection_name = Dataset.gen_collection_name_by_id(dataset_id)
-                elif vector_type == VectorType.QDRANT:
-                    if dataset.collection_binding_id:
-                        dataset_collection_binding = (
-                            db.session.query(DatasetCollectionBinding)
-                            .where(DatasetCollectionBinding.id == dataset.collection_binding_id)
-                            .one_or_none()
-                        )
-                        if dataset_collection_binding:
-                            collection_name = dataset_collection_binding.collection_name
-                        else:
-                            raise ValueError("Dataset Collection Binding not found")
-                    else:
-                        collection_name = Dataset.gen_collection_name_by_id(dataset_id)
-
-                elif vector_type in lower_collection_vector_types:
-                    collection_name = Dataset.gen_collection_name_by_id(dataset_id).lower()
-                else:
-                    raise ValueError(f"Vector store {vector_type} is not supported.")
-
-                index_struct_dict = {"type": vector_type, "vector_store": {"class_prefix": collection_name}}
-                dataset.index_struct = json.dumps(index_struct_dict)
-                vector = Vector(dataset)
-                click.echo(f"Migrating dataset {dataset.id}.")
-
-                try:
-                    vector.delete()
-                    click.echo(
-                        click.style(f"Deleted vector index {collection_name} for dataset {dataset.id}.", fg="green")
-                    )
-                except Exception as e:
-                    click.echo(
-                        click.style(
-                            f"Failed to delete vector index {collection_name} for dataset {dataset.id}.", fg="red"
-                        )
-                    )
-                    raise e
-
-                dataset_documents = db.session.scalars(
-                    select(DatasetDocument).where(
-                        DatasetDocument.dataset_id == dataset.id,
-                        DatasetDocument.indexing_status == "completed",
-                        DatasetDocument.enabled == True,
-                        DatasetDocument.archived == False,
-                    )
-                ).all()
-
-                documents = []
-                segments_count = 0
-                for dataset_document in dataset_documents:
-                    segments = db.session.scalars(
-                        select(DocumentSegment).where(
-                            DocumentSegment.document_id == dataset_document.id,
-                            DocumentSegment.status == "completed",
-                            DocumentSegment.enabled == True,
-                        )
-                    ).all()
-
-                    for segment in segments:
-                        document = Document(
-                            page_content=segment.content,
-                            metadata={
-                                "doc_id": segment.index_node_id,
-                                "doc_hash": segment.index_node_hash,
-                                "document_id": segment.document_id,
-                                "dataset_id": segment.dataset_id,
-                            },
-                        )
-                        if dataset_document.doc_form == "hierarchical_model":
-                            child_chunks = segment.get_child_chunks()
-                            if child_chunks:
-                                child_documents = []
-                                for child_chunk in child_chunks:
-                                    child_document = ChildDocument(
-                                        page_content=child_chunk.content,
-                                        metadata={
-                                            "doc_id": child_chunk.index_node_id,
-                                            "doc_hash": child_chunk.index_node_hash,
-                                            "document_id": segment.document_id,
-                                            "dataset_id": segment.dataset_id,
-                                        },
-                                    )
-                                    child_documents.append(child_document)
-                                document.children = child_documents
-
-                        documents.append(document)
-                        segments_count = segments_count + 1
-
-                if documents:
-                    try:
-                        click.echo(
-                            click.style(
-                                f"Creating vector index with {len(documents)} documents of {segments_count}"
-                                f" segments for dataset {dataset.id}.",
-                                fg="green",
-                            )
-                        )
-                        all_child_documents = []
-                        for doc in documents:
-                            if doc.children:
-                                all_child_documents.extend(doc.children)
-                        vector.create(documents)
-                        if all_child_documents:
-                            vector.create(all_child_documents)
-                        click.echo(click.style(f"Created vector index for dataset {dataset.id}.", fg="green"))
-                    except Exception as e:
-                        click.echo(click.style(f"Failed to created vector index for dataset {dataset.id}.", fg="red"))
-                        raise e
-                db.session.add(dataset)
-                db.session.commit()
-                click.echo(f"Successfully migrated dataset {dataset.id}.")
-                create_count += 1
-            except Exception as e:
-                db.session.rollback()
-                click.echo(click.style(f"Error creating dataset index: {e.__class__.__name__} {str(e)}", fg="red"))
-                continue
-
-    click.echo(
-        click.style(
-            f"Migration complete. Created {create_count} dataset indexes. Skipped {skipped_count} datasets.", fg="green"
-        )
-    )
-
-
-@click.command("add-qdrant-index", help="Add Qdrant index.")
-@click.option("--field", default="metadata.doc_id", prompt=False, help="Index field , default is metadata.doc_id.")
-def add_qdrant_index(field: str):
-    click.echo(click.style("Starting Qdrant index creation.", fg="green"))
-
-    create_count = 0
-
-    try:
-        bindings = db.session.query(DatasetCollectionBinding).all()
-        if not bindings:
-            click.echo(click.style("No dataset collection bindings found.", fg="red"))
-            return
-        import qdrant_client
-        from qdrant_client.http.exceptions import UnexpectedResponse
-        from qdrant_client.http.models import PayloadSchemaType
-
-        from core.rag.datasource.vdb.qdrant.qdrant_vector import PathQdrantParams, QdrantConfig
-
-        for binding in bindings:
-            if dify_config.QDRANT_URL is None:
-                raise ValueError("Qdrant URL is required.")
-            qdrant_config = QdrantConfig(
-                endpoint=dify_config.QDRANT_URL,
-                api_key=dify_config.QDRANT_API_KEY,
-                root_path=current_app.root_path,
-                timeout=dify_config.QDRANT_CLIENT_TIMEOUT,
-                grpc_port=dify_config.QDRANT_GRPC_PORT,
-                prefer_grpc=dify_config.QDRANT_GRPC_ENABLED,
-            )
-            try:
-                params = qdrant_config.to_qdrant_params()
-                # Check the type before using
-                if isinstance(params, PathQdrantParams):
-                    # PathQdrantParams case
-                    client = qdrant_client.QdrantClient(path=params.path)
-                else:
-                    # UrlQdrantParams case - params is UrlQdrantParams
-                    client = qdrant_client.QdrantClient(
-                        url=params.url,
-                        api_key=params.api_key,
-                        timeout=int(params.timeout),
-                        verify=params.verify,
-                        grpc_port=params.grpc_port,
-                        prefer_grpc=params.prefer_grpc,
-                    )
-                # create payload index
-                client.create_payload_index(binding.collection_name, field, field_schema=PayloadSchemaType.KEYWORD)
-                create_count += 1
-            except UnexpectedResponse as e:
-                # Collection does not exist, so return
-                if e.status_code == 404:
-                    click.echo(click.style(f"Collection not found: {binding.collection_name}.", fg="red"))
-                    continue
-                # Some other error occurred, so re-raise the exception
-                else:
-                    click.echo(
-                        click.style(
-                            f"Failed to create Qdrant index for collection: {binding.collection_name}.", fg="red"
-                        )
-                    )
-
-    except Exception:
-        click.echo(click.style("Failed to create Qdrant client.", fg="red"))
-
-    click.echo(click.style(f"Index creation complete. Created {create_count} collection indexes.", fg="green"))
-
-
-@click.command("old-metadata-migration", help="Old metadata migration.")
-def old_metadata_migration():
-    """
-    Old metadata migration.
-    """
-    click.echo(click.style("Starting old metadata migration.", fg="green"))
-
-    page = 1
-    while True:
-        try:
-            stmt = (
-                select(DatasetDocument)
-                .where(DatasetDocument.doc_metadata.is_not(None))
-                .order_by(DatasetDocument.created_at.desc())
-            )
-            documents = db.paginate(select=stmt, page=page, per_page=50, max_per_page=50, error_out=False)
-        except SQLAlchemyError:
-            raise
-        if not documents:
-            break
-        for document in documents:
-            if document.doc_metadata:
-                doc_metadata = document.doc_metadata
-                for key in doc_metadata:
-                    for field in BuiltInField:
-                        if field.value == key:
-                            break
-                    else:
-                        dataset_metadata = (
-                            db.session.query(DatasetMetadata)
-                            .where(DatasetMetadata.dataset_id == document.dataset_id, DatasetMetadata.name == key)
-                            .first()
-                        )
-                        if not dataset_metadata:
-                            dataset_metadata = DatasetMetadata(
-                                tenant_id=document.tenant_id,
-                                dataset_id=document.dataset_id,
-                                name=key,
-                                type="string",
-                                created_by=document.created_by,
-                            )
-                            db.session.add(dataset_metadata)
-                            db.session.flush()
-                            dataset_metadata_binding = DatasetMetadataBinding(
-                                tenant_id=document.tenant_id,
-                                dataset_id=document.dataset_id,
-                                metadata_id=dataset_metadata.id,
-                                document_id=document.id,
-                                created_by=document.created_by,
-                            )
-                            db.session.add(dataset_metadata_binding)
-                        else:
-                            dataset_metadata_binding = (
-                                db.session.query(DatasetMetadataBinding)  # type: ignore
-                                .where(
-                                    DatasetMetadataBinding.dataset_id == document.dataset_id,
-                                    DatasetMetadataBinding.document_id == document.id,
-                                    DatasetMetadataBinding.metadata_id == dataset_metadata.id,
-                                )
-                                .first()
-                            )
-                            if not dataset_metadata_binding:
-                                dataset_metadata_binding = DatasetMetadataBinding(
-                                    tenant_id=document.tenant_id,
-                                    dataset_id=document.dataset_id,
-                                    metadata_id=dataset_metadata.id,
-                                    document_id=document.id,
-                                    created_by=document.created_by,
-                                )
-                                db.session.add(dataset_metadata_binding)
-                        db.session.commit()
-        page += 1
-    click.echo(click.style("Old metadata migration completed.", fg="green"))
@@ -18,7 +18,3 @@ class EnterpriseFeatureConfig(BaseSettings):
        description="Allow customization of the enterprise logo.",
        default=False,
    )
-
-    ENTERPRISE_REQUEST_TIMEOUT: int = Field(
-        ge=1, description="Maximum timeout in seconds for enterprise requests", default=5
-    )
@@ -807,7 +807,7 @@ class DatasetApiKeyApi(Resource):
            console_ns.abort(
                400,
                message=f"Cannot create more than {self.max_keys} API keys for this resource type.",
-                custom="max_keys_exceeded",
+                code="max_keys_exceeded",
            )

        key = ApiToken.generate_api_key(self.token_prefix, 24)
@@ -10,6 +10,7 @@ from controllers.common.file_response import enforce_download_for_html
 from controllers.files import files_ns
 from core.tools.signature import verify_tool_file_signature
 from core.tools.tool_file_manager import ToolFileManager
+from extensions.ext_database import db as global_db

 DEFAULT_REF_TEMPLATE_SWAGGER_2_0 = "#/definitions/{model}"

@@ -56,7 +57,7 @@ class ToolFileApi(Resource):
            raise Forbidden("Invalid request.")

        try:
-            tool_file_manager = ToolFileManager()
+            tool_file_manager = ToolFileManager(engine=global_db.engine)
            stream, tool_file = tool_file_manager.get_file_generator_by_tool_file_id(
                file_id,
            )
@@ -1,9 +1,8 @@
 import json
-from contextlib import ExitStack
 from typing import Self
 from uuid import UUID

-from flask import request, send_file
+from flask import request
 from flask_restx import marshal
 from pydantic import BaseModel, Field, field_validator, model_validator
 from sqlalchemy import desc, select
@@ -101,15 +100,6 @@ class DocumentListQuery(BaseModel):
    status: str | None = Field(default=None, description="Document status filter")


-DOCUMENT_BATCH_DOWNLOAD_ZIP_MAX_DOCS = 100
-
-
-class DocumentBatchDownloadZipPayload(BaseModel):
-    """Request payload for bulk downloading uploaded documents as a ZIP archive."""
-
-    document_ids: list[UUID] = Field(..., min_length=1, max_length=DOCUMENT_BATCH_DOWNLOAD_ZIP_MAX_DOCS)
-
-
 register_enum_models(service_api_ns, RetrievalMethod)

 register_schema_models(
@@ -119,7 +109,6 @@ register_schema_models(
    DocumentTextCreatePayload,
    DocumentTextUpdate,
    DocumentListQuery,
-    DocumentBatchDownloadZipPayload,
    Rule,
    PreProcessingRule,
    Segmentation,
@@ -551,46 +540,6 @@ class DocumentListApi(DatasetApiResource):
        return response


-@service_api_ns.route("/datasets/<uuid:dataset_id>/documents/download-zip")
-class DocumentBatchDownloadZipApi(DatasetApiResource):
-    """Download multiple uploaded-file documents as a single ZIP archive."""
-
-    @service_api_ns.expect(service_api_ns.models[DocumentBatchDownloadZipPayload.__name__])
-    @service_api_ns.doc("download_documents_as_zip")
-    @service_api_ns.doc(description="Download selected uploaded documents as a single ZIP archive")
-    @service_api_ns.doc(params={"dataset_id": "Dataset ID"})
-    @service_api_ns.doc(
-        responses={
-            200: "ZIP archive generated successfully",
-            401: "Unauthorized - invalid API token",
-            403: "Forbidden - insufficient permissions",
-            404: "Document or dataset not found",
-        }
-    )
-    @cloud_edition_billing_rate_limit_check("knowledge", "dataset")
-    def post(self, tenant_id, dataset_id):
-        payload = DocumentBatchDownloadZipPayload.model_validate(service_api_ns.payload or {})
-
-        upload_files, download_name = DocumentService.prepare_document_batch_download_zip(
-            dataset_id=str(dataset_id),
-            document_ids=[str(document_id) for document_id in payload.document_ids],
-            tenant_id=str(tenant_id),
-            current_user=current_user,
-        )
-
-        with ExitStack() as stack:
-            zip_path = stack.enter_context(FileService.build_upload_files_zip_tempfile(upload_files=upload_files))
-            response = send_file(
-                zip_path,
-                mimetype="application/zip",
-                as_attachment=True,
-                download_name=download_name,
-            )
-            cleanup = stack.pop_all()
-            response.call_on_close(cleanup.close)
-        return response
-
-
@service_api_ns.route("/datasets/<uuid:dataset_id>/documents/<string:batch>/indexing-status")
 class DocumentIndexingStatusApi(DatasetApiResource):
    @service_api_ns.doc("get_document_indexing_status")
@@ -651,35 +600,6 @@ class DocumentIndexingStatusApi(DatasetApiResource):
        return data


-@service_api_ns.route("/datasets/<uuid:dataset_id>/documents/<uuid:document_id>/download")
-class DocumentDownloadApi(DatasetApiResource):
-    """Return a signed download URL for a document's original uploaded file."""
-
-    @service_api_ns.doc("get_document_download_url")
-    @service_api_ns.doc(description="Get a signed download URL for a document's original uploaded file")
-    @service_api_ns.doc(params={"dataset_id": "Dataset ID", "document_id": "Document ID"})
-    @service_api_ns.doc(
-        responses={
-            200: "Download URL generated successfully",
-            401: "Unauthorized - invalid API token",
-            403: "Forbidden - insufficient permissions",
-            404: "Document or upload file not found",
-        }
-    )
-    @cloud_edition_billing_rate_limit_check("knowledge", "dataset")
-    def get(self, tenant_id, dataset_id, document_id):
-        dataset = self.get_dataset(str(dataset_id), str(tenant_id))
-        document = DocumentService.get_document(dataset.id, str(document_id))
-
-        if not document:
-            raise NotFound("Document not found.")
-
-        if document.tenant_id != str(tenant_id):
-            raise Forbidden("No permission.")
-
-        return {"url": DocumentService.get_document_download_url(document)}
-
-
@service_api_ns.route("/datasets/<uuid:dataset_id>/documents/<uuid:document_id>")
 class DocumentApi(DatasetApiResource):
    METADATA_CHOICES = {"all", "only", "without"}
@@ -239,7 +239,7 @@ class MessageSuggestedQuestionApi(WebApiResource):
    def get(self, app_model, end_user, message_id):
        app_mode = AppMode.value_of(app_model.mode)
        if app_mode not in {AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT}:
-            raise NotChatAppError()
+            raise NotCompletionAppError()

        message_id = str(message_id)

@@ -44,13 +44,14 @@ from core.app.entities.task_entities import (
 )
 from core.app.task_pipeline.based_generate_task_pipeline import BasedGenerateTaskPipeline
 from core.app.task_pipeline.message_cycle_manager import MessageCycleManager
-from core.app.task_pipeline.message_file_utils import prepare_file_dict
 from core.base.tts import AppGeneratorTTSPublisher, AudioTrunk
 from core.model_manager import ModelInstance
 from core.ops.entities.trace_entity import TraceTaskName
 from core.ops.ops_trace_manager import TraceQueueManager, TraceTask
 from core.prompt.utils.prompt_message_util import PromptMessageUtil
 from core.prompt.utils.prompt_template_parser import PromptTemplateParser
+from core.tools.signature import sign_tool_file
+from dify_graph.file import helpers as file_helpers
 from dify_graph.file.enums import FileTransferMethod
 from dify_graph.model_runtime.entities.llm_entities import LLMResult, LLMResultChunk, LLMResultChunkDelta, LLMUsage
 from dify_graph.model_runtime.entities.message_entities import (
@@ -459,40 +460,91 @@ class EasyUIBasedGenerateTaskPipeline(BasedGenerateTaskPipeline):
        """
        self._task_state.metadata.usage = self._task_state.llm_result.usage
        metadata_dict = self._task_state.metadata.model_dump()
-
-        # Fetch files associated with this message
-        files = None
-        with Session(db.engine, expire_on_commit=False) as session:
-            message_files = session.scalars(select(MessageFile).where(MessageFile.message_id == self._message_id)).all()
-
-            if message_files:
-                # Fetch all required UploadFile objects in a single query to avoid N+1 problem
-                upload_file_ids = list(
-                    dict.fromkeys(
-                        mf.upload_file_id
-                        for mf in message_files
-                        if mf.transfer_method == FileTransferMethod.LOCAL_FILE and mf.upload_file_id
-                    )
-                )
-                upload_files_map = {}
-                if upload_file_ids:
-                    upload_files = session.scalars(select(UploadFile).where(UploadFile.id.in_(upload_file_ids))).all()
-                    upload_files_map = {uf.id: uf for uf in upload_files}
-
-                files_list = []
-                for message_file in message_files:
-                    file_dict = prepare_file_dict(message_file, upload_files_map)
-                    files_list.append(file_dict)
-
-                files = files_list or None
-
        return MessageEndStreamResponse(
            task_id=self._application_generate_entity.task_id,
            id=self._message_id,
            metadata=metadata_dict,
-            files=files,
        )

+    def _record_files(self):
+        with Session(db.engine, expire_on_commit=False) as session:
+            message_files = session.scalars(select(MessageFile).where(MessageFile.message_id == self._message_id)).all()
+            if not message_files:
+                return None
+
+            files_list = []
+            upload_file_ids = [
+                mf.upload_file_id
+                for mf in message_files
+                if mf.transfer_method == FileTransferMethod.LOCAL_FILE and mf.upload_file_id
+            ]
+            upload_files_map = {}
+            if upload_file_ids:
+                upload_files = session.scalars(select(UploadFile).where(UploadFile.id.in_(upload_file_ids))).all()
+                upload_files_map = {uf.id: uf for uf in upload_files}
+
+            for message_file in message_files:
+                upload_file = None
+                if message_file.transfer_method == FileTransferMethod.LOCAL_FILE and message_file.upload_file_id:
+                    upload_file = upload_files_map.get(message_file.upload_file_id)
+
+                url = None
+                filename = "file"
+                mime_type = "application/octet-stream"
+                size = 0
+                extension = ""
+
+                if message_file.transfer_method == FileTransferMethod.REMOTE_URL:
+                    url = message_file.url
+                    if message_file.url:
+                        filename = message_file.url.split("/")[-1].split("?")[0]  # Remove query params
+                elif message_file.transfer_method == FileTransferMethod.LOCAL_FILE:
+                    if upload_file:
+                        url = file_helpers.get_signed_file_url(upload_file_id=str(upload_file.id))
+                        filename = upload_file.name
+                        mime_type = upload_file.mime_type or "application/octet-stream"
+                        size = upload_file.size or 0
+                        extension = f".{upload_file.extension}" if upload_file.extension else ""
+                    elif message_file.upload_file_id:
+                        # Fallback: generate URL even if upload_file not found
+                        url = file_helpers.get_signed_file_url(upload_file_id=str(message_file.upload_file_id))
+                elif message_file.transfer_method == FileTransferMethod.TOOL_FILE and message_file.url:
+                    # For tool files, use URL directly if it's HTTP, otherwise sign it
+                    if message_file.url.startswith("http"):
+                        url = message_file.url
+                        filename = message_file.url.split("/")[-1].split("?")[0]
+                    else:
+                        # Extract tool file id and extension from URL
+                        url_parts = message_file.url.split("/")
+                        if url_parts:
+                            file_part = url_parts[-1].split("?")[0]  # Remove query params first
+                            # Use rsplit to correctly handle filenames with multiple dots
+                            if "." in file_part:
+                                tool_file_id, ext = file_part.rsplit(".", 1)
+                                extension = f".{ext}"
+                            else:
+                                tool_file_id = file_part
+                                extension = ".bin"
+                            url = sign_tool_file(tool_file_id=tool_file_id, extension=extension)
+                            filename = file_part
+
+                transfer_method_value = message_file.transfer_method
+                remote_url = message_file.url if message_file.transfer_method == FileTransferMethod.REMOTE_URL else ""
+                file_dict = {
+                    "related_id": message_file.id,
+                    "extension": extension,
+                    "filename": filename,
+                    "size": size,
+                    "mime_type": mime_type,
+                    "transfer_method": transfer_method_value,
+                    "type": message_file.type,
+                    "url": url or "",
+                    "upload_file_id": message_file.upload_file_id or message_file.id,
+                    "remote_url": remote_url,
+                }
+                files_list.append(file_dict)
+            return files_list or None
+
    def _agent_message_to_stream_response(self, answer: str, message_id: str) -> AgentMessageStreamResponse:
        """
        Agent message to stream response.
@@ -1,6 +1,7 @@
 import hashlib
 import logging
-from threading import Thread, Timer
+import time
+from threading import Thread
 from typing import Union

 from flask import Flask, current_app
@@ -95,9 +96,9 @@ class MessageCycleManager:
        if auto_generate_conversation_name and is_first_message:
            # start generate thread
            # time.sleep not block other logic
-            thread = Timer(
-                1,
-                self._generate_conversation_name_worker,
+            time.sleep(1)
+            thread = Thread(
+                target=self._generate_conversation_name_worker,
                kwargs={
                    "flask_app": current_app._get_current_object(),  # type: ignore
                    "conversation_id": conversation_id,
@@ -1,76 +0,0 @@
-from core.tools.signature import sign_tool_file
-from dify_graph.file import helpers as file_helpers
-from dify_graph.file.enums import FileTransferMethod
-from models.model import MessageFile, UploadFile
-
-MAX_TOOL_FILE_EXTENSION_LENGTH = 10
-
-
-def prepare_file_dict(message_file: MessageFile, upload_files_map: dict[str, UploadFile]) -> dict:
-    """
-    Prepare file dictionary for message end stream response.
-
-    :param message_file: MessageFile instance
-    :param upload_files_map: Dictionary mapping upload_file_id to UploadFile
-    :return: Dictionary containing file information
-    """
-    upload_file = None
-    if message_file.transfer_method == FileTransferMethod.LOCAL_FILE and message_file.upload_file_id:
-        upload_file = upload_files_map.get(message_file.upload_file_id)
-
-    url = None
-    filename = "file"
-    mime_type = "application/octet-stream"
-    size = 0
-    extension = ""
-
-    if message_file.transfer_method == FileTransferMethod.REMOTE_URL:
-        url = message_file.url
-        if message_file.url:
-            filename = message_file.url.split("/")[-1].split("?")[0]
-            if "." in filename:
-                extension = "." + filename.rsplit(".", 1)[1]
-    elif message_file.transfer_method == FileTransferMethod.LOCAL_FILE:
-        if upload_file:
-            url = file_helpers.get_signed_file_url(upload_file_id=str(upload_file.id))
-            filename = upload_file.name
-            mime_type = upload_file.mime_type or "application/octet-stream"
-            size = upload_file.size or 0
-            extension = f".{upload_file.extension}" if upload_file.extension else ""
-        elif message_file.upload_file_id:
-            url = file_helpers.get_signed_file_url(upload_file_id=str(message_file.upload_file_id))
-    elif message_file.transfer_method == FileTransferMethod.TOOL_FILE and message_file.url:
-        if message_file.url.startswith(("http://", "https://")):
-            url = message_file.url
-            filename = message_file.url.split("/")[-1].split("?")[0]
-            if "." in filename:
-                extension = "." + filename.rsplit(".", 1)[1]
-        else:
-            url_parts = message_file.url.split("/")
-            if url_parts:
-                file_part = url_parts[-1].split("?")[0]
-                if "." in file_part:
-                    tool_file_id, ext = file_part.rsplit(".", 1)
-                    extension = f".{ext}"
-                    if len(extension) > MAX_TOOL_FILE_EXTENSION_LENGTH:
-                        extension = ".bin"
-                else:
-                    tool_file_id = file_part
-                    extension = ".bin"
-                url = sign_tool_file(tool_file_id=tool_file_id, extension=extension)
-                filename = file_part
-
-    transfer_method_value = message_file.transfer_method.value
-    remote_url = message_file.url if message_file.transfer_method == FileTransferMethod.REMOTE_URL else ""
-    return {
-        "related_id": message_file.id,
-        "extension": extension,
-        "filename": filename,
-        "size": size,
-        "mime_type": mime_type,
-        "transfer_method": transfer_method_value,
-        "type": message_file.type,
-        "url": url or "",
-        "upload_file_id": message_file.upload_file_id or message_file.id,
-        "remote_url": remote_url,
-    }
@@ -1,4 +1,3 @@
-import hashlib
 import logging
 import os
 import uuid
@@ -47,22 +46,6 @@ def wrap_metadata(metadata, **kwargs):
    return metadata


-def _seed_to_uuid4(seed: str) -> str:
-    """Derive a deterministic UUID4-formatted string from an arbitrary seed.
-
-    uuid4_to_uuid7 requires a valid UUID v4 string, but some Dify identifiers
-    are not UUIDs (e.g. a workflow_run_id with a "-root" suffix appended to
-    distinguish the root span from the trace).  This helper hashes the seed
-    with MD5 and patches the version/variant bits so the result satisfies the
-    UUID v4 contract.
-    """
-    raw = hashlib.md5(seed.encode()).digest()
-    ba = bytearray(raw)
-    ba[6] = (ba[6] & 0x0F) | 0x40  # version 4
-    ba[8] = (ba[8] & 0x3F) | 0x80  # variant 1
-    return str(uuid.UUID(bytes=bytes(ba)))
-
-
 def prepare_opik_uuid(user_datetime: datetime | None, user_uuid: str | None):
    """Opik needs UUIDv7 while Dify uses UUIDv4 for identifier of most
    messages and objects. The type-hints of BaseTraceInfo indicates that
@@ -112,52 +95,60 @@ class OpikDataTrace(BaseTraceInstance):
            self.generate_name_trace(trace_info)

    def workflow_trace(self, trace_info: WorkflowTraceInfo):
+        dify_trace_id = trace_info.trace_id or trace_info.workflow_run_id
+        opik_trace_id = prepare_opik_uuid(trace_info.start_time, dify_trace_id)
        workflow_metadata = wrap_metadata(
            trace_info.metadata, message_id=trace_info.message_id, workflow_app_log_id=trace_info.workflow_app_log_id
        )
+        root_span_id = None

        if trace_info.message_id:
            dify_trace_id = trace_info.trace_id or trace_info.message_id
-            trace_name = TraceTaskName.MESSAGE_TRACE
-            trace_tags = ["message", "workflow"]
-            root_span_seed = trace_info.workflow_run_id
+            opik_trace_id = prepare_opik_uuid(trace_info.start_time, dify_trace_id)
+
+            trace_data = {
+                "id": opik_trace_id,
+                "name": TraceTaskName.MESSAGE_TRACE,
+                "start_time": trace_info.start_time,
+                "end_time": trace_info.end_time,
+                "metadata": workflow_metadata,
+                "input": wrap_dict("input", trace_info.workflow_run_inputs),
+                "output": wrap_dict("output", trace_info.workflow_run_outputs),
+                "thread_id": trace_info.conversation_id,
+                "tags": ["message", "workflow"],
+                "project_name": self.project,
+            }
+            self.add_trace(trace_data)
+
+            root_span_id = prepare_opik_uuid(trace_info.start_time, trace_info.workflow_run_id)
+            span_data = {
+                "id": root_span_id,
+                "parent_span_id": None,
+                "trace_id": opik_trace_id,
+                "name": TraceTaskName.WORKFLOW_TRACE,
+                "input": wrap_dict("input", trace_info.workflow_run_inputs),
+                "output": wrap_dict("output", trace_info.workflow_run_outputs),
+                "start_time": trace_info.start_time,
+                "end_time": trace_info.end_time,
+                "metadata": workflow_metadata,
+                "tags": ["workflow"],
+                "project_name": self.project,
+            }
+            self.add_span(span_data)
        else:
-            dify_trace_id = trace_info.trace_id or trace_info.workflow_run_id
-            trace_name = TraceTaskName.WORKFLOW_TRACE
-            trace_tags = ["workflow"]
-            root_span_seed = _seed_to_uuid4(trace_info.workflow_run_id + "-root")
-
-        opik_trace_id = prepare_opik_uuid(trace_info.start_time, dify_trace_id)
-
-        trace_data = {
-            "id": opik_trace_id,
-            "name": trace_name,
-            "start_time": trace_info.start_time,
-            "end_time": trace_info.end_time,
-            "metadata": workflow_metadata,
-            "input": wrap_dict("input", trace_info.workflow_run_inputs),
-            "output": wrap_dict("output", trace_info.workflow_run_outputs),
-            "thread_id": trace_info.conversation_id,
-            "tags": trace_tags,
-            "project_name": self.project,
-        }
-        self.add_trace(trace_data)
-
-        root_span_id = prepare_opik_uuid(trace_info.start_time, root_span_seed)
-        span_data = {
-            "id": root_span_id,
-            "parent_span_id": None,
-            "trace_id": opik_trace_id,
-            "name": TraceTaskName.WORKFLOW_TRACE,
-            "input": wrap_dict("input", trace_info.workflow_run_inputs),
-            "output": wrap_dict("output", trace_info.workflow_run_outputs),
-            "start_time": trace_info.start_time,
-            "end_time": trace_info.end_time,
-            "metadata": workflow_metadata,
-            "tags": ["workflow"],
-            "project_name": self.project,
-        }
-        self.add_span(span_data)
+            trace_data = {
+                "id": opik_trace_id,
+                "name": TraceTaskName.MESSAGE_TRACE,
+                "start_time": trace_info.start_time,
+                "end_time": trace_info.end_time,
+                "metadata": workflow_metadata,
+                "input": wrap_dict("input", trace_info.workflow_run_inputs),
+                "output": wrap_dict("output", trace_info.workflow_run_outputs),
+                "thread_id": trace_info.conversation_id,
+                "tags": ["workflow"],
+                "project_name": self.project,
+            }
+            self.add_trace(trace_data)

        # through workflow_run_id get all_nodes_execution using repository
        session_factory = sessionmaker(bind=db.engine)
@@ -240,13 +231,15 @@ class OpikDataTrace(BaseTraceInstance):
            else:
                run_type = "tool"

+            parent_span_id = trace_info.workflow_app_log_id or trace_info.workflow_run_id
+
            if not total_tokens:
                total_tokens = execution_metadata.get(WorkflowNodeExecutionMetadataKey.TOTAL_TOKENS) or 0

            span_data = {
                "trace_id": opik_trace_id,
                "id": prepare_opik_uuid(created_at, node_execution_id),
-                "parent_span_id": root_span_id,
+                "parent_span_id": prepare_opik_uuid(trace_info.start_time, parent_span_id),
                "name": node_name,
                "type": run_type,
                "start_time": created_at,
@@ -57,7 +57,7 @@ from core.rag.retrieval.template_prompts import (
 from core.tools.signature import sign_upload_file
 from core.tools.utils.dataset_retriever.dataset_retriever_base_tool import DatasetRetrieverBaseTool
 from dify_graph.file import File, FileTransferMethod, FileType
-from dify_graph.model_runtime.entities.llm_entities import LLMMode, LLMResult, LLMUsage
+from dify_graph.model_runtime.entities.llm_entities import LLMResult, LLMUsage
 from dify_graph.model_runtime.entities.message_entities import PromptMessage, PromptMessageRole, PromptMessageTool
 from dify_graph.model_runtime.entities.model_entities import ModelFeature, ModelType
 from dify_graph.model_runtime.model_providers.__base.large_language_model import LargeLanguageModel
@@ -127,12 +127,11 @@ class DatasetRetrieval:
        metadata_filter_document_ids, metadata_condition = None, None

        if request.metadata_filtering_mode != "disabled":
-            app_metadata_model_config = ModelConfig(provider="", name="", mode=LLMMode.CHAT, completion_params={})
-            if request.metadata_filtering_mode == "automatic":
-                if not request.metadata_model_config:
-                    raise ValueError("metadata_model_config is required for this method")
+            # Convert workflow layer types to app_config layer types
+            if not request.metadata_model_config:
+                raise ValueError("metadata_model_config is required for this method")

-                app_metadata_model_config = ModelConfig.model_validate(request.metadata_model_config.model_dump())
+            app_metadata_model_config = ModelConfig.model_validate(request.metadata_model_config.model_dump())

            app_metadata_filtering_conditions = None
            if request.metadata_filtering_conditions is not None:
@@ -194,13 +194,6 @@ class SQLAlchemyWorkflowExecutionRepository(WorkflowExecutionRepository):

        # Create a new database session
        with self._session_factory() as session:
-            existing_model = session.get(WorkflowRun, db_model.id)
-            if existing_model:
-                if existing_model.tenant_id != self._tenant_id:
-                    raise ValueError("Unauthorized access to workflow run")
-                # Preserve the original start time for pause/resume flows.
-                db_model.created_at = existing_model.created_at
-
            # SQLAlchemy merge intelligently handles both insert and update operations
            # based on the presence of the primary key
            session.merge(db_model)
@@ -10,19 +10,28 @@ from typing import Union
 from uuid import uuid4

 import httpx
+from sqlalchemy.orm import Session

 from configs import dify_config
-from core.db.session_factory import session_factory
 from core.helper import ssrf_proxy
-from dify_graph.file.models import ToolFile as ToolFilePydanticModel
+from extensions.ext_database import db as global_db
 from extensions.ext_storage import storage
 from models.model import MessageFile
 from models.tools import ToolFile

 logger = logging.getLogger(__name__)

+from sqlalchemy.engine import Engine
+

 class ToolFileManager:
+    _engine: Engine
+
+    def __init__(self, engine: Engine | None = None):
+        if engine is None:
+            engine = global_db.engine
+        self._engine = engine
+
    @staticmethod
    def sign_file(tool_file_id: str, extension: str) -> str:
        """
@@ -80,7 +89,7 @@ class ToolFileManager:
        filepath = f"tools/{tenant_id}/{unique_filename}"
        storage.save(filepath, file_binary)

-        with session_factory.create_session() as session:
+        with Session(self._engine, expire_on_commit=False) as session:
            tool_file = ToolFile(
                user_id=user_id,
                tenant_id=tenant_id,
@@ -123,7 +132,7 @@ class ToolFileManager:
        filename = f"{unique_name}{extension}"
        filepath = f"tools/{tenant_id}/{filename}"
        storage.save(filepath, blob)
-        with session_factory.create_session() as session:
+        with Session(self._engine, expire_on_commit=False) as session:
            tool_file = ToolFile(
                user_id=user_id,
                tenant_id=tenant_id,
@@ -148,7 +157,7 @@ class ToolFileManager:

        :return: the binary of the file, mime type
        """
-        with session_factory.create_session() as session:
+        with Session(self._engine, expire_on_commit=False) as session:
            tool_file: ToolFile | None = (
                session.query(ToolFile)
                .where(
@@ -172,7 +181,7 @@ class ToolFileManager:

        :return: the binary of the file, mime type
        """
-        with session_factory.create_session() as session:
+        with Session(self._engine, expire_on_commit=False) as session:
            message_file: MessageFile | None = (
                session.query(MessageFile)
                .where(
@@ -208,9 +217,7 @@ class ToolFileManager:

        return blob, tool_file.mimetype

-    def get_file_generator_by_tool_file_id(
-        self, tool_file_id: str
-    ) -> tuple[Generator | None, ToolFilePydanticModel | None]:
+    def get_file_generator_by_tool_file_id(self, tool_file_id: str) -> tuple[Generator | None, ToolFile | None]:
        """
        get file binary

@@ -218,7 +225,7 @@ class ToolFileManager:

        :return: the binary of the file, mime type
        """
-        with session_factory.create_session() as session:
+        with Session(self._engine, expire_on_commit=False) as session:
            tool_file: ToolFile | None = (
                session.query(ToolFile)
                .where(
@@ -232,7 +239,7 @@ class ToolFileManager:

        stream = storage.load_stream(tool_file.file_key)

-        return stream, ToolFilePydanticModel.model_validate(tool_file)
+        return stream, tool_file


 # init tool_file_parser
@@ -37,7 +37,6 @@ VARIABLE_TO_PARAMETER_TYPE_MAPPING = {
    VariableEntityType.CHECKBOX: ToolParameter.ToolParameterType.BOOLEAN,
    VariableEntityType.FILE: ToolParameter.ToolParameterType.FILE,
    VariableEntityType.FILE_LIST: ToolParameter.ToolParameterType.FILES,
-    VariableEntityType.JSON_OBJECT: ToolParameter.ToolParameterType.OBJECT,
 }


@@ -50,7 +50,6 @@ from dify_graph.nodes.template_transform.template_renderer import (
    CodeExecutorJinja2TemplateRenderer,
 )
 from dify_graph.nodes.template_transform.template_transform_node import TemplateTransformNode
-from dify_graph.nodes.tool.tool_node import ToolNode
 from dify_graph.variables.segments import StringSegment
 from extensions.ext_database import db
 from models.model import Conversation
@@ -251,7 +250,6 @@ class DifyNodeFactory(NodeFactory):
                model_factory=self._llm_model_factory,
                model_instance=model_instance,
                memory=memory,
-                http_client=self._http_request_http_client,
            )

        if node_type == NodeType.DATASOURCE:
@@ -294,7 +292,6 @@ class DifyNodeFactory(NodeFactory):
                model_factory=self._llm_model_factory,
                model_instance=model_instance,
                memory=memory,
-                http_client=self._http_request_http_client,
            )

        if node_type == NodeType.PARAMETER_EXTRACTOR:
@@ -311,15 +308,6 @@ class DifyNodeFactory(NodeFactory):
                memory=memory,
            )

-        if node_type == NodeType.TOOL:
-            return ToolNode(
-                id=node_id,
-                config=node_config,
-                graph_init_params=self.graph_init_params,
-                graph_runtime_state=self.graph_runtime_state,
-                tool_file_manager_factory=self._http_request_tool_file_manager_factory(),
-            )
-
        return node_class(
            id=node_id,
            config=node_config,
@@ -2,7 +2,6 @@ from __future__ import annotations

 from collections.abc import Mapping, Sequence
 from typing import Any
-from uuid import UUID, uuid4

 from pydantic import BaseModel, Field, model_validator

@@ -44,24 +43,6 @@ class FileUploadConfig(BaseModel):
    number_limits: int = 0


-class ToolFile(BaseModel):
-    id: UUID = Field(default_factory=uuid4, description="Unique identifier for the file")
-    user_id: UUID = Field(..., description="ID of the user who owns this file")
-    tenant_id: UUID = Field(..., description="ID of the tenant/organization")
-    conversation_id: UUID | None = Field(None, description="ID of the associated conversation")
-    file_key: str = Field(..., max_length=255, description="Storage key for the file")
-    mimetype: str = Field(..., max_length=255, description="MIME type of the file")
-    original_url: str | None = Field(
-        None, max_length=2048, description="Original URL if file was fetched from external source"
-    )
-    name: str = Field(default="", max_length=255, description="Display name of the file")
-    size: int = Field(default=-1, ge=-1, description="File size in bytes (-1 if unknown)")
-
-    class Config:
-        from_attributes = True  # Enable ORM mode for SQLAlchemy compatibility
-        populate_by_name = True
-
-
 class File(BaseModel):
    # NOTE: dify_model_identity is a special identifier used to distinguish between
    # new and old data formats during serialization and deserialization.
@@ -4,7 +4,6 @@ import json
 import logging
 import os
 import tempfile
-import zipfile
 from collections.abc import Mapping, Sequence
 from typing import TYPE_CHECKING, Any

@@ -83,18 +82,8 @@ class DocumentExtractorNode(Node[DocumentExtractorNodeData]):

        value = variable.value
        inputs = {"variable_selector": variable_selector}
-        if isinstance(value, list):
-            value = list(filter(lambda x: x, value))
        process_data = {"documents": value if isinstance(value, list) else [value]}

-        if not value:
-            return NodeRunResult(
-                status=WorkflowNodeExecutionStatus.SUCCEEDED,
-                inputs=inputs,
-                process_data=process_data,
-                outputs={"text": ArrayStringSegment(value=[])},
-            )
-
        try:
            if isinstance(value, list):
                extracted_text_list = [
@@ -122,7 +111,6 @@ class DocumentExtractorNode(Node[DocumentExtractorNodeData]):
            else:
                raise DocumentExtractorError(f"Unsupported variable type: {type(value)}")
        except DocumentExtractorError as e:
-            logger.warning(e, exc_info=True)
            return NodeRunResult(
                status=WorkflowNodeExecutionStatus.FAILED,
                error=str(e),
@@ -397,32 +385,6 @@ def parser_docx_part(block, doc: Document, content_items, i):
        content_items.append((i, "table", Table(block, doc)))


-def _normalize_docx_zip(file_content: bytes) -> bytes:
-    """
-    Some DOCX files (e.g. exported by Evernote on Windows) are malformed:
-    ZIP entry names use backslash (\\) as path separator instead of the forward
-    slash (/) required by both the ZIP spec and OOXML.  On Linux/Mac the entry
-    "word\\document.xml" is never found when python-docx looks for
-    "word/document.xml", which triggers a KeyError about a missing relationship.
-
-    This function rewrites the ZIP in-memory, normalizing all entry names to
-    use forward slashes without touching any actual document content.
-    """
-    try:
-        with zipfile.ZipFile(io.BytesIO(file_content), "r") as zin:
-            out_buf = io.BytesIO()
-            with zipfile.ZipFile(out_buf, "w", compression=zipfile.ZIP_DEFLATED) as zout:
-                for item in zin.infolist():
-                    data = zin.read(item.filename)
-                    # Normalize backslash path separators to forward slash
-                    item.filename = item.filename.replace("\\", "/")
-                    zout.writestr(item, data)
-            return out_buf.getvalue()
-    except zipfile.BadZipFile:
-        # Not a valid zip — return as-is and let python-docx report the real error
-        return file_content
-
-
 def _extract_text_from_docx(file_content: bytes) -> str:
    """
    Extract text from a DOCX file.
@@ -430,15 +392,7 @@ def _extract_text_from_docx(file_content: bytes) -> str:
    """
    try:
        doc_file = io.BytesIO(file_content)
-        try:
-            doc = docx.Document(doc_file)
-        except Exception as e:
-            logger.warning("Failed to parse DOCX, attempting to normalize ZIP entry paths: %s", e)
-            # Some DOCX files exported by tools like Evernote on Windows use
-            # backslash path separators in ZIP entries and/or single-quoted XML
-            # attributes, both of which break python-docx on Linux. Normalize and retry.
-            file_content = _normalize_docx_zip(file_content)
-            doc = docx.Document(io.BytesIO(file_content))
+        doc = docx.Document(doc_file)
        text = []

        # Keep track of paragraph and table positions
@@ -14,6 +14,7 @@ from dify_graph.model_runtime.utils.encoders import jsonable_encoder
 from dify_graph.node_events import NodeRunResult
 from dify_graph.nodes.base import LLMUsageTrackingMixin
 from dify_graph.nodes.base.node import Node
+from dify_graph.nodes.llm.file_saver import FileSaverImpl, LLMFileSaver
 from dify_graph.repositories.rag_retrieval_protocol import KnowledgeRetrievalRequest, RAGRetrievalProtocol, Source
 from dify_graph.variables import (
    ArrayFileSegment,
@@ -22,11 +23,7 @@ from dify_graph.variables import (
 )
 from dify_graph.variables.segments import ArrayObjectSegment

-from .entities import (
-    Condition,
-    KnowledgeRetrievalNodeData,
-    MetadataFilteringCondition,
-)
+from .entities import KnowledgeRetrievalNodeData
 from .exc import (
    KnowledgeRetrievalNodeError,
    RateLimitExceededError,
@@ -46,6 +43,8 @@ class KnowledgeRetrievalNode(LLMUsageTrackingMixin, Node[KnowledgeRetrievalNodeD
    # Output variable for file
    _file_outputs: list["File"]

+    _llm_file_saver: LLMFileSaver
+
    def __init__(
        self,
        id: str,
@@ -53,6 +52,8 @@ class KnowledgeRetrievalNode(LLMUsageTrackingMixin, Node[KnowledgeRetrievalNodeD
        graph_init_params: "GraphInitParams",
        graph_runtime_state: "GraphRuntimeState",
        rag_retrieval: RAGRetrievalProtocol,
+        *,
+        llm_file_saver: LLMFileSaver | None = None,
    ):
        super().__init__(
            id=id,
@@ -64,6 +65,14 @@ class KnowledgeRetrievalNode(LLMUsageTrackingMixin, Node[KnowledgeRetrievalNodeD
        self._file_outputs = []
        self._rag_retrieval = rag_retrieval

+        if llm_file_saver is None:
+            dify_ctx = self.require_dify_context()
+            llm_file_saver = FileSaverImpl(
+                user_id=dify_ctx.user_id,
+                tenant_id=dify_ctx.tenant_id,
+            )
+        self._llm_file_saver = llm_file_saver
+
    @classmethod
    def version(cls):
        return "1"
@@ -162,12 +171,6 @@ class KnowledgeRetrievalNode(LLMUsageTrackingMixin, Node[KnowledgeRetrievalNodeD
        if node_data.metadata_filtering_mode is not None:
            metadata_filtering_mode = node_data.metadata_filtering_mode

-        resolved_metadata_conditions = (
-            self._resolve_metadata_filtering_conditions(node_data.metadata_filtering_conditions)
-            if node_data.metadata_filtering_conditions
-            else None
-        )
-
        if str(node_data.retrieval_mode) == DatasetRetrieveConfigEntity.RetrieveStrategy.SINGLE and query:
            # fetch model config
            if node_data.single_retrieval_config is None:
@@ -186,7 +189,7 @@ class KnowledgeRetrievalNode(LLMUsageTrackingMixin, Node[KnowledgeRetrievalNodeD
                    model_mode=model.mode,
                    model_name=model.name,
                    metadata_model_config=node_data.metadata_model_config,
-                    metadata_filtering_conditions=resolved_metadata_conditions,
+                    metadata_filtering_conditions=node_data.metadata_filtering_conditions,
                    metadata_filtering_mode=metadata_filtering_mode,
                    query=query,
                )
@@ -244,7 +247,7 @@ class KnowledgeRetrievalNode(LLMUsageTrackingMixin, Node[KnowledgeRetrievalNodeD
                    weights=weights,
                    reranking_enable=node_data.multiple_retrieval_config.reranking_enable,
                    metadata_model_config=node_data.metadata_model_config,
-                    metadata_filtering_conditions=resolved_metadata_conditions,
+                    metadata_filtering_conditions=node_data.metadata_filtering_conditions,
                    metadata_filtering_mode=metadata_filtering_mode,
                    attachment_ids=[attachment.related_id for attachment in attachments] if attachments else None,
                )
@@ -253,48 +256,6 @@ class KnowledgeRetrievalNode(LLMUsageTrackingMixin, Node[KnowledgeRetrievalNodeD
        usage = self._rag_retrieval.llm_usage
        return retrieval_resource_list, usage

-    def _resolve_metadata_filtering_conditions(
-        self, conditions: MetadataFilteringCondition
-    ) -> MetadataFilteringCondition:
-        if conditions.conditions is None:
-            return MetadataFilteringCondition(
-                logical_operator=conditions.logical_operator,
-                conditions=None,
-            )
-
-        variable_pool = self.graph_runtime_state.variable_pool
-        resolved_conditions: list[Condition] = []
-        for cond in conditions.conditions or []:
-            value = cond.value
-            if isinstance(value, str):
-                segment_group = variable_pool.convert_template(value)
-                if len(segment_group.value) == 1:
-                    resolved_value = segment_group.value[0].to_object()
-                else:
-                    resolved_value = segment_group.text
-            elif isinstance(value, Sequence) and all(isinstance(v, str) for v in value):
-                resolved_values = []
-                for v in value:  # type: ignore
-                    segment_group = variable_pool.convert_template(v)
-                    if len(segment_group.value) == 1:
-                        resolved_values.append(segment_group.value[0].to_object())
-                    else:
-                        resolved_values.append(segment_group.text)
-                resolved_value = resolved_values
-            else:
-                resolved_value = value
-            resolved_conditions.append(
-                Condition(
-                    name=cond.name,
-                    comparison_operator=cond.comparison_operator,
-                    value=resolved_value,
-                )
-            )
-        return MetadataFilteringCondition(
-            logical_operator=conditions.logical_operator or "and",
-            conditions=resolved_conditions,
-        )
-
    @classmethod
    def _extract_variable_selector_to_variable_mapping(
        cls,
@@ -1,11 +1,14 @@
 import mimetypes
 import typing as tp

+from sqlalchemy import Engine
+
 from constants.mimetypes import DEFAULT_EXTENSION, DEFAULT_MIME_TYPE
+from core.helper import ssrf_proxy
 from core.tools.signature import sign_tool_file
 from core.tools.tool_file_manager import ToolFileManager
 from dify_graph.file import File, FileTransferMethod, FileType
-from dify_graph.nodes.protocols import HttpClientProtocol
+from extensions.ext_database import db as global_db


 class LLMFileSaver(tp.Protocol):
@@ -56,20 +59,30 @@ class LLMFileSaver(tp.Protocol):
        raise NotImplementedError()


+EngineFactory: tp.TypeAlias = tp.Callable[[], Engine]
+
+
 class FileSaverImpl(LLMFileSaver):
+    _engine_factory: EngineFactory
    _tenant_id: str
    _user_id: str

-    def __init__(self, user_id: str, tenant_id: str, http_client: HttpClientProtocol):
+    def __init__(self, user_id: str, tenant_id: str, engine_factory: EngineFactory | None = None):
+        if engine_factory is None:
+
+            def _factory():
+                return global_db.engine
+
+            engine_factory = _factory
+        self._engine_factory = engine_factory
        self._user_id = user_id
        self._tenant_id = tenant_id
-        self._http_client = http_client

    def _get_tool_file_manager(self):
-        return ToolFileManager()
+        return ToolFileManager(engine=self._engine_factory())

    def save_remote_url(self, url: str, file_type: FileType) -> File:
-        http_response = self._http_client.get(url)
+        http_response = ssrf_proxy.get(url)
        http_response.raise_for_status()
        data = http_response.content
        mime_type_from_header = http_response.headers.get("Content-Type")
@@ -64,7 +64,6 @@ from dify_graph.nodes.base.entities import VariableSelector
 from dify_graph.nodes.base.node import Node
 from dify_graph.nodes.base.variable_template_parser import VariableTemplateParser
 from dify_graph.nodes.llm.protocols import CredentialsProvider, ModelFactory
-from dify_graph.nodes.protocols import HttpClientProtocol
 from dify_graph.runtime import VariablePool
 from dify_graph.variables import (
    ArrayFileSegment,
@@ -128,7 +127,6 @@ class LLMNode(Node[LLMNodeData]):
        credentials_provider: CredentialsProvider,
        model_factory: ModelFactory,
        model_instance: ModelInstance,
-        http_client: HttpClientProtocol,
        memory: PromptMessageMemory | None = None,
        llm_file_saver: LLMFileSaver | None = None,
    ):
@@ -151,7 +149,6 @@ class LLMNode(Node[LLMNodeData]):
            llm_file_saver = FileSaverImpl(
                user_id=dify_ctx.user_id,
                tenant_id=dify_ctx.tenant_id,
-                http_client=http_client,
            )
        self._llm_file_saver = llm_file_saver

@@ -1,10 +1,8 @@
-from collections.abc import Generator
 from typing import Any, Protocol

 import httpx

 from dify_graph.file import File
-from dify_graph.file.models import ToolFile


 class HttpClientProtocol(Protocol):
@@ -42,5 +40,3 @@ class ToolFileManagerProtocol(Protocol):
        mimetype: str,
        filename: str | None = None,
    ) -> Any: ...
-
-    def get_file_generator_by_tool_file_id(self, tool_file_id: str) -> tuple[Generator | None, ToolFile | None]: ...
@@ -28,7 +28,6 @@ from dify_graph.nodes.llm import (
 )
 from dify_graph.nodes.llm.file_saver import FileSaverImpl, LLMFileSaver
 from dify_graph.nodes.llm.protocols import CredentialsProvider, ModelFactory
-from dify_graph.nodes.protocols import HttpClientProtocol
 from libs.json_in_md_parser import parse_and_check_json_markdown

 from .entities import QuestionClassifierNodeData
@@ -69,7 +68,6 @@ class QuestionClassifierNode(Node[QuestionClassifierNodeData]):
        credentials_provider: "CredentialsProvider",
        model_factory: "ModelFactory",
        model_instance: ModelInstance,
-        http_client: HttpClientProtocol,
        memory: PromptMessageMemory | None = None,
        llm_file_saver: LLMFileSaver | None = None,
    ):
@@ -92,7 +90,6 @@ class QuestionClassifierNode(Node[QuestionClassifierNodeData]):
            llm_file_saver = FileSaverImpl(
                user_id=dify_ctx.user_id,
                tenant_id=dify_ctx.tenant_id,
-                http_client=http_client,
            )
        self._llm_file_saver = llm_file_saver

@@ -1,6 +1,9 @@
 from collections.abc import Generator, Mapping, Sequence
 from typing import TYPE_CHECKING, Any

+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
 from core.callback_handler.workflow_tool_callback_handler import DifyWorkflowCallbackHandler
 from core.tools.__base.tool import Tool
 from core.tools.entities.tool_entities import ToolInvokeMessage, ToolParameter
@@ -18,10 +21,11 @@ from dify_graph.model_runtime.entities.llm_entities import LLMUsage
 from dify_graph.node_events import NodeEventBase, NodeRunResult, StreamChunkEvent, StreamCompletedEvent
 from dify_graph.nodes.base.node import Node
 from dify_graph.nodes.base.variable_template_parser import VariableTemplateParser
-from dify_graph.nodes.protocols import ToolFileManagerProtocol
 from dify_graph.variables.segments import ArrayAnySegment, ArrayFileSegment
 from dify_graph.variables.variables import ArrayAnyVariable
+from extensions.ext_database import db
 from factories import file_factory
+from models import ToolFile
 from services.tools.builtin_tools_manage_service import BuiltinToolManageService

 from .entities import ToolNodeData
@@ -32,8 +36,7 @@ from .exc import (
 )

 if TYPE_CHECKING:
-    from dify_graph.entities import GraphInitParams
-    from dify_graph.runtime import GraphRuntimeState, VariablePool
+    from dify_graph.runtime import VariablePool


 class ToolNode(Node[ToolNodeData]):
@@ -43,23 +46,6 @@ class ToolNode(Node[ToolNodeData]):

    node_type = NodeType.TOOL

-    def __init__(
-        self,
-        id: str,
-        config: Mapping[str, Any],
-        graph_init_params: "GraphInitParams",
-        graph_runtime_state: "GraphRuntimeState",
-        *,
-        tool_file_manager_factory: ToolFileManagerProtocol,
-    ):
-        super().__init__(
-            id=id,
-            config=config,
-            graph_init_params=graph_init_params,
-            graph_runtime_state=graph_runtime_state,
-        )
-        self._tool_file_manager_factory = tool_file_manager_factory
-
    @classmethod
    def version(cls) -> str:
        return "1"
@@ -285,9 +271,11 @@ class ToolNode(Node[ToolNodeData]):

                tool_file_id = str(url).split("/")[-1].split(".")[0]

-                _, tool_file = self._tool_file_manager_factory.get_file_generator_by_tool_file_id(tool_file_id)
-                if not tool_file:
-                    raise ToolFileError(f"tool file {tool_file_id} not found")
+                with Session(db.engine) as session:
+                    stmt = select(ToolFile).where(ToolFile.id == tool_file_id)
+                    tool_file = session.scalar(stmt)
+                    if tool_file is None:
+                        raise ToolFileError(f"Tool file {tool_file_id} does not exist")

                mapping = {
                    "tool_file_id": tool_file_id,
@@ -306,9 +294,11 @@ class ToolNode(Node[ToolNodeData]):
                assert message.meta

                tool_file_id = message.message.text.split("/")[-1].split(".")[0]
-                _, tool_file = self._tool_file_manager_factory.get_file_generator_by_tool_file_id(tool_file_id)
-                if not tool_file:
-                    raise ToolFileError(f"tool file {tool_file_id} not exists")
+                with Session(db.engine) as session:
+                    stmt = select(ToolFile).where(ToolFile.id == tool_file_id)
+                    tool_file = session.scalar(stmt)
+                    if tool_file is None:
+                        raise ToolFileError(f"tool file {tool_file_id} not exists")

                mapping = {
                    "tool_file_id": tool_file_id,
@@ -13,7 +13,6 @@ def init_app(app: DifyApp):
        convert_to_agent_apps,
        create_tenant,
        delete_archived_workflow_runs,
-        export_app_messages,
        extract_plugins,
        extract_unique_plugins,
        file_usage,
@@ -67,7 +66,6 @@ def init_app(app: DifyApp):
        restore_workflow_runs,
        clean_workflow_runs,
        clean_expired_messages,
-        export_app_messages,
    ]
    for cmd in cmds_to_register:
        app.cli.add_command(cmd)
@@ -1,114 +0,0 @@
-"""
-Celery SQL comment context for OpenTelemetry SQLCommenter.
-
-Injects Celery-specific metadata (framework, task_name, traceparent, celery_retries,
-routing_key) into SQL comments for queries executed by Celery workers. This improves
-trace-to-SQL correlation and debugging in production.
-
-Uses the OpenTelemetry context key SQLCOMMENTER_ORM_TAGS_AND_VALUES, which is read
-by opentelemetry.instrumentation.sqlcommenter_utils._add_framework_tags() when the
-SQLAlchemy instrumentor appends comments to SQL statements.
-"""
-
-import logging
-from typing import Any
-
-from celery.signals import task_postrun, task_prerun
-from opentelemetry import context
-from opentelemetry.trace.propagation.tracecontext import TraceContextTextMapPropagator
-
-logger = logging.getLogger(__name__)
-_TRACE_PROPAGATOR = TraceContextTextMapPropagator()
-
-_SQLCOMMENTER_CONTEXT_KEY = "SQLCOMMENTER_ORM_TAGS_AND_VALUES"
-_TOKEN_ATTR = "_dify_sqlcommenter_context_token"
-
-
-def _build_celery_sqlcommenter_tags(task: Any) -> dict[str, str | int]:
-    """Build SQL commenter tags from the current Celery task and OpenTelemetry context."""
-    tags: dict[str, str | int] = {}
-
-    try:
-        tags["framework"] = f"celery:{_get_celery_version()}"
-    except Exception:
-        tags["framework"] = "celery:unknown"
-
-    if task and getattr(task, "name", None):
-        tags["task_name"] = str(task.name)
-
-    traceparent = _get_traceparent()
-    if traceparent:
-        tags["traceparent"] = traceparent
-
-    if task and hasattr(task, "request"):
-        request = task.request
-        retries = getattr(request, "retries", None)
-        if retries is not None and retries > 0:
-            tags["celery_retries"] = int(retries)
-
-        delivery_info = getattr(request, "delivery_info", None) or {}
-        if isinstance(delivery_info, dict):
-            routing_key = delivery_info.get("routing_key")
-            if routing_key:
-                tags["routing_key"] = str(routing_key)
-
-    return tags
-
-
-def _get_celery_version() -> str:
-    import celery
-
-    return getattr(celery, "__version__", "unknown")
-
-
-def _get_traceparent() -> str | None:
-    """Extract traceparent from the current OpenTelemetry context."""
-    carrier: dict[str, str] = {}
-    _TRACE_PROPAGATOR.inject(carrier)
-    return carrier.get("traceparent")
-
-
-def _on_task_prerun(*args: object, **kwargs: object) -> None:
-    task = kwargs.get("task")
-    if not task:
-        return
-
-    tags = _build_celery_sqlcommenter_tags(task)
-    if not tags:
-        return
-
-    current = context.get_current()
-    new_ctx = context.set_value(_SQLCOMMENTER_CONTEXT_KEY, tags, current)
-    token = context.attach(new_ctx)
-    setattr(task, _TOKEN_ATTR, token)
-
-
-def _on_task_postrun(*args: object, **kwargs: object) -> None:
-    task = kwargs.get("task")
-    if not task:
-        return
-
-    token = getattr(task, _TOKEN_ATTR, None)
-    if token is None:
-        return
-
-    try:
-        context.detach(token)
-    except Exception:
-        logger.debug("Failed to detach SQL commenter context", exc_info=True)
-    finally:
-        try:
-            delattr(task, _TOKEN_ATTR)
-        except AttributeError:
-            pass
-
-
-def setup_celery_sqlcommenter() -> None:
-    """
-    Connect Celery task_prerun and task_postrun handlers to inject SQL comment
-    context for worker queries. Call this from init_celery_worker after
-    CeleryInstrumentor().instrument() so our handlers run after the OTEL
-    instrumentor's and the trace context is already attached.
-    """
-    task_prerun.connect(_on_task_prerun, weak=False)
-    task_postrun.connect(_on_task_postrun, weak=False)
@@ -67,14 +67,11 @@ def init_celery_worker(*args, **kwargs):
        from opentelemetry.metrics import get_meter_provider
        from opentelemetry.trace import get_tracer_provider

-        from extensions.otel.celery_sqlcommenter import setup_celery_sqlcommenter
-
        tracer_provider = get_tracer_provider()
        metric_provider = get_meter_provider()
        if dify_config.DEBUG:
            logger.info("Initializing OpenTelemetry for Celery worker")
        CeleryInstrumentor(tracer_provider=tracer_provider, meter_provider=metric_provider).instrument()
-        setup_celery_sqlcommenter()


 def is_instrument_flag_enabled() -> bool:
@@ -66,7 +66,6 @@ def run_migrations_offline():
    context.configure(
        url=url, target_metadata=get_metadata(), literal_binds=True
    )
-    logger.info("Generating offline migration SQL with url: %s", url)

    with context.begin_transaction():
        context.run_migrations()
@@ -1,6 +1,5 @@
 [pytest]
-pythonpath = .
-addopts = --cov=./api --cov-report=json --import-mode=importlib
+addopts = --cov=./api --cov-report=json
 env =
    ANTHROPIC_API_KEY = sk-ant-api11-IamNotARealKeyJustForMockTestKawaiiiiiiiiii-NotBaka-ASkksz
    AZURE_OPENAI_API_BASE = https://difyai-openai.openai.azure.com
@@ -20,7 +19,7 @@ env =
    GOOGLE_API_KEY = abcdefghijklmnopqrstuvwxyz
    HUGGINGFACE_API_KEY = hf-awuwuwuwuwuwuwuwuwuwuwuwuwuwuwuwuwu
    HUGGINGFACE_EMBEDDINGS_ENDPOINT_URL = c
-    HUGGINGFACE_TEXT2TEXT_GEN_ENDPOINT_URL =    b
+    HUGGINGFACE_TEXT2TEXT_GEN_ENDPOINT_URL = b
    HUGGINGFACE_TEXT_GEN_ENDPOINT_URL = a
    MIXEDBREAD_API_KEY = mk-aaaaaaaaaaaaaaaaaaaa
    MOCK_SWITCH = true
@@ -21,10 +21,6 @@ celery_redis = Redis(
    ssl_cert_reqs=getattr(dify_config, "REDIS_SSL_CERT_REQS", None) if dify_config.BROKER_USE_SSL else None,
    ssl_certfile=getattr(dify_config, "REDIS_SSL_CERTFILE", None) if dify_config.BROKER_USE_SSL else None,
    ssl_keyfile=getattr(dify_config, "REDIS_SSL_KEYFILE", None) if dify_config.BROKER_USE_SSL else None,
-    # Add conservative socket timeouts and health checks to avoid long-lived half-open sockets
-    socket_timeout=5,
-    socket_connect_timeout=5,
-    health_check_interval=30,
 )

 logger = logging.getLogger(__name__)
@@ -3,7 +3,6 @@ import math
 import time
 from collections.abc import Iterable, Sequence

-from celery import group
 from sqlalchemy import ColumnElement, and_, func, or_, select
 from sqlalchemy.engine.row import Row
 from sqlalchemy.orm import Session
@@ -86,25 +85,20 @@ def trigger_provider_refresh() -> None:
            lock_keys: list[str] = build_trigger_refresh_lock_keys(subscriptions)
            acquired: list[bool] = _acquire_locks(keys=lock_keys, ttl_seconds=lock_ttl)

-            if not any(acquired):
-                continue
-
-            jobs = [
-                trigger_subscription_refresh.s(tenant_id=tenant_id, subscription_id=subscription_id)
-                for (tenant_id, subscription_id), is_locked in zip(subscriptions, acquired)
-                if is_locked
-            ]
-            result = group(jobs).apply_async()
-            enqueued = len(jobs)
+            enqueued: int = 0
+            for (tenant_id, subscription_id), is_locked in zip(subscriptions, acquired):
+                if not is_locked:
+                    continue
+                trigger_subscription_refresh.delay(tenant_id=tenant_id, subscription_id=subscription_id)
+                enqueued += 1

            logger.info(
-                "Trigger refresh page %d/%d: scanned=%d locks_acquired=%d enqueued=%d result=%s",
+                "Trigger refresh page %d/%d: scanned=%d locks_acquired=%d enqueued=%d",
                page + 1,
                pages,
                len(subscriptions),
                sum(1 for x in acquired if x),
                enqueued,
-                result,
            )

    logger.info("Trigger refresh scan done: due=%d", total_due)
@@ -1,6 +1,6 @@
 import logging

-from celery import current_app, group, shared_task
+from celery import group, shared_task
 from sqlalchemy import and_, select
 from sqlalchemy.orm import Session, sessionmaker

@@ -29,27 +29,31 @@ def poll_workflow_schedules() -> None:
    with session_factory() as session:
        total_dispatched = 0

+        # Process in batches until we've handled all due schedules or hit the limit
        while True:
            due_schedules = _fetch_due_schedules(session)

            if not due_schedules:
                break

-            with current_app.producer_or_acquire() as producer:  # type: ignore
-                dispatched_count = _process_schedules(session, due_schedules, producer)
-                total_dispatched += dispatched_count
+            dispatched_count = _process_schedules(session, due_schedules)
+            total_dispatched += dispatched_count

-                logger.debug("Batch processed: %d dispatched", dispatched_count)
+            logger.debug("Batch processed: %d dispatched", dispatched_count)
+
+            # Circuit breaker: check if we've hit the per-tick limit (if enabled)
+            if (
+                dify_config.WORKFLOW_SCHEDULE_MAX_DISPATCH_PER_TICK > 0
+                and total_dispatched >= dify_config.WORKFLOW_SCHEDULE_MAX_DISPATCH_PER_TICK
+            ):
+                logger.warning(
+                    "Circuit breaker activated: reached dispatch limit (%d), will continue next tick",
+                    dify_config.WORKFLOW_SCHEDULE_MAX_DISPATCH_PER_TICK,
+                )
+                break

-                # Circuit breaker: check if we've hit the per-tick limit (if enabled)
-                if 0 < dify_config.WORKFLOW_SCHEDULE_MAX_DISPATCH_PER_TICK <= total_dispatched:
-                    logger.warning(
-                        "Circuit breaker activated: reached dispatch limit (%d), will continue next tick",
-                        dify_config.WORKFLOW_SCHEDULE_MAX_DISPATCH_PER_TICK,
-                    )
-                    break
        if total_dispatched > 0:
-            logger.info("Total processed: %d workflow schedule(s) dispatched", total_dispatched)
+            logger.info("Total processed: %d dispatched", total_dispatched)


 def _fetch_due_schedules(session: Session) -> list[WorkflowSchedulePlan]:
@@ -86,7 +90,7 @@ def _fetch_due_schedules(session: Session) -> list[WorkflowSchedulePlan]:
    return list(due_schedules)


-def _process_schedules(session: Session, schedules: list[WorkflowSchedulePlan], producer=None) -> int:
+def _process_schedules(session: Session, schedules: list[WorkflowSchedulePlan]) -> int:
    """Process schedules: check quota, update next run time and dispatch to Celery in parallel."""
    if not schedules:
        return 0
@@ -103,7 +107,7 @@ def _process_schedules(session: Session, schedules: list[WorkflowSchedulePlan],

    if tasks_to_dispatch:
        job = group(run_schedule_trigger.s(schedule_id) for schedule_id in tasks_to_dispatch)
-        job.apply_async(producer=producer)
+        job.apply_async()

        logger.debug("Dispatched %d tasks in parallel", len(tasks_to_dispatch))

@@ -824,7 +824,6 @@ class DatasourceProviderService:
                "langgenius/firecrawl_datasource",
                "langgenius/notion_datasource",
                "langgenius/jina_datasource",
-                "watercrawl/watercrawl_datasource",
            ]:
                datasource_provider_id = DatasourceProviderID(f"{datasource.plugin_id}/{datasource.provider}")
                credentials = self.list_datasource_credentials(
@@ -3,7 +3,6 @@ import logging

 from pydantic import BaseModel

-from configs import dify_config
 from services.enterprise.base import EnterprisePluginManagerRequest
 from services.errors.base import BaseServiceError

@@ -29,11 +28,6 @@ class CheckCredentialPolicyComplianceRequest(BaseModel):
        return data


-class PreUninstallPluginRequest(BaseModel):
-    tenant_id: str
-    plugin_unique_identifier: str
-
-
 class CredentialPolicyViolationError(BaseServiceError):
    pass

@@ -61,21 +55,3 @@ class PluginManagerService:
            body.dify_credential_id,
            ret.get("result", False),
        )
-
-    @classmethod
-    def try_pre_uninstall_plugin(cls, body: PreUninstallPluginRequest):
-        try:
-            # the invocation must be synchronous.
-            EnterprisePluginManagerRequest.send_request(
-                "POST",
-                "/pre-uninstall-plugin",
-                json=body.model_dump(),
-                raise_for_status=True,
-                timeout=dify_config.ENTERPRISE_REQUEST_TIMEOUT,
-            )
-        except Exception:
-            logger.exception(
-                "failed to perform pre uninstall plugin hook. tenant_id: %s, plugin_unique_identifier: %s",
-                body.tenant_id,
-                body.plugin_unique_identifier,
-            )
@@ -32,10 +32,6 @@ from extensions.ext_database import db
 from extensions.ext_redis import redis_client
 from models.provider import Provider, ProviderCredential
 from models.provider_ids import GenericProviderID
-from services.enterprise.plugin_manager_service import (
-    PluginManagerService,
-    PreUninstallPluginRequest,
-)
 from services.errors.plugin import PluginInstallationForbiddenError
 from services.feature_service import FeatureService, PluginInstallationScope

@@ -523,13 +519,6 @@ class PluginService:
        if not plugin:
            return manager.uninstall(tenant_id, plugin_installation_id)

-        if dify_config.ENTERPRISE_ENABLED:
-            PluginManagerService.try_pre_uninstall_plugin(
-                PreUninstallPluginRequest(
-                    tenant_id=tenant_id,
-                    plugin_unique_identifier=plugin.plugin_unique_identifier,
-                )
-            )
        with Session(db.engine) as session, session.begin():
            plugin_id = plugin.plugin_id
            logger.info("Deleting credentials for plugin: %s", plugin_id)
@@ -63,12 +63,7 @@ class RagPipelineTransformService:
            ):
                node = self._deal_file_extensions(node)
            if node.get("data", {}).get("type") == "knowledge-index":
-                knowledge_configuration = KnowledgeConfiguration.model_validate(node.get("data", {}))
-                if dataset.tenant_id != current_user.current_tenant_id:
-                    raise ValueError("Unauthorized")
-                node = self._deal_knowledge_index(
-                    knowledge_configuration, dataset, indexing_technique, retrieval_model, node
-                )
+                node = self._deal_knowledge_index(dataset, doc_form, indexing_technique, retrieval_model, node)
            new_nodes.append(node)
        if new_nodes:
            graph["nodes"] = new_nodes
@@ -160,13 +155,14 @@ class RagPipelineTransformService:

    def _deal_knowledge_index(
        self,
-        knowledge_configuration: KnowledgeConfiguration,
        dataset: Dataset,
+        doc_form: str,
        indexing_technique: str | None,
        retrieval_model: RetrievalSetting | None,
        node: dict,
    ):
        knowledge_configuration_dict = node.get("data", {})
+        knowledge_configuration = KnowledgeConfiguration.model_validate(knowledge_configuration_dict)

        if indexing_technique == "high_quality":
            knowledge_configuration.embedding_model = dataset.embedding_model
@@ -1,304 +0,0 @@
-"""
-Export app messages to JSONL.GZ format.
-
-Outputs: conversation_id, message_id, query, answer, inputs (raw JSON),
-retriever_resources (from message_metadata), feedback (user feedbacks array).
-
-Uses (created_at, id) cursor pagination and batch-loads feedbacks to avoid N+1.
-Does NOT touch Message.inputs / Message.user_feedback properties.
-"""
-
-import datetime
-import gzip
-import json
-import logging
-import tempfile
-from collections import defaultdict
-from collections.abc import Generator, Iterable
-from pathlib import Path, PurePosixPath
-from typing import Any, BinaryIO, cast
-
-import orjson
-import sqlalchemy as sa
-from pydantic import BaseModel, ConfigDict, Field
-from sqlalchemy import select, tuple_
-from sqlalchemy.orm import Session
-
-from extensions.ext_database import db
-from extensions.ext_storage import storage
-from models.model import Message, MessageFeedback
-
-logger = logging.getLogger(__name__)
-
-MAX_FILENAME_BASE_LENGTH = 1024
-FORBIDDEN_FILENAME_SUFFIXES = (".jsonl.gz", ".jsonl", ".gz")
-
-
-class AppMessageExportFeedback(BaseModel):
-    id: str
-    app_id: str
-    conversation_id: str
-    message_id: str
-    rating: str
-    content: str | None = None
-    from_source: str
-    from_end_user_id: str | None = None
-    from_account_id: str | None = None
-    created_at: str
-    updated_at: str
-
-    model_config = ConfigDict(extra="forbid")
-
-
-class AppMessageExportRecord(BaseModel):
-    conversation_id: str
-    message_id: str
-    query: str
-    answer: str
-    inputs: dict[str, Any]
-    retriever_resources: list[Any] = Field(default_factory=list)
-    feedback: list[AppMessageExportFeedback] = Field(default_factory=list)
-
-    model_config = ConfigDict(extra="forbid")
-
-
-class AppMessageExportStats(BaseModel):
-    batches: int = 0
-    total_messages: int = 0
-    messages_with_feedback: int = 0
-    total_feedbacks: int = 0
-
-    model_config = ConfigDict(extra="forbid")
-
-
-class AppMessageExportService:
-    @staticmethod
-    def validate_export_filename(filename: str) -> str:
-        normalized = filename.strip()
-        if not normalized:
-            raise ValueError("--filename must not be empty.")
-
-        normalized_lower = normalized.lower()
-        if normalized_lower.endswith(FORBIDDEN_FILENAME_SUFFIXES):
-            raise ValueError("--filename must not include .jsonl.gz/.jsonl/.gz suffix; pass base filename only.")
-
-        if normalized.startswith("/"):
-            raise ValueError("--filename must be a relative path; absolute paths are not allowed.")
-
-        if "\\" in normalized:
-            raise ValueError("--filename must use '/' as path separator; '\\' is not allowed.")
-
-        if "//" in normalized:
-            raise ValueError("--filename must not contain empty path segments ('//').")
-
-        if len(normalized) > MAX_FILENAME_BASE_LENGTH:
-            raise ValueError(f"--filename is too long; max length is {MAX_FILENAME_BASE_LENGTH}.")
-
-        for ch in normalized:
-            if ch == "\x00" or ord(ch) < 32 or ord(ch) == 127:
-                raise ValueError("--filename must not contain control characters or NUL.")
-
-        parts = PurePosixPath(normalized).parts
-        if not parts:
-            raise ValueError("--filename must include a file name.")
-
-        if any(part in (".", "..") for part in parts):
-            raise ValueError("--filename must not contain '.' or '..' path segments.")
-
-        return normalized
-
-    @property
-    def output_gz_name(self) -> str:
-        return f"{self._filename_base}.jsonl.gz"
-
-    @property
-    def output_jsonl_name(self) -> str:
-        return f"{self._filename_base}.jsonl"
-
-    def __init__(
-        self,
-        app_id: str,
-        end_before: datetime.datetime,
-        filename: str,
-        *,
-        start_from: datetime.datetime | None = None,
-        batch_size: int = 1000,
-        use_cloud_storage: bool = False,
-        dry_run: bool = False,
-    ) -> None:
-        if start_from and start_from >= end_before:
-            raise ValueError(f"start_from ({start_from}) must be before end_before ({end_before})")
-
-        self._app_id = app_id
-        self._end_before = end_before
-        self._start_from = start_from
-        self._filename_base = self.validate_export_filename(filename)
-        self._batch_size = batch_size
-        self._use_cloud_storage = use_cloud_storage
-        self._dry_run = dry_run
-
-    def run(self) -> AppMessageExportStats:
-        stats = AppMessageExportStats()
-
-        logger.info(
-            "export_app_messages: app_id=%s, start_from=%s, end_before=%s, dry_run=%s, cloud=%s, output_gz=%s",
-            self._app_id,
-            self._start_from,
-            self._end_before,
-            self._dry_run,
-            self._use_cloud_storage,
-            self.output_gz_name,
-        )
-
-        if self._dry_run:
-            for _ in self._iter_records_with_stats(stats):
-                pass
-            self._finalize_stats(stats)
-            return stats
-
-        if self._use_cloud_storage:
-            self._export_to_cloud(stats)
-        else:
-            self._export_to_local(stats)
-
-        self._finalize_stats(stats)
-        return stats
-
-    def iter_records(self) -> Generator[AppMessageExportRecord, None, None]:
-        for batch in self._iter_record_batches():
-            yield from batch
-
-    @staticmethod
-    def write_jsonl_gz(records: Iterable[AppMessageExportRecord], fileobj: BinaryIO) -> None:
-        with gzip.GzipFile(fileobj=fileobj, mode="wb") as gz:
-            for record in records:
-                gz.write(orjson.dumps(record.model_dump(mode="json")) + b"\n")
-
-    def _export_to_local(self, stats: AppMessageExportStats) -> None:
-        output_path = Path.cwd() / self.output_gz_name
-        output_path.parent.mkdir(parents=True, exist_ok=True)
-        with output_path.open("wb") as output_file:
-            self.write_jsonl_gz(self._iter_records_with_stats(stats), output_file)
-
-    def _export_to_cloud(self, stats: AppMessageExportStats) -> None:
-        with tempfile.SpooledTemporaryFile(max_size=64 * 1024 * 1024) as tmp:
-            self.write_jsonl_gz(self._iter_records_with_stats(stats), cast(BinaryIO, tmp))
-            tmp.seek(0)
-            data = tmp.read()
-
-        storage.save(self.output_gz_name, data)
-        logger.info("export_app_messages: uploaded %d bytes to cloud key=%s", len(data), self.output_gz_name)
-
-    def _iter_records_with_stats(self, stats: AppMessageExportStats) -> Generator[AppMessageExportRecord, None, None]:
-        for record in self.iter_records():
-            self._update_stats(stats, record)
-            yield record
-
-    @staticmethod
-    def _update_stats(stats: AppMessageExportStats, record: AppMessageExportRecord) -> None:
-        stats.total_messages += 1
-        if record.feedback:
-            stats.messages_with_feedback += 1
-            stats.total_feedbacks += len(record.feedback)
-
-    def _finalize_stats(self, stats: AppMessageExportStats) -> None:
-        if stats.total_messages == 0:
-            stats.batches = 0
-            return
-        stats.batches = (stats.total_messages + self._batch_size - 1) // self._batch_size
-
-    def _iter_record_batches(self) -> Generator[list[AppMessageExportRecord], None, None]:
-        cursor: tuple[datetime.datetime, str] | None = None
-        while True:
-            rows, cursor = self._fetch_batch(cursor)
-            if not rows:
-                break
-
-            message_ids = [str(row.id) for row in rows]
-            feedbacks_map = self._fetch_feedbacks(message_ids)
-            yield [self._build_record(row, feedbacks_map) for row in rows]
-
-    def _fetch_batch(
-        self, cursor: tuple[datetime.datetime, str] | None
-    ) -> tuple[list[Any], tuple[datetime.datetime, str] | None]:
-        with Session(db.engine, expire_on_commit=False) as session:
-            stmt = (
-                select(
-                    Message.id,
-                    Message.conversation_id,
-                    Message.query,
-                    Message.answer,
-                    Message._inputs,  # pyright: ignore[reportPrivateUsage]
-                    Message.message_metadata,
-                    Message.created_at,
-                )
-                .where(
-                    Message.app_id == self._app_id,
-                    Message.created_at < self._end_before,
-                )
-                .order_by(Message.created_at, Message.id)
-                .limit(self._batch_size)
-            )
-
-            if self._start_from:
-                stmt = stmt.where(Message.created_at >= self._start_from)
-
-            if cursor:
-                stmt = stmt.where(
-                    tuple_(Message.created_at, Message.id)
-                    > tuple_(
-                        sa.literal(cursor[0], type_=sa.DateTime()),
-                        sa.literal(cursor[1], type_=Message.id.type),
-                    )
-                )
-
-            rows = list(session.execute(stmt).all())
-
-        if not rows:
-            return [], cursor
-
-        last = rows[-1]
-        return rows, (last.created_at, last.id)
-
-    def _fetch_feedbacks(self, message_ids: list[str]) -> dict[str, list[AppMessageExportFeedback]]:
-        if not message_ids:
-            return {}
-
-        with Session(db.engine, expire_on_commit=False) as session:
-            stmt = (
-                select(MessageFeedback)
-                .where(
-                    MessageFeedback.message_id.in_(message_ids),
-                    MessageFeedback.from_source == "user",
-                )
-                .order_by(MessageFeedback.message_id, MessageFeedback.created_at)
-            )
-            feedbacks = list(session.scalars(stmt).all())
-
-        result: dict[str, list[AppMessageExportFeedback]] = defaultdict(list)
-        for feedback in feedbacks:
-            result[str(feedback.message_id)].append(AppMessageExportFeedback.model_validate(feedback.to_dict()))
-        return result
-
-    @staticmethod
-    def _build_record(row: Any, feedbacks_map: dict[str, list[AppMessageExportFeedback]]) -> AppMessageExportRecord:
-        retriever_resources: list[Any] = []
-        if row.message_metadata:
-            try:
-                metadata = json.loads(row.message_metadata)
-                value = metadata.get("retriever_resources", [])
-                if isinstance(value, list):
-                    retriever_resources = value
-            except (json.JSONDecodeError, TypeError):
-                pass
-
-        message_id = str(row.id)
-        return AppMessageExportRecord(
-            conversation_id=str(row.conversation_id),
-            message_id=message_id,
-            query=row.query,
-            answer=row.answer,
-            inputs=row._inputs if isinstance(row._inputs, dict) else {},
-            retriever_resources=retriever_resources,
-            feedback=feedbacks_map.get(message_id, []),
-        )
@@ -12,7 +12,6 @@ from sqlalchemy.engine import CursorResult
 from sqlalchemy.orm import Session

 from extensions.ext_database import db
-from libs.datetime_utils import naive_utc_now
 from models.model import (
    App,
    AppAnnotationHitHistory,
@@ -143,7 +142,7 @@ class MessagesCleanService:
        if batch_size <= 0:
            raise ValueError(f"batch_size ({batch_size}) must be greater than 0")

-        end_before = naive_utc_now() - datetime.timedelta(days=days)
+        end_before = datetime.datetime.now() - datetime.timedelta(days=days)

        logger.info(
            "clean_messages: days=%s, end_before=%s, batch_size=%s, policy=%s",
@@ -124,7 +124,7 @@ class WebsiteService:
        if provider == "firecrawl":
            plugin_id = "langgenius/firecrawl_datasource"
        elif provider == "watercrawl":
-            plugin_id = "watercrawl/watercrawl_datasource"
+            plugin_id = "langgenius/watercrawl_datasource"
        elif provider == "jinareader":
            plugin_id = "langgenius/jina_datasource"
        else:
@@ -1,10 +1,9 @@
 import logging
 import time
-from collections.abc import Sequence
-from typing import Any, Protocol
+from collections.abc import Callable, Sequence

 import click
-from celery import current_app, shared_task
+from celery import shared_task

 from configs import dify_config
 from core.db.session_factory import session_factory
@@ -20,12 +19,6 @@ from tasks.generate_summary_index_task import generate_summary_index_task
 logger = logging.getLogger(__name__)


-class CeleryTaskLike(Protocol):
-    def delay(self, *args: Any, **kwargs: Any) -> Any: ...
-
-    def apply_async(self, *args: Any, **kwargs: Any) -> Any: ...
-
-
@shared_task(queue="dataset")
 def document_indexing_task(dataset_id: str, document_ids: list):
    """
@@ -186,8 +179,8 @@ def _document_indexing(dataset_id: str, document_ids: Sequence[str]):


 def _document_indexing_with_tenant_queue(
-    tenant_id: str, dataset_id: str, document_ids: Sequence[str], task_func: CeleryTaskLike
-) -> None:
+    tenant_id: str, dataset_id: str, document_ids: Sequence[str], task_func: Callable[[str, str, Sequence[str]], None]
+):
    try:
        _document_indexing(dataset_id, document_ids)
    except Exception:
@@ -208,20 +201,16 @@ def _document_indexing_with_tenant_queue(
        logger.info("document indexing tenant isolation queue %s next tasks: %s", tenant_id, next_tasks)

        if next_tasks:
-            with current_app.producer_or_acquire() as producer:  # type: ignore
-                for next_task in next_tasks:
-                    document_task = DocumentTask(**next_task)
-                    # Keep the flag set to indicate a task is running
-                    tenant_isolated_task_queue.set_task_waiting_time()
-                    task_func.apply_async(
-                        kwargs={
-                            "tenant_id": document_task.tenant_id,
-                            "dataset_id": document_task.dataset_id,
-                            "document_ids": document_task.document_ids,
-                        },
-                        producer=producer,
-                    )
-
+            for next_task in next_tasks:
+                document_task = DocumentTask(**next_task)
+                # Process the next waiting task
+                # Keep the flag set to indicate a task is running
+                tenant_isolated_task_queue.set_task_waiting_time()
+                task_func.delay(  # type: ignore
+                    tenant_id=document_task.tenant_id,
+                    dataset_id=document_task.dataset_id,
+                    document_ids=document_task.document_ids,
+                )
        else:
            # No more waiting tasks, clear the flag
            tenant_isolated_task_queue.delete_task_key()
@@ -6,6 +6,7 @@ import typing
 import click
 from celery import shared_task

+from core.helper.marketplace import record_install_plugin_event
 from core.plugin.entities.marketplace import MarketplacePluginSnapshot
 from core.plugin.entities.plugin import PluginInstallationSource
 from core.plugin.impl.plugin import PluginInstaller
@@ -165,6 +166,7 @@ def process_tenant_plugin_autoupgrade_check_task(
                        # execute upgrade
                        new_unique_identifier = manifest.latest_package_identifier

+                        record_install_plugin_event(new_unique_identifier)
                        click.echo(
                            click.style(
                                f"Upgrade plugin: {original_unique_identifier} -> {new_unique_identifier}",
@@ -3,13 +3,12 @@ import json
 import logging
 import time
 import uuid
-from collections.abc import Mapping, Sequence
+from collections.abc import Mapping
 from concurrent.futures import ThreadPoolExecutor
-from itertools import islice
 from typing import Any

 import click
-from celery import group, shared_task
+from celery import shared_task  # type: ignore
 from flask import current_app, g
 from sqlalchemy.orm import Session, sessionmaker

@@ -28,11 +27,6 @@ from services.file_service import FileService
 logger = logging.getLogger(__name__)


-def chunked(iterable: Sequence, size: int):
-    it = iter(iterable)
-    return iter(lambda: list(islice(it, size)), [])
-
-
@shared_task(queue="pipeline")
 def rag_pipeline_run_task(
    rag_pipeline_invoke_entities_file_id: str,
@@ -89,24 +83,16 @@ def rag_pipeline_run_task(
        logger.info("rag pipeline tenant isolation queue %s next files: %s", tenant_id, next_file_ids)

        if next_file_ids:
-            for batch in chunked(next_file_ids, 100):
-                jobs = []
-                for next_file_id in batch:
-                    tenant_isolated_task_queue.set_task_waiting_time()
-
-                    file_id = (
-                        next_file_id.decode("utf-8") if isinstance(next_file_id, (bytes, bytearray)) else next_file_id
-                    )
-
-                    jobs.append(
-                        rag_pipeline_run_task.s(
-                            rag_pipeline_invoke_entities_file_id=file_id,
-                            tenant_id=tenant_id,
-                        )
-                    )
-
-                if jobs:
-                    group(jobs).apply_async()
+            for next_file_id in next_file_ids:
+                # Process the next waiting task
+                # Keep the flag set to indicate a task is running
+                tenant_isolated_task_queue.set_task_waiting_time()
+                rag_pipeline_run_task.delay(  # type: ignore
+                    rag_pipeline_invoke_entities_file_id=next_file_id.decode("utf-8")
+                    if isinstance(next_file_id, bytes)
+                    else next_file_id,
+                    tenant_id=tenant_id,
+                )
        else:
            # No more waiting tasks, clear the flag
            tenant_isolated_task_queue.delete_task_key()
@@ -5,10 +5,14 @@ This test module validates the 400-character limit enforcement
 for App descriptions across all creation and editing endpoints.
 """

+import os
 import sys

 import pytest

+# Add the API root to Python path for imports
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "..", ".."))
+

 class TestAppDescriptionValidationUnit:
    """Unit tests for description validation function"""
@@ -11,7 +11,6 @@ from dify_graph.enums import WorkflowNodeExecutionStatus
 from dify_graph.node_events import StreamCompletedEvent
 from dify_graph.nodes.llm.node import LLMNode
 from dify_graph.nodes.llm.protocols import CredentialsProvider, ModelFactory
-from dify_graph.nodes.protocols import HttpClientProtocol
 from dify_graph.runtime import GraphRuntimeState, VariablePool
 from dify_graph.system_variable import SystemVariable
 from extensions.ext_database import db
@@ -75,7 +74,6 @@ def init_llm_node(config: dict) -> LLMNode:
        credentials_provider=MagicMock(spec=CredentialsProvider),
        model_factory=MagicMock(spec=ModelFactory),
        model_instance=MagicMock(spec=ModelInstance),
-        http_client=MagicMock(spec=HttpClientProtocol),
    )

    return node
@@ -8,7 +8,6 @@ from core.workflow.node_factory import DifyNodeFactory
 from dify_graph.enums import WorkflowNodeExecutionStatus
 from dify_graph.graph import Graph
 from dify_graph.node_events import StreamCompletedEvent
-from dify_graph.nodes.protocols import ToolFileManagerProtocol
 from dify_graph.nodes.tool.tool_node import ToolNode
 from dify_graph.runtime import GraphRuntimeState, VariablePool
 from dify_graph.system_variable import SystemVariable
@@ -56,14 +55,11 @@ def init_tool_node(config: dict):

    graph = Graph.init(graph_config=graph_config, node_factory=node_factory)

-    tool_file_manager_factory = MagicMock(spec=ToolFileManagerProtocol)
-
    node = ToolNode(
        id=str(uuid.uuid4()),
        config=config,
        graph_init_params=init_params,
        graph_runtime_state=graph_runtime_state,
-        tool_file_manager_factory=tool_file_manager_factory,
    )
    return node

@@ -10,11 +10,8 @@ more reliable and realistic test scenarios.
 import logging
 import os
 from collections.abc import Generator
-from contextlib import contextmanager
 from pathlib import Path
-from typing import Protocol, TypeVar

-import psycopg2
 import pytest
 from flask import Flask
 from flask.testing import FlaskClient
@@ -34,25 +31,6 @@ logging.basicConfig(level=logging.INFO, format="%(asctime)s - %(name)s - %(level
 logger = logging.getLogger(__name__)


-class _CloserProtocol(Protocol):
-    """_Closer is any type which implement the close() method."""
-
-    def close(self):
-        """close the current object, release any external resouece (file, transaction, connection etc.)
-        associated with it.
-        """
-        pass
-
-
-_Closer = TypeVar("_Closer", bound=_CloserProtocol)
-
-
-@contextmanager
-def _auto_close(closer: _Closer) -> Generator[_Closer, None, None]:
-    yield closer
-    closer.close()
-
-
 class DifyTestContainers:
    """
    Manages all test containers required for Dify integration tests.
@@ -119,28 +97,45 @@ class DifyTestContainers:
        wait_for_logs(self.postgres, "is ready to accept connections", timeout=30)
        logger.info("PostgreSQL container is ready and accepting connections")

-        conn = psycopg2.connect(
-            host=db_host,
-            port=db_port,
-            user=self.postgres.username,
-            password=self.postgres.password,
-            database=self.postgres.dbname,
-        )
-        conn.autocommit = True
-        with _auto_close(conn):
-            with conn.cursor() as cursor:
-                # Install uuid-ossp extension for UUID generation
-                logger.info("Installing uuid-ossp extension...")
-                cursor.execute('CREATE EXTENSION IF NOT EXISTS "uuid-ossp";')
-            logger.info("uuid-ossp extension installed successfully")
+        # Install uuid-ossp extension for UUID generation
+        logger.info("Installing uuid-ossp extension...")
+        try:
+            import psycopg2

-            # NOTE: We cannot use `with conn.cursor() as cursor:` as it will wrap the statement
-            # inside a transaction. However, the `CREATE DATABASE` statement cannot run inside a transaction block.
-            with _auto_close(conn.cursor()) as cursor:
-                # Create plugin database for dify-plugin-daemon
-                logger.info("Creating plugin database...")
-                cursor.execute("CREATE DATABASE dify_plugin;")
+            conn = psycopg2.connect(
+                host=db_host,
+                port=db_port,
+                user=self.postgres.username,
+                password=self.postgres.password,
+                database=self.postgres.dbname,
+            )
+            conn.autocommit = True
+            cursor = conn.cursor()
+            cursor.execute('CREATE EXTENSION IF NOT EXISTS "uuid-ossp";')
+            cursor.close()
+            conn.close()
+            logger.info("uuid-ossp extension installed successfully")
+        except Exception as e:
+            logger.warning("Failed to install uuid-ossp extension: %s", e)
+
+        # Create plugin database for dify-plugin-daemon
+        logger.info("Creating plugin database...")
+        try:
+            conn = psycopg2.connect(
+                host=db_host,
+                port=db_port,
+                user=self.postgres.username,
+                password=self.postgres.password,
+                database=self.postgres.dbname,
+            )
+            conn.autocommit = True
+            cursor = conn.cursor()
+            cursor.execute("CREATE DATABASE dify_plugin;")
+            cursor.close()
+            conn.close()
            logger.info("Plugin database created successfully")
+        except Exception as e:
+            logger.warning("Failed to create plugin database: %s", e)

        # Set up storage environment variables
        os.environ.setdefault("STORAGE_TYPE", "opendal")
@@ -263,16 +258,23 @@ class DifyTestContainers:
        containers = [self.redis, self.postgres, self.dify_sandbox, self.dify_plugin_daemon]
        for container in containers:
            if container:
-                container_name = container.image
-                logger.info("Stopping container: %s", container_name)
-                container.stop()
-                logger.info("Successfully stopped container: %s", container_name)
+                try:
+                    container_name = container.image
+                    logger.info("Stopping container: %s", container_name)
+                    container.stop()
+                    logger.info("Successfully stopped container: %s", container_name)
+                except Exception as e:
+                    # Log error but don't fail the test cleanup
+                    logger.warning("Failed to stop container %s: %s", container, e)

        # Stop and remove the network
        if self.network:
-            logger.info("Removing Docker network...")
-            self.network.remove()
-            logger.info("Successfully removed Docker network")
+            try:
+                logger.info("Removing Docker network...")
+                self.network.remove()
+                logger.info("Successfully removed Docker network")
+            except Exception as e:
+                logger.warning("Failed to remove Docker network: %s", e)

        self._containers_started = False
        logger.info("All test containers stopped and cleaned up successfully")
@@ -8,7 +8,6 @@ from core.rag.retrieval.dataset_retrieval import DatasetRetrieval
 from dify_graph.repositories.rag_retrieval_protocol import KnowledgeRetrievalRequest
 from models.dataset import Dataset, Document
 from services.account_service import AccountService, TenantService
-from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestGetAvailableDatasetsIntegration:
@@ -23,7 +22,7 @@ class TestGetAvailableDatasetsIntegration:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -84,7 +83,7 @@ class TestGetAvailableDatasetsIntegration:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -137,7 +136,7 @@ class TestGetAvailableDatasetsIntegration:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -190,7 +189,7 @@ class TestGetAvailableDatasetsIntegration:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -253,7 +252,7 @@ class TestGetAvailableDatasetsIntegration:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -287,7 +286,7 @@ class TestGetAvailableDatasetsIntegration:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account1, name=fake.company())
        tenant1 = account1.current_tenant
@@ -296,7 +295,7 @@ class TestGetAvailableDatasetsIntegration:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account2, name=fake.company())
        tenant2 = account2.current_tenant
@@ -363,7 +362,7 @@ class TestGetAvailableDatasetsIntegration:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -385,7 +384,7 @@ class TestGetAvailableDatasetsIntegration:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -446,7 +445,7 @@ class TestKnowledgeRetrievalIntegration:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -514,7 +513,7 @@ class TestKnowledgeRetrievalIntegration:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -562,7 +561,7 @@ class TestKnowledgeRetrievalIntegration:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -1,24 +1 @@
 """Helper utilities for integration tests."""
-
-import re
-
-
-def generate_valid_password(fake, length: int = 12) -> str:
-    """Generate a password that always satisfies the project's password validation rules.
-
-    The password validation rule in ``api/libs/password.py`` requires passwords to
-    contain **both letters and digits** with a minimum length of 8:
-
-        ``^(?=.*[a-zA-Z])(?=.*\\d).{8,}$``
-
-    ``Faker.password()`` does **not** guarantee that the generated password will
-    contain both character types, which can cause intermittent test failures.
-
-    This helper re-generates until the result is valid (typically first attempt).
-    """
-    for _ in range(100):
-        pwd = fake.password(length=length)
-        if re.search(r"[a-zA-Z]", pwd) and re.search(r"\d", pwd):
-            return pwd
-    # Fallback: should never be reached in practice
-    return fake.password(length=max(length - 2, 6)) + "a1"
@@ -20,7 +20,6 @@ from services.errors.account import (
    TenantNotFoundError,
 )
 from services.errors.workspace import WorkSpaceNotAllowedCreateError, WorkspacesLimitExceededError
-from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestAccountService:
@@ -54,7 +53,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -134,7 +133,7 @@ class TestAccountService:
                email=email,
                name=name,
                interface_language="en-US",
-                password=generate_valid_password(fake),
+                password=fake.password(length=12),
            )

    def test_create_account_email_in_freeze(
@@ -146,7 +145,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = True
@@ -170,7 +169,7 @@ class TestAccountService:
        """
        fake = Faker()
        email = fake.email()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        with pytest.raises(AccountPasswordError):
            AccountService.authenticate(email, password)

@@ -181,7 +180,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -209,8 +208,8 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        correct_password = generate_valid_password(fake)
-        wrong_password = generate_valid_password(fake)
+        correct_password = fake.password(length=12)
+        wrong_password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -235,7 +234,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        new_password = generate_valid_password(fake)
+        new_password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -268,7 +267,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -298,8 +297,8 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        old_password = generate_valid_password(fake)
-        new_password = generate_valid_password(fake)
+        old_password = fake.password(length=12)
+        new_password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -328,9 +327,9 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        old_password = generate_valid_password(fake)
-        wrong_password = generate_valid_password(fake)
-        new_password = generate_valid_password(fake)
+        old_password = fake.password(length=12)
+        wrong_password = fake.password(length=12)
+        new_password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -355,7 +354,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        old_password = generate_valid_password(fake)
+        old_password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -379,7 +378,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies[
@@ -413,7 +412,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies[
@@ -438,7 +437,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies[
@@ -536,7 +535,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -564,7 +563,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        updated_name = fake.name()
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -593,7 +592,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -616,7 +615,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        ip_address = fake.ipv4()
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -646,7 +645,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        ip_address = fake.ipv4()
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -685,7 +684,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -715,7 +714,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -748,7 +747,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        tenant_name = fake.company()
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -793,7 +792,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -826,7 +825,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        tenant_name = fake.company()
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -865,7 +864,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -893,7 +892,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -927,7 +926,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        tenant_name = fake.company()
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -958,7 +957,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -998,7 +997,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -1044,7 +1043,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -1081,7 +1080,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -1111,7 +1110,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -1140,7 +1139,7 @@ class TestAccountService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        wrong_code = fake.numerify(text="######")
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -1260,7 +1259,7 @@ class TestTenantService:
        tenant_name = fake.company()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -1292,10 +1291,10 @@ class TestTenantService:
        tenant_name = fake.company()
        email1 = fake.email()
        name1 = fake.name()
-        password1 = generate_valid_password(fake)
+        password1 = fake.password(length=12)
        email2 = fake.email()
        name2 = fake.name()
-        password2 = generate_valid_password(fake)
+        password2 = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -1333,7 +1332,7 @@ class TestTenantService:
        tenant_name = fake.company()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -1365,7 +1364,7 @@ class TestTenantService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        tenant1_name = fake.company()
        tenant2_name = fake.company()
        # Setup mocks
@@ -1404,7 +1403,7 @@ class TestTenantService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        tenant_name = fake.company()
        # Setup mocks
        mock_external_service_dependencies[
@@ -1442,7 +1441,7 @@ class TestTenantService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -1467,7 +1466,7 @@ class TestTenantService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        tenant1_name = fake.company()
        tenant2_name = fake.company()
        # Setup mocks
@@ -1508,7 +1507,7 @@ class TestTenantService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -1535,7 +1534,7 @@ class TestTenantService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        tenant_name = fake.company()
        # Setup mocks
        mock_external_service_dependencies[
@@ -1563,10 +1562,10 @@ class TestTenantService:
        tenant_name = fake.company()
        owner_email = fake.email()
        owner_name = fake.name()
-        owner_password = generate_valid_password(fake)
+        owner_password = fake.password(length=12)
        admin_email = fake.email()
        admin_name = fake.name()
-        admin_password = generate_valid_password(fake)
+        admin_password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -1632,7 +1631,7 @@ class TestTenantService:
        tenant_name = fake.company()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -1665,10 +1664,10 @@ class TestTenantService:
        tenant_name = fake.company()
        owner_email = fake.email()
        owner_name = fake.name()
-        owner_password = generate_valid_password(fake)
+        owner_password = fake.password(length=12)
        member_email = fake.email()
        member_name = fake.name()
-        member_password = generate_valid_password(fake)
+        member_password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -1706,7 +1705,7 @@ class TestTenantService:
        tenant_name = fake.company()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        invalid_action = "invalid_action_that_doesnt_exist"
        # Setup mocks
        mock_external_service_dependencies[
@@ -1739,7 +1738,7 @@ class TestTenantService:
        tenant_name = fake.company()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -1771,10 +1770,10 @@ class TestTenantService:
        tenant_name = fake.company()
        owner_email = fake.email()
        owner_name = fake.name()
-        owner_password = generate_valid_password(fake)
+        owner_password = fake.password(length=12)
        member_email = fake.email()
        member_name = fake.name()
-        member_password = generate_valid_password(fake)
+        member_password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -1830,7 +1829,7 @@ class TestTenantService:
        tenant_name = fake.company()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -1862,10 +1861,10 @@ class TestTenantService:
        tenant_name = fake.company()
        owner_email = fake.email()
        owner_name = fake.name()
-        owner_password = generate_valid_password(fake)
+        owner_password = fake.password(length=12)
        non_member_email = fake.email()
        non_member_name = fake.name()
-        non_member_password = generate_valid_password(fake)
+        non_member_password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -1901,10 +1900,10 @@ class TestTenantService:
        tenant_name = fake.company()
        owner_email = fake.email()
        owner_name = fake.name()
-        owner_password = generate_valid_password(fake)
+        owner_password = fake.password(length=12)
        member_email = fake.email()
        member_name = fake.name()
-        member_password = generate_valid_password(fake)
+        member_password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -1950,10 +1949,10 @@ class TestTenantService:
        tenant_name = fake.company()
        owner_email = fake.email()
        owner_name = fake.name()
-        owner_password = generate_valid_password(fake)
+        owner_password = fake.password(length=12)
        member_email = fake.email()
        member_name = fake.name()
-        member_password = generate_valid_password(fake)
+        member_password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -2007,10 +2006,10 @@ class TestTenantService:
        tenant_name = fake.company()
        owner_email = fake.email()
        owner_name = fake.name()
-        owner_password = generate_valid_password(fake)
+        owner_password = fake.password(length=12)
        member_email = fake.email()
        member_name = fake.name()
-        member_password = generate_valid_password(fake)
+        member_password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -2072,7 +2071,7 @@ class TestTenantService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        workspace_name = fake.company()
        # Setup mocks
        mock_external_service_dependencies[
@@ -2111,7 +2110,7 @@ class TestTenantService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        existing_tenant_name = fake.company()
        new_workspace_name = fake.company()
        # Setup mocks
@@ -2152,7 +2151,7 @@ class TestTenantService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        workspace_name = fake.company()
        # Setup mocks to disable workspace creation
        mock_external_service_dependencies[
@@ -2179,13 +2178,13 @@ class TestTenantService:
        tenant_name = fake.company()
        owner_email = fake.email()
        owner_name = fake.name()
-        owner_password = generate_valid_password(fake)
+        owner_password = fake.password(length=12)
        admin_email = fake.email()
        admin_name = fake.name()
-        admin_password = generate_valid_password(fake)
+        admin_password = fake.password(length=12)
        normal_email = fake.email()
        normal_name = fake.name()
-        normal_password = generate_valid_password(fake)
+        normal_password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -2245,13 +2244,13 @@ class TestTenantService:
        tenant_name = fake.company()
        owner_email = fake.email()
        owner_name = fake.name()
-        owner_password = generate_valid_password(fake)
+        owner_password = fake.password(length=12)
        operator_email = fake.email()
        operator_name = fake.name()
-        operator_password = generate_valid_password(fake)
+        operator_password = fake.password(length=12)
        normal_email = fake.email()
        normal_name = fake.name()
-        normal_password = generate_valid_password(fake)
+        normal_password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies[
            "feature_service"
@@ -2352,7 +2351,7 @@ class TestRegisterService:
        fake = Faker()
        admin_email = fake.email()
        admin_name = fake.name()
-        admin_password = generate_valid_password(fake)
+        admin_password = fake.password(length=12)
        ip_address = fake.ipv4()
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -2400,7 +2399,7 @@ class TestRegisterService:
        fake = Faker()
        admin_email = fake.email()
        admin_name = fake.name()
-        admin_password = generate_valid_password(fake)
+        admin_password = fake.password(length=12)
        ip_address = fake.ipv4()
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -2441,7 +2440,7 @@ class TestRegisterService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        language = fake.random_element(elements=("en-US", "zh-CN"))
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -2532,7 +2531,7 @@ class TestRegisterService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        language = fake.random_element(elements=("en-US", "zh-CN"))
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -2577,7 +2576,7 @@ class TestRegisterService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        language = fake.random_element(elements=("en-US", "zh-CN"))
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -2615,7 +2614,7 @@ class TestRegisterService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        language = fake.random_element(elements=("en-US", "zh-CN"))
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -2654,7 +2653,7 @@ class TestRegisterService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        language = fake.random_element(elements=("en-US", "zh-CN"))
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -2691,7 +2690,7 @@ class TestRegisterService:
        tenant_name = fake.company()
        inviter_email = fake.email()
        inviter_name = fake.name()
-        inviter_password = generate_valid_password(fake)
+        inviter_password = fake.password(length=12)
        new_member_email = fake.email()
        language = fake.random_element(elements=("en-US", "zh-CN"))
        # Setup mocks
@@ -2761,10 +2760,10 @@ class TestRegisterService:
        tenant_name = fake.company()
        inviter_email = fake.email()
        inviter_name = fake.name()
-        inviter_password = generate_valid_password(fake)
+        inviter_password = fake.password(length=12)
        existing_member_email = fake.email()
        existing_member_name = fake.name()
-        existing_member_password = generate_valid_password(fake)
+        existing_member_password = fake.password(length=12)
        language = fake.random_element(elements=("en-US", "zh-CN"))
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -2825,10 +2824,10 @@ class TestRegisterService:
        tenant_name = fake.company()
        inviter_email = fake.email()
        inviter_name = fake.name()
-        inviter_password = generate_valid_password(fake)
+        inviter_password = fake.password(length=12)
        existing_pending_member_email = fake.email()
        existing_pending_member_name = fake.name()
-        existing_pending_member_password = generate_valid_password(fake)
+        existing_pending_member_password = fake.password(length=12)
        language = fake.random_element(elements=("en-US", "zh-CN"))
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -2915,10 +2914,10 @@ class TestRegisterService:
        tenant_name = fake.company()
        inviter_email = fake.email()
        inviter_name = fake.name()
-        inviter_password = generate_valid_password(fake)
+        inviter_password = fake.password(length=12)
        already_in_tenant_email = fake.email()
        already_in_tenant_name = fake.name()
-        already_in_tenant_password = generate_valid_password(fake)
+        already_in_tenant_password = fake.password(length=12)
        language = fake.random_element(elements=("en-US", "zh-CN"))
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -2968,7 +2967,7 @@ class TestRegisterService:
        tenant_name = fake.company()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -3012,7 +3011,7 @@ class TestRegisterService:
        tenant_name = fake.company()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -3059,7 +3058,7 @@ class TestRegisterService:
        tenant_name = fake.company()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -3102,7 +3101,7 @@ class TestRegisterService:
        tenant_name = fake.company()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -3145,7 +3144,7 @@ class TestRegisterService:
        tenant_name = fake.company()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
        mock_external_service_dependencies["billing_service"].is_email_in_freeze.return_value = False
@@ -3213,7 +3212,7 @@ class TestRegisterService:
        fake = Faker()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        invalid_tenant_id = fake.uuid4()
        token = fake.uuid4()
        # Setup mocks
@@ -3264,7 +3263,7 @@ class TestRegisterService:
        tenant_name = fake.company()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        token = fake.uuid4()
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -3314,7 +3313,7 @@ class TestRegisterService:
        tenant_name = fake.company()
        email = fake.email()
        name = fake.name()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        token = fake.uuid4()
        # Setup mocks
        mock_external_service_dependencies["feature_service"].get_system_features.return_value.is_allow_register = True
@@ -11,7 +11,6 @@ from models.model import AppModelConfig, Conversation, EndUser, Message, Message
 from services.account_service import AccountService, TenantService
 from services.agent_service import AgentService
 from services.app_service import AppService
-from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestAgentService:
@@ -112,7 +111,7 @@ class TestAgentService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -9,7 +9,6 @@ from models import Account
 from models.model import MessageAnnotation
 from services.annotation_service import AppAnnotationService
 from services.app_service import AppService
-from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestAnnotationService:
@@ -79,7 +78,7 @@ class TestAnnotationService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -7,7 +7,6 @@ from sqlalchemy.orm import Session
 from models.api_based_extension import APIBasedExtension
 from services.account_service import AccountService, TenantService
 from services.api_based_extension_service import APIBasedExtensionService
-from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestAPIBasedExtensionService:
@@ -56,7 +55,7 @@ class TestAPIBasedExtensionService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -9,7 +9,6 @@ from models.model import App, AppModelConfig
 from services.account_service import AccountService, TenantService
 from services.app_dsl_service import AppDslService, ImportMode, ImportStatus
 from services.app_service import AppService
-from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestAppDslService:
@@ -90,7 +89,7 @@ class TestAppDslService:
                email=fake.email(),
                name=fake.name(),
                interface_language="en-US",
-                password=generate_valid_password(fake),
+                password=fake.password(length=12),
            )
            TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
            tenant = account.current_tenant
@@ -10,7 +10,6 @@ from models.model import EndUser
 from models.workflow import Workflow
 from services.app_generate_service import AppGenerateService
 from services.errors.app import WorkflowIdFormatError, WorkflowNotFoundError
-from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestAppGenerateService:
@@ -148,7 +147,7 @@ class TestAppGenerateService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -8,7 +8,6 @@ from constants.model_template import default_app_templates
 from models import Account
 from models.model import App, Site
 from services.account_service import AccountService, TenantService
-from tests.test_containers_integration_tests.helpers import generate_valid_password

 # Delay import of AppService to avoid circular dependency
 # from services.app_service import AppService
@@ -57,7 +56,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -113,7 +112,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -156,7 +155,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -204,7 +203,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -260,7 +259,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -335,7 +334,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -405,7 +404,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -474,7 +473,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -527,7 +526,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -586,7 +585,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -646,7 +645,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -706,7 +705,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -757,7 +756,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -809,7 +808,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -869,7 +868,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -908,7 +907,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -948,7 +947,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -998,7 +997,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -1040,7 +1039,7 @@ class TestAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -1,233 +0,0 @@
-import datetime
-import json
-import uuid
-from decimal import Decimal
-
-import pytest
-from sqlalchemy.orm import Session
-
-from models.account import Account, Tenant, TenantAccountJoin, TenantAccountRole
-from models.model import (
-    App,
-    AppAnnotationHitHistory,
-    Conversation,
-    DatasetRetrieverResource,
-    Message,
-    MessageAgentThought,
-    MessageAnnotation,
-    MessageChain,
-    MessageFeedback,
-    MessageFile,
-)
-from models.web import SavedMessage
-from services.retention.conversation.message_export_service import AppMessageExportService, AppMessageExportStats
-
-
-class TestAppMessageExportServiceIntegration:
-    @pytest.fixture(autouse=True)
-    def cleanup_database(self, db_session_with_containers: Session):
-        yield
-        db_session_with_containers.query(DatasetRetrieverResource).delete()
-        db_session_with_containers.query(AppAnnotationHitHistory).delete()
-        db_session_with_containers.query(SavedMessage).delete()
-        db_session_with_containers.query(MessageFile).delete()
-        db_session_with_containers.query(MessageAgentThought).delete()
-        db_session_with_containers.query(MessageChain).delete()
-        db_session_with_containers.query(MessageAnnotation).delete()
-        db_session_with_containers.query(MessageFeedback).delete()
-        db_session_with_containers.query(Message).delete()
-        db_session_with_containers.query(Conversation).delete()
-        db_session_with_containers.query(App).delete()
-        db_session_with_containers.query(TenantAccountJoin).delete()
-        db_session_with_containers.query(Tenant).delete()
-        db_session_with_containers.query(Account).delete()
-        db_session_with_containers.commit()
-
-    @staticmethod
-    def _create_app_context(session: Session) -> tuple[App, Conversation]:
-        account = Account(
-            email=f"test-{uuid.uuid4()}@example.com",
-            name="tester",
-            interface_language="en-US",
-            status="active",
-        )
-        session.add(account)
-        session.flush()
-
-        tenant = Tenant(name=f"tenant-{uuid.uuid4()}", status="normal")
-        session.add(tenant)
-        session.flush()
-
-        join = TenantAccountJoin(
-            tenant_id=tenant.id,
-            account_id=account.id,
-            role=TenantAccountRole.OWNER,
-            current=True,
-        )
-        session.add(join)
-        session.flush()
-
-        app = App(
-            tenant_id=tenant.id,
-            name="export-app",
-            description="integration test app",
-            mode="chat",
-            enable_site=True,
-            enable_api=True,
-            api_rpm=60,
-            api_rph=3600,
-            is_demo=False,
-            is_public=False,
-            created_by=account.id,
-            updated_by=account.id,
-        )
-        session.add(app)
-        session.flush()
-
-        conversation = Conversation(
-            app_id=app.id,
-            app_model_config_id=str(uuid.uuid4()),
-            model_provider="openai",
-            model_id="gpt-4o-mini",
-            mode="chat",
-            name="conv",
-            inputs={"seed": 1},
-            status="normal",
-            from_source="api",
-            from_end_user_id=str(uuid.uuid4()),
-        )
-        session.add(conversation)
-        session.commit()
-        return app, conversation
-
-    @staticmethod
-    def _create_message(
-        session: Session,
-        app: App,
-        conversation: Conversation,
-        created_at: datetime.datetime,
-        *,
-        query: str,
-        answer: str,
-        inputs: dict,
-        message_metadata: str | None,
-    ) -> Message:
-        message = Message(
-            app_id=app.id,
-            conversation_id=conversation.id,
-            model_provider="openai",
-            model_id="gpt-4o-mini",
-            inputs=inputs,
-            query=query,
-            answer=answer,
-            message=[{"role": "assistant", "content": answer}],
-            message_tokens=10,
-            message_unit_price=Decimal("0.001"),
-            answer_tokens=20,
-            answer_unit_price=Decimal("0.002"),
-            total_price=Decimal("0.003"),
-            currency="USD",
-            message_metadata=message_metadata,
-            from_source="api",
-            from_end_user_id=conversation.from_end_user_id,
-            created_at=created_at,
-        )
-        session.add(message)
-        session.flush()
-        return message
-
-    def test_iter_records_with_stats(self, db_session_with_containers: Session):
-        app, conversation = self._create_app_context(db_session_with_containers)
-
-        first_inputs = {
-            "plain": "v1",
-            "nested": {"a": 1, "b": [1, {"x": True}]},
-            "list": ["x", 2, {"y": "z"}],
-        }
-        second_inputs = {"other": "value", "items": [1, 2, 3]}
-
-        base_time = datetime.datetime(2026, 2, 25, 10, 0, 0)
-        first_message = self._create_message(
-            db_session_with_containers,
-            app,
-            conversation,
-            created_at=base_time,
-            query="q1",
-            answer="a1",
-            inputs=first_inputs,
-            message_metadata=json.dumps({"retriever_resources": [{"dataset_id": "ds-1"}]}),
-        )
-        second_message = self._create_message(
-            db_session_with_containers,
-            app,
-            conversation,
-            created_at=base_time + datetime.timedelta(minutes=1),
-            query="q2",
-            answer="a2",
-            inputs=second_inputs,
-            message_metadata=None,
-        )
-
-        user_feedback_1 = MessageFeedback(
-            app_id=app.id,
-            conversation_id=conversation.id,
-            message_id=first_message.id,
-            rating="like",
-            from_source="user",
-            content="first",
-            from_end_user_id=conversation.from_end_user_id,
-        )
-        user_feedback_2 = MessageFeedback(
-            app_id=app.id,
-            conversation_id=conversation.id,
-            message_id=first_message.id,
-            rating="dislike",
-            from_source="user",
-            content="second",
-            from_end_user_id=conversation.from_end_user_id,
-        )
-        admin_feedback = MessageFeedback(
-            app_id=app.id,
-            conversation_id=conversation.id,
-            message_id=first_message.id,
-            rating="like",
-            from_source="admin",
-            content="should-be-filtered",
-            from_account_id=str(uuid.uuid4()),
-        )
-        db_session_with_containers.add_all([user_feedback_1, user_feedback_2, admin_feedback])
-        user_feedback_1.created_at = base_time + datetime.timedelta(minutes=2)
-        user_feedback_2.created_at = base_time + datetime.timedelta(minutes=3)
-        admin_feedback.created_at = base_time + datetime.timedelta(minutes=4)
-        db_session_with_containers.commit()
-
-        service = AppMessageExportService(
-            app_id=app.id,
-            start_from=base_time - datetime.timedelta(minutes=1),
-            end_before=base_time + datetime.timedelta(minutes=10),
-            filename="unused",
-            batch_size=1,
-            dry_run=True,
-        )
-        stats = AppMessageExportStats()
-        records = list(service._iter_records_with_stats(stats))
-        service._finalize_stats(stats)
-
-        assert len(records) == 2
-        assert records[0].message_id == first_message.id
-        assert records[1].message_id == second_message.id
-
-        assert records[0].inputs == first_inputs
-        assert records[1].inputs == second_inputs
-
-        assert records[0].retriever_resources == [{"dataset_id": "ds-1"}]
-        assert records[1].retriever_resources == []
-
-        assert [feedback.rating for feedback in records[0].feedback] == ["like", "dislike"]
-        assert [feedback.content for feedback in records[0].feedback] == ["first", "second"]
-        assert records[1].feedback == []
-
-        assert stats.batches == 2
-        assert stats.total_messages == 2
-        assert stats.messages_with_feedback == 1
-        assert stats.total_feedbacks == 2
@@ -13,7 +13,6 @@ from services.errors.message import (
    SuggestedQuestionsAfterAnswerDisabledError,
 )
 from services.message_service import MessageService
-from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestMessageService:
@@ -96,7 +95,7 @@ class TestMessageService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -634,7 +633,7 @@ class TestMessageService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(other_account, name=fake.company())

@@ -8,7 +8,6 @@ from models.model import EndUser, Message
 from models.web import SavedMessage
 from services.app_service import AppService
 from services.saved_message_service import SavedMessageService
-from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestSavedMessageService:
@@ -65,7 +64,7 @@ class TestSavedMessageService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -10,7 +10,6 @@ from core.trigger.entities.entities import Subscription as TriggerSubscriptionEn
 from models.provider_ids import TriggerProviderID
 from models.trigger import TriggerSubscription
 from services.trigger.trigger_provider_service import TriggerProviderService
-from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestTriggerProviderService:
@@ -76,7 +75,7 @@ class TestTriggerProviderService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -12,7 +12,6 @@ from models.web import PinnedConversation
 from services.account_service import AccountService, TenantService
 from services.app_service import AppService
 from services.web_conversation_service import WebConversationService
-from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestWebConversationService:
@@ -70,7 +69,7 @@ class TestWebConversationService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -12,7 +12,6 @@ from models import Account, AccountStatus, Tenant, TenantAccountJoin, TenantAcco
 from models.model import App, Site
 from services.errors.account import AccountLoginError, AccountNotFoundError, AccountPasswordError
 from services.webapp_auth_service import WebAppAuthService, WebAppAuthType
-from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestWebAppAuthService:
@@ -110,7 +109,7 @@ class TestWebAppAuthService:
            tuple: (account, tenant, password) - Created account, tenant and password
        """
        fake = Faker()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)

        # Create account with password
        import uuid
@@ -273,7 +272,7 @@ class TestWebAppAuthService:
        """
        # Arrange: Create banned account
        fake = Faker()
-        password = generate_valid_password(fake)
+        password = fake.password(length=12)
        unique_email = f"test_{uuid.uuid4().hex[:8]}@example.com"

        account = Account(
@@ -13,7 +13,6 @@ from models.trigger import AppTrigger, WorkflowWebhookTrigger
 from models.workflow import Workflow
 from services.account_service import AccountService, TenantService
 from services.trigger.webhook_service import WebhookService
-from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestWebhookService:
@@ -61,7 +60,7 @@ class TestWebhookService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -15,7 +15,6 @@ from services.account_service import AccountService, TenantService
 # Delay import of AppService to avoid circular dependency
 # from services.app_service import AppService
 from services.workflow_app_service import WorkflowAppService
-from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestWorkflowAppService:
@@ -73,7 +72,7 @@ class TestWorkflowAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -121,7 +120,7 @@ class TestWorkflowAppService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -15,7 +15,6 @@ from models.workflow import WorkflowRun
 from services.account_service import AccountService, TenantService
 from services.app_service import AppService
 from services.workflow_run_service import WorkflowRunService
-from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestWorkflowRunService:
@@ -73,7 +72,7 @@ class TestWorkflowRunService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -13,7 +13,6 @@ from models.workflow import Workflow as WorkflowModel
 from services.account_service import AccountService, TenantService
 from services.app_service import AppService
 from services.tools.workflow_tools_manage_service import WorkflowToolManageService
-from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestWorkflowToolManageService:
@@ -88,7 +87,7 @@ class TestWorkflowToolManageService:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -15,7 +15,6 @@ from faker import Faker
 from models.dataset import Dataset, Document, DocumentSegment
 from services.account_service import AccountService, TenantService
 from tasks.clean_notion_document_task import clean_notion_document_task
-from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestCleanNotionDocumentTask:
@@ -77,7 +76,7 @@ class TestCleanNotionDocumentTask:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -209,7 +208,7 @@ class TestCleanNotionDocumentTask:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -253,7 +252,7 @@ class TestCleanNotionDocumentTask:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -346,7 +345,7 @@ class TestCleanNotionDocumentTask:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -432,7 +431,7 @@ class TestCleanNotionDocumentTask:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -547,7 +546,7 @@ class TestCleanNotionDocumentTask:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -643,7 +642,7 @@ class TestCleanNotionDocumentTask:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -725,7 +724,7 @@ class TestCleanNotionDocumentTask:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -835,7 +834,7 @@ class TestCleanNotionDocumentTask:
                email=fake.email(),
                name=fake.name(),
                interface_language="en-US",
-                password=generate_valid_password(fake),
+                password=fake.password(length=12),
            )
            TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
            tenant = account.current_tenant
@@ -952,7 +951,7 @@ class TestCleanNotionDocumentTask:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -1055,7 +1054,7 @@ class TestCleanNotionDocumentTask:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
@@ -322,14 +322,11 @@ class TestDatasetIndexingTaskIntegration:
            _document_indexing_with_tenant_queue(dataset.tenant_id, dataset.id, document_ids, task_dispatch_spy)

        # Assert
-        # apply_async is used by implementation; assert it was called once with expected kwargs
-        assert task_dispatch_spy.apply_async.call_count == 1
-        call_kwargs = task_dispatch_spy.apply_async.call_args.kwargs.get("kwargs", {})
-        assert call_kwargs == {
-            "tenant_id": next_task["tenant_id"],
-            "dataset_id": next_task["dataset_id"],
-            "document_ids": next_task["document_ids"],
-        }
+        task_dispatch_spy.delay.assert_called_once_with(
+            tenant_id=next_task["tenant_id"],
+            dataset_id=next_task["dataset_id"],
+            document_ids=next_task["document_ids"],
+        )
        set_waiting_spy.assert_called_once()
        delete_key_spy.assert_not_called()

@@ -355,7 +352,7 @@ class TestDatasetIndexingTaskIntegration:
            _document_indexing_with_tenant_queue(dataset.tenant_id, dataset.id, document_ids, task_dispatch_spy)

        # Assert
-        task_dispatch_spy.apply_async.assert_not_called()
+        task_dispatch_spy.delay.assert_not_called()
        delete_key_spy.assert_called_once()

    def test_validation_failure_sets_error_status_when_vector_space_at_limit(
@@ -450,7 +447,7 @@ class TestDatasetIndexingTaskIntegration:
            _document_indexing_with_tenant_queue(dataset.tenant_id, dataset.id, document_ids, task_dispatch_spy)

        # Assert
-        task_dispatch_spy.apply_async.assert_called_once()
+        task_dispatch_spy.delay.assert_called_once()

    def test_sessions_close_on_successful_indexing(
        self,
@@ -537,7 +534,7 @@ class TestDatasetIndexingTaskIntegration:
            _document_indexing_with_tenant_queue(dataset.tenant_id, dataset.id, document_ids, task_dispatch_spy)

        # Assert
-        assert task_dispatch_spy.apply_async.call_count == concurrency_limit
+        assert task_dispatch_spy.delay.call_count == concurrency_limit
        assert set_waiting_spy.call_count == concurrency_limit

    def test_task_queue_fifo_ordering(self, db_session_with_containers, patched_external_dependencies):
@@ -568,10 +565,9 @@ class TestDatasetIndexingTaskIntegration:
            _document_indexing_with_tenant_queue(dataset.tenant_id, dataset.id, document_ids, task_dispatch_spy)

        # Assert
-        assert task_dispatch_spy.apply_async.call_count == 3
+        assert task_dispatch_spy.delay.call_count == 3
        for index, expected_task in enumerate(ordered_tasks):
-            call_kwargs = task_dispatch_spy.apply_async.call_args_list[index].kwargs.get("kwargs", {})
-            assert call_kwargs.get("document_ids") == expected_task["document_ids"]
+            assert task_dispatch_spy.delay.call_args_list[index].kwargs["document_ids"] == expected_task["document_ids"]

    def test_billing_disabled_skips_limit_checks(self, db_session_with_containers, patched_external_dependencies):
        """Skip limit checks when billing feature is disabled."""
@@ -15,7 +15,6 @@ from faker import Faker
 from models.dataset import Dataset, Document, DocumentSegment
 from services.account_service import AccountService, TenantService
 from tasks.deal_dataset_vector_index_task import deal_dataset_vector_index_task
-from tests.test_containers_integration_tests.helpers import generate_valid_password


 class TestDealDatasetVectorIndexTask:
@@ -62,7 +61,7 @@ class TestDealDatasetVectorIndexTask:
            email=fake.email(),
            name=fake.name(),
            interface_language="en-US",
-            password=generate_valid_password(fake),
+            password=fake.password(length=12),
        )
        TenantService.create_owner_tenant_if_not_exist(account, name=fake.company())
        tenant = account.current_tenant
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
yyh	0c08c4016d	Merge remote-tracking branch 'origin/main' into feat/model-provider-refactor	2026-03-06 14:57:48 +08:00
yyh	948efa129f	Merge remote-tracking branch 'origin/main' into feat/model-provider-refactor	2026-03-06 14:47:56 +08:00
yyh	6d612c0909	test: improve Jotai atom test quality and add model-provider atoms tests Replace dynamic imports with static imports in marketplace atom tests. Convert type-only and not-toThrow assertions into proper state-change verifications. Add comprehensive test suite for model-provider-page atoms covering all four hooks, cross-hook interaction, selectAtom granularity, and Provider isolation.	2026-03-05 22:49:09 +08:00
yyh	56e0dc0ae6	trigger ci Signed-off-by: yyh <[email protected]>	2026-03-05 21:22:03 +08:00
yyh	975eca00c3	Merge remote-tracking branch 'origin/main' into feat/model-provider-refactor	2026-03-05 20:25:53 +08:00
yyh	f049bafcc3	refactor: simplify Jotai atoms by removing redundant write-only atoms Replace 2 write-only derived atoms with primitive atom's built-in updater functions. The selectAtom on the read side already prevents unnecessary re-renders, making the manual guard logic redundant.	2026-03-05 20:25:29 +08:00
yyh	922dc71e36	fix	2026-03-05 16:17:38 +08:00
yyhandGitHub	f03ec7f671	Merge branch 'main' into feat/model-provider-refactor	2026-03-05 16:14:36 +08:00
yyh	29f275442d	Merge remote-tracking branch 'origin/main' into feat/model-provider-refactor # Conflicts: # web/app/components/header/account-setting/model-provider-page/provider-added-card/credential-panel.spec.tsx # web/app/components/header/account-setting/model-provider-page/provider-added-card/credential-panel.tsx # web/app/components/header/account-setting/model-provider-page/system-model-selector/index.tsx	2026-03-05 16:13:40 +08:00
yyh	c9532ffd43	add stories	2026-03-05 15:55:21 +08:00
yyh	840dc33b8b	Merge remote-tracking branch 'origin/main' into feat/model-provider-refactor	2026-03-05 15:12:32 +08:00
yyh	cae58a0649	Merge remote-tracking branch 'origin/main' into feat/model-provider-refactor	2026-03-05 15:08:13 +08:00
yyh	1752edc047	refactor(web): optimize model provider re-render and remove useEffect state sync - Replace useEffect state sync with derived state pattern in useSystemDefaultModelAndModelList - Use useCallback instead of useMemo for function memoization in useProviderCredentialsAndLoadBalancing - Add memo() to ProviderAddedCard and CredentialPanel to prevent unnecessary re-renders - Switch to useProviderContextSelector for precise context subscription in ProviderAddedCard - Stabilize activate callback ref in useActivateCredential via supportedModelTypes ref - Add usage priority tooltip with i18n support	2026-03-05 15:07:53 +08:00
yyh	7471c32612	Revert "temp: remove IS_CLOUD_EDITION guard from supportsCredits for local testing" This reverts commit `ab87ac333a`.	2026-03-05 14:33:48 +08:00
yyh	2d333bbbe5	refactor(web): extract credential activation into hook and migrate credential-item overlays Extract credential switching logic from dropdown-content into a dedicated useActivateCredential hook with optimistic updates and proper data flow separation. Credential items now stay visible in the popover after clicking (no auto-close), show cursor-pointer, and disable during activation. Migrate credential-item from legacy Tooltip and remixicon imports to base-ui Tooltip and CSS icon classes, pruning stale ESLint suppressions.	2026-03-05 14:22:39 +08:00
yyh	4af6788ce0	fix(web): wrap Header test in Dialog context for base-ui compatibility	2026-03-05 14:20:35 +08:00
yyh	24b072def9	fix: lint	2026-03-05 14:08:20 +08:00
yyh	909c8c3350	Merge remote-tracking branch 'origin/main' into feat/model-provider-refactor	2026-03-05 13:58:51 +08:00
yyh	80e9c8bee0	refactor(web): make account setting fully controlled with action props	2026-03-05 13:39:36 +08:00
yyh	15b7b304d2	refactor(web): migrate model-modal overlays to base-ui Dialog and AlertDialog Replace legacy PortalToFollowElem and Confirm with Dialog/AlertDialog primitives. Remove manual ESC handler and backdrop div — now handled natively by base-ui. Add backdropProps={{ forceRender: true }} for correct nested overlay rendering.	2026-03-05 13:33:53 +08:00
yyh	61e2672b59	refactor(web): make provider reset event-driven and scope model invalidation - remove provider-page lifecycle reset effect and handle reset in explicit tab/close actions - switch account setting tab state to controlled/uncontrolled pattern without sync effect - use provider-scoped model list queryKey with exact invalidation in credential and model toggle mutations - update related tests and mocks for new behavior	2026-03-05 13:28:30 +08:00
yyh	5f4ed4c6f6	refactor(web): replace model provider emitter refresh with jotai state - add atom-based provider expansion state with reset/prune helpers - remove event-emitter dependency from model provider refresh flow - invalidate exact provider model-list query key on refresh - reset expansion state on model provider page mount/unmount - update and extend tests for external expansion and query invalidation - update eslint suppressions to match current code	2026-03-05 13:20:58 +08:00
yyh	4a1032c628	fix(web): remove redundant hover text swap on show models button Merge the two hover-toggling divs into a single always-visible element and remove the unused showModelsNum i18n key from all locales.	2026-03-05 13:16:04 +08:00
yyh	423c97a47e	code style	2026-03-05 13:09:33 +08:00
yyh	a7e3fb2e33	fix(web): use triangle Warning icon instead of circle error icon Replace i-ri-error-warning-fill (circle exclamation) with the Warning component (triangle) for api-fallback and credits-fallback variants to match Figma design.	2026-03-05 13:07:20 +08:00
yyh	ce34937a1c	feat(web): add credits-fallback variant for API Key priority with available credits When API Key is selected but unavailable/unconfigured and credits are available, the card now shows "AI credits in use" with a warning icon instead of "API key required". When both credits are exhausted and no API key exists, it shows "No available usage" (destructive). New deriveVariant logic for priority=apiKey: - !exhausted + !authorized → credits-fallback (was api-required-*) - exhausted + no credential → no-usage (was api-required-add) - exhausted + named unauthorized → api-unavailable (unchanged)	2026-03-05 13:02:40 +08:00
yyh	ad9ac6978e	fix(web): align alert card width with API key section in dropdown Change mx-1 (4px) to mx-2 (8px) on CreditsFallbackAlert and CreditsExhaustedAlert to match ApiKeySection's p-2 (8px) padding, consistent with Figma design where both sections are 8px from the dropdown edge.	2026-03-05 12:56:55 +08:00
yyh	57c1ba3543	fix(web): hide divider above empty API keys state in dropdown Move the border from UsagePrioritySection (always visible) to ApiKeySection's list variant (only when credentials exist). This removes the unwanted divider line above the "No API Keys" empty state card when on the AI Credits tab with no keys configured.	2026-03-05 12:25:11 +08:00
yyh	d7a5af2b9a	Merge remote-tracking branch 'origin/main' into feat/model-provider-refactor # Conflicts: # web/app/components/header/account-setting/model-provider-page/index.tsx	2026-03-05 10:46:24 +08:00
yyh	d45edffaa3	fix(web): wire upgrade link to pricing modal and add credits-coin icon Replace broken HTML string interpolation with Trans component and useModalContextSelector so "upgrade your plan" opens the pricing modal. Add custom credits-coin SVG icon to replace the generic ri-coin-line.	2026-03-05 10:39:31 +08:00
yyh	530515b6ef	fix(web): prevent model list from expanding on priority switch Remove UPDATE_MODEL_PROVIDER_CUSTOM_MODEL_LIST event emission from changePriority onSuccess. This event was designed for custom model add/edit/delete scenarios where the card should expand, but firing it on priority switch caused ProviderAddedCard to unexpectedly expand via refreshModelList → setCollapsed(false).	2026-03-05 10:35:03 +08:00
yyh	f13f0d1f9a	fix(web): align dropdown alerts with Figma design and fix hardcoded credits total - Expose totalCredits from useTrialCredits hook instead of hardcoding 10,000 - Align CreditsExhaustedAlert with Figma: dynamic progress bar, correct design tokens (components-progress-error-bg/progress), sm-medium/xs-regular typography - Align CreditsFallbackAlert typography to sm-medium/xs-regular - Fix ApiKeySection empty state: horizontal gradient, sm-medium title, Figma-aligned padding (pl-7 for API KEYS label) - Hoist empty credentials array constant to stabilize memo (rerender-memo-with-default-value) - Remove redundant useCallback wrapper in ApiKeySection - Replace nested ternary with Record lookup in TextLabel - Remove dead \|\| 0 guard in useTrialCredits - Update all test mocks with totalCredits field	2026-03-05 10:09:51 +08:00
yyh	b597d52c11	refactor(web): remove dialog description from system model selector Remove the DialogDescription and its i18n key (modelProvider.systemModelSettingsLink) from the system model settings dialog across all 23 locales.	2026-03-05 10:05:01 +08:00
yyh	34c42fe666	Revert "temp: remove cloud condition" This reverts commit `29e344ac8b`.	2026-03-05 09:44:19 +08:00
yyh	dc109c99f0	test(web): expand credential panel and dropdown test coverage for all 8 card variants Add comprehensive behavioral tests covering all discriminated union variants, destructive/default styling, warning icons, CreditsFallbackAlert conditions, credential CRUD interactions, AlertDialog delete confirmation, and Popover behavior.	2026-03-05 09:41:48 +08:00
yyh	223b9d89c1	refactor(web): migrate priority change to oRPC contract with useMutation - Add changePreferredProviderType contract in model-providers.ts - Register in consoleRouterContract - Replace raw async changeModelProviderPriority with useMutation - Use Toast.notify (static API) instead of useToastContext hook - Pass isPending as isChangingPriority to disable buttons during switch - Add disabled prop to UsagePrioritySection - Fix pre-existing test assertions for api-unavailable variant - Update all specs with isChangingPriority prop and oRPC mock pattern	2026-03-05 09:30:38 +08:00
yyh	dd119eb44f	fix(web): align UsagePrioritySection with Figma design and fix i18n key ordering - Single-row layout for icon, label, and option cards - Icon: arrow-up-double-line matching design spec - Buttons: flexible width with whitespace-nowrap instead of fixed w-[72px] - Add min-w-0 + truncate for text overflow, focus-visible ring for a11y - Sort modelProvider.card.* i18n keys alphabetically	2026-03-05 09:15:16 +08:00
yyh	970493fa85	test(web): update tests for credential panel refactoring and new ModelAuthDropdown components Rewrite credential-panel.spec.tsx to match the new discriminated union state model and variant-driven rendering. Add new test files for useCredentialPanelState hook, SystemQuotaCard Label enhancement, and all ModelAuthDropdown sub-components.	2026-03-05 08:41:17 +08:00
yyh	ab87ac333a	temp: remove IS_CLOUD_EDITION guard from supportsCredits for local testing	2026-03-05 08:34:10 +08:00
yyh	b8b70da9ad	refactor(web): rewrite CredentialPanel with declarative variant-driven state and new ModelAuthDropdown - Extract useCredentialPanelState hook with discriminated union CardVariant type replacing scattered boolean conditions - Create ModelAuthDropdown compound component (Popover-based) with UsagePrioritySection, CreditsExhaustedAlert, and ApiKeySection - Enhance SystemQuotaCard.Label to accept className override for flexible styling - Add i18n keys for new card states and dropdown content (en-US, zh-Hans)	2026-03-05 08:33:04 +08:00
yyh	77d81aebe8	Merge remote-tracking branch 'origin/main' into feat/model-provider-refactor	2026-03-04 23:35:20 +08:00
yyh	deb4cd3ece	fix: i18n	2026-03-04 23:35:13 +08:00
yyh	648d9ef1f9	refactor(web): extract SystemQuotaCard compound component and shared useTrialCredits hook Extract trial credits calculation into a shared useTrialCredits hook to prevent logic drift between QuotaPanel and CredentialPanel. Add SystemQuotaCard compound component with explicit default/destructive variants for the system quota UI state in provider cards, replacing inline conditional styling with composable Label and Actions slots. Remove unnecessary useMemo for simple derived values.	2026-03-04 23:30:25 +08:00
yyh	5ed4797078	fix	2026-03-04 22:53:29 +08:00
yyh	62631658e9	fix(web): update tests for AlertDialog migration and component API changes - Replace deprecated Confirm mock with real AlertDialog role-based queries - Add useInvalidateCheckInstalled mock for QueryClient dependency - Wrap model-list-item renders in QueryClientProvider - Migrate PluginVersionPicker from PortalToFollowElem to Popover - Migrate UpdatePluginModal from Modal to Dialog - Update version picker offset props (sideOffset/alignOffset)	2026-03-04 22:52:21 +08:00
yyh	22a4100dd7	fix(web): invalidate plugin checkInstalled cache after version updates	2026-03-04 22:33:17 +08:00
yyh	0f7ed6f67e	refactor(web): align provider badges with figma and remove dead add-model-button	2026-03-04 22:29:51 +08:00
yyh	4d9fcbec57	refactor(web): migrate remove-plugin dialog to base UI AlertDialog and improve UX - Replace deprecated Confirm component with AlertDialog primitives - Add forceRender backdrop for proper overlay rendering - Add success Toast notification after plugin removal - Update "View Detail" text to "View on Marketplace" (en/zh-Hans) - Add i18n keys for delete success message - Prune stale eslint suppression for header-modals	2026-03-04 22:14:19 +08:00
yyh	4d7a9bc798	fix(web): align model provider cache invalidation with oRPC keys	2026-03-04 22:06:27 +08:00
yyh	d6d04ed657	fix	2026-03-04 22:03:06 +08:00
yyh	f594a71dae	fix: icon	2026-03-04 22:02:36 +08:00
yyh	04e0ab7eda	refactor(web): migrate provider-added-card model list to oRPC query-driven state	2026-03-04 21:55:34 +08:00
yyh	784bda9c86	refactor(web): migrate operation-dropdown to base UI and align provider card styles with Figma - Migrate OperationDropdown from legacy portal-to-follow-elem to base UI DropdownMenu primitives - Add placement, sideOffset, alignOffset, popupClassName props for flexible positioning - Fix version badge font size: system-2xs-medium-uppercase (10px) → system-xs-medium-uppercase (12px) - Set provider card dropdown to bottom-start placement with 192px width per Figma spec - Fix PluginVersionPicker toggle: clicking badge now opens and closes the picker - Add max-h-[224px] overflow scroll to version list - Replace Remix icon imports with Tailwind CSS icon classes - Prune stale eslint suppressions for migrated files	2026-03-04 21:55:23 +08:00
yyh	1af1fb6913	feat(web): add version badge and actions menu to provider cards Integrate plugin version management into model provider cards by reusing existing plugin detail panel hooks and components. Batch query installed plugins at list level to avoid N+1 requests.	2026-03-04 21:29:52 +08:00
yyh	1f0c36e9f7	fix: style	2026-03-04 21:07:42 +08:00
yyh	455ae65025	fix: style	2026-03-04 20:58:14 +08:00
yyh	d44682e957	refactor(web): align quota panel with Figma design and migrate to base UI tooltip - Rename title from "Quota" to "AI Credits" and update tooltip copy (Message Credits → AI Credits, free → Trial) - Show "Credits exhausted" in destructive text when credits reach zero instead of displaying the number "0" - Migrate from deprecated Tooltip to base UI Tooltip compound component - Add 4px grid background with radial fade mask via CSS module - Simplify provider icon tooltip text for uninstalled state - Update i18n keys for both en-US and zh-Hans	2026-03-04 20:52:30 +08:00
yyh	8c4afc0c18	fix(model-selector): align empty trigger with default trigger style	2026-03-04 20:14:49 +08:00
yyh	539cbcae6a	fix(account-settings): render nested system model backdrop via base ui	2026-03-04 19:57:53 +08:00
yyh	8d257fea7c	chore(web): commit dialog overlay follow-up changes	2026-03-04 19:37:10 +08:00
yyh	c3364ac350	refactor(web): align account settings dialogs with base UI	2026-03-04 19:31:14 +08:00
yyh	f991644989	refactor(pricing): migrate to base ui dialog and extract category types	2026-03-04 19:26:54 +08:00
yyh	29e344ac8b	temp: remove cloud condition	2026-03-04 18:50:38 +08:00
yyh	1ad9305732	fix(web): avoid quota panel flicker on account-setting tab switch - remove mount-time workspace invalidate in model provider page - read quota with useCurrentWorkspace and keep loading only for initial empty fetch - reuse existing useSystemFeaturesQuery for marketplace and trial models - update model provider and quota panel tests for new query/loading behavior	2026-03-04 18:43:01 +08:00
yyh	17f38f171d	lint	2026-03-04 18:21:59 +08:00
yyh	802088c8eb	test(web): fix trivial assertion and add useInvalidateDefaultModel tests Replace the no-provider test assertion from checking a nonexistent i18n key to verifying actual warning keys are absent. Add unit tests for useInvalidateDefaultModel following the useUpdateModelList pattern.	2026-03-04 17:51:20 +08:00
yyh	cad6d94491	refactor(web): replace remixicon imports with Tailwind CSS icons in system-model-selector	2026-03-04 17:45:41 +08:00
yyh	621d0fb2c9	fix	2026-03-04 17:42:34 +08:00
yyh	a92fb3244b	fix(web): skip top warning for no-provider state and remove unused i18n key The empty state card below already prompts users to install a provider, so the top warning bar is redundant for the no-provider case. Remove the unused noProviderInstalled i18n key and replace the lookup map with a ternary to preserve i18n literal types without assertions.	2026-03-04 17:39:49 +08:00
yyh	97508f8d7b	fix(web): invalidate default model cache after saving system model settings After saving system models, only the model list cache was invalidated but not the default model cache, causing stale config status in the UI. Add useInvalidateDefaultModel hook and call it for all 5 model types after a successful save.	2026-03-04 17:26:24 +08:00
yyh	70e677a6ac	feat(web): refine system model settings to 4 distinct config states Replace the single `defaultModelNotConfigured` boolean with a derived `systemModelConfigStatus` that distinguishes between no-provider, none-configured, partially-configured, and fully-configured states, each showing a context-appropriate warning message. Also updates the button label from "System Model Settings" to "Default Model Settings" and migrates remixicon imports to Tailwind CSS icon classes.	2026-03-04 16:58:46 +08:00