fix: fix conflict

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: yyh <92089059+lyzno1@users.noreply.github.com>

api/controllers/console/__init__.py

@@ -144,6 +144,7 @@ from .workspace import (
     models,
     plugin,
     rbac,
+    skills,
     snippets,
     tool_providers,
     trigger_providers,
@@ -225,6 +226,7 @@ __all__ = [
     "saved_message",
     "setup",
     "site",
+    "skills",
     "snippet_workflow",
     "snippet_workflow_draft_variable",
     "snippets",

api/controllers/console/app/audio.py

@@ -278,9 +278,7 @@ class ChatMessageTextApi(Resource):
     @get_app_model
     def post(self, app_model: App):
         try:
-            payload_data = dict(console_ns.payload or {})
-            payload_data.setdefault("text", "")
-            payload = TextToSpeechPayload.model_validate(payload_data)
+            payload = TextToSpeechPayload.model_validate(console_ns.payload)
             message_ref = None
             if payload.message_id:
                 app_ref = AppRefService.create_app_ref(app_model)

api/controllers/console/tag/tags.py

@@ -59,7 +59,7 @@ class TagBindingRemovePayload(BaseModel):
 
 
 class TagListQueryParam(BaseModel):
-    type: Literal["knowledge", "app", "snippet", ""] = Field("", description="Tag type filter")
+    type: TagType | Literal[""] = Field("", description="Tag type filter")
     keyword: str | None = Field(None, description="Search keyword")
 
 

api/controllers/console/workspace/skills.py

@@ -0,0 +1,834 @@
+"""Console API for workspace-level Skill Management."""
+
+from __future__ import annotations
+
+import io
+
+from flask import request, send_file
+from flask_restx import Resource
+from pydantic import BaseModel, ConfigDict, Field, ValidationError
+
+from controllers.common.fields import BinaryFileResponse
+from controllers.common.schema import query_params_from_model, register_response_schema_models, register_schema_models
+from controllers.console import console_ns
+from controllers.console.wraps import (
+    account_initialization_required,
+    edit_permission_required,
+    setup_required,
+    with_current_tenant_id,
+    with_current_user,
+)
+from fields.base import ResponseModel
+from libs import helper
+from libs.helper import dump_response
+from libs.login import login_required
+from models.account import Account
+from services.skill_management_service import (
+    SkillAssistMessagePayload,
+    SkillCreatePayload,
+    SkillDraftFileOperationPayload,
+    SkillDraftTreePayload,
+    SkillImportPayload,
+    SkillManagementService,
+    SkillManagementServiceError,
+    SkillMetadataPayload,
+    SkillPublishPayload,
+    SkillRestorePayload,
+    SkillVersionUpdatePayload,
+)
+
+_FILE_UPLOAD_PARAMS = {
+    "file": {
+        "description": "Skill draft file payload",
+        "in": "formData",
+        "type": "file",
+        "required": True,
+    },
+}
+
+
+class WorkspaceSkillsQuery(BaseModel):
+    keyword: str | None = Field(default=None, description="Search keyword matching skill name or description.")
+    page: int = Field(default=1, ge=1, le=99999, description="Page number.")
+    limit: int = Field(default=20, ge=1, le=100, description="Number of items per page.")
+    tag: list[str] = Field(
+        default_factory=list,
+        description="Skill tag filters. Repeat the parameter for multiple tags.",
+    )
+
+
+class SkillDeletePayload(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    confirmation_name: str | None = Field(
+        default=None,
+        description="Required when deleting a referenced Skill. Must match the Skill name.",
+    )
+
+
+class AgentSkillBindingsPayload(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    skill_ids: list[str] = Field(default_factory=list, description="Ordered Skill IDs bound to the Agent.")
+
+
+class SkillFileQuery(BaseModel):
+    path: str = Field(description="Skill file path relative to the Skill root.")
+    version_id: str | None = Field(default=None, description="Optional published version ID. Omit for current draft.")
+
+
+class SkillResponse(ResponseModel):
+    id: str
+    name: str
+    display_name: str
+    icon: str
+    description: str
+    tags: list[str] = Field(default_factory=list)
+    name_manually_edited: bool = False
+    visibility: str
+    latest_published_version_id: str | None = None
+    reference_count: int = 0
+    created_by: str | None = None
+    created_by_name: str | None = None
+    updated_by: str | None = None
+    updated_by_name: str | None = None
+    created_at: int
+    updated_at: int
+
+
+class SkillFileResponse(ResponseModel):
+    id: str | None = None
+    path: str
+    kind: str
+    storage: str | None = None
+    mime_type: str | None = None
+    content: str | None = None
+    tool_file_id: str | None = None
+    size: int | None = None
+    hash: str | None = None
+
+
+class SkillFilePreviewResponse(ResponseModel):
+    path: str
+    mime_type: str
+    content: str
+    size: int
+    hash: str
+
+
+class SkillFileUploadResponse(ResponseModel):
+    id: str
+    name: str
+    mime_type: str
+    size: int
+    hash: str
+
+
+class SkillDetailResponse(SkillResponse):
+    files: list[SkillFileResponse] = Field(default_factory=list)
+
+
+class SkillListResponse(ResponseModel):
+    data: list[SkillResponse] = Field(default_factory=list)
+    has_more: bool = False
+    limit: int = 20
+    page: int = 1
+    total: int = 0
+
+
+class SkillTagResponse(ResponseModel):
+    tag: str
+    count: int
+
+
+class SkillTagListResponse(ResponseModel):
+    data: list[SkillTagResponse] = Field(default_factory=list)
+
+
+class SkillVersionResponse(ResponseModel):
+    id: str
+    skill_id: str
+    version_number: int
+    version_name: str
+    publish_note: str
+    hash_code: str
+    archive_size: int
+    published_by: str | None = None
+    published_by_name: str | None = None
+    is_latest: bool = False
+    created_at: int
+
+
+class SkillVersionListResponse(ResponseModel):
+    data: list[SkillVersionResponse] = Field(default_factory=list)
+
+
+class SkillVersionDetailResponse(SkillVersionResponse):
+    files: list[SkillFileResponse] = Field(default_factory=list)
+
+
+class SkillVersionDeleteResponse(ResponseModel):
+    id: str
+    deleted: bool
+    latest_published_version_id: str | None = None
+
+
+class SkillReferenceResponse(ResponseModel):
+    type: str
+    agent_id: str
+    agent_icon: str | None = None
+    agent_icon_background: str | None = None
+    agent_icon_type: str | None = None
+    app_id: str | None = None
+    name: str
+    display_name: str
+    workflow_id: str | None = None
+    workflow_name: str | None = None
+    workflow_icon: str | None = None
+    workflow_icon_background: str | None = None
+    workflow_icon_type: str | None = None
+    workflow_version: str | None = None
+    node_id: str | None = None
+    node_name: str | None = None
+
+
+class SkillReferenceListResponse(ResponseModel):
+    data: list[SkillReferenceResponse] = Field(default_factory=list)
+
+
+class SkillDeleteResponse(ResponseModel):
+    id: str
+    deleted: bool
+
+
+class AgentSkillBindingItemResponse(ResponseModel):
+    id: str
+    priority: int
+    name: str
+    display_name: str
+    icon: str
+    description: str
+    tags: list[str] = Field(default_factory=list)
+    status: str
+    file_count: int
+    latest_published_version_id: str | None = None
+    latest_published_at: int | None = None
+    updated_at: int
+
+
+class AgentSkillBindingsResponse(ResponseModel):
+    agent_id: str
+    skill_ids: list[str] = Field(default_factory=list)
+    data: list[AgentSkillBindingItemResponse] = Field(default_factory=list)
+
+
+register_schema_models(
+    console_ns,
+    WorkspaceSkillsQuery,
+    SkillCreatePayload,
+    SkillAssistMessagePayload,
+    SkillMetadataPayload,
+    SkillDraftFileOperationPayload,
+    SkillDraftTreePayload,
+    SkillPublishPayload,
+    SkillRestorePayload,
+    SkillVersionUpdatePayload,
+    SkillDeletePayload,
+    SkillFileQuery,
+    AgentSkillBindingsPayload,
+)
+
+register_response_schema_models(
+    console_ns,
+    SkillResponse,
+    SkillFileResponse,
+    SkillFilePreviewResponse,
+    SkillFileUploadResponse,
+    SkillDetailResponse,
+    SkillListResponse,
+    SkillTagResponse,
+    SkillTagListResponse,
+    SkillVersionResponse,
+    SkillVersionListResponse,
+    SkillVersionDetailResponse,
+    SkillVersionDeleteResponse,
+    SkillReferenceResponse,
+    SkillReferenceListResponse,
+    SkillDeleteResponse,
+    AgentSkillBindingItemResponse,
+    AgentSkillBindingsResponse,
+    BinaryFileResponse,
+)
+
+
+def _error_response(exc: SkillManagementServiceError) -> tuple[dict[str, object], int]:
+    body: dict[str, object] = {"code": exc.code, "message": exc.message}
+    if exc.details:
+        body["details"] = exc.details
+    return body, exc.status_code
+
+
+@console_ns.route("/workspaces/current/skills")
+class WorkspaceSkillsApi(Resource):
+    @console_ns.doc(params=query_params_from_model(WorkspaceSkillsQuery))
+    @console_ns.response(200, "Workspace skills", console_ns.models[SkillListResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_tenant_id
+    def get(self, current_tenant_id: str):
+        query_input: dict[str, object] = {
+            "keyword": request.args.get("keyword"),
+            "tag": request.args.getlist("tag"),
+        }
+        if "limit" in request.args:
+            query_input["limit"] = request.args.get("limit")
+        if "page" in request.args:
+            query_input["page"] = request.args.get("page")
+        query = WorkspaceSkillsQuery.model_validate(query_input)
+        result = SkillManagementService().list_skills(
+            tenant_id=current_tenant_id,
+            keyword=query.keyword,
+            page=query.page,
+            limit=query.limit,
+            tags=[tag for tag in query.tag if tag],
+        )
+        return dump_response(SkillListResponse, result)
+
+    @console_ns.expect(console_ns.models[SkillCreatePayload.__name__])
+    @console_ns.response(201, "Skill created", console_ns.models[SkillDetailResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def post(self, current_tenant_id: str, current_user: Account):
+        try:
+            payload = SkillCreatePayload.model_validate(console_ns.payload or {})
+            result = SkillManagementService().create_skill(
+                tenant_id=current_tenant_id,
+                user_id=current_user.id,
+                payload=payload,
+            )
+            return dump_response(SkillDetailResponse, result), 201
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except ValueError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/files/upload")
+class WorkspaceSkillFileUploadApi(Resource):
+    @console_ns.doc(consumes=["multipart/form-data"], params=_FILE_UPLOAD_PARAMS)
+    @console_ns.response(201, "Skill draft file uploaded", console_ns.models[SkillFileUploadResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def post(self, current_tenant_id: str, current_user: Account):
+        if "file" not in request.files:
+            return {"code": "no_file_uploaded", "message": "no file uploaded"}, 400
+
+        file = request.files["file"]
+        if not file.filename:
+            return {"code": "filename_missing", "message": "filename is required"}, 400
+
+        result = SkillManagementService().upload_file(
+            tenant_id=current_tenant_id,
+            user_id=current_user.id,
+            filename=file.filename,
+            content=file.stream.read(),
+            mime_type=file.mimetype,
+        )
+        return dump_response(SkillFileUploadResponse, result), 201
+
+
+@console_ns.route("/workspaces/current/skills/tags")
+class WorkspaceSkillTagsApi(Resource):
+    @console_ns.response(200, "Workspace Skill tags", console_ns.models[SkillTagListResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_tenant_id
+    def get(self, current_tenant_id: str):
+        result = SkillManagementService().list_tags(tenant_id=current_tenant_id)
+        return dump_response(SkillTagListResponse, result)
+
+
+@console_ns.route("/workspaces/current/skills/import")
+class WorkspaceSkillImportApi(Resource):
+    @console_ns.doc(description="Import a Skill zip package from multipart form field `file`.")
+    @console_ns.response(201, "Skill imported", console_ns.models[SkillDetailResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def post(self, current_tenant_id: str, current_user: Account):
+        upload = request.files.get("file")
+        if upload is None:
+            return {"code": "invalid_request", "message": "file is required"}, 400
+        try:
+            payload = SkillImportPayload(content=upload.read(), filename=upload.filename or "skill.zip")
+            result = SkillManagementService().import_skill(
+                tenant_id=current_tenant_id,
+                user_id=current_user.id,
+                payload=payload,
+            )
+            return dump_response(SkillDetailResponse, result), 201
+        except (ValidationError, ValueError) as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>")
+class WorkspaceSkillApi(Resource):
+    @console_ns.response(200, "Skill detail", console_ns.models[SkillDetailResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_tenant_id
+    def get(self, current_tenant_id: str, skill_id: str):
+        try:
+            result = SkillManagementService().get_skill(tenant_id=current_tenant_id, skill_id=skill_id)
+            return dump_response(SkillDetailResponse, result)
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+    @console_ns.expect(console_ns.models[SkillMetadataPayload.__name__])
+    @console_ns.response(200, "Skill updated", console_ns.models[SkillResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def patch(self, current_tenant_id: str, current_user: Account, skill_id: str):
+        try:
+            payload = SkillMetadataPayload.model_validate(console_ns.payload or {})
+            result = SkillManagementService().update_metadata(
+                tenant_id=current_tenant_id,
+                user_id=current_user.id,
+                skill_id=skill_id,
+                payload=payload,
+            )
+            return dump_response(SkillResponse, result)
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except ValueError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+    @console_ns.expect(console_ns.models[SkillDeletePayload.__name__])
+    @console_ns.response(200, "Skill deleted", console_ns.models[SkillDeleteResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_tenant_id
+    def delete(self, current_tenant_id: str, skill_id: str):
+        try:
+            payload = SkillDeletePayload.model_validate(console_ns.payload or {})
+            result = SkillManagementService().delete_skill(
+                tenant_id=current_tenant_id,
+                skill_id=skill_id,
+                confirmation_name=payload.confirmation_name,
+            )
+            return dump_response(SkillDeleteResponse, result)
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>/duplicate")
+class WorkspaceSkillDuplicateApi(Resource):
+    @console_ns.response(201, "Skill duplicated", console_ns.models[SkillDetailResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def post(self, current_tenant_id: str, current_user: Account, skill_id: str):
+        try:
+            result = SkillManagementService().duplicate_skill(
+                tenant_id=current_tenant_id,
+                user_id=current_user.id,
+                skill_id=skill_id,
+            )
+            return dump_response(SkillDetailResponse, result), 201
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>/export")
+class WorkspaceSkillExportApi(Resource):
+    @console_ns.response(200, "Published Skill zip archive")
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_tenant_id
+    def get(self, current_tenant_id: str, skill_id: str):
+        try:
+            result = SkillManagementService().pull_published_archive(tenant_id=current_tenant_id, skill_id=skill_id)
+            return send_file(
+                io.BytesIO(result.payload),
+                mimetype=result.mime_type,
+                as_attachment=True,
+                download_name=result.filename,
+            )
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>/assist/messages")
+class WorkspaceSkillAssistMessageApi(Resource):
+    """Stream read-only Skill Authoring suggestions from the default workspace model."""
+
+    @console_ns.expect(console_ns.models[SkillAssistMessagePayload.__name__])
+    @console_ns.response(200, "Skill Authoring assistant event stream")
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_user
+    @with_current_tenant_id
+    def post(self, current_tenant_id: str, current_user: Account, skill_id: str):
+        try:
+            payload = SkillAssistMessagePayload.model_validate(console_ns.payload or {})
+            response = SkillManagementService().create_assistant_action_stream(
+                tenant_id=current_tenant_id,
+                skill_id=skill_id,
+                user_id=current_user.id,
+                message=payload.message,
+                attachments=payload.attachments,
+                model_payload=payload.model,
+                target_path=payload.target_path,
+            )
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+        return helper.compact_generate_response(response)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>/files")
+class WorkspaceSkillFilesApi(Resource):
+    @console_ns.expect(console_ns.models[SkillDraftFileOperationPayload.__name__])
+    @console_ns.response(200, "Draft file operation applied", console_ns.models[SkillDetailResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def patch(self, current_tenant_id: str, current_user: Account, skill_id: str):
+        try:
+            payload = SkillDraftFileOperationPayload.model_validate(console_ns.payload or {})
+            result = SkillManagementService().apply_draft_file_operation(
+                tenant_id=current_tenant_id,
+                user_id=current_user.id,
+                skill_id=skill_id,
+                payload=payload,
+            )
+            return dump_response(SkillDetailResponse, result)
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except ValueError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+    @console_ns.expect(console_ns.models[SkillDraftTreePayload.__name__])
+    @console_ns.response(200, "Draft files replaced", console_ns.models[SkillDetailResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def put(self, current_tenant_id: str, current_user: Account, skill_id: str):
+        try:
+            payload = SkillDraftTreePayload.model_validate(console_ns.payload or {})
+            result = SkillManagementService().replace_draft_tree(
+                tenant_id=current_tenant_id,
+                user_id=current_user.id,
+                skill_id=skill_id,
+                payload=payload,
+            )
+            return dump_response(SkillDetailResponse, result)
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except ValueError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>/files/preview")
+class WorkspaceSkillFilePreviewApi(Resource):
+    @console_ns.doc(params=query_params_from_model(SkillFileQuery))
+    @console_ns.response(200, "Skill file text preview", console_ns.models[SkillFilePreviewResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_tenant_id
+    def get(self, current_tenant_id: str, skill_id: str):
+        try:
+            query = SkillFileQuery.model_validate(
+                {
+                    "path": request.args.get("path"),
+                    "version_id": request.args.get("version_id"),
+                }
+            )
+            result = SkillManagementService().preview_file(
+                tenant_id=current_tenant_id,
+                skill_id=skill_id,
+                path=query.path,
+                version_id=query.version_id,
+            )
+            return dump_response(SkillFilePreviewResponse, result)
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except ValueError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>/files/content")
+class WorkspaceSkillFileContentApi(Resource):
+    @console_ns.doc(params={**query_params_from_model(SkillFileQuery), "download": "Return as an attachment when 1."})
+    @console_ns.response(200, "Skill file content", console_ns.models[BinaryFileResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_tenant_id
+    def get(self, current_tenant_id: str, skill_id: str):
+        try:
+            query = SkillFileQuery.model_validate(
+                {
+                    "path": request.args.get("path"),
+                    "version_id": request.args.get("version_id"),
+                }
+            )
+            result = SkillManagementService().pull_file(
+                tenant_id=current_tenant_id,
+                skill_id=skill_id,
+                path=query.path,
+                version_id=query.version_id,
+            )
+            return send_file(
+                io.BytesIO(result.payload),
+                mimetype=result.mime_type,
+                as_attachment=request.args.get("download") == "1",
+                download_name=result.filename,
+            )
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except ValueError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>/publish")
+class WorkspaceSkillPublishApi(Resource):
+    @console_ns.expect(console_ns.models[SkillPublishPayload.__name__])
+    @console_ns.response(200, "Skill published", console_ns.models[SkillVersionResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def post(self, current_tenant_id: str, current_user: Account, skill_id: str):
+        try:
+            payload = SkillPublishPayload.model_validate(console_ns.payload or {})
+            result = SkillManagementService().publish_skill(
+                tenant_id=current_tenant_id,
+                user_id=current_user.id,
+                skill_id=skill_id,
+                payload=payload,
+            )
+            return dump_response(SkillVersionResponse, result)
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>/restore")
+class WorkspaceSkillRestoreApi(Resource):
+    @console_ns.expect(console_ns.models[SkillRestorePayload.__name__])
+    @console_ns.response(200, "Skill version restored", console_ns.models[SkillVersionResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def post(self, current_tenant_id: str, current_user: Account, skill_id: str):
+        try:
+            payload = SkillRestorePayload.model_validate(console_ns.payload or {})
+            result = SkillManagementService().restore_version(
+                tenant_id=current_tenant_id,
+                user_id=current_user.id,
+                skill_id=skill_id,
+                payload=payload,
+            )
+            return dump_response(SkillVersionResponse, result)
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>/references")
+class WorkspaceSkillReferencesApi(Resource):
+    @console_ns.response(200, "Skill references", console_ns.models[SkillReferenceListResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_tenant_id
+    def get(self, current_tenant_id: str, skill_id: str):
+        try:
+            result = SkillManagementService().list_skill_references(tenant_id=current_tenant_id, skill_id=skill_id)
+            return dump_response(SkillReferenceListResponse, result)
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>/versions")
+class WorkspaceSkillVersionsApi(Resource):
+    @console_ns.response(200, "Skill versions", console_ns.models[SkillVersionListResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_tenant_id
+    def get(self, current_tenant_id: str, skill_id: str):
+        try:
+            result = SkillManagementService().list_versions(tenant_id=current_tenant_id, skill_id=skill_id)
+            return dump_response(SkillVersionListResponse, result)
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/skills/<string:skill_id>/versions/<string:version_id>")
+class WorkspaceSkillVersionApi(Resource):
+    @console_ns.response(200, "Skill version detail", console_ns.models[SkillVersionDetailResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_tenant_id
+    def get(self, current_tenant_id: str, skill_id: str, version_id: str):
+        try:
+            result = SkillManagementService().get_version(
+                tenant_id=current_tenant_id,
+                skill_id=skill_id,
+                version_id=version_id,
+            )
+            return dump_response(SkillVersionDetailResponse, result)
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+    @console_ns.expect(console_ns.models[SkillVersionUpdatePayload.__name__])
+    @console_ns.response(200, "Skill version updated", console_ns.models[SkillVersionResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_tenant_id
+    def patch(self, current_tenant_id: str, skill_id: str, version_id: str):
+        try:
+            payload = SkillVersionUpdatePayload.model_validate(console_ns.payload or {})
+            result = SkillManagementService().update_version(
+                tenant_id=current_tenant_id,
+                skill_id=skill_id,
+                version_id=version_id,
+                payload=payload,
+            )
+            return dump_response(SkillVersionResponse, result)
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+    @console_ns.response(200, "Skill version deleted", console_ns.models[SkillVersionDeleteResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def delete(self, current_tenant_id: str, current_user: Account, skill_id: str, version_id: str):
+        try:
+            result = SkillManagementService().delete_version(
+                tenant_id=current_tenant_id,
+                user_id=current_user.id,
+                skill_id=skill_id,
+                version_id=version_id,
+            )
+            return dump_response(SkillVersionDeleteResponse, result)
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+@console_ns.route("/workspaces/current/agents/<string:agent_id>/skills")
+class WorkspaceAgentSkillBindingsApi(Resource):
+    @console_ns.response(200, "Agent Skill bindings", console_ns.models[AgentSkillBindingsResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_tenant_id
+    def get(self, current_tenant_id: str, agent_id: str):
+        result = SkillManagementService().list_agent_bindings(tenant_id=current_tenant_id, agent_id=agent_id)
+        return dump_response(AgentSkillBindingsResponse, result)
+
+    @console_ns.expect(console_ns.models[AgentSkillBindingsPayload.__name__])
+    @console_ns.response(200, "Agent Skill bindings replaced", console_ns.models[AgentSkillBindingsResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def put(self, current_tenant_id: str, current_user: Account, agent_id: str):
+        try:
+            payload = AgentSkillBindingsPayload.model_validate(console_ns.payload or {})
+            result = SkillManagementService().replace_agent_bindings(
+                tenant_id=current_tenant_id,
+                user_id=current_user.id,
+                agent_id=agent_id,
+                skill_ids=payload.skill_ids,
+            )
+            return dump_response(AgentSkillBindingsResponse, result)
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+__all__ = [
+    "WorkspaceAgentSkillBindingsApi",
+    "WorkspaceSkillApi",
+    "WorkspaceSkillDuplicateApi",
+    "WorkspaceSkillExportApi",
+    "WorkspaceSkillFilesApi",
+    "WorkspaceSkillImportApi",
+    "WorkspaceSkillPublishApi",
+    "WorkspaceSkillReferencesApi",
+    "WorkspaceSkillRestoreApi",
+    "WorkspaceSkillTagsApi",
+    "WorkspaceSkillVersionApi",
+    "WorkspaceSkillVersionsApi",
+    "WorkspaceSkillsApi",
+]

api/controllers/inner_api/__init__.py

@@ -23,6 +23,7 @@ from .knowledge import retrieval as _knowledge_retrieval
 from .plugin import agent_config as _agent_config
 from .plugin import agent_drive as _agent_drive
 from .plugin import plugin as _plugin
+from .plugin import skills as _skills
 from .workspace import workspace as _workspace
 
 api.add_namespace(inner_api_ns)
@@ -36,6 +37,7 @@ __all__ = [
     "_mail",
     "_plugin",
     "_runtime_credentials",
+    "_skills",
     "_workspace",
     "api",
     "bp",

api/controllers/inner_api/plugin/skills.py

@@ -0,0 +1,54 @@
+"""Inner API for published workspace Skills.
+
+These endpoints are called by trusted runtime services. They expose only
+published Skill artifacts, never draft files or editable metadata.
+"""
+
+from __future__ import annotations
+
+import io
+
+from flask import request, send_file
+from flask_restx import Resource
+from pydantic import BaseModel, ValidationError
+
+from controllers.console.wraps import setup_required
+from controllers.inner_api import inner_api_ns
+from controllers.inner_api.wraps import plugin_inner_api_only
+from services.skill_management_service import SkillManagementService, SkillManagementServiceError
+
+
+class _SkillTargetQuery(BaseModel):
+    tenant_id: str
+
+
+def _target_query_from_request() -> _SkillTargetQuery:
+    return _SkillTargetQuery.model_validate({"tenant_id": request.args.get("tenant_id")})
+
+
+def _error_response(exc: SkillManagementServiceError) -> tuple[dict[str, str], int]:
+    return {"code": exc.code, "message": exc.message}, exc.status_code
+
+
+@inner_api_ns.route("/skills/<string:skill_id>/pull")
+class PublishedSkillPullApi(Resource):
+    @setup_required
+    @plugin_inner_api_only
+    @inner_api_ns.doc("published_skill_pull")
+    def get(self, skill_id: str):
+        try:
+            query = _target_query_from_request()
+            result = SkillManagementService().pull_published_archive(tenant_id=query.tenant_id, skill_id=skill_id)
+            return send_file(
+                io.BytesIO(result.payload),
+                mimetype=result.mime_type,
+                as_attachment=True,
+                download_name=result.filename,
+            )
+        except ValidationError as exc:
+            return {"code": "invalid_request", "message": str(exc)}, 400
+        except SkillManagementServiceError as exc:
+            return _error_response(exc)
+
+
+__all__ = ["PublishedSkillPullApi"]

api/core/app/apps/agent_app/runtime_request_builder.py

@@ -43,6 +43,7 @@ from core.workflow.nodes.agent_v2.runtime_request_builder import (
     build_config_layer_config,
     build_knowledge_layer_config,
     build_shell_layer_config,
+    load_runtime_agent_skill_configs,
 )
 from models.agent_config_entities import AgentSoulConfig, AgentSoulToolsConfig
 from models.provider_ids import ModelProviderID
@@ -125,14 +126,22 @@ class AgentAppRuntimeRequestBuilder:
                 "cli_tool_count": len(agent_soul.tools.cli_tools),
             }
 
+        runtime_config_skills = load_runtime_agent_skill_configs(
+            tenant_id=context.dify_context.tenant_id,
+            agent_id=context.agent_id,
+        )
         config_layer_config, config_warnings = build_config_layer_config(
             agent_soul,
             agent_id=context.agent_id,
             config_version_id=context.agent_config_snapshot_id,
             config_version_kind=context.agent_config_version_kind,
+            runtime_config_skills=runtime_config_skills,
         )
         append_runtime_warnings(metadata, config_warnings)
-        soul_prompt_resolver = build_config_aware_soul_mention_resolver(agent_soul)
+        soul_prompt_resolver = build_config_aware_soul_mention_resolver(
+            agent_soul,
+            runtime_config_skills=runtime_config_skills,
+        )
         knowledge_config = build_knowledge_layer_config(agent_soul)
 
         request = self._request_builder.build_for_agent_app(

api/core/app/apps/base_app_runner.py

@@ -1,7 +1,7 @@
 import base64
 import logging
 import time
-from collections.abc import Generator, Mapping, MutableMapping, Sequence
+from collections.abc import Generator, Mapping, Sequence
 from mimetypes import guess_extension
 from typing import TYPE_CHECKING, Any, Union
 
@@ -54,15 +54,9 @@ _logger = logging.getLogger(__name__)
 
 class AppRunner:
     def recalc_llm_max_tokens(
-        self,
-        model_config: ModelConfigWithCredentialsEntity,
-        prompt_messages: list[PromptMessage],
-        *,
-        model_parameters: MutableMapping[str, Any] | None = None,
-    ) -> int | None:
-        """Clamp max tokens against the final prompt on the selected parameter mapping."""
+        self, model_config: ModelConfigWithCredentialsEntity, prompt_messages: list[PromptMessage]
+    ):
         # recalc max_tokens if sum(prompt_token +  max_tokens) over model token limit
-        parameters = model_parameters if model_parameters is not None else model_config.parameters
         model_instance = ModelInstance(
             provider_model_bundle=model_config.provider_model_bundle, model=model_config.model
         )
@@ -75,7 +69,8 @@ class AppRunner:
                 parameter_rule.use_template and parameter_rule.use_template == "max_tokens"
             ):
                 max_tokens = (
-                    parameters.get(parameter_rule.name) or parameters.get(parameter_rule.use_template or "")
+                    model_config.parameters.get(parameter_rule.name)
+                    or model_config.parameters.get(parameter_rule.use_template or "")
                 ) or 0
 
         if model_context_tokens is None:
@@ -90,9 +85,7 @@ class AppRunner:
                 if parameter_rule.name == "max_tokens" or (
                     parameter_rule.use_template and parameter_rule.use_template == "max_tokens"
                 ):
-                    parameters[parameter_rule.name] = max_tokens
-
-        return None
+                    model_config.parameters[parameter_rule.name] = max_tokens
 
     def organize_prompt_messages(
         self,

api/core/app/apps/completion/app_generator.py

@@ -15,8 +15,8 @@ from core.app.app_config.easy_ui_based_app.model_config.converter import ModelCo
 from core.app.app_config.features.file_upload.manager import FileUploadConfigManager
 from core.app.apps.base_app_queue_manager import AppQueueManager, PublishFrom
 from core.app.apps.completion.app_config_manager import CompletionAppConfigManager
+from core.app.apps.completion.app_runner import CompletionAppRunner
 from core.app.apps.completion.generate_response_converter import CompletionAppGenerateResponseConverter
-from core.app.apps.completion.workflow_runner import CompletionWorkflowRunner
 from core.app.apps.exc import GenerateTaskStoppedError
 from core.app.apps.message_based_app_generator import MessageBasedAppGenerator
 from core.app.apps.message_based_app_queue_manager import MessageBasedAppQueueManager
@@ -243,7 +243,7 @@ class CompletionAppGenerator(MessageBasedAppGenerator):
                 message = self._get_message(message_id)
 
                 # chatbot app
-                runner = CompletionWorkflowRunner()
+                runner = CompletionAppRunner()
                 with session_factory.create_session() as session:
                     runner.run(
                         application_generate_entity=application_generate_entity,

api/core/app/apps/completion/app_runner.py

@@ -0,0 +1,208 @@
+import logging
+from typing import cast
+
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
+from core.app.apps.base_app_queue_manager import AppQueueManager
+from core.app.apps.base_app_runner import AppRunner
+from core.app.apps.completion.app_config_manager import CompletionAppConfig
+from core.app.entities.app_invoke_entities import (
+    CompletionAppGenerateEntity,
+)
+from core.callback_handler.index_tool_callback_handler import DatasetIndexToolCallbackHandler
+from core.db.session_factory import create_session
+from core.model_manager import ModelInstance
+from core.moderation.base import ModerationError
+from core.rag.retrieval.dataset_retrieval import DatasetRetrieval
+from graphon.file import File
+from graphon.model_runtime.entities.message_entities import ImagePromptMessageContent
+from models.model import App, Message
+
+logger = logging.getLogger(__name__)
+
+
+class CompletionAppRunner(AppRunner):
+    """
+    Completion Application Runner
+    """
+
+    def run(
+        self,
+        application_generate_entity: CompletionAppGenerateEntity,
+        queue_manager: AppQueueManager,
+        message: Message,
+        session: Session,
+    ):
+        """Run the application without retaining ``session`` during model I/O.
+
+        Database preparation is committed and the connection is released before
+        the provider response is requested or consumed.
+
+        :param application_generate_entity: application generate entity
+        :param queue_manager: application queue manager
+        :param message: message
+        :return:
+        """
+        app_config = application_generate_entity.app_config
+        app_config = cast(CompletionAppConfig, app_config)
+        stmt = select(App).where(App.id == app_config.app_id)
+        with create_session() as read_session:
+            app_record = read_session.scalar(stmt)
+            if app_record:
+                read_session.expunge(app_record)
+        if not app_record:
+            raise ValueError("App not found")
+
+        inputs = application_generate_entity.inputs
+        query = application_generate_entity.query
+        files = application_generate_entity.files
+
+        image_detail_config = (
+            application_generate_entity.file_upload_config.image_config.detail
+            if (
+                application_generate_entity.file_upload_config
+                and application_generate_entity.file_upload_config.image_config
+            )
+            else None
+        )
+        image_detail_config = image_detail_config or ImagePromptMessageContent.DETAIL.LOW
+
+        # organize all inputs and template to prompt messages
+        # Include: prompt template, inputs, query(optional), files(optional)
+        prompt_messages, stop = self.organize_prompt_messages(
+            app_record=app_record,
+            model_config=application_generate_entity.model_conf,
+            prompt_template_entity=app_config.prompt_template,
+            inputs=inputs,
+            files=files,
+            query=query,
+            image_detail_config=image_detail_config,
+        )
+
+        # moderation
+        try:
+            # process sensitive_word_avoidance
+            _, inputs, query = self.moderation_for_inputs(
+                app_id=app_record.id,
+                tenant_id=app_config.tenant_id,
+                app_generate_entity=application_generate_entity,
+                inputs=inputs,
+                query=query or "",
+                message_id=message.id,
+            )
+        except ModerationError as e:
+            self.direct_output(
+                queue_manager=queue_manager,
+                app_generate_entity=application_generate_entity,
+                prompt_messages=prompt_messages,
+                text=str(e),
+                stream=application_generate_entity.stream,
+            )
+            return
+
+        # fill in variable inputs from external data tools if exists
+        external_data_tools = app_config.external_data_variables
+        if external_data_tools:
+            inputs = self.fill_in_inputs_from_external_data_tools(
+                tenant_id=app_record.tenant_id,
+                app_id=app_record.id,
+                external_data_tools=external_data_tools,
+                inputs=inputs,
+                query=query,
+            )
+
+        # get context from datasets
+        context = None
+        context_files: list[File] = []
+        if app_config.dataset and app_config.dataset.dataset_ids:
+            hit_callback = DatasetIndexToolCallbackHandler(
+                queue_manager,
+                app_record.id,
+                message.id,
+                application_generate_entity.user_id,
+                application_generate_entity.invoke_from,
+            )
+
+            dataset_config = app_config.dataset
+            if dataset_config and dataset_config.retrieve_config.query_variable:
+                query = inputs.get(dataset_config.retrieve_config.query_variable, "")
+
+            dataset_retrieval = DatasetRetrieval(application_generate_entity)
+            context, retrieved_files = dataset_retrieval.retrieve(
+                session=session,
+                app_id=app_record.id,
+                user_id=application_generate_entity.user_id,
+                tenant_id=app_record.tenant_id,
+                model_config=application_generate_entity.model_conf,
+                config=dataset_config,
+                query=query or "",
+                invoke_from=application_generate_entity.invoke_from,
+                show_retrieve_source=app_config.additional_features.show_retrieve_source
+                if app_config.additional_features
+                else False,
+                hit_callback=hit_callback,
+                message_id=message.id,
+                inputs=inputs,
+                vision_enabled=bool(
+                    application_generate_entity.app_config.app_model_config_dict.get("file_upload", {})
+                    .get("image", {})
+                    .get("enabled", False)
+                ),
+            )
+            context_files = retrieved_files or []
+
+        session.commit()
+        session.close()
+
+        # reorganize all inputs and template to prompt messages
+        # Include: prompt template, inputs, query(optional), files(optional)
+        #          memory(optional), external data, dataset context(optional)
+        prompt_messages, stop = self.organize_prompt_messages(
+            app_record=app_record,
+            model_config=application_generate_entity.model_conf,
+            prompt_template_entity=app_config.prompt_template,
+            inputs=inputs,
+            files=files,
+            query=query,
+            context=context,
+            image_detail_config=image_detail_config,
+            context_files=context_files,
+        )
+
+        # check hosting moderation
+        hosting_moderation_result = self.check_hosting_moderation(
+            application_generate_entity=application_generate_entity,
+            queue_manager=queue_manager,
+            prompt_messages=prompt_messages,
+        )
+
+        if hosting_moderation_result:
+            return
+
+        # Re-calculate the max tokens if sum(prompt_token +  max_tokens) over model token limit
+        self.recalc_llm_max_tokens(model_config=application_generate_entity.model_conf, prompt_messages=prompt_messages)
+
+        # Invoke model
+        model_instance = ModelInstance(
+            provider_model_bundle=application_generate_entity.model_conf.provider_model_bundle,
+            model=application_generate_entity.model_conf.model,
+        )
+
+        invoke_result = model_instance.invoke_llm(
+            prompt_messages=prompt_messages,
+            model_parameters=application_generate_entity.model_conf.parameters,
+            stop=stop,
+            stream=application_generate_entity.stream,
+            request_metadata={"app_id": app_config.app_id},
+        )
+
+        # handle invoke result
+        self._handle_invoke_result(
+            invoke_result=invoke_result,
+            queue_manager=queue_manager,
+            stream=application_generate_entity.stream,
+            message_id=message.id,
+            user_id=application_generate_entity.user_id,
+            tenant_id=app_config.tenant_id,
+        )

api/core/app/apps/completion/graph_event_adapter.py

@@ -1,144 +0,0 @@
-from collections.abc import Mapping, Sequence
-
-from core.app.apps.base_app_queue_manager import AppQueueManager, PublishFrom
-from core.app.entities.app_invoke_entities import CompletionAppGenerateEntity
-from core.app.entities.queue_entities import (
-    QueueErrorEvent,
-    QueueLLMChunkEvent,
-    QueueMessageEndEvent,
-    QueueRetrieverResourcesEvent,
-    QueueStopEvent,
-)
-from core.rag.entities import RetrievalSourceMetadata
-from graphon.graph_events import (
-    GraphEngineEvent,
-    GraphRunAbortedEvent,
-    GraphRunFailedEvent,
-    GraphRunSucceededEvent,
-    NodeRunRetrieverResourceEvent,
-    NodeRunStreamChunkEvent,
-    NodeRunSucceededEvent,
-)
-from graphon.model_runtime.entities.llm_entities import LLMResult, LLMResultChunk, LLMResultChunkDelta, LLMUsage
-from graphon.model_runtime.entities.message_entities import AssistantPromptMessage, PromptMessage
-
-_LLM_TEXT_SELECTOR_PREFIX = ("llm", "text")
-
-
-class CompletionGraphEventAdapter:
-    """Translate one runtime graph run into legacy Completion queue events."""
-
-    _application_generate_entity: CompletionAppGenerateEntity
-    _queue_manager: AppQueueManager
-    _answer: str
-    _usage: LLMUsage
-    _prompt_messages: list[PromptMessage]
-    _chunk_index: int
-
-    def __init__(
-        self,
-        *,
-        application_generate_entity: CompletionAppGenerateEntity,
-        queue_manager: AppQueueManager,
-    ) -> None:
-        self._application_generate_entity = application_generate_entity
-        self._queue_manager = queue_manager
-        self._answer = ""
-        self._usage = LLMUsage.empty_usage()
-        self._prompt_messages = []
-        self._chunk_index = 0
-
-    def set_prompt_messages(self, prompt_messages: Sequence[PromptMessage]) -> None:
-        """Capture the final GraphOn prompt for legacy chunks and message persistence."""
-        self._prompt_messages = list(prompt_messages)
-
-    def handle_event(self, event: GraphEngineEvent) -> None:
-        match event:
-            case NodeRunStreamChunkEvent():
-                self._handle_stream_chunk(event)
-            case NodeRunRetrieverResourceEvent():
-                self._handle_retriever_resource(event)
-            case NodeRunSucceededEvent():
-                self._handle_node_succeeded(event)
-            case GraphRunSucceededEvent():
-                self._publish_message_end(event.outputs)
-            case GraphRunFailedEvent():
-                self._publish_error(event.error)
-            case GraphRunAbortedEvent():
-                self._queue_manager.publish(
-                    QueueStopEvent(stopped_by=QueueStopEvent.StopBy.USER_MANUAL),
-                    PublishFrom.APPLICATION_MANAGER,
-                )
-            case _:
-                return
-
-    def _handle_stream_chunk(self, event: NodeRunStreamChunkEvent) -> None:
-        if tuple(event.selector)[:2] != _LLM_TEXT_SELECTOR_PREFIX:
-            return
-        if event.is_final and not event.chunk:
-            return
-
-        self._answer += event.chunk
-        self._queue_manager.publish(
-            QueueLLMChunkEvent(
-                chunk=LLMResultChunk(
-                    model=self._application_generate_entity.model_conf.model,
-                    prompt_messages=self._prompt_messages,
-                    delta=LLMResultChunkDelta(
-                        index=self._chunk_index,
-                        message=AssistantPromptMessage(content=event.chunk),
-                    ),
-                )
-            ),
-            PublishFrom.APPLICATION_MANAGER,
-        )
-        self._chunk_index += 1
-
-    def _handle_retriever_resource(self, event: NodeRunRetrieverResourceEvent) -> None:
-        additional_features = self._application_generate_entity.app_config.additional_features
-        if not additional_features or not additional_features.show_retrieve_source:
-            return
-
-        self._queue_manager.publish(
-            QueueRetrieverResourcesEvent(
-                retriever_resources=[
-                    RetrievalSourceMetadata.model_validate(resource) for resource in event.retriever_resources
-                ],
-                in_iteration_id=event.in_iteration_id,
-                in_loop_id=event.in_loop_id,
-            ),
-            PublishFrom.APPLICATION_MANAGER,
-        )
-
-    def _handle_node_succeeded(self, event: NodeRunSucceededEvent) -> None:
-        if event.node_id != "llm":
-            return
-
-        result = event.node_run_result
-        text = result.outputs.get("text")
-        if isinstance(text, str):
-            self._answer = text
-        self._usage = result.llm_usage
-
-    def _publish_message_end(self, outputs: Mapping[str, object]) -> None:
-        result = outputs.get("result")
-        if isinstance(result, str) and not self._answer:
-            self._answer = result
-
-        self._queue_manager.publish(
-            QueueMessageEndEvent(
-                llm_result=LLMResult(
-                    model=self._application_generate_entity.model_conf.model,
-                    prompt_messages=self._prompt_messages,
-                    message=AssistantPromptMessage(content=self._answer),
-                    usage=self._usage,
-                )
-            ),
-            PublishFrom.APPLICATION_MANAGER,
-        )
-
-    def _publish_error(self, error: object) -> None:
-        self._queue_manager.publish(
-            QueueErrorEvent(error=ValueError(str(error))),
-            PublishFrom.APPLICATION_MANAGER,
-        )

api/core/app/apps/completion/runtime_workflow_builder.py

@@ -1,69 +0,0 @@
-import json
-from dataclasses import dataclass
-from typing import Any
-from uuid import uuid4
-
-from sqlalchemy.orm import Session
-
-from core.app.apps.completion.app_config_manager import CompletionAppConfig
-from graphon.nodes import BuiltinNodeTypes
-from models.model import App, AppMode
-from services.workflow.workflow_converter import WorkflowConverter, WorkflowGraph
-
-
-@dataclass(frozen=True, slots=True)
-class RuntimeCompletionWorkflow:
-    workflow_id: str
-    root_node_id: str
-    graph_dict: WorkflowGraph
-
-
-def build_runtime_completion_workflow(
-    *,
-    app_model: App,
-    app_config: CompletionAppConfig,
-    session: Session,
-    workflow_converter: WorkflowConverter | None = None,
-) -> RuntimeCompletionWorkflow:
-    """Build the transient WorkflowEntry graph used by Completion execution."""
-    converter = workflow_converter or WorkflowConverter()
-    graph, _ = converter.build_graph_from_app_config(
-        app_model=app_model,
-        app_config=app_config,
-        target_app_mode=AppMode.WORKFLOW,
-        session=session,
-    )
-    _route_external_data_query_to_sys_query(graph)
-    return RuntimeCompletionWorkflow(
-        workflow_id=f"completion-runtime-{uuid4()}",
-        root_node_id="start",
-        graph_dict=graph,
-    )
-
-
-def _route_external_data_query_to_sys_query(graph: WorkflowGraph) -> None:
-    """Preserve Completion API-based variable behavior in the runtime graph."""
-    for node in graph["nodes"]:
-        data = node.get("data", {})
-        if data.get("type") != BuiltinNodeTypes.HTTP_REQUEST:
-            continue
-
-        body = data.get("body")
-        if not isinstance(body, dict) or body.get("type") != "json":
-            continue
-
-        raw_body_data = body.get("data")
-        if not isinstance(raw_body_data, str):
-            continue
-
-        try:
-            body_data: dict[str, Any] = json.loads(raw_body_data)
-        except json.JSONDecodeError:
-            continue
-
-        params = body_data.get("params")
-        if not isinstance(params, dict) or params.get("query") != "":
-            continue
-
-        params["query"] = "{{#sys.query#}}"
-        body["data"] = json.dumps(body_data)

api/core/app/apps/completion/workflow_runner.py

@@ -1,242 +0,0 @@
-import time
-from collections.abc import Callable, Mapping, Sequence
-from dataclasses import dataclass
-from typing import Any, cast
-
-from sqlalchemy import select
-from sqlalchemy.orm import Session
-
-from core.app.apps.base_app_queue_manager import AppQueueManager
-from core.app.apps.base_app_runner import AppRunner
-from core.app.apps.completion.app_config_manager import CompletionAppConfig
-from core.app.apps.completion.graph_event_adapter import CompletionGraphEventAdapter
-from core.app.apps.completion.runtime_workflow_builder import build_runtime_completion_workflow
-from core.app.apps.exc import GenerateTaskStoppedError
-from core.app.apps.workflow_app_runner import init_graph
-from core.app.entities.app_invoke_entities import CompletionAppGenerateEntity, UserFrom
-from core.moderation.base import ModerationError
-from core.workflow.node_runtime import DIFY_BEFORE_LLM_INVOKE_KEY
-from core.workflow.system_variables import build_bootstrap_variables, build_system_variables
-from core.workflow.variable_pool_initializer import add_node_inputs_to_pool, add_variables_to_pool
-from core.workflow.workflow_entry import WorkflowEntry
-from extensions.ext_redis import redis_client
-from graphon.graph_engine.command_channels import RedisChannel
-from graphon.model_runtime.entities.message_entities import ImagePromptMessageContent, PromptMessage
-from graphon.runtime import GraphRuntimeState, VariablePool
-from models.model import App, Message
-
-
-@dataclass(frozen=True, slots=True)
-class ModeratedCompletionInputs:
-    stopped: bool
-    inputs: Mapping[str, Any]
-    query: str
-
-
-class CompletionWorkflowRunner(AppRunner):
-    """Run a transient WorkflowEntry graph while the legacy task pipeline owns persistence."""
-
-    def run(
-        self,
-        application_generate_entity: CompletionAppGenerateEntity,
-        queue_manager: AppQueueManager,
-        message: Message,
-        session: Session,
-    ) -> None:
-        app_config = cast(CompletionAppConfig, application_generate_entity.app_config)
-        app_record = self._get_app(app_id=app_config.app_id, tenant_id=app_config.tenant_id, session=session)
-
-        moderation_result = self._run_input_moderation(
-            app_record=app_record,
-            application_generate_entity=application_generate_entity,
-            queue_manager=queue_manager,
-            message=message,
-        )
-        if moderation_result.stopped:
-            return
-
-        runtime_workflow = build_runtime_completion_workflow(
-            app_model=app_record,
-            app_config=app_config,
-            session=session,
-        )
-        variable_pool = self._build_variable_pool(
-            application_generate_entity=application_generate_entity,
-            message=message,
-            workflow_id=runtime_workflow.workflow_id,
-            root_node_id=runtime_workflow.root_node_id,
-            inputs=moderation_result.inputs,
-            query=moderation_result.query,
-        )
-        graph_runtime_state = GraphRuntimeState(variable_pool=variable_pool, start_at=time.perf_counter())
-        user_from = self._resolve_user_from(application_generate_entity)
-        adapter = CompletionGraphEventAdapter(
-            application_generate_entity=application_generate_entity,
-            queue_manager=queue_manager,
-        )
-        extra_context = {
-            DIFY_BEFORE_LLM_INVOKE_KEY: self._build_before_llm_invoke_hook(
-                application_generate_entity=application_generate_entity,
-                queue_manager=queue_manager,
-                adapter=adapter,
-            )
-        }
-
-        graph = init_graph(
-            app_id=app_config.app_id,
-            graph_config=runtime_workflow.graph_dict,
-            graph_runtime_state=graph_runtime_state,
-            user_from=user_from,
-            invoke_from=application_generate_entity.invoke_from,
-            workflow_id=runtime_workflow.workflow_id,
-            tenant_id=app_config.tenant_id,
-            user_id=application_generate_entity.user_id,
-            root_node_id=runtime_workflow.root_node_id,
-            trace_session_id=application_generate_entity.extras.get("trace_session_id"),
-            call_depth=application_generate_entity.call_depth,
-            extra_context=extra_context,
-        )
-
-        queue_manager.graph_runtime_state = graph_runtime_state
-        command_channel = RedisChannel(redis_client, f"workflow:{application_generate_entity.task_id}:commands")
-        workflow_entry = WorkflowEntry(
-            tenant_id=app_config.tenant_id,
-            app_id=app_config.app_id,
-            workflow_id=runtime_workflow.workflow_id,
-            graph_config=runtime_workflow.graph_dict,
-            graph=graph,
-            user_id=application_generate_entity.user_id,
-            user_from=user_from,
-            invoke_from=application_generate_entity.invoke_from,
-            call_depth=application_generate_entity.call_depth,
-            variable_pool=variable_pool,
-            graph_runtime_state=graph_runtime_state,
-            command_channel=command_channel,
-        )
-        # Do not hold a database connection during graph execution or provider streaming.
-        session.commit()
-        session.close()
-        for event in workflow_entry.run():
-            adapter.handle_event(event)
-
-    def _get_app(self, *, app_id: str, tenant_id: str, session: Session) -> App:
-        app_record = session.scalar(select(App).where(App.id == app_id, App.tenant_id == tenant_id))
-        if not app_record:
-            raise ValueError("App not found")
-        return app_record
-
-    def _run_input_moderation(
-        self,
-        *,
-        app_record: App,
-        application_generate_entity: CompletionAppGenerateEntity,
-        queue_manager: AppQueueManager,
-        message: Message,
-    ) -> ModeratedCompletionInputs:
-        app_config = cast(CompletionAppConfig, application_generate_entity.app_config)
-        prompt_messages, _ = self.organize_prompt_messages(
-            app_record=app_record,
-            model_config=application_generate_entity.model_conf,
-            prompt_template_entity=app_config.prompt_template,
-            inputs=application_generate_entity.inputs,
-            files=application_generate_entity.files,
-            query=application_generate_entity.query,
-            image_detail_config=self._resolve_image_detail_config(application_generate_entity),
-        )
-
-        try:
-            _, inputs, query = self.moderation_for_inputs(
-                app_id=app_record.id,
-                tenant_id=app_config.tenant_id,
-                app_generate_entity=application_generate_entity,
-                inputs=application_generate_entity.inputs,
-                query=application_generate_entity.query or "",
-                message_id=message.id,
-            )
-        except ModerationError as exc:
-            self.direct_output(
-                queue_manager=queue_manager,
-                app_generate_entity=application_generate_entity,
-                prompt_messages=prompt_messages,
-                text=str(exc),
-                stream=application_generate_entity.stream,
-            )
-            return ModeratedCompletionInputs(
-                stopped=True,
-                inputs=application_generate_entity.inputs,
-                query=application_generate_entity.query or "",
-            )
-
-        return ModeratedCompletionInputs(stopped=False, inputs=inputs, query=query)
-
-    def _build_before_llm_invoke_hook(
-        self,
-        *,
-        application_generate_entity: CompletionAppGenerateEntity,
-        queue_manager: AppQueueManager,
-        adapter: CompletionGraphEventAdapter,
-    ) -> Callable[[Sequence[PromptMessage], Mapping[str, Any]], Mapping[str, Any]]:
-        def check(
-            prompt_messages: Sequence[PromptMessage],
-            model_parameters: Mapping[str, Any],
-        ) -> Mapping[str, Any]:
-            adapter.set_prompt_messages(prompt_messages)
-            if self.check_hosting_moderation(
-                application_generate_entity=application_generate_entity,
-                queue_manager=queue_manager,
-                prompt_messages=list(prompt_messages),
-            ):
-                raise GenerateTaskStoppedError()
-
-            adjusted_parameters = dict(model_parameters)
-            self.recalc_llm_max_tokens(
-                model_config=application_generate_entity.model_conf,
-                prompt_messages=list(prompt_messages),
-                model_parameters=adjusted_parameters,
-            )
-            return adjusted_parameters
-
-        return check
-
-    def _build_variable_pool(
-        self,
-        *,
-        application_generate_entity: CompletionAppGenerateEntity,
-        message: Message,
-        workflow_id: str,
-        root_node_id: str,
-        inputs: Mapping[str, Any],
-        query: str,
-    ) -> VariablePool:
-        variable_pool = VariablePool()
-        system_inputs = build_system_variables(
-            files=application_generate_entity.files,
-            user_id=application_generate_entity.user_id,
-            app_id=application_generate_entity.app_config.app_id,
-            workflow_id=workflow_id,
-            workflow_execution_id=application_generate_entity.task_id,
-            timestamp=int(time.time()),
-            query=query,
-            conversation_id=message.conversation_id,
-        )
-        add_variables_to_pool(
-            variable_pool,
-            build_bootstrap_variables(system_variables=system_inputs, environment_variables=[]),
-        )
-        add_node_inputs_to_pool(variable_pool, node_id=root_node_id, inputs=inputs)
-        return variable_pool
-
-    @staticmethod
-    def _resolve_user_from(application_generate_entity: CompletionAppGenerateEntity) -> UserFrom:
-        if application_generate_entity.invoke_from.runs_as_account():
-            return UserFrom.ACCOUNT
-        return UserFrom.END_USER
-
-    @staticmethod
-    def _resolve_image_detail_config(
-        application_generate_entity: CompletionAppGenerateEntity,
-    ) -> ImagePromptMessageContent.DETAIL:
-        file_upload_config = application_generate_entity.file_upload_config
-        if file_upload_config and file_upload_config.image_config:
-            return file_upload_config.image_config.detail or ImagePromptMessageContent.DETAIL.LOW
-        return ImagePromptMessageContent.DETAIL.LOW

api/core/app/apps/workflow_app_runner.py

@@ -93,60 +93,6 @@ from tasks.mail_human_input_delivery_task import dispatch_human_input_email_task
 logger = logging.getLogger(__name__)
 
 
-def init_graph(
-    *,
-    app_id: str,
-    graph_config: Mapping[str, Any],
-    graph_runtime_state: GraphRuntimeState,
-    user_from: UserFrom,
-    invoke_from: InvokeFrom,
-    workflow_id: str = "",
-    tenant_id: str = "",
-    user_id: str = "",
-    root_node_id: str | None = None,
-    trace_session_id: str | None = None,
-    call_depth: int = 0,
-    extra_context: Mapping[str, Any] | None = None,
-) -> Graph:
-    if "nodes" not in graph_config or "edges" not in graph_config:
-        raise ValueError("nodes or edges not found in workflow graph")
-
-    if not isinstance(graph_config.get("nodes"), list):
-        raise ValueError("nodes in workflow graph must be a list")
-
-    if not isinstance(graph_config.get("edges"), list):
-        raise ValueError("edges in workflow graph must be a list")
-
-    run_context = build_dify_run_context(
-        tenant_id=tenant_id or "",
-        app_id=app_id,
-        user_id=user_id,
-        user_from=user_from,
-        invoke_from=invoke_from,
-        trace_session_id=trace_session_id,
-        extra_context=extra_context,
-    )
-    graph_init_context = DifyGraphInitContext(
-        workflow_id=workflow_id,
-        graph_config=graph_config,
-        run_context=run_context,
-        call_depth=call_depth,
-    )
-    node_factory = DifyNodeFactory.from_graph_init_context(
-        graph_init_context=graph_init_context,
-        graph_runtime_state=graph_runtime_state,
-    )
-
-    if root_node_id is None:
-        root_node_id = get_default_root_node_id(graph_config)
-
-    graph = Graph.init(graph_config=graph_config, node_factory=node_factory, root_node_id=root_node_id)
-    if not graph:
-        raise ValueError("graph not found in workflow")
-
-    return graph
-
-
 class WorkflowBasedAppRunner:
     def __init__(
         self,
@@ -182,18 +128,48 @@ class WorkflowBasedAppRunner:
         """
         Init graph
         """
-        return init_graph(
+        if "nodes" not in graph_config or "edges" not in graph_config:
+            raise ValueError("nodes or edges not found in workflow graph")
+
+        if not isinstance(graph_config.get("nodes"), list):
+            raise ValueError("nodes in workflow graph must be a list")
+
+        if not isinstance(graph_config.get("edges"), list):
+            raise ValueError("edges in workflow graph must be a list")
+
+        # Create explicit graph init context for Graph.init.
+        run_context = build_dify_run_context(
+            tenant_id=tenant_id or "",
             app_id=self._app_id,
-            graph_config=graph_config,
-            graph_runtime_state=graph_runtime_state,
+            user_id=user_id,
             user_from=user_from,
             invoke_from=invoke_from,
-            workflow_id=workflow_id,
-            tenant_id=tenant_id,
-            user_id=user_id,
-            root_node_id=root_node_id,
             trace_session_id=trace_session_id,
         )
+        graph_init_context = DifyGraphInitContext(
+            workflow_id=workflow_id,
+            graph_config=graph_config,
+            run_context=run_context,
+            call_depth=0,
+        )
+
+        # Use the provided graph_runtime_state for consistent state management
+
+        node_factory = DifyNodeFactory.from_graph_init_context(
+            graph_init_context=graph_init_context,
+            graph_runtime_state=graph_runtime_state,
+        )
+
+        if root_node_id is None:
+            root_node_id = get_default_root_node_id(graph_config)
+
+        # init graph
+        graph = Graph.init(graph_config=graph_config, node_factory=node_factory, root_node_id=root_node_id)
+
+        if not graph:
+            raise ValueError("graph not found in workflow")
+
+        return graph
 
     def _prepare_single_node_execution(
         self,

api/core/workflow/node_factory.py

@@ -23,8 +23,6 @@ from core.prompt.entities.advanced_prompt_entities import MemoryConfig
 from core.trigger.constants import TRIGGER_NODE_TYPES
 from core.workflow.human_input_adapter import adapt_node_config_for_graph
 from core.workflow.node_runtime import (
-    DIFY_BEFORE_LLM_INVOKE_KEY,
-    BeforeLLMInvoke,
     DifyFileReferenceFactory,
     DifyHumanInputNodeRuntime,
     DifyPreparedLLM,
@@ -551,10 +549,6 @@ class DifyNodeFactory(NodeFactory):
     ) -> dict[str, object]:
         validated_node_data = cast(LLMCompatibleNodeData, node_data)
         model_instance = self._build_model_instance_for_llm_node(validated_node_data)
-        before_llm_invoke = cast(
-            BeforeLLMInvoke | None,
-            self.graph_init_params.run_context.get(DIFY_BEFORE_LLM_INVOKE_KEY),
-        )
         node_init_kwargs: dict[str, object] = {
             "credentials_provider": self._llm_credentials_provider,
             "model_factory": self._llm_model_factory,
@@ -563,7 +557,6 @@ class DifyNodeFactory(NodeFactory):
                     node_data=validated_node_data,
                     model_instance=model_instance,
                     request_metadata={"app_id": self._dify_context.app_id},
-                    before_invoke=before_llm_invoke,
                 )
                 if wrap_model_instance
                 else model_instance
@@ -597,22 +590,13 @@ class DifyNodeFactory(NodeFactory):
         node_data: LLMCompatibleNodeData,
         model_instance: ModelInstance,
         request_metadata: Mapping[str, object] | None = None,
-        before_invoke: BeforeLLMInvoke | None = None,
     ) -> DifyPreparedLLM:
         # Only graphon's LLM node consumes the polling protocol. Keep classifier
         # and extractor nodes on the existing wrapper even if the same model
         # advertises polling support.
         if node_data.type == BuiltinNodeTypes.LLM and DifyNodeFactory._supports_plugin_llm_polling(model_instance):
-            return DifyPreparedPollingLLM(
-                model_instance,
-                request_metadata=request_metadata,
-                before_invoke=before_invoke,
-            )
-        return DifyPreparedLLM(
-            model_instance,
-            request_metadata=request_metadata,
-            before_invoke=before_invoke,
-        )
+            return DifyPreparedPollingLLM(model_instance, request_metadata=request_metadata)
+        return DifyPreparedLLM(model_instance, request_metadata=request_metadata)
 
     @staticmethod
     def _supports_plugin_llm_polling(model_instance: ModelInstance) -> bool:

api/core/workflow/node_runtime.py

@@ -94,8 +94,6 @@ if TYPE_CHECKING:
     from graphon.nodes.tool.entities import ToolNodeData
 
 
-DIFY_BEFORE_LLM_INVOKE_KEY = "_dify_before_llm_invoke"
-BeforeLLMInvoke = Callable[[Sequence[PromptMessage], Mapping[str, Any]], Mapping[str, Any]]
 _file_access_controller = DatabaseFileAccessController()
 
 
@@ -152,15 +150,9 @@ class DifyFileReferenceFactory(FileReferenceFactoryProtocol):
 class DifyPreparedLLM(LLMProtocol):
     """Workflow-layer adapter that hides the full `ModelInstance` API from `graphon` nodes."""
 
-    def __init__(
-        self,
-        model_instance: ModelInstance,
-        request_metadata: Mapping[str, object] | None = None,
-        before_invoke: BeforeLLMInvoke | None = None,
-    ) -> None:
+    def __init__(self, model_instance: ModelInstance, request_metadata: Mapping[str, object] | None = None) -> None:
         self._model_instance = model_instance
         self._request_metadata = request_metadata
-        self._before_invoke = before_invoke
 
     @property
     @override
@@ -201,15 +193,6 @@ class DifyPreparedLLM(LLMProtocol):
     def get_llm_num_tokens(self, prompt_messages: Sequence[PromptMessage]) -> int:
         return self._model_instance.get_llm_num_tokens(prompt_messages)
 
-    def _run_before_invoke(
-        self,
-        prompt_messages: Sequence[PromptMessage],
-        model_parameters: Mapping[str, Any],
-    ) -> Mapping[str, Any]:
-        if self._before_invoke is None:
-            return model_parameters
-        return self._before_invoke(prompt_messages, model_parameters)
-
     @overload
     def invoke_llm(
         self,
@@ -242,7 +225,6 @@ class DifyPreparedLLM(LLMProtocol):
         stop: Sequence[str] | None,
         stream: bool,
     ) -> LLMResult | Generator[LLMResultChunk, None, None]:
-        model_parameters = self._run_before_invoke(prompt_messages, model_parameters)
         return self._model_instance.invoke_llm(
             prompt_messages=list(prompt_messages),
             model_parameters=dict(model_parameters),
@@ -284,7 +266,6 @@ class DifyPreparedLLM(LLMProtocol):
         stop: Sequence[str] | None,
         stream: bool,
     ) -> LLMResultWithStructuredOutput | Generator[LLMResultChunkWithStructuredOutput, None, None]:
-        model_parameters = self._run_before_invoke(prompt_messages, model_parameters)
         return invoke_llm_with_structured_output(
             provider=self.provider,
             model_schema=self.get_model_schema(),
@@ -304,15 +285,10 @@ class DifyPreparedLLM(LLMProtocol):
 class DifyPreparedPollingLLM(DifyPreparedLLM, LLMPollingCapableProtocol):
     """Prepared workflow LLM adapter that exposes Graphon's polling protocol."""
 
-    def __init__(
-        self,
-        model_instance: ModelInstance,
-        request_metadata: Mapping[str, object] | None = None,
-        before_invoke: BeforeLLMInvoke | None = None,
-    ) -> None:
+    def __init__(self, model_instance: ModelInstance, request_metadata: Mapping[str, object] | None = None) -> None:
         from core.plugin.impl.model_runtime import PluginModelRuntime
 
-        super().__init__(model_instance, request_metadata=request_metadata, before_invoke=before_invoke)
+        super().__init__(model_instance, request_metadata=request_metadata)
         model_type_instance = model_instance.model_type_instance
         if not isinstance(model_type_instance, LargeLanguageModel):
             raise TypeError("Polling wrapper requires a large-language-model instance.")
@@ -333,7 +309,6 @@ class DifyPreparedPollingLLM(DifyPreparedLLM, LLMPollingCapableProtocol):
         stop: Sequence[str] | None,
         json_schema: Mapping[str, Any] | None,
     ) -> LLMPollingResult:
-        model_parameters = self._run_before_invoke(prompt_messages, model_parameters)
         return self._plugin_model_runtime.start_llm_polling(
             provider=self.provider,
             model=self.model_name,

api/core/workflow/nodes/agent_v2/runtime_request_builder.py

@@ -38,6 +38,7 @@ from dify_agent.layers.shell import (
 )
 from dify_agent.protocol import CreateRunRequest, DeferredToolResultsPayload
 from pydantic import BaseModel, ValidationError
+from sqlalchemy.exc import OperationalError
 
 from clients.agent_backend import (
     AgentBackendModelConfig,
@@ -206,14 +207,22 @@ class WorkflowAgentRuntimeRequestBuilder:
                 "cli_tool_count": len(agent_soul.tools.cli_tools),
             }
 
+        runtime_config_skills = load_runtime_agent_skill_configs(
+            tenant_id=context.dify_context.tenant_id,
+            agent_id=context.agent.id,
+        )
         config_layer_config, config_warnings = build_config_layer_config(
             agent_soul,
             agent_id=context.agent.id,
             config_version_id=context.snapshot.id,
             config_version_kind="snapshot",
+            runtime_config_skills=runtime_config_skills,
         )
         append_runtime_warnings(metadata, config_warnings)
-        soul_prompt_resolver = build_config_aware_soul_mention_resolver(agent_soul)
+        soul_prompt_resolver = build_config_aware_soul_mention_resolver(
+            agent_soul,
+            runtime_config_skills=runtime_config_skills,
+        )
         soul_prompt = expand_prompt_mentions(agent_soul.prompt.system_prompt, soul_prompt_resolver).strip()
         knowledge_config = build_knowledge_layer_config(agent_soul)
 
@@ -883,11 +892,16 @@ def append_runtime_warnings(metadata: dict[str, Any], warnings: list[dict[str, s
             existing.extend(warnings)
 
 
-def build_config_aware_soul_mention_resolver(agent_soul: AgentSoulConfig):
+def build_config_aware_soul_mention_resolver(
+    agent_soul: AgentSoulConfig,
+    *,
+    runtime_config_skills: Sequence[DifyConfigSkillConfig] = (),
+):
     """Resolve config skill/file mentions and delegate the rest to Agent Soul."""
 
     base_resolver = build_soul_mention_resolver(agent_soul)
     skill_names = {item.name for item in agent_soul.config_skills if not item.is_missing}
+    skill_names.update(item.name for item in runtime_config_skills)
     file_names = {item.name for item in agent_soul.config_files if not item.is_missing}
 
     def _resolve(mention: object) -> str | None:
@@ -905,12 +919,34 @@ def build_config_aware_soul_mention_resolver(agent_soul: AgentSoulConfig):
     return _resolve
 
 
+def load_runtime_agent_skill_configs(*, tenant_id: str, agent_id: str) -> list[DifyConfigSkillConfig]:
+    """Return workspace-bound Skills as prompt-safe runtime config skills."""
+    from services.skill_management_service import SkillManagementService
+
+    try:
+        runtime_skills = SkillManagementService().list_runtime_agent_skills(tenant_id=tenant_id, agent_id=agent_id)
+    except OperationalError as exc:
+        if "no such table: agent_skill_bindings" not in str(exc.orig):
+            raise
+        runtime_skills = []
+    return [
+        DifyConfigSkillConfig(
+            name=str(item["name"]),
+            description=str(item.get("description") or ""),
+            size=cast(int | None, item.get("size")),
+            mime_type=cast(str | None, item.get("mime_type")),
+        )
+        for item in runtime_skills
+    ]
+
+
 def build_config_layer_config(
     agent_soul: AgentSoulConfig,
     *,
     agent_id: str | None = None,
     config_version_id: str | None = None,
     config_version_kind: Literal["snapshot", "draft", "build_draft"] = "snapshot",
+    runtime_config_skills: Sequence[DifyConfigSkillConfig] = (),
 ) -> tuple[DifyConfigLayerConfig, list[dict[str, str]]]:
     """Build the always-present Agent config layer from Agent Soul state.
 
@@ -927,8 +963,23 @@ def build_config_layer_config(
         )
     )
     available_skills = [skill for skill in agent_soul.config_skills if not skill.is_missing]
+    skill_configs = [
+        DifyConfigSkillConfig(
+            name=skill.name,
+            description=skill.description,
+            size=skill.size,
+            mime_type=skill.mime_type,
+        )
+        for skill in available_skills
+    ]
+    seen_skill_names = {skill.name for skill in skill_configs}
+    for skill in runtime_config_skills:
+        if skill.name in seen_skill_names:
+            continue
+        seen_skill_names.add(skill.name)
+        skill_configs.append(skill)
     available_files = [file_ref for file_ref in agent_soul.config_files if not file_ref.is_missing]
-    skill_names = {skill.name for skill in available_skills}
+    skill_names = {skill.name for skill in skill_configs}
     file_names = {file_ref.name for file_ref in available_files}
     warnings: list[dict[str, str]] = [
         {
@@ -965,15 +1016,7 @@ def build_config_layer_config(
                 kind=config_version_kind,
                 writable=config_version_kind == "build_draft",
             ),
-            skills=[
-                DifyConfigSkillConfig(
-                    name=skill.name,
-                    description=skill.description,
-                    size=skill.size,
-                    mime_type=skill.mime_type,
-                )
-                for skill in available_skills
-            ],
+            skills=skill_configs,
             files=[
                 DifyConfigFileConfig(
                     name=file_ref.name,

api/libs/helper.py

@@ -289,7 +289,11 @@ UUIDStr = Annotated[str, AfterValidator(_strict_uuid)]
 
 def alphanumeric(value: str):
     # check if the value is alphanumeric and underlined
-    if re.match(r"^[a-zA-Z0-9_]+$", value):
+    # Use re.fullmatch instead of re.match to reject trailing newlines.
+    # In Python, '$' matches at end-of-string OR just before a trailing newline,
+    # so re.match accepts "tool_name\n". re.fullmatch requires the entire
+    # string to match. Regression for #39666 (sibling of #39234 / #39548).
+    if re.fullmatch(r"^[a-zA-Z0-9_]+$", value):
         return value
 
     raise ValueError(f"{value} is not a valid alphanumeric value")

api/migrations/versions/2026_07_09_1200-a4f8d2c9e1b0_add_workspace_skill_management.py

@@ -0,0 +1,114 @@
+"""add workspace skill management
+
+Revision ID: a4f8d2c9e1b0
+Revises: 6f5a9c2d8e1b
+Create Date: 2026-07-09 12:00:00.000000
+
+"""
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.dialects import mysql
+
+from models.types import StringUUID
+
+# revision identifiers, used by Alembic.
+revision = "a4f8d2c9e1b0"
+down_revision = "6f5a9c2d8e1b"
+branch_labels = None
+depends_on = None
+
+
+def _uuid_column(name: str, *, nullable: bool = False) -> sa.Column:
+    return sa.Column(name, StringUUID(), nullable=nullable)
+
+
+def _long_text() -> sa.types.TypeEngine:
+    return sa.Text().with_variant(mysql.LONGTEXT(), "mysql")
+
+
+def upgrade() -> None:
+    op.create_table(
+        "skills",
+        _uuid_column("id"),
+        _uuid_column("tenant_id"),
+        sa.Column("name", sa.String(length=64), nullable=False),
+        sa.Column("display_name", sa.String(length=128), nullable=False),
+        sa.Column("icon", sa.String(length=16), nullable=False, server_default="📄"),
+        sa.Column("description", sa.String(length=1024), nullable=False, server_default=""),
+        sa.Column("name_manually_edited", sa.Boolean(), nullable=False, server_default=sa.false()),
+        sa.Column("visibility", sa.String(length=32), nullable=False, server_default="workspace"),
+        _uuid_column("latest_published_version_id", nullable=True),
+        _uuid_column("created_by", nullable=True),
+        _uuid_column("updated_by", nullable=True),
+        sa.Column("created_at", sa.DateTime(), nullable=False, server_default=sa.func.current_timestamp()),
+        sa.Column("updated_at", sa.DateTime(), nullable=False, server_default=sa.func.current_timestamp()),
+        sa.PrimaryKeyConstraint("id", name="skill_pkey"),
+        sa.UniqueConstraint("tenant_id", "name", name="skill_tenant_name_unique"),
+    )
+    op.create_index("skills_tenant_updated_at_idx", "skills", ["tenant_id", "updated_at"])
+
+    op.create_table(
+        "skill_draft_files",
+        _uuid_column("id"),
+        _uuid_column("skill_id"),
+        sa.Column("path", sa.String(length=512), nullable=False),
+        sa.Column("kind", sa.String(length=32), nullable=False),
+        sa.Column("storage", sa.String(length=32), nullable=True),
+        sa.Column("mime_type", sa.String(length=255), nullable=True),
+        sa.Column("content_text", _long_text(), nullable=True),
+        _uuid_column("tool_file_id", nullable=True),
+        sa.Column("size", sa.BigInteger(), nullable=True),
+        sa.Column("hash", sa.String(length=255), nullable=True),
+        sa.Column("created_at", sa.DateTime(), nullable=False, server_default=sa.func.current_timestamp()),
+        sa.Column("updated_at", sa.DateTime(), nullable=False, server_default=sa.func.current_timestamp()),
+        sa.PrimaryKeyConstraint("id", name="skill_draft_file_pkey"),
+        sa.UniqueConstraint("skill_id", "path", name="skill_draft_file_skill_path_unique"),
+    )
+    op.create_index("skill_draft_files_skill_path_idx", "skill_draft_files", ["skill_id", "path"])
+
+    op.create_table(
+        "skill_versions",
+        _uuid_column("id"),
+        _uuid_column("skill_id"),
+        sa.Column("version_number", sa.Integer(), nullable=False),
+        sa.Column("version_name", sa.String(length=128), nullable=False, server_default=""),
+        sa.Column("publish_note", sa.String(length=1024), nullable=False, server_default=""),
+        sa.Column("manifest", _long_text(), nullable=False),
+        _uuid_column("archive_tool_file_id"),
+        sa.Column("hash_code", sa.String(length=255), nullable=False),
+        sa.Column("archive_size", sa.BigInteger(), nullable=False),
+        _uuid_column("published_by", nullable=True),
+        sa.Column("created_at", sa.DateTime(), nullable=False, server_default=sa.func.current_timestamp()),
+        sa.Column("updated_at", sa.DateTime(), nullable=False, server_default=sa.func.current_timestamp()),
+        sa.PrimaryKeyConstraint("id", name="skill_version_pkey"),
+        sa.UniqueConstraint("skill_id", "version_number", name="skill_version_skill_number_unique"),
+    )
+    op.create_index("skill_versions_skill_created_at_idx", "skill_versions", ["skill_id", "created_at"])
+
+    op.create_table(
+        "agent_skill_bindings",
+        _uuid_column("id"),
+        _uuid_column("tenant_id"),
+        _uuid_column("agent_id"),
+        _uuid_column("skill_id"),
+        sa.Column("priority", sa.Integer(), nullable=False),
+        _uuid_column("created_by", nullable=True),
+        sa.Column("created_at", sa.DateTime(), nullable=False, server_default=sa.func.current_timestamp()),
+        sa.Column("updated_at", sa.DateTime(), nullable=False, server_default=sa.func.current_timestamp()),
+        sa.PrimaryKeyConstraint("id", name="agent_skill_binding_pkey"),
+        sa.UniqueConstraint("tenant_id", "agent_id", "skill_id", name="agent_skill_binding_unique"),
+        sa.UniqueConstraint("tenant_id", "agent_id", "priority", name="agent_skill_binding_priority_unique"),
+    )
+    op.create_index("agent_skill_bindings_skill_idx", "agent_skill_bindings", ["tenant_id", "skill_id"])
+
+
+def downgrade() -> None:
+    op.drop_index("agent_skill_bindings_skill_idx", table_name="agent_skill_bindings")
+    op.drop_table("agent_skill_bindings")
+    op.drop_index("skill_versions_skill_created_at_idx", table_name="skill_versions")
+    op.drop_table("skill_versions")
+    op.drop_index("skill_draft_files_skill_path_idx", table_name="skill_draft_files")
+    op.drop_table("skill_draft_files")
+    op.drop_index("skills_tenant_updated_at_idx", table_name="skills")
+    op.drop_table("skills")

api/migrations/versions/2026_07_22_1500-d2825e7b9c10_scope_agent_debug_conversations.py

@@ -18,31 +18,109 @@ branch_labels = None
 depends_on = None
 
 
+def _is_pg(conn) -> bool:
+    return conn.dialect.name == "postgresql"
+
+
+def _uuid_column(name: str, *, nullable: bool = False, primary_key: bool = False) -> sa.Column:
+    kwargs = {"nullable": nullable, "primary_key": primary_key}
+    if primary_key and _is_pg(op.get_bind()):
+        kwargs["server_default"] = sa.text("uuidv7()")
+    return sa.Column(name, models.types.StringUUID(), **kwargs)
+
+
+def _has_table(table_name: str) -> bool:
+    return sa.inspect(op.get_bind()).has_table(table_name)
+
+
+def _has_column(table_name: str, column_name: str) -> bool:
+    return any(
+        column["name"] == column_name for column in sa.inspect(op.get_bind()).get_columns(table_name)
+    )
+
+
+def _has_unique_constraint(table_name: str, constraint_name: str) -> bool:
+    return any(
+        constraint["name"] == constraint_name
+        for constraint in sa.inspect(op.get_bind()).get_unique_constraints(table_name)
+    )
+
+
 def upgrade():
+    if not _has_table("agent_debug_conversations"):
+        op.create_table(
+            "agent_debug_conversations",
+            _uuid_column("id", primary_key=True),
+            sa.Column("tenant_id", models.types.StringUUID(), nullable=False),
+            sa.Column("agent_id", models.types.StringUUID(), nullable=False),
+            sa.Column("app_id", models.types.StringUUID(), nullable=False),
+            sa.Column("account_id", models.types.StringUUID(), nullable=False),
+            sa.Column("conversation_id", models.types.StringUUID(), nullable=False),
+            sa.Column(
+                "draft_type",
+                sa.String(length=32),
+                nullable=False,
+                server_default=sa.text("'debug_build'"),
+            ),
+            sa.Column("created_at", sa.DateTime(), server_default=sa.func.current_timestamp(), nullable=False),
+            sa.Column("updated_at", sa.DateTime(), server_default=sa.func.current_timestamp(), nullable=False),
+            sa.PrimaryKeyConstraint("id", name=op.f("agent_debug_conversation_pkey")),
+            sa.UniqueConstraint(
+                "tenant_id",
+                "agent_id",
+                "account_id",
+                "draft_type",
+                name=op.f("agent_debug_conversation_agent_account_draft_type_unique"),
+            ),
+        )
+        op.create_index(
+            "agent_debug_conversation_conversation_idx",
+            "agent_debug_conversations",
+            ["conversation_id"],
+        )
+        op.create_index(
+            "agent_debug_conversation_account_idx",
+            "agent_debug_conversations",
+            ["tenant_id", "account_id"],
+        )
+        return
+
     # Existing pointers have always represented Build chat because the Agent
     # detail API exposes them as ``debug_conversation_id`` for that surface.
-    op.add_column(
+    if not _has_column("agent_debug_conversations", "draft_type"):
+        op.add_column(
+            "agent_debug_conversations",
+            sa.Column(
+                "draft_type",
+                sa.String(length=32),
+                nullable=False,
+                server_default=sa.text("'debug_build'"),
+            ),
+        )
+    if _has_unique_constraint(
         "agent_debug_conversations",
-        sa.Column(
-            "draft_type",
-            sa.String(length=32),
-            nullable=False,
-            server_default=sa.text("'debug_build'"),
-        ),
-    )
-    op.drop_constraint(
         "agent_debug_conversation_agent_account_unique",
+    ):
+        op.drop_constraint(
+            "agent_debug_conversation_agent_account_unique",
+            "agent_debug_conversations",
+            type_="unique",
+        )
+    if not _has_unique_constraint(
         "agent_debug_conversations",
-        type_="unique",
-    )
-    op.create_unique_constraint(
         "agent_debug_conversation_agent_account_draft_type_unique",
-        "agent_debug_conversations",
-        ["tenant_id", "agent_id", "account_id", "draft_type"],
-    )
+    ):
+        op.create_unique_constraint(
+            "agent_debug_conversation_agent_account_draft_type_unique",
+            "agent_debug_conversations",
+            ["tenant_id", "agent_id", "account_id", "draft_type"],
+        )
 
 
 def downgrade():
+    if not _has_table("agent_debug_conversations"):
+        return
+
     debug_conversations = sa.table(
         "agent_debug_conversations",
         sa.column("tenant_id", models.types.StringUUID()),
@@ -64,14 +142,23 @@ def downgrade():
             ),
         )
     )
-    op.drop_constraint(
+    if _has_unique_constraint(
+        "agent_debug_conversations",
         "agent_debug_conversation_agent_account_draft_type_unique",
+    ):
+        op.drop_constraint(
+            "agent_debug_conversation_agent_account_draft_type_unique",
+            "agent_debug_conversations",
+            type_="unique",
+        )
+    if not _has_unique_constraint(
         "agent_debug_conversations",
-        type_="unique",
-    )
-    op.create_unique_constraint(
         "agent_debug_conversation_agent_account_unique",
-        "agent_debug_conversations",
-        ["tenant_id", "agent_id", "account_id"],
-    )
-    op.drop_column("agent_debug_conversations", "draft_type")
+    ):
+        op.create_unique_constraint(
+            "agent_debug_conversation_agent_account_unique",
+            "agent_debug_conversations",
+            ["tenant_id", "agent_id", "account_id"],
+        )
+    if _has_column("agent_debug_conversations", "draft_type"):
+        op.drop_column("agent_debug_conversations", "draft_type")

api/migrations/versions/2026_07_23_1500-e9f4a1b2c3d5_merge_skill_and_agent_debug_heads.py

@@ -0,0 +1,21 @@
+"""merge skill and agent debug conversation heads
+
+Revision ID: e9f4a1b2c3d5
+Revises: a4f8d2c9e1b0, d2825e7b9c10
+Create Date: 2026-07-23 15:00:00.000000
+
+"""
+
+# revision identifiers, used by Alembic.
+revision = "e9f4a1b2c3d5"
+down_revision = ("a4f8d2c9e1b0", "d2825e7b9c10")
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    pass
+
+
+def downgrade():
+    pass

api/models/__init__.py

@@ -113,6 +113,7 @@ from .provider import (
     TenantDefaultModel,
     TenantPreferredModelProvider,
 )
+from .skill import AgentSkillBinding, Skill, SkillDraftFile, SkillFileKind, SkillFileStorage, SkillVersion
 from .snippet import CustomizedSnippet, SnippetType
 from .source import DataSourceApiKeyAuthBinding, DataSourceOauthBinding
 from .task import CeleryTask, CeleryTaskSet
@@ -173,6 +174,7 @@ __all__ = [
     "AgentRuntimeSessionOwnerType",
     "AgentRuntimeSessionStatus",
     "AgentScope",
+    "AgentSkillBinding",
     "AgentSource",
     "AgentStatus",
     "ApiRequest",
@@ -246,6 +248,11 @@ __all__ = [
     "RecommendedApp",
     "SavedMessage",
     "Site",
+    "Skill",
+    "SkillDraftFile",
+    "SkillFileKind",
+    "SkillFileStorage",
+    "SkillVersion",
     "SnippetType",
     "Tag",
     "TagBinding",

api/models/enums.py

@@ -249,6 +249,7 @@ class TagType(StrEnum):
     KNOWLEDGE = "knowledge"
     APP = "app"
     SNIPPET = "snippet"
+    SKILL = "skill"
 
 
 class DatasetMetadataType(StrEnum):

api/models/model.py

@@ -2667,7 +2667,7 @@ class Tag(TypeBase):
         sa.Index("tag_name_idx", "name"),
     )
 
-    TAG_TYPE_LIST = ["knowledge", "app", "snippet"]
+    TAG_TYPE_LIST = ["knowledge", "app", "snippet", "skill"]
 
     id: Mapped[str] = mapped_column(
         StringUUID, insert_default=lambda: str(uuid4()), default_factory=lambda: str(uuid4()), init=False

api/models/skill.py

@@ -0,0 +1,164 @@
+"""Workspace-level Skill Management models.
+
+These tables are the source of truth for reusable workspace Skills. Agent Soul
+``config_skills`` and Agent Drive skill rows remain per-agent runtime/config
+assets; they may consume a published Skill snapshot but do not own the Skill's
+draft, metadata, version history, or Agent binding priority.
+"""
+
+from enum import StrEnum
+
+import sqlalchemy as sa
+from pydantic import BaseModel, ConfigDict
+from sqlalchemy import Index, UniqueConstraint
+from sqlalchemy.orm import Mapped, mapped_column
+
+from models.base import Base, DefaultFieldsMixin
+from models.types import EnumText, JSONModelColumn, LongText, StringUUID
+
+
+class SkillFileKind(StrEnum):
+    """Draft file entry kind."""
+
+    FILE = "file"
+    DIRECTORY = "directory"
+
+
+class SkillFileStorage(StrEnum):
+    """How a draft file's content is stored."""
+
+    TEXT = "text"
+    TOOL_FILE = "tool_file"
+
+
+class SkillVersionManifestFile(BaseModel):
+    """One file entry captured in a published Skill snapshot manifest."""
+
+    path: str
+    mime_type: str | None = None
+    size: int
+    hash: str
+
+    model_config = ConfigDict(extra="forbid")
+
+
+class SkillVersionManifest(BaseModel):
+    """Published Skill snapshot file index."""
+
+    files: list[SkillVersionManifestFile]
+
+    model_config = ConfigDict(extra="forbid")
+
+
+class Skill(DefaultFieldsMixin, Base):
+    """Workspace-level reusable Skill metadata and draft status."""
+
+    __tablename__ = "skills"
+    __table_args__ = (
+        sa.PrimaryKeyConstraint("id", name="skill_pkey"),
+        UniqueConstraint("tenant_id", "name", name="skill_tenant_name_unique"),
+        Index("skills_tenant_updated_at_idx", "tenant_id", "updated_at"),
+    )
+
+    tenant_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
+    name: Mapped[str] = mapped_column(sa.String(64), nullable=False)
+    display_name: Mapped[str] = mapped_column(sa.String(128), nullable=False)
+    icon: Mapped[str] = mapped_column(sa.String(16), nullable=False, default="📄", server_default="📄")
+    description: Mapped[str] = mapped_column(sa.String(1024), nullable=False, default="", server_default="")
+    name_manually_edited: Mapped[bool] = mapped_column(
+        sa.Boolean,
+        nullable=False,
+        default=False,
+        server_default=sa.false(),
+    )
+    visibility: Mapped[str] = mapped_column(
+        sa.String(32),
+        nullable=False,
+        default="workspace",
+        server_default="workspace",
+    )
+    latest_published_version_id: Mapped[str | None] = mapped_column(StringUUID, nullable=True)
+    created_by: Mapped[str | None] = mapped_column(StringUUID, nullable=True)
+    updated_by: Mapped[str | None] = mapped_column(StringUUID, nullable=True)
+
+
+class SkillDraftFile(DefaultFieldsMixin, Base):
+    """One draft file or directory in a workspace Skill."""
+
+    __tablename__ = "skill_draft_files"
+    __table_args__ = (
+        sa.PrimaryKeyConstraint("id", name="skill_draft_file_pkey"),
+        UniqueConstraint("skill_id", "path", name="skill_draft_file_skill_path_unique"),
+        Index("skill_draft_files_skill_path_idx", "skill_id", "path"),
+    )
+
+    skill_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
+    path: Mapped[str] = mapped_column(sa.String(512), nullable=False)
+    kind: Mapped[SkillFileKind] = mapped_column(EnumText(SkillFileKind, length=32), nullable=False)
+    storage: Mapped[SkillFileStorage | None] = mapped_column(EnumText(SkillFileStorage, length=32), nullable=True)
+    mime_type: Mapped[str | None] = mapped_column(sa.String(255), nullable=True)
+    content_text: Mapped[str | None] = mapped_column(LongText, nullable=True)
+    tool_file_id: Mapped[str | None] = mapped_column(StringUUID, nullable=True)
+    size: Mapped[int | None] = mapped_column(sa.BigInteger, nullable=True)
+    hash: Mapped[str | None] = mapped_column(sa.String(255), nullable=True)
+
+
+class SkillVersion(DefaultFieldsMixin, Base):
+    """Immutable published Skill snapshot.
+
+    ``hash_code`` uniquely identifies a published version for downstream
+    execution audit. It includes Skill identity, version number, and archive
+    content digest instead of being only the archive content hash.
+    """
+
+    __tablename__ = "skill_versions"
+    __table_args__ = (
+        sa.PrimaryKeyConstraint("id", name="skill_version_pkey"),
+        UniqueConstraint("skill_id", "version_number", name="skill_version_skill_number_unique"),
+        Index("skill_versions_skill_created_at_idx", "skill_id", "created_at"),
+    )
+
+    skill_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
+    version_number: Mapped[int] = mapped_column(sa.Integer, nullable=False)
+    version_name: Mapped[str] = mapped_column(sa.String(128), nullable=False, default="", server_default="")
+    publish_note: Mapped[str] = mapped_column(sa.String(1024), nullable=False, default="", server_default="")
+    manifest: Mapped[SkillVersionManifest] = mapped_column(JSONModelColumn(SkillVersionManifest), nullable=False)
+    archive_tool_file_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
+    hash_code: Mapped[str] = mapped_column(sa.String(255), nullable=False)
+    archive_size: Mapped[int] = mapped_column(sa.BigInteger, nullable=False)
+    published_by: Mapped[str | None] = mapped_column(StringUUID, nullable=True)
+
+
+class AgentSkillBinding(DefaultFieldsMixin, Base):
+    """Direct Agent-to-workspace-Skill binding.
+
+    ``priority`` is retained as an internal ordering column for the current
+    schema constraints. Runtime Skill selection is Agent-driven and must not
+    treat it as a matching priority.
+    """
+
+    __tablename__ = "agent_skill_bindings"
+    __table_args__ = (
+        sa.PrimaryKeyConstraint("id", name="agent_skill_binding_pkey"),
+        UniqueConstraint("tenant_id", "agent_id", "skill_id", name="agent_skill_binding_unique"),
+        UniqueConstraint("tenant_id", "agent_id", "priority", name="agent_skill_binding_priority_unique"),
+        Index("agent_skill_bindings_skill_idx", "tenant_id", "skill_id"),
+    )
+
+    tenant_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
+    agent_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
+    skill_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
+    priority: Mapped[int] = mapped_column(sa.Integer, nullable=False)
+    created_by: Mapped[str | None] = mapped_column(StringUUID, nullable=True)
+
+
+__all__ = [
+    "AgentSkillBinding",
+    "Skill",
+    "SkillDraftFile",
+    "SkillFileKind",
+    "SkillFileStorage",
+    "SkillVersion",
+    "SkillVersionManifest",
+    "SkillVersionManifestFile",
+]

api/openapi/markdown/console-openapi.md

@@ -9551,7 +9551,7 @@ Remove one or more tag bindings from a target.
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | keyword | query | Search keyword | No | string |
-| type | query | Tag type filter | No | string, <br>**Available values:** "", "app", "knowledge", "snippet" |
+| type | query | Tag type filter | No | string |
 
 #### Responses
 
@@ -10087,6 +10087,38 @@ Get list of available agent providers
 | ---- | ----------- | ------ |
 | 200 | Success | **application/json**: [AgentProviderListResponse](#agentproviderlistresponse)<br> |
 
+### [GET] /workspaces/current/agents/{agent_id}/skills
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| agent_id | path |  | Yes | string |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Agent Skill bindings | **application/json**: [AgentSkillBindingsResponse](#agentskillbindingsresponse)<br> |
+
+### [PUT] /workspaces/current/agents/{agent_id}/skills
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| agent_id | path |  | Yes | string |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [AgentSkillBindingsPayload](#agentskillbindingspayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Agent Skill bindings replaced | **application/json**: [AgentSkillBindingsResponse](#agentskillbindingsresponse)<br> |
+
 ### [GET] /workspaces/current/customized-snippets
 **List customized snippets with pagination and search**
 
@@ -11988,6 +12020,341 @@ Returns permission flags that control workspace features like member invitations
 | ---- | ----------- | ------ |
 | 200 | Success | **application/json**: [WorkspaceAccessMatrix](#workspaceaccessmatrix)<br> |
 
+### [GET] /workspaces/current/skills
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| keyword | query | Search keyword matching skill name or description. | No | string |
+| limit | query | Number of items per page. | No | integer, <br>**Default:** 20 |
+| page | query | Page number. | No | integer, <br>**Default:** 1 |
+| tag | query | Skill tag filters. Repeat the parameter for multiple tags. | No | [ string ] |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Workspace skills | **application/json**: [SkillListResponse](#skilllistresponse)<br> |
+
+### [POST] /workspaces/current/skills
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [SkillCreatePayload](#skillcreatepayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 201 | Skill created | **application/json**: [SkillDetailResponse](#skilldetailresponse)<br> |
+
+### [POST] /workspaces/current/skills/files/upload
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **multipart/form-data**: { **"file"**: binary }<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 201 | Skill draft file uploaded | **application/json**: [SkillFileUploadResponse](#skillfileuploadresponse)<br> |
+
+### [POST] /workspaces/current/skills/import
+Import a Skill zip package from multipart form field `file`.
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 201 | Skill imported | **application/json**: [SkillDetailResponse](#skilldetailresponse)<br> |
+
+### [GET] /workspaces/current/skills/tags
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Workspace Skill tags | **application/json**: [SkillTagListResponse](#skilltaglistresponse)<br> |
+
+### [DELETE] /workspaces/current/skills/{skill_id}
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| skill_id | path |  | Yes | string |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [SkillDeletePayload](#skilldeletepayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Skill deleted | **application/json**: [SkillDeleteResponse](#skilldeleteresponse)<br> |
+
+### [GET] /workspaces/current/skills/{skill_id}
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| skill_id | path |  | Yes | string |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Skill detail | **application/json**: [SkillDetailResponse](#skilldetailresponse)<br> |
+
+### [PATCH] /workspaces/current/skills/{skill_id}
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| skill_id | path |  | Yes | string |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [SkillMetadataPayload](#skillmetadatapayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Skill updated | **application/json**: [SkillResponse](#skillresponse)<br> |
+
+### [POST] /workspaces/current/skills/{skill_id}/assist/messages
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| skill_id | path |  | Yes | string |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [SkillAssistMessagePayload](#skillassistmessagepayload)<br> |
+
+#### Responses
+
+| Code | Description |
+| ---- | ----------- |
+| 200 | Skill Authoring assistant event stream |
+
+### [POST] /workspaces/current/skills/{skill_id}/duplicate
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| skill_id | path |  | Yes | string |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 201 | Skill duplicated | **application/json**: [SkillDetailResponse](#skilldetailresponse)<br> |
+
+### [GET] /workspaces/current/skills/{skill_id}/export
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| skill_id | path |  | Yes | string |
+
+#### Responses
+
+| Code | Description |
+| ---- | ----------- |
+| 200 | Published Skill zip archive |
+
+### [PATCH] /workspaces/current/skills/{skill_id}/files
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| skill_id | path |  | Yes | string |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [SkillDraftFileOperationPayload](#skilldraftfileoperationpayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Draft file operation applied | **application/json**: [SkillDetailResponse](#skilldetailresponse)<br> |
+
+### [PUT] /workspaces/current/skills/{skill_id}/files
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| skill_id | path |  | Yes | string |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [SkillDraftTreePayload](#skilldrafttreepayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Draft files replaced | **application/json**: [SkillDetailResponse](#skilldetailresponse)<br> |
+
+### [GET] /workspaces/current/skills/{skill_id}/files/content
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| download | query | Return as an attachment when 1. | No | string |
+| path | query | Skill file path relative to the Skill root. | Yes | string |
+| version_id | query | Optional published version ID. Omit for current draft. | No | string |
+| skill_id | path |  | Yes | string |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Skill file content | **application/json**: [BinaryFileResponse](#binaryfileresponse)<br> |
+
+### [GET] /workspaces/current/skills/{skill_id}/files/preview
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| path | query | Skill file path relative to the Skill root. | Yes | string |
+| version_id | query | Optional published version ID. Omit for current draft. | No | string |
+| skill_id | path |  | Yes | string |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Skill file text preview | **application/json**: [SkillFilePreviewResponse](#skillfilepreviewresponse)<br> |
+
+### [POST] /workspaces/current/skills/{skill_id}/publish
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| skill_id | path |  | Yes | string |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [SkillPublishPayload](#skillpublishpayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Skill published | **application/json**: [SkillVersionResponse](#skillversionresponse)<br> |
+
+### [GET] /workspaces/current/skills/{skill_id}/references
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| skill_id | path |  | Yes | string |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Skill references | **application/json**: [SkillReferenceListResponse](#skillreferencelistresponse)<br> |
+
+### [POST] /workspaces/current/skills/{skill_id}/restore
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| skill_id | path |  | Yes | string |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [SkillRestorePayload](#skillrestorepayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Skill version restored | **application/json**: [SkillVersionResponse](#skillversionresponse)<br> |
+
+### [GET] /workspaces/current/skills/{skill_id}/versions
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| skill_id | path |  | Yes | string |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Skill versions | **application/json**: [SkillVersionListResponse](#skillversionlistresponse)<br> |
+
+### [DELETE] /workspaces/current/skills/{skill_id}/versions/{version_id}
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| skill_id | path |  | Yes | string |
+| version_id | path |  | Yes | string |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Skill version deleted | **application/json**: [SkillVersionDeleteResponse](#skillversiondeleteresponse)<br> |
+
+### [GET] /workspaces/current/skills/{skill_id}/versions/{version_id}
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| skill_id | path |  | Yes | string |
+| version_id | path |  | Yes | string |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Skill version detail | **application/json**: [SkillVersionDetailResponse](#skillversiondetailresponse)<br> |
+
+### [PATCH] /workspaces/current/skills/{skill_id}/versions/{version_id}
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| skill_id | path |  | Yes | string |
+| version_id | path |  | Yes | string |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [SkillVersionUpdatePayload](#skillversionupdatepayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Skill version updated | **application/json**: [SkillVersionResponse](#skillversionresponse)<br> |
+
 ### [GET] /workspaces/current/tool-labels
 #### Responses
 
@@ -14709,6 +15076,37 @@ Visibility and lifecycle scope of an Agent record.
 | ---- | ---- | ----------- | -------- |
 | result | string |  | Yes |
 
+#### AgentSkillBindingItemResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| description | string |  | Yes |
+| display_name | string |  | Yes |
+| file_count | integer |  | Yes |
+| icon | string |  | Yes |
+| id | string |  | Yes |
+| latest_published_at | integer |  | No |
+| latest_published_version_id | string |  | No |
+| name | string |  | Yes |
+| priority | integer |  | Yes |
+| status | string |  | Yes |
+| tags | [ string ] |  | No |
+| updated_at | integer |  | Yes |
+
+#### AgentSkillBindingsPayload
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| skill_ids | [ string ] | Ordered Skill IDs bound to the Agent. | No |
+
+#### AgentSkillBindingsResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| agent_id | string |  | Yes |
+| data | [ [AgentSkillBindingItemResponse](#agentskillbindingitemresponse) ] |  | No |
+| skill_ids | [ string ] |  | No |
+
 #### AgentSkillRefConfig
 
 | Name | Type | Description | Required |
@@ -21665,6 +22063,186 @@ Simple provider entity response.
 | title | string |  | Yes |
 | use_icon_as_answer_icon | boolean |  | Yes |
 
+#### SkillAssistAttachmentPayload
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| mime_type | string |  | No |
+| name | string |  | Yes |
+| size | integer |  | No |
+| tool_file_id | string |  | Yes |
+
+#### SkillAssistMessagePayload
+
+One user message and optional uploaded context for the read-only Skill Authoring assistant.
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| attachments | [ [SkillAssistAttachmentPayload](#skillassistattachmentpayload) ] |  | No |
+| message | string |  | Yes |
+| model | [SkillAssistModelPayload](#skillassistmodelpayload) |  | No |
+
+#### SkillAssistModelPayload
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| model | string |  | Yes |
+| model_settings | object |  | No |
+| plugin_id | string |  | No |
+| provider | string |  | Yes |
+
+#### SkillCreatePayload
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| description | string |  | No |
+| display_name | string |  | No |
+| icon | string, <br>**Default:** 📄 |  | No |
+| name | string |  | No |
+| tags | [ string ] |  | No |
+
+#### SkillDeletePayload
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| confirmation_name | string | Required when deleting a referenced Skill. Must match the Skill name. | No |
+
+#### SkillDeleteResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| deleted | boolean |  | Yes |
+| id | string |  | Yes |
+
+#### SkillDetailResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| created_at | integer |  | Yes |
+| created_by | string |  | No |
+| created_by_name | string |  | No |
+| description | string |  | Yes |
+| display_name | string |  | Yes |
+| files | [ [SkillFileResponse](#skillfileresponse) ] |  | No |
+| icon | string |  | Yes |
+| id | string |  | Yes |
+| latest_published_version_id | string |  | No |
+| name | string |  | Yes |
+| name_manually_edited | boolean |  | No |
+| reference_count | integer |  | No |
+| tags | [ string ] |  | No |
+| updated_at | integer |  | Yes |
+| updated_by | string |  | No |
+| updated_by_name | string |  | No |
+| visibility | string |  | Yes |
+
+#### SkillDraftFileOperation
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| SkillDraftFileOperation | string |  |  |
+
+#### SkillDraftFileOperationPayload
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| content | string |  | No |
+| expected_updated_at | integer |  | No |
+| hash | string |  | No |
+| mime_type | string |  | No |
+| operation | [SkillDraftFileOperation](#skilldraftfileoperation) |  | Yes |
+| path | string |  | Yes |
+| size | integer |  | No |
+| target_path | string |  | No |
+| tool_file_id | string |  | No |
+
+#### SkillDraftTreeItemPayload
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| content | string |  | No |
+| hash | string |  | No |
+| kind | [SkillFileKind](#skillfilekind) |  | No |
+| mime_type | string |  | No |
+| path | string |  | Yes |
+| size | integer |  | No |
+| storage | [SkillFileStorage](#skillfilestorage) |  | No |
+| tool_file_id | string |  | No |
+
+#### SkillDraftTreePayload
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| expected_updated_at | integer |  | No |
+| files | [ [SkillDraftTreeItemPayload](#skilldrafttreeitempayload) ] |  | No |
+
+#### SkillFileKind
+
+Draft file entry kind.
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| SkillFileKind | string | Draft file entry kind. |  |
+
+#### SkillFilePreviewResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| content | string |  | Yes |
+| hash | string |  | Yes |
+| mime_type | string |  | Yes |
+| path | string |  | Yes |
+| size | integer |  | Yes |
+
+#### SkillFileQuery
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| path | string | Skill file path relative to the Skill root. | Yes |
+| version_id | string | Optional published version ID. Omit for current draft. | No |
+
+#### SkillFileResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| content | string |  | No |
+| hash | string |  | No |
+| id | string |  | No |
+| kind | string |  | Yes |
+| mime_type | string |  | No |
+| path | string |  | Yes |
+| size | integer |  | No |
+| storage | string |  | No |
+| tool_file_id | string |  | No |
+
+#### SkillFileStorage
+
+How a draft file's content is stored.
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| SkillFileStorage | string | How a draft file's content is stored. |  |
+
+#### SkillFileUploadResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| hash | string |  | Yes |
+| id | string |  | Yes |
+| mime_type | string |  | Yes |
+| name | string |  | Yes |
+| size | integer |  | Yes |
+
+#### SkillListResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| data | [ [SkillResponse](#skillresponse) ] |  | No |
+| has_more | boolean |  | No |
+| limit | integer, <br>**Default:** 20 |  | No |
+| page | integer, <br>**Default:** 1 |  | No |
+| total | integer |  | No |
+
 #### SkillManifest
 
 Validated metadata extracted from a Skill package.
@@ -21678,6 +22256,91 @@ Validated metadata extracted from a Skill package.
 | name | string |  | Yes |
 | size | integer |  | Yes |
 
+#### SkillMetadataPayload
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| display_name | string |  | No |
+| expected_updated_at | integer |  | No |
+| icon | string |  | No |
+| tags | [ string ] |  | No |
+
+#### SkillPublishPayload
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| publish_note | string |  | No |
+| version_name | string |  | No |
+
+#### SkillReferenceListResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| data | [ [SkillReferenceResponse](#skillreferenceresponse) ] |  | No |
+
+#### SkillReferenceResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| agent_icon | string |  | No |
+| agent_icon_background | string |  | No |
+| agent_icon_type | string |  | No |
+| agent_id | string |  | Yes |
+| app_id | string |  | No |
+| display_name | string |  | Yes |
+| name | string |  | Yes |
+| node_id | string |  | No |
+| node_name | string |  | No |
+| type | string |  | Yes |
+| workflow_icon | string |  | No |
+| workflow_icon_background | string |  | No |
+| workflow_icon_type | string |  | No |
+| workflow_id | string |  | No |
+| workflow_name | string |  | No |
+| workflow_version | string |  | No |
+
+#### SkillResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| created_at | integer |  | Yes |
+| created_by | string |  | No |
+| created_by_name | string |  | No |
+| description | string |  | Yes |
+| display_name | string |  | Yes |
+| icon | string |  | Yes |
+| id | string |  | Yes |
+| latest_published_version_id | string |  | No |
+| name | string |  | Yes |
+| name_manually_edited | boolean |  | No |
+| reference_count | integer |  | No |
+| tags | [ string ] |  | No |
+| updated_at | integer |  | Yes |
+| updated_by | string |  | No |
+| updated_by_name | string |  | No |
+| visibility | string |  | Yes |
+
+#### SkillRestorePayload
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| publish_note | string |  | No |
+| version_id | string |  | Yes |
+| version_name | string |  | No |
+
+#### SkillTagListResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| data | [ [SkillTagResponse](#skilltagresponse) ] |  | No |
+
+#### SkillTagResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| count | integer |  | Yes |
+| tag | string |  | Yes |
+
 #### SkillToolInferenceResult
 
 | Name | Type | Description | Required |
@@ -21686,6 +22349,60 @@ Validated metadata extracted from a Skill package.
 | inferable | boolean |  | Yes |
 | reason | string |  | No |
 
+#### SkillVersionDeleteResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| deleted | boolean |  | Yes |
+| id | string |  | Yes |
+| latest_published_version_id | string |  | No |
+
+#### SkillVersionDetailResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| archive_size | integer |  | Yes |
+| created_at | integer |  | Yes |
+| files | [ [SkillFileResponse](#skillfileresponse) ] |  | No |
+| hash_code | string |  | Yes |
+| id | string |  | Yes |
+| is_latest | boolean |  | No |
+| publish_note | string |  | Yes |
+| published_by | string |  | No |
+| published_by_name | string |  | No |
+| skill_id | string |  | Yes |
+| version_name | string |  | Yes |
+| version_number | integer |  | Yes |
+
+#### SkillVersionListResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| data | [ [SkillVersionResponse](#skillversionresponse) ] |  | No |
+
+#### SkillVersionResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| archive_size | integer |  | Yes |
+| created_at | integer |  | Yes |
+| hash_code | string |  | Yes |
+| id | string |  | Yes |
+| is_latest | boolean |  | No |
+| publish_note | string |  | Yes |
+| published_by | string |  | No |
+| published_by_name | string |  | No |
+| skill_id | string |  | Yes |
+| version_name | string |  | Yes |
+| version_number | integer |  | Yes |
+
+#### SkillVersionUpdatePayload
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| publish_note | string |  | No |
+| version_name | string |  | No |
+
 #### SnippetDependencyCheckResponse
 
 | Name | Type | Description | Required |
@@ -22153,7 +22870,7 @@ Non-sensitive bootstrap snapshot exposed before Console or Web authentication.
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
 | keyword | string | Search keyword | No |
-| type | string, <br>**Available values:** "", "app", "knowledge", "snippet" | Tag type filter<br>*Enum:* `""`, `"app"`, `"knowledge"`, `"snippet"` | No |
+| type | [TagType](#tagtype)<br>string | Tag type filter | No |
 
 #### TagListResponse
 
@@ -24339,6 +25056,15 @@ Workflow tool configuration
 | ---- | ---- | ----------- | -------- |
 | permission_keys | [ string ] |  | No |
 
+#### WorkspaceSkillsQuery
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| keyword | string | Search keyword matching skill name or description. | No |
+| limit | integer, <br>**Default:** 20 | Number of items per page. | No |
+| page | integer, <br>**Default:** 1 | Page number. | No |
+| tag | [ string ] | Skill tag filters. Repeat the parameter for multiple tags. | No |
+
 #### WorkspaceTenantResultResponse
 
 | Name | Type | Description | Required |

api/providers/trace/trace-aliyun/tests/unit_tests/aliyun_trace/test_aliyun_trace_utils.py

@@ -1,3 +1,5 @@
+"""Unit tests for Aliyun trace utility transformations and database lookups."""
+
 import json
 from collections.abc import Mapping
 from typing import Any, cast
@@ -25,11 +27,13 @@ from dify_trace_aliyun.utils import (
     serialize_json_data,
 )
 from opentelemetry.trace import Link, StatusCode
+from sqlalchemy.orm import Session
 
 from core.rag.models.document import Document
 from graphon.entities import WorkflowNodeExecution
 from graphon.enums import WorkflowNodeExecutionStatus
 from models import EndUser
+from models.enums import EndUserType
 
 
 def test_get_user_id_from_message_data_no_end_user(monkeypatch: pytest.MonkeyPatch):
@@ -40,35 +44,40 @@ def test_get_user_id_from_message_data_no_end_user(monkeypatch: pytest.MonkeyPat
     assert get_user_id_from_message_data(message_data) == "account_id"
 
 
-def test_get_user_id_from_message_data_with_end_user(monkeypatch: pytest.MonkeyPatch):
+@pytest.mark.parametrize("sqlite3_session", [(EndUser,)], indirect=True)
+def test_get_user_id_from_message_data_with_end_user(monkeypatch: pytest.MonkeyPatch, sqlite3_session: Session) -> None:
     message_data = MagicMock()
     message_data.from_account_id = "account_id"
     message_data.from_end_user_id = "end_user_id"
 
-    end_user_data = MagicMock(spec=EndUser)
-    end_user_data.session_id = "session_id"
-
-    mock_session = MagicMock()
-    mock_session.get.return_value = end_user_data
+    end_user_data = EndUser(
+        id="end_user_id",
+        tenant_id="tenant_id",
+        app_id="app_id",
+        type=EndUserType.BROWSER,
+        session_id="session_id",
+    )
+    sqlite3_session.add(end_user_data)
+    sqlite3_session.commit()
 
     from dify_trace_aliyun.utils import db
 
-    monkeypatch.setattr(db, "session", mock_session)
+    monkeypatch.setattr(db, "session", sqlite3_session)
 
     assert get_user_id_from_message_data(message_data) == "session_id"
 
 
-def test_get_user_id_from_message_data_end_user_not_found(monkeypatch: pytest.MonkeyPatch):
+@pytest.mark.parametrize("sqlite3_session", [(EndUser,)], indirect=True)
+def test_get_user_id_from_message_data_end_user_not_found(
+    monkeypatch: pytest.MonkeyPatch, sqlite3_session: Session
+) -> None:
     message_data = MagicMock()
     message_data.from_account_id = "account_id"
     message_data.from_end_user_id = "end_user_id"
 
-    mock_session = MagicMock()
-    mock_session.get.return_value = None
-
     from dify_trace_aliyun.utils import db
 
-    monkeypatch.setattr(db, "session", mock_session)
+    monkeypatch.setattr(db, "session", sqlite3_session)
 
     assert get_user_id_from_message_data(message_data) == "account_id"
 

api/providers/trace/trace-langsmith/tests/unit_tests/langsmith_trace/test_langsmith_trace.py

@@ -1,5 +1,8 @@
+"""Unit tests for LangSmith trace translation with SQLite-backed lookups."""
+
 import collections
 from datetime import datetime, timedelta
+from types import SimpleNamespace
 from typing import override
 from unittest.mock import MagicMock
 
@@ -11,6 +14,7 @@ from dify_trace_langsmith.entities.langsmith_trace_entity import (
     LangSmithRunUpdateModel,
 )
 from dify_trace_langsmith.langsmith_trace import LangSmithDataTrace
+from sqlalchemy.orm import Session
 
 from core.ops.entities.trace_entity import (
     DatasetRetrievalTraceInfo,
@@ -24,6 +28,7 @@ from core.ops.entities.trace_entity import (
 )
 from graphon.enums import BuiltinNodeTypes, WorkflowNodeExecutionMetadataKey
 from models import EndUser
+from models.enums import EndUserType
 
 
 def _dt() -> datetime:
@@ -108,7 +113,8 @@ def test_trace_dispatch(trace_instance, monkeypatch: pytest.MonkeyPatch):
     mocks["generate_name_trace"].assert_called_once_with(info)
 
 
-def test_workflow_trace(trace_instance, monkeypatch: pytest.MonkeyPatch):
+@pytest.mark.parametrize("sqlite3_session", [()], indirect=True)
+def test_workflow_trace(trace_instance, monkeypatch: pytest.MonkeyPatch, sqlite3_session: Session) -> None:
     # Setup trace info
     workflow_data = MagicMock()
     workflow_data.created_at = _dt()
@@ -137,10 +143,10 @@ def test_workflow_trace(trace_instance, monkeypatch: pytest.MonkeyPatch):
         workflow_data=workflow_data,
     )
 
-    # Mock dependencies
-    mock_session = MagicMock()
-    monkeypatch.setattr("dify_trace_langsmith.langsmith_trace.sessionmaker", lambda bind: lambda: mock_session)
-    monkeypatch.setattr("dify_trace_langsmith.langsmith_trace.db", MagicMock(engine="engine"))
+    monkeypatch.setattr(
+        "dify_trace_langsmith.langsmith_trace.db",
+        SimpleNamespace(engine=sqlite3_session.get_bind(), session=sqlite3_session),
+    )
 
     # Mock node executions
     node_llm = MagicMock()
@@ -228,7 +234,10 @@ def test_workflow_trace(trace_instance, monkeypatch: pytest.MonkeyPatch):
     assert call_args[4].run_type == LangSmithRunType.retriever
 
 
-def test_workflow_trace_no_start_time(trace_instance, monkeypatch: pytest.MonkeyPatch):
+@pytest.mark.parametrize("sqlite3_session", [()], indirect=True)
+def test_workflow_trace_no_start_time(
+    trace_instance, monkeypatch: pytest.MonkeyPatch, sqlite3_session: Session
+) -> None:
     workflow_data = MagicMock()
     workflow_data.created_at = _dt()
     workflow_data.finished_at = _dt() + timedelta(seconds=1)
@@ -256,9 +265,10 @@ def test_workflow_trace_no_start_time(trace_instance, monkeypatch: pytest.Monkey
         workflow_data=workflow_data,
     )
 
-    mock_session = MagicMock()
-    monkeypatch.setattr("dify_trace_langsmith.langsmith_trace.sessionmaker", lambda bind: lambda: mock_session)
-    monkeypatch.setattr("dify_trace_langsmith.langsmith_trace.db", MagicMock(engine="engine"))
+    monkeypatch.setattr(
+        "dify_trace_langsmith.langsmith_trace.db",
+        SimpleNamespace(engine=sqlite3_session.get_bind(), session=sqlite3_session),
+    )
     repo = MagicMock()
     repo.get_by_workflow_execution.return_value = []
     mock_factory = MagicMock()
@@ -271,7 +281,10 @@ def test_workflow_trace_no_start_time(trace_instance, monkeypatch: pytest.Monkey
     assert trace_instance.add_run.called
 
 
-def test_workflow_trace_missing_app_id(trace_instance, monkeypatch: pytest.MonkeyPatch):
+@pytest.mark.parametrize("sqlite3_session", [()], indirect=True)
+def test_workflow_trace_missing_app_id(
+    trace_instance, monkeypatch: pytest.MonkeyPatch, sqlite3_session: Session
+) -> None:
     trace_info = MagicMock(spec=WorkflowTraceInfo)
     trace_info.trace_id = "trace-1"
     trace_info.message_id = None
@@ -287,15 +300,17 @@ def test_workflow_trace_missing_app_id(trace_instance, monkeypatch: pytest.Monke
     trace_info.workflow_run_outputs = {}
     trace_info.error = ""
 
-    mock_session = MagicMock()
-    monkeypatch.setattr("dify_trace_langsmith.langsmith_trace.sessionmaker", lambda bind: lambda: mock_session)
-    monkeypatch.setattr("dify_trace_langsmith.langsmith_trace.db", MagicMock(engine="engine"))
+    monkeypatch.setattr(
+        "dify_trace_langsmith.langsmith_trace.db",
+        SimpleNamespace(engine=sqlite3_session.get_bind(), session=sqlite3_session),
+    )
 
     with pytest.raises(ValueError, match="No app_id found in trace_info metadata"):
         trace_instance.workflow_trace(trace_info)
 
 
-def test_message_trace(trace_instance, monkeypatch: pytest.MonkeyPatch):
+@pytest.mark.parametrize("sqlite3_session", [(EndUser,)], indirect=True)
+def test_message_trace(trace_instance, monkeypatch: pytest.MonkeyPatch, sqlite3_session: Session) -> None:
     message_data = MagicMock()
     message_data.id = "msg-1"
     message_data.from_account_id = "acc-1"
@@ -321,10 +336,19 @@ def test_message_trace(trace_instance, monkeypatch: pytest.MonkeyPatch):
         message_file_data=MagicMock(url="file-url"),
     )
 
-    # Mock EndUser lookup
-    mock_end_user = MagicMock(spec=EndUser)
-    mock_end_user.session_id = "session-id-123"
-    monkeypatch.setattr("dify_trace_langsmith.langsmith_trace.db.session.get", lambda model, pk: mock_end_user)
+    end_user = EndUser(
+        id="end-user-1",
+        tenant_id="tenant-1",
+        app_id="app-1",
+        type=EndUserType.BROWSER,
+        session_id="session-id-123",
+    )
+    sqlite3_session.add(end_user)
+    sqlite3_session.commit()
+    monkeypatch.setattr(
+        "dify_trace_langsmith.langsmith_trace.db",
+        SimpleNamespace(engine=sqlite3_session.get_bind(), session=sqlite3_session),
+    )
 
     trace_instance.add_run = MagicMock()
 
@@ -521,9 +545,13 @@ def test_update_run_error(trace_instance):
         trace_instance.update_run(update_data)
 
 
+@pytest.mark.parametrize("sqlite3_session", [()], indirect=True)
 def test_workflow_trace_usage_extraction_error(
-    trace_instance, monkeypatch: pytest.MonkeyPatch, caplog: pytest.LogCaptureFixture
-):
+    trace_instance,
+    monkeypatch: pytest.MonkeyPatch,
+    caplog: pytest.LogCaptureFixture,
+    sqlite3_session: Session,
+) -> None:
     workflow_data = MagicMock()
     workflow_data.created_at = _dt()
     workflow_data.finished_at = _dt() + timedelta(seconds=1)
@@ -576,8 +604,10 @@ def test_workflow_trace_usage_extraction_error(
     mock_factory = MagicMock()
     mock_factory.create_workflow_node_execution_repository.return_value = repo
     monkeypatch.setattr("dify_trace_langsmith.langsmith_trace.DifyCoreRepositoryFactory", mock_factory)
-    monkeypatch.setattr("dify_trace_langsmith.langsmith_trace.sessionmaker", lambda bind: lambda: MagicMock())
-    monkeypatch.setattr("dify_trace_langsmith.langsmith_trace.db", MagicMock(engine="engine"))
+    monkeypatch.setattr(
+        "dify_trace_langsmith.langsmith_trace.db",
+        SimpleNamespace(engine=sqlite3_session.get_bind(), session=sqlite3_session),
+    )
     monkeypatch.setattr(trace_instance, "get_service_account_with_tenant", lambda app_id: MagicMock())
 
     trace_instance.add_run = MagicMock()
@@ -644,9 +674,11 @@ def _make_workflow_trace_info(
     )
 
 
-def _patch_workflow_trace_deps(monkeypatch, trace_instance):
-    monkeypatch.setattr("dify_trace_langsmith.langsmith_trace.sessionmaker", lambda bind: lambda: MagicMock())
-    monkeypatch.setattr("dify_trace_langsmith.langsmith_trace.db", MagicMock(engine="engine"))
+def _patch_workflow_trace_deps(monkeypatch, trace_instance, sqlite3_session: Session) -> None:
+    monkeypatch.setattr(
+        "dify_trace_langsmith.langsmith_trace.db",
+        SimpleNamespace(engine=sqlite3_session.get_bind(), session=sqlite3_session),
+    )
     repo = MagicMock()
     repo.get_by_workflow_execution.return_value = []
     factory = MagicMock()
@@ -656,14 +688,17 @@ def _patch_workflow_trace_deps(monkeypatch, trace_instance):
     trace_instance.add_run = MagicMock()
 
 
-def test_workflow_trace_id_uses_message_id_not_external(trace_instance, monkeypatch: pytest.MonkeyPatch):
+@pytest.mark.parametrize("sqlite3_session", [()], indirect=True)
+def test_workflow_trace_id_uses_message_id_not_external(
+    trace_instance, monkeypatch: pytest.MonkeyPatch, sqlite3_session: Session
+) -> None:
     """Chatflow with external trace_id: LangSmith trace_id must be message_id, not external."""
     trace_info = _make_workflow_trace_info(
         message_id="msg-abc",
         workflow_run_id="run-xyz",
         trace_id="external-999",
     )
-    _patch_workflow_trace_deps(monkeypatch, trace_instance)
+    _patch_workflow_trace_deps(monkeypatch, trace_instance, sqlite3_session)
 
     trace_instance.workflow_trace(trace_info)
 
@@ -677,14 +712,17 @@ def test_workflow_trace_id_uses_message_id_not_external(trace_instance, monkeypa
     assert trace_info.metadata.get("external_trace_id") == "external-999"
 
 
-def test_workflow_trace_id_pure_workflow_uses_run_id(trace_instance, monkeypatch: pytest.MonkeyPatch):
+@pytest.mark.parametrize("sqlite3_session", [()], indirect=True)
+def test_workflow_trace_id_pure_workflow_uses_run_id(
+    trace_instance, monkeypatch: pytest.MonkeyPatch, sqlite3_session: Session
+) -> None:
     """Pure workflow (no message_id) with external trace_id: trace_id must be workflow_run_id."""
     trace_info = _make_workflow_trace_info(
         message_id=None,
         workflow_run_id="run-xyz",
         trace_id="external-999",
     )
-    _patch_workflow_trace_deps(monkeypatch, trace_instance)
+    _patch_workflow_trace_deps(monkeypatch, trace_instance, sqlite3_session)
 
     trace_instance.workflow_trace(trace_info)
 

api/services/account_service.py

@@ -1599,7 +1599,9 @@ class TenantService:
         return updated_accounts
 
     @staticmethod
-    def iter_member_account_id_batches(tenant_id: str, batch_size: int, *, session: Session) -> Iterator[list[str]]:
+    def iter_member_account_id_batches(
+        tenant_id: str, batch_size: int, *, session: Session
+    ) -> Iterator[list[str]]:
         """Yield workspace member account ids in bounded, ordered batches."""
         offset = 0
         while True:

api/services/agent/skill_package_service.py

@@ -19,12 +19,11 @@ from __future__ import annotations
 import hashlib
 import io
 import posixpath
-import re
 import zipfile
 import zlib
 
 import yaml
-from pydantic import BaseModel
+from pydantic import BaseModel, Field, ValidationError, field_validator
 
 # Bounds — generous but finite so a hostile upload can't exhaust memory/disk.
 _MAX_ARCHIVE_BYTES = 50 * 1024 * 1024
@@ -33,7 +32,8 @@ _MAX_SKILL_MD_BYTES = 1 * 1024 * 1024
 _MAX_ENTRIES = 5000
 _ALLOWED_EXTENSIONS = (".zip", ".skill")
 _SKILL_MD_NAME = "SKILL.md"
-_HEADING_RE = re.compile(r"^\s*#\s+(.+?)\s*$", re.MULTILINE)
+_SKILL_NAME_PATTERN = r"^[a-z0-9]+(?:-[a-z0-9]+)*$"
+_MAX_SKILL_DESCRIPTION_LENGTH = 1024
 
 
 class SkillPackageError(Exception):
@@ -53,13 +53,18 @@ class SkillPackageError(Exception):
 class SkillManifest(BaseModel):
     """Validated metadata extracted from a Skill package."""
 
-    name: str
-    description: str
+    name: str = Field(min_length=1, max_length=64, pattern=_SKILL_NAME_PATTERN)
+    description: str = Field(min_length=1, max_length=_MAX_SKILL_DESCRIPTION_LENGTH)
     entry_path: str  # path of SKILL.md inside the archive
     files: list[str]  # all (safe) file paths inside the archive
     size: int  # total uncompressed bytes
     hash: str  # sha256 of the archive bytes
 
+    @field_validator("name", "description", mode="before")
+    @classmethod
+    def _strip_required_string(cls, value: object) -> object:
+        return value.strip() if isinstance(value, str) else value
+
 
 class NormalizedSkillPackage(BaseModel):
     """Canonical skill package bytes and metadata ready to store in agent drive."""
@@ -108,14 +113,17 @@ class SkillPackageService:
             normalized_size = sum(max(info.file_size, 0) for info in normalized_members.values())
 
         name, description = self._parse_skill_md(skill_md)
-        manifest = SkillManifest(
-            name=name,
-            description=description,
-            entry_path=_SKILL_MD_NAME,
-            files=sorted(normalized_members),
-            size=normalized_size,
-            hash=hashlib.sha256(normalized_archive_bytes).hexdigest(),
-        )
+        try:
+            manifest = SkillManifest(
+                name=name,
+                description=description,
+                entry_path=_SKILL_MD_NAME,
+                files=sorted(normalized_members),
+                size=normalized_size,
+                hash=hashlib.sha256(normalized_archive_bytes).hexdigest(),
+            )
+        except ValidationError as exc:
+            raise self._manifest_validation_error(exc) from exc
         return NormalizedSkillPackage(
             manifest=manifest,
             archive_bytes=normalized_archive_bytes,
@@ -123,6 +131,31 @@ class SkillPackageService:
             strip_prefix=strip_prefix,
         )
 
+    @staticmethod
+    def _manifest_validation_error(exc: ValidationError) -> SkillPackageError:
+        first_error = exc.errors()[0]
+        loc = first_error["loc"]
+        field = loc[0] if loc else "manifest"
+        error_type = first_error["type"]
+        if field == "name":
+            code = "missing_skill_name" if error_type == "string_too_short" else "invalid_skill_name"
+            message = (
+                "SKILL.md frontmatter name is required"
+                if code == "missing_skill_name"
+                else "SKILL.md frontmatter name must be lowercase letters, numbers, and hyphens only, "
+                "must not start or end with a hyphen, and must be at most 64 characters"
+            )
+            return SkillPackageError(code, message, status_code=400)
+        if field == "description":
+            code = "missing_skill_description" if error_type == "string_too_short" else "invalid_skill_description"
+            message = (
+                "SKILL.md frontmatter description is required"
+                if code == "missing_skill_description"
+                else f"SKILL.md frontmatter description must be at most {_MAX_SKILL_DESCRIPTION_LENGTH} characters"
+            )
+            return SkillPackageError(code, message, status_code=400)
+        return SkillPackageError("invalid_skill_manifest", "SKILL.md frontmatter is invalid", status_code=400)
+
     def _open_archive(self, *, content: bytes, filename: str) -> zipfile.ZipFile:
         self._check_extension(filename)
         if not content:
@@ -280,13 +313,6 @@ class SkillPackageService:
         frontmatter = cls._parse_frontmatter(content)
         name = str(frontmatter.get("name") or "").strip()
         description = str(frontmatter.get("description") or "").strip()
-        if not name:
-            heading = _HEADING_RE.search(content)
-            name = heading.group(1).strip() if heading else ""
-        if not name:
-            raise SkillPackageError(
-                "missing_skill_name", "SKILL.md must declare a name (frontmatter or top heading)", status_code=400
-            )
         return name, description
 
     @staticmethod

api/services/agent_config_service.py

@@ -46,6 +46,7 @@ from models.tools import ToolFile
 from services.agent.config_skill_normalize_service import ConfigSkillNormalizeService
 from services.agent.skill_package_service import SkillPackageError
 from services.agent_drive_service import DriveFileRef
+from services.skill_management_service import SkillManagementService, SkillManagementServiceError
 
 
 class AgentConfigVersionKind(StrEnum):
@@ -98,6 +99,7 @@ class ConfigPushPayload(BaseModel):
 
 @dataclass(slots=True)
 class AgentConfigTarget:
+    tenant_id: str
     agent_id: str
     version_id: str
     kind: AgentConfigVersionKind
@@ -146,6 +148,7 @@ class AgentConfigService:
                 user_id=user_id,
             )
             return AgentConfigTarget(
+                tenant_id=tenant_id,
                 agent_id=target.agent_id,
                 version_id=target.version_id,
                 kind=target.kind,
@@ -191,7 +194,7 @@ class AgentConfigService:
         return {
             "agent_id": target.agent_id,
             "config_version": self._config_version_payload(target),
-            "items": [self._serialize_skill_item(skill) for skill in target.agent_soul.config_skills],
+            "items": self._skill_items_for_target(target),
         }
 
     def list_files(
@@ -233,10 +236,27 @@ class AgentConfigService:
             config_version_kind=config_version_kind,
             user_id=user_id,
         )
-        skill = self._require_skill(target.agent_soul, name=name)
-        file_id = self._available_skill_file_id(skill)
-        payload, mime_type = self._load_tool_file_bytes(tenant_id=tenant_id, file_id=file_id)
-        return ConfigDownload(filename=f"{skill.name}.zip", mime_type=mime_type or "application/zip", payload=payload)
+        try:
+            skill = self._require_skill(target.agent_soul, name=name)
+            file_id = self._available_skill_file_id(skill)
+            payload, mime_type = self._load_tool_file_bytes(tenant_id=tenant_id, file_id=file_id)
+            return ConfigDownload(
+                filename=f"{skill.name}.zip",
+                mime_type=mime_type or "application/zip",
+                payload=payload,
+            )
+        except AgentConfigServiceError as exc:
+            if exc.code != "config_skill_not_found":
+                raise
+        try:
+            result = SkillManagementService().pull_runtime_agent_skill(
+                tenant_id=tenant_id,
+                agent_id=agent_id,
+                name=name,
+            )
+            return ConfigDownload(filename=result.filename, mime_type=result.mime_type, payload=result.payload)
+        except SkillManagementServiceError as exc:
+            raise AgentConfigServiceError("config_skill_not_found", "config skill not found", status_code=404) from exc
 
     def download_skill_url(
         self,
@@ -279,9 +299,45 @@ class AgentConfigService:
             config_version_kind=config_version_kind,
             user_id=user_id,
         )
-        skill = self._require_skill(target.agent_soul, name=name)
-        file_id = self._available_skill_file_id(skill)
-        archive_bytes, _mime_type = self._load_tool_file_bytes(tenant_id=tenant_id, file_id=file_id)
+        try:
+            skill = self._require_skill(target.agent_soul, name=name)
+            file_id = self._available_skill_file_id(skill)
+            archive_bytes, _mime_type = self._load_tool_file_bytes(tenant_id=tenant_id, file_id=file_id)
+            skill_item = self._serialize_skill_item(skill)
+        except AgentConfigServiceError as exc:
+            if exc.code != "config_skill_not_found":
+                raise
+            try:
+                workspace_archive = SkillManagementService().pull_runtime_agent_skill(
+                    tenant_id=tenant_id,
+                    agent_id=agent_id,
+                    name=name,
+                )
+            except SkillManagementServiceError as skill_exc:
+                raise AgentConfigServiceError(
+                    "config_skill_not_found",
+                    "config skill not found",
+                    status_code=404,
+                ) from skill_exc
+            archive_bytes = workspace_archive.payload
+            skill_item = next(
+                (
+                    item
+                    for item in SkillManagementService().list_runtime_agent_skills(
+                        tenant_id=tenant_id,
+                        agent_id=agent_id,
+                    )
+                    if item["name"] == name
+                ),
+                {
+                    "id": name,
+                    "name": name,
+                    "description": "",
+                    "size": None,
+                    "hash": None,
+                    "mime_type": "application/zip",
+                },
+            )
         try:
             archive_items, skill_md = self._inspect_skill_archive(archive_bytes)
         except (OSError, ValueError, zipfile.BadZipFile) as exc:
@@ -291,7 +347,7 @@ class AgentConfigService:
                 status_code=500,
             ) from exc
         return {
-            **self._serialize_skill_item(skill),
+            **skill_item,
             "source": "config_skill_zip",
             "files": archive_items,
             "skill_md": skill_md,
@@ -839,6 +895,7 @@ class AgentConfigService:
                 status_code=404,
             )
         return AgentConfigTarget(
+            tenant_id=tenant_id,
             agent_id=agent_id,
             version_id=version.id,
             kind=config_version_kind,
@@ -1133,9 +1190,7 @@ class AgentConfigService:
         return {
             "agent_id": target.agent_id,
             "config_version": AgentConfigService._config_version_payload(target),
-            "skills": {
-                "items": [AgentConfigService._serialize_skill_item(skill) for skill in target.agent_soul.config_skills]
-            },
+            "skills": {"items": AgentConfigService._skill_items_for_target(target)},
             "files": {
                 "items": [
                     AgentConfigService._serialize_file_item(file_ref) for file_ref in target.agent_soul.config_files
@@ -1145,6 +1200,20 @@ class AgentConfigService:
             "note": target.agent_soul.config_note,
         }
 
+    @staticmethod
+    def _skill_items_for_target(target: AgentConfigTarget) -> list[dict[str, object]]:
+        items = [AgentConfigService._serialize_skill_item(skill) for skill in target.agent_soul.config_skills]
+        seen_names = {str(item["name"]) for item in items}
+        for item in SkillManagementService().list_runtime_agent_skills(
+            tenant_id=target.tenant_id,
+            agent_id=target.agent_id,
+        ):
+            if item["name"] in seen_names:
+                continue
+            seen_names.add(str(item["name"]))
+            items.append(item)
+        return items
+
     @staticmethod
     def _config_version_payload(target: AgentConfigTarget) -> dict[str, object]:
         return {

api/services/app_task_service.py

@@ -40,7 +40,7 @@ class AppTaskService:
         # Legacy mechanism: Set stop flag in Redis
         AppQueueManager.set_stop_flag(task_id, invoke_from, user_id)
 
-        # New mechanism: send stop command via GraphEngine for graph-backed apps.
-        # Completion uses WorkflowEntry at runtime but keeps legacy message persistence.
-        if app_mode in (AppMode.ADVANCED_CHAT, AppMode.WORKFLOW, AppMode.COMPLETION):
+        # New mechanism: Send stop command via GraphEngine for workflow-based apps
+        # This ensures proper workflow status recording in the persistence layer
+        if app_mode in (AppMode.ADVANCED_CHAT, AppMode.WORKFLOW):
             GraphEngineManager(redis_client).send_stop_command(task_id)

api/services/tag_service.py

@@ -12,6 +12,7 @@ from werkzeug.exceptions import NotFound
 from models.dataset import Dataset
 from models.enums import TagType
 from models.model import App, Tag, TagBinding
+from models.skill import Skill
 from models.snippet import CustomizedSnippet
 
 type _TagTypeLike = TagType | str
@@ -282,5 +283,13 @@ class TagService:
             )
             if not snippet:
                 raise NotFound("Snippet not found")
+        elif type == "skill":
+            skill = session.scalar(
+                select(Skill)
+                .where(Skill.tenant_id == current_user.current_tenant_id, Skill.id == target_id)
+                .limit(1)
+            )
+            if not skill:
+                raise NotFound("Skill not found")
         else:
             raise NotFound("Invalid binding type")

api/services/workflow/workflow_converter.py

@@ -135,45 +135,7 @@ class WorkflowConverter:
             app_model=app_model, app_model_config=app_model_config, session=session
         )
 
-        graph, features = self.build_graph_from_app_config(
-            app_model=app_model,
-            app_config=app_config,
-            target_app_mode=new_app_mode,
-            session=session,
-        )
-
-        # create workflow record
-        workflow = Workflow(
-            tenant_id=app_model.tenant_id,
-            app_id=app_model.id,
-            type=WorkflowType.from_app_mode(new_app_mode).value,
-            version=Workflow.VERSION_DRAFT,
-            graph=json.dumps(graph),
-            features=json.dumps(features),
-            created_by=account_id,
-            environment_variables=[],
-            conversation_variables=[],
-        )
-
-        session.add(workflow)
-        session.commit()
-
-        return workflow
-
-    def build_graph_from_app_config(
-        self,
-        *,
-        app_model: App,
-        app_config: EasyUIBasedAppConfig,
-        target_app_mode: AppMode,
-        session: Session,
-    ) -> tuple[WorkflowGraph, dict[str, Any]]:
-        """
-        Build a workflow graph from an EasyUI app config without persisting it.
-
-        This is shared by the persisted app-conversion flow and runtime-only
-        execution paths that need a graph but must not create a Workflow row.
-        """
+        # init workflow graph
         graph: WorkflowGraph = {"nodes": [], "edges": []}
 
         # Convert list:
@@ -206,7 +168,7 @@ class WorkflowConverter:
         # convert to knowledge retrieval node
         if app_config.dataset:
             knowledge_retrieval_node = self._convert_to_knowledge_retrieval_node(
-                new_app_mode=target_app_mode, dataset_config=app_config.dataset, model_config=app_config.model
+                new_app_mode=new_app_mode, dataset_config=app_config.dataset, model_config=app_config.model
             )
 
             if knowledge_retrieval_node:
@@ -215,7 +177,7 @@ class WorkflowConverter:
         # convert to llm node
         llm_node = self._convert_to_llm_node(
             original_app_mode=AppMode.value_of(app_model.mode),
-            new_app_mode=target_app_mode,
+            new_app_mode=new_app_mode,
             graph=graph,
             model_config=app_config.model,
             prompt_template=app_config.prompt_template,
@@ -227,7 +189,7 @@ class WorkflowConverter:
 
         app_model_config_dict = app_config.app_model_config_dict
 
-        match target_app_mode:
+        match new_app_mode:
             case AppMode.WORKFLOW:
                 end_node = self._convert_to_end_node()
                 graph = self._append_node(graph, end_node)
@@ -258,7 +220,23 @@ class WorkflowConverter:
                     "sensitive_word_avoidance": app_model_config_dict.get("sensitive_word_avoidance"),
                 }
 
-        return graph, features
+        # create workflow record
+        workflow = Workflow(
+            tenant_id=app_model.tenant_id,
+            app_id=app_model.id,
+            type=WorkflowType.from_app_mode(new_app_mode).value,
+            version=Workflow.VERSION_DRAFT,
+            graph=json.dumps(graph),
+            features=json.dumps(features),
+            created_by=account_id,
+            environment_variables=[],
+            conversation_variables=[],
+        )
+
+        session.add(workflow)
+        session.commit()
+
+        return workflow
 
     def _convert_to_app_config(
         self, app_model: App, app_model_config: AppModelConfig, *, session: Session
@@ -595,7 +573,8 @@ class WorkflowConverter:
         if new_app_mode == AppMode.ADVANCED_CHAT:
             memory = {"role_prefix": role_prefix, "window": {"enabled": False}}
 
-        completion_params = {**model_config.parameters, "stop": model_config.stop}
+        completion_params = model_config.parameters
+        completion_params.update({"stop": model_config.stop})
         return {
             "id": "llm",
             "position": None,

api/tests/test_containers_integration_tests/services/test_workflow_app_service.py

@@ -3,7 +3,6 @@ from __future__ import annotations
 import json
 import uuid
 from datetime import UTC, datetime, timedelta
-from types import SimpleNamespace
 from unittest.mock import patch
 
 import pytest
@@ -12,13 +11,13 @@ from sqlalchemy.orm import Session
 
 from graphon.enums import WorkflowExecutionStatus
 from models import EndUser, Workflow, WorkflowAppLog, WorkflowArchiveLog, WorkflowRun
-from models.enums import AppTriggerType, CreatorUserRole, EndUserType, WorkflowRunTriggeredFrom
+from models.enums import CreatorUserRole, EndUserType, WorkflowRunTriggeredFrom
 from models.workflow import WorkflowAppLogCreatedFrom
 from services.account_service import AccountService, TenantService
 
 # Delay import of AppService to avoid circular dependency
 # from services.app_service import AppService, CreateAppParams
-from services.workflow_app_service import LogView, WorkflowAppService
+from services.workflow_app_service import WorkflowAppService
 from tests.test_containers_integration_tests.helpers import generate_valid_password
 
 
@@ -1627,73 +1626,3 @@ class TestWorkflowAppService:
         end_user_item = next(d for d in result["data"] if d["created_by_end_user"] is not None)
         assert account_item["created_by_account"].id == account.id
         assert end_user_item["created_by_end_user"].id == end_user.id
-
-
-class TestLogView:
-    def test_details_and_proxy_attributes(self):
-        log = SimpleNamespace(id="log-1", status="succeeded")
-        view = LogView(log=log, details={"trigger_metadata": {"type": "plugin"}})
-
-        assert view.details == {"trigger_metadata": {"type": "plugin"}}
-        assert view.status == "succeeded"
-
-
-class TestHandleTriggerMetadata:
-    def test_returns_empty_dict_when_metadata_missing(self):
-        service = WorkflowAppService()
-        assert service.handle_trigger_metadata("tenant-1", None) == {}
-
-    def test_enriches_plugin_icons(self):
-        service = WorkflowAppService()
-        meta = {
-            "type": AppTriggerType.TRIGGER_PLUGIN.value,
-            "icon_filename": "light.png",
-            "icon_dark_filename": "dark.png",
-        }
-        with patch(
-            "services.workflow_app_service.PluginService.get_plugin_icon_url",
-            side_effect=["https://cdn/light.png", "https://cdn/dark.png"],
-        ) as mock_icon:
-            result = service.handle_trigger_metadata("tenant-1", json.dumps(meta))
-
-        assert result["icon"] == "https://cdn/light.png"
-        assert result["icon_dark"] == "https://cdn/dark.png"
-        assert mock_icon.call_count == 2
-
-    def test_non_plugin_metadata_without_icon_lookup(self):
-        service = WorkflowAppService()
-        meta = {"type": AppTriggerType.TRIGGER_WEBHOOK.value}
-        with patch("services.workflow_app_service.PluginService.get_plugin_icon_url") as mock_icon:
-            result = service.handle_trigger_metadata("tenant-1", json.dumps(meta))
-
-        assert result["type"] == AppTriggerType.TRIGGER_WEBHOOK.value
-        mock_icon.assert_not_called()
-
-
-class TestSafeJsonLoads:
-    @pytest.mark.parametrize(
-        ("value", "expected"),
-        [
-            (None, None),
-            ("", None),
-            ('{"k":"v"}', {"k": "v"}),
-            ("not-json", None),
-            ({"raw": True}, {"raw": True}),
-        ],
-    )
-    def test_handles_various_inputs(self, value, expected):
-        assert WorkflowAppService._safe_json_loads(value) == expected
-
-
-class TestSafeParseUuid:
-    def test_returns_none_for_short_or_invalid_values(self):
-        service = WorkflowAppService()
-        assert service._safe_parse_uuid("short") is None
-        assert service._safe_parse_uuid("x" * 40) is None
-
-    def test_returns_uuid_for_valid_string(self):
-        service = WorkflowAppService()
-        raw = str(uuid.uuid4())
-        result = service._safe_parse_uuid(raw)
-        assert result is not None
-        assert str(result) == raw

api/tests/unit_tests/controllers/console/app/test_audio.py

@@ -321,33 +321,6 @@ def test_console_text_api_builds_message_ref(app: Flask, monkeypatch: pytest.Mon
     assert calls["message_ref"] == MessageRef(AppRef("tenant-1", "app-1"), "message-1", account_id="account-1")
 
 
-def test_console_text_api_accepts_message_id_without_text(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
-    calls = {}
-    monkeypatch.setattr(AudioService, "transcript_tts", lambda **kwargs: calls.update(kwargs) or {"audio": "ok"})
-
-    api = ChatMessageTextApi()
-    handler = unwrap(api.post)
-    app_model = SimpleNamespace(id="app-1", tenant_id="tenant-1")
-
-    with (
-        app.test_request_context(
-            "/console/api/apps/app/text-to-audio",
-            method="POST",
-            json={"message_id": "0f67f8c5-8f7c-4ebd-b549-7ac8e972d37e", "streaming": True},
-        ),
-        patch("controllers.console.app.audio.current_user", SimpleNamespace(id="account-1")),
-    ):
-        response = handler(api, app_model=app_model)
-
-    assert response == {"audio": "ok"}
-    assert calls["text"] == ""
-    assert calls["message_ref"] == MessageRef(
-        AppRef("tenant-1", "app-1"),
-        "0f67f8c5-8f7c-4ebd-b549-7ac8e972d37e",
-        account_id="account-1",
-    )
-
-
 def test_console_text_api_error_mapping(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setattr(AudioService, "transcript_tts", lambda **_kwargs: (_ for _ in ()).throw(QuotaExceededError()))
 

api/tests/unit_tests/controllers/console/workspace/test_skills.py

@@ -0,0 +1,394 @@
+from __future__ import annotations
+
+from inspect import unwrap
+from unittest.mock import MagicMock, PropertyMock, patch
+
+import pytest
+from flask import Flask
+
+from controllers.console import console_ns
+from controllers.console.workspace.skills import (
+    WorkspaceAgentSkillBindingsApi,
+    WorkspaceSkillAssistMessageApi,
+    WorkspaceSkillFilesApi,
+    WorkspaceSkillsApi,
+    WorkspaceSkillTagsApi,
+    WorkspaceSkillVersionApi,
+)
+from models.account import Account
+from services.skill_management_service import SkillAssistAttachmentPayload, SkillManagementServiceError
+
+
+@pytest.fixture
+def app() -> Flask:
+    flask_app = Flask("test_workspace_skills")
+    flask_app.config["TESTING"] = True
+    return flask_app
+
+
+@pytest.fixture
+def current_user() -> Account:
+    user = Account(name="Test User", email="test@example.com")
+    user.id = "user-1"
+    return user
+
+
+def _skill_detail() -> dict:
+    return {
+        "id": "skill-1",
+        "name": "finance-sop",
+        "display_name": "Finance SOP",
+        "icon": "📄",
+        "description": "",
+        "tags": [],
+        "name_manually_edited": False,
+        "visibility": "workspace",
+        "latest_published_version_id": None,
+        "reference_count": 0,
+        "created_by": "user-1",
+        "created_by_name": "Test User",
+        "updated_by": "user-1",
+        "updated_by_name": "Test User",
+        "created_at": 1,
+        "updated_at": 1,
+        "files": [
+            {
+                "id": "file-1",
+                "path": "SKILL.md",
+                "kind": "file",
+                "storage": "text",
+                "mime_type": "text/markdown",
+                "content": "---\nname: finance-sop\n---\n# Body",
+                "tool_file_id": None,
+                "size": 32,
+                "hash": "hash",
+            }
+        ],
+    }
+
+
+def test_create_skill_validates_payload_and_returns_detail(app: Flask, current_user: Account) -> None:
+    api = WorkspaceSkillsApi()
+    method = unwrap(api.post)
+    service = MagicMock()
+    service.create_skill.return_value = _skill_detail()
+
+    with (
+        app.test_request_context("/", method="POST"),
+        patch.object(type(console_ns), "payload", new_callable=PropertyMock, return_value={}),
+        patch("controllers.console.workspace.skills.SkillManagementService", return_value=service),
+    ):
+        payload, status = method(api, "tenant-1", current_user)
+
+    assert status == 201
+    assert payload["id"] == "skill-1"
+    assert payload["files"][0]["path"] == "SKILL.md"
+    service.create_skill.assert_called_once()
+    assert service.create_skill.call_args.kwargs["tenant_id"] == "tenant-1"
+    assert service.create_skill.call_args.kwargs["user_id"] == "user-1"
+
+
+def test_list_skills_uses_default_pagination_when_query_omits_page_and_limit(app: Flask) -> None:
+    api = WorkspaceSkillsApi()
+    method = unwrap(api.get)
+    service = MagicMock()
+    service.list_skills.return_value = {
+        "data": [],
+        "has_more": False,
+        "limit": 20,
+        "page": 1,
+        "total": 0,
+    }
+
+    with (
+        app.test_request_context("/?keyword=finance&tag=ops&tag=", method="GET"),
+        patch("controllers.console.workspace.skills.SkillManagementService", return_value=service),
+    ):
+        payload = method(api, "tenant-1")
+
+    assert payload == {
+        "data": [],
+        "has_more": False,
+        "limit": 20,
+        "page": 1,
+        "total": 0,
+    }
+    service.list_skills.assert_called_once_with(
+        tenant_id="tenant-1",
+        keyword="finance",
+        page=1,
+        limit=20,
+        tags=["ops"],
+    )
+
+
+def test_get_agent_skill_bindings_returns_card_data(app: Flask) -> None:
+    api = WorkspaceAgentSkillBindingsApi()
+    method = unwrap(api.get)
+    service = MagicMock()
+    service.list_agent_bindings.return_value = {
+        "agent_id": "agent-1",
+        "skill_ids": ["skill-1"],
+        "data": [
+            {
+                "id": "skill-1",
+                "priority": 0,
+                "name": "finance-sop",
+                "display_name": "Finance SOP",
+                "icon": "📄",
+                "description": "Handle finance.",
+                "tags": ["Finance"],
+                "status": "published",
+                "file_count": 2,
+                "latest_published_version_id": "version-1",
+                "latest_published_at": 123,
+                "updated_at": 124,
+            }
+        ],
+    }
+
+    with (
+        app.test_request_context("/", method="GET"),
+        patch("controllers.console.workspace.skills.SkillManagementService", return_value=service),
+    ):
+        payload = method(api, "tenant-1", "agent-1")
+
+    assert payload["skill_ids"] == ["skill-1"]
+    assert payload["data"][0]["display_name"] == "Finance SOP"
+    assert payload["data"][0]["file_count"] == 2
+    service.list_agent_bindings.assert_called_once_with(tenant_id="tenant-1", agent_id="agent-1")
+
+
+def test_patch_skill_file_operation_validates_payload_and_returns_detail(app: Flask, current_user: Account) -> None:
+    api = WorkspaceSkillFilesApi()
+    method = unwrap(api.patch)
+    service = MagicMock()
+    service.apply_draft_file_operation.return_value = _skill_detail()
+    request_payload = {
+        "operation": "upsert_text",
+        "path": "references/policy.md",
+        "content": "Policy",
+    }
+
+    with (
+        app.test_request_context("/", method="PATCH"),
+        patch.object(type(console_ns), "payload", new_callable=PropertyMock, return_value=request_payload),
+        patch("controllers.console.workspace.skills.SkillManagementService", return_value=service),
+    ):
+        payload = method(api, "tenant-1", current_user, "skill-1")
+
+    assert payload["id"] == "skill-1"
+    service.apply_draft_file_operation.assert_called_once()
+    call = service.apply_draft_file_operation.call_args.kwargs
+    assert call["tenant_id"] == "tenant-1"
+    assert call["user_id"] == "user-1"
+    assert call["skill_id"] == "skill-1"
+    assert call["payload"].operation == "upsert_text"
+
+
+def test_patch_skill_file_operation_returns_error_details(app: Flask, current_user: Account) -> None:
+    api = WorkspaceSkillFilesApi()
+    method = unwrap(api.patch)
+    service = MagicMock()
+    service.apply_draft_file_operation.side_effect = SkillManagementServiceError(
+        "missing_skill_name",
+        "SKILL.md frontmatter name is required",
+        details={"path": "SKILL.md", "field": "name", "line": 2},
+    )
+
+    with (
+        app.test_request_context("/", method="PATCH"),
+        patch.object(
+            type(console_ns),
+            "payload",
+            new_callable=PropertyMock,
+            return_value={"operation": "delete", "path": "SKILL.md"},
+        ),
+        patch("controllers.console.workspace.skills.SkillManagementService", return_value=service),
+    ):
+        payload, status = method(api, "tenant-1", current_user, "skill-1")
+
+    assert status == 400
+    assert payload == {
+        "code": "missing_skill_name",
+        "message": "SKILL.md frontmatter name is required",
+        "details": {"path": "SKILL.md", "field": "name", "line": 2},
+    }
+
+
+def test_list_skill_tags_returns_filter_options(app: Flask) -> None:
+    api = WorkspaceSkillTagsApi()
+    method = unwrap(api.get)
+    service = MagicMock()
+    service.list_tags.return_value = {"data": [{"tag": "finance", "count": 2}]}
+
+    with (
+        app.test_request_context("/", method="GET"),
+        patch("controllers.console.workspace.skills.SkillManagementService", return_value=service),
+    ):
+        payload = method(api, "tenant-1")
+
+    assert payload == {"data": [{"tag": "finance", "count": 2}]}
+    service.list_tags.assert_called_once_with(tenant_id="tenant-1")
+
+
+def test_get_skill_version_returns_version_detail(app: Flask) -> None:
+    api = WorkspaceSkillVersionApi()
+    method = unwrap(api.get)
+    service = MagicMock()
+    service.get_version.return_value = {
+        "id": "version-1",
+        "skill_id": "skill-1",
+        "version_number": 1,
+        "version_name": "Initial finance policy",
+        "publish_note": "Initial finance policy",
+        "hash_code": "hash-code",
+        "archive_size": 123,
+        "published_by": "user-1",
+        "published_by_name": "Li Wei",
+        "is_latest": True,
+        "created_at": 1,
+        "files": [
+            {
+                "id": None,
+                "path": "SKILL.md",
+                "kind": "file",
+                "storage": "text",
+                "mime_type": "text/markdown",
+                "content": "# Version",
+                "tool_file_id": None,
+                "size": 9,
+                "hash": "file-hash",
+            }
+        ],
+    }
+
+    with (
+        app.test_request_context("/", method="GET"),
+        patch("controllers.console.workspace.skills.SkillManagementService", return_value=service),
+    ):
+        payload = method(api, "tenant-1", "skill-1", "version-1")
+
+    assert payload["files"][0]["content"] == "# Version"
+    service.get_version.assert_called_once_with(
+        tenant_id="tenant-1",
+        skill_id="skill-1",
+        version_id="version-1",
+    )
+
+
+def test_patch_skill_version_renames_version(app: Flask) -> None:
+    api = WorkspaceSkillVersionApi()
+    method = unwrap(api.patch)
+    service = MagicMock()
+    service.update_version.return_value = {
+        "id": "version-1",
+        "skill_id": "skill-1",
+        "version_number": 1,
+        "version_name": "Approval threshold",
+        "publish_note": "",
+        "hash_code": "hash-code",
+        "archive_size": 123,
+        "published_by": "user-1",
+        "published_by_name": "Li Wei",
+        "is_latest": True,
+        "created_at": 1,
+    }
+
+    with (
+        app.test_request_context("/", method="PATCH"),
+        patch.object(
+            type(console_ns),
+            "payload",
+            new_callable=PropertyMock,
+            return_value={"version_name": "Approval threshold"},
+        ),
+        patch("controllers.console.workspace.skills.SkillManagementService", return_value=service),
+    ):
+        payload = method(api, "tenant-1", "skill-1", "version-1")
+
+    assert payload["version_name"] == "Approval threshold"
+    service.update_version.assert_called_once()
+    assert service.update_version.call_args.kwargs["payload"].version_name == "Approval threshold"
+
+
+def test_delete_skill_version_returns_new_latest(app: Flask, current_user: Account) -> None:
+    api = WorkspaceSkillVersionApi()
+    method = unwrap(api.delete)
+    service = MagicMock()
+    service.delete_version.return_value = {
+        "id": "version-2",
+        "deleted": True,
+        "latest_published_version_id": "version-1",
+    }
+
+    with (
+        app.test_request_context("/", method="DELETE"),
+        patch("controllers.console.workspace.skills.SkillManagementService", return_value=service),
+    ):
+        payload = method(api, "tenant-1", current_user, "skill-1", "version-2")
+
+    assert payload == {"id": "version-2", "deleted": True, "latest_published_version_id": "version-1"}
+    service.delete_version.assert_called_once_with(
+        tenant_id="tenant-1",
+        user_id="user-1",
+        skill_id="skill-1",
+        version_id="version-2",
+    )
+
+
+def test_skill_assistant_runs_agent_app_stream(app: Flask, current_user: Account) -> None:
+    api = WorkspaceSkillAssistMessageApi()
+    method = unwrap(api.post)
+    service = MagicMock()
+    assistant_app = MagicMock()
+    assistant_app.id = "assistant-app-1"
+    service.get_or_create_assistant_app.return_value = (assistant_app, "<skill_draft>draft</skill_draft>")
+    app_model = MagicMock()
+    app_response = MagicMock()
+    compact_response = MagicMock()
+
+    with (
+        app.test_request_context("/", method="POST"),
+        patch.object(
+            type(console_ns),
+            "payload",
+            new_callable=PropertyMock,
+            return_value={
+                "attachments": [
+                    {
+                        "tool_file_id": "tool-file-1",
+                        "name": "requirements.md",
+                        "mime_type": "text/markdown",
+                        "size": 128,
+                    }
+                ],
+                "message": "Create an approval checklist.",
+            },
+        ),
+        patch("controllers.console.workspace.skills.SkillManagementService", return_value=service),
+        patch(
+            "controllers.console.workspace.skills.db.session",
+            return_value=MagicMock(get=MagicMock(return_value=app_model)),
+        ),
+        patch("controllers.console.workspace.skills.AppGenerateService.generate", return_value=app_response),
+        patch("controllers.console.workspace.skills.helper.compact_generate_response", return_value=compact_response),
+    ):
+        response = method(api, "tenant-1", current_user, "skill-1")
+
+    assert response is compact_response
+    service.get_or_create_assistant_app.assert_called_once_with(
+        tenant_id="tenant-1",
+        skill_id="skill-1",
+        user_id="user-1",
+        attachments=[
+            SkillAssistAttachmentPayload(
+                tool_file_id="tool-file-1",
+                name="requirements.md",
+                mime_type="text/markdown",
+                size=128,
+            )
+        ],
+        message="Create an approval checklist.",
+        model_payload=None,
+    )

api/tests/unit_tests/core/app/apps/agent_app/test_runtime_request_builder.py

@@ -7,6 +7,7 @@ from types import SimpleNamespace
 from typing import Any
 
 import pytest
+from dify_agent.layers.config import DifyConfigSkillConfig
 from dify_agent.layers.dify_core_tools import DifyCoreToolConfig, DifyCoreToolsLayerConfig
 from dify_agent.layers.dify_plugin import DifyPluginToolConfig, DifyPluginToolsLayerConfig
 from dify_agent.layers.execution_context import DifyExecutionContextLayerConfig
@@ -29,6 +30,14 @@ from core.app.entities.app_invoke_entities import InvokeFrom, UserFrom
 from models.agent_config_entities import AgentSoulConfig
 
 
+@pytest.fixture(autouse=True)
+def _no_runtime_agent_skills(monkeypatch: pytest.MonkeyPatch):
+    monkeypatch.setattr(
+        "core.app.apps.agent_app.runtime_request_builder.load_runtime_agent_skill_configs",
+        lambda *, tenant_id, agent_id: [],
+    )
+
+
 def _exec_ctx() -> DifyExecutionContextLayerConfig:
     return DifyExecutionContextLayerConfig(
         tenant_id="tenant-1",
@@ -514,6 +523,33 @@ class TestAgentAppConfigLayer:
             "mentioned_file_names": [],
         }
 
+    def test_config_layer_includes_bound_workspace_skills(self, monkeypatch: pytest.MonkeyPatch):
+        monkeypatch.setattr(
+            "core.app.apps.agent_app.runtime_request_builder.load_runtime_agent_skill_configs",
+            lambda *, tenant_id, agent_id: [
+                DifyConfigSkillConfig(
+                    name="workspace-skill",
+                    description="Bound workspace skill.",
+                    size=123,
+                    mime_type="application/zip",
+                )
+            ],
+        )
+        soul = _soul_with_model()
+        soul.prompt.system_prompt = "Use [§skill:workspace-skill:Workspace Skill§]."
+        builder = AgentAppRuntimeRequestBuilder(
+            credentials_provider=_FakeCredentialsProvider(),
+            dify_tools_builder=_NoToolsBuilder(),  # type: ignore[arg-type]
+        )
+
+        result = builder.build(_ctx(soul))
+
+        config = next(layer for layer in result.request.composition.layers if layer.name == DIFY_CONFIG_LAYER_ID)
+        assert [skill.name for skill in config.config.skills] == ["workspace-skill"]
+        assert config.config.mentioned_skill_names == ["workspace-skill"]
+        prompt_layer = next(layer for layer in result.request.composition.layers if layer.name == "agent_soul_prompt")
+        assert prompt_layer.config.prefix == "Use workspace-skill."
+
     @pytest.mark.parametrize(
         ("system_prompt", "expected_prefix"),
         [

api/tests/unit_tests/core/app/apps/completion/test_app_runner.py

@@ -1,11 +1,21 @@
+from contextlib import contextmanager
 from types import SimpleNamespace
-from unittest.mock import MagicMock
+from unittest.mock import ANY, MagicMock, patch
 
-from core.app.apps.completion.workflow_runner import CompletionWorkflowRunner
+import pytest
+from pytest_mock import MockerFixture
+
+import core.app.apps.completion.app_runner as module
+from core.app.apps.completion.app_runner import CompletionAppRunner
 from core.moderation.base import ModerationError
 from graphon.model_runtime.entities.message_entities import ImagePromptMessageContent
 
 
+@pytest.fixture
+def runner():
+    return CompletionAppRunner()
+
+
 def _build_app_config(dataset=None, external_tools=None, additional_features=None):
     app_config = MagicMock()
     app_config.app_id = "app1"
@@ -14,7 +24,7 @@ def _build_app_config(dataset=None, external_tools=None, additional_features=Non
     app_config.dataset = dataset
     app_config.external_data_variables = external_tools or []
     app_config.additional_features = additional_features
-    app_config.app_model_config_dict = {"file_upload": {"image": {"enabled": True}}}
+    app_config.app_model_config_dict = {"file_upload": {"enabled": True}}
     return app_config
 
 
@@ -28,40 +38,163 @@ def _build_generate_entity(app_config, file_upload_config=None):
     return SimpleNamespace(
         app_config=app_config,
         model_conf=model_conf,
-        inputs={"qvar": "original_query_from_input"},
+        inputs={"qvar": "query_from_input"},
         query="original_query",
         files=[],
         file_upload_config=file_upload_config,
         stream=True,
         user_id="user",
         invoke_from=MagicMock(),
-        trace_manager=None,
     )
 
 
-def test_workflow_runner_direct_outputs_on_input_moderation() -> None:
-    runner = CompletionWorkflowRunner()
-    app_record = MagicMock(id="app1", tenant_id="tenant")
-    app_generate_entity = _build_generate_entity(_build_app_config())
-    queue_manager = MagicMock()
-    message = MagicMock(id="msg")
-    runner.organize_prompt_messages = MagicMock(return_value=([], None))
-    runner.moderation_for_inputs = MagicMock(side_effect=ModerationError("blocked"))
-    runner.direct_output = MagicMock()
-
-    result = runner._run_input_moderation(
-        app_record=app_record,
-        application_generate_entity=app_generate_entity,
-        queue_manager=queue_manager,
-        message=message,
-    )
-
-    assert result.stopped is True
-    runner.direct_output.assert_called_once()
+@contextmanager
+def patched_create_session(*, return_value=None):
+    session = MagicMock()
+    session.scalar.return_value = return_value
+    session_context = MagicMock()
+    session_context.__enter__.return_value = session
+    with patch.object(module, "create_session", return_value=session_context):
+        yield session
 
 
-def test_workflow_runner_uses_low_image_detail_default() -> None:
-    runner = CompletionWorkflowRunner()
-    app_generate_entity = _build_generate_entity(_build_app_config(), file_upload_config=None)
+class TestCompletionAppRunner:
+    def test_run_app_not_found(self, runner, mocker: MockerFixture):
+        app_config = _build_app_config()
+        app_generate_entity = _build_generate_entity(app_config)
 
-    assert runner._resolve_image_detail_config(app_generate_entity) == ImagePromptMessageContent.DETAIL.LOW
+        with patched_create_session(return_value=None):
+            with pytest.raises(ValueError):
+                runner.run(app_generate_entity, MagicMock(), MagicMock(), MagicMock())
+
+    def test_run_moderation_error_outputs_direct(self, runner, mocker: MockerFixture):
+        app_record = MagicMock(id="app1", tenant_id="tenant")
+
+        app_config = _build_app_config()
+        app_generate_entity = _build_generate_entity(app_config)
+
+        runner.organize_prompt_messages = MagicMock(return_value=([], None))
+        runner.moderation_for_inputs = MagicMock(side_effect=ModerationError("blocked"))
+        runner.direct_output = MagicMock()
+        runner._handle_invoke_result = MagicMock()
+
+        with patched_create_session(return_value=app_record):
+            runner.run(app_generate_entity, MagicMock(), MagicMock(id="msg"), MagicMock())
+
+        runner.direct_output.assert_called_once()
+        runner._handle_invoke_result.assert_not_called()
+
+    def test_run_hosting_moderation_stops(self, runner, mocker: MockerFixture):
+        app_record = MagicMock(id="app1", tenant_id="tenant")
+
+        app_config = _build_app_config()
+        app_generate_entity = _build_generate_entity(app_config)
+
+        runner.organize_prompt_messages = MagicMock(return_value=([], None))
+        runner.moderation_for_inputs = MagicMock(return_value=(None, app_generate_entity.inputs, "query"))
+        runner.check_hosting_moderation = MagicMock(return_value=True)
+        runner._handle_invoke_result = MagicMock()
+
+        with patched_create_session(return_value=app_record):
+            runner.run(app_generate_entity, MagicMock(), MagicMock(id="msg"), MagicMock())
+
+        runner._handle_invoke_result.assert_not_called()
+
+    def test_run_dataset_and_external_tools_flow(self, runner, mocker: MockerFixture):
+        app_record = MagicMock(id="app1", tenant_id="tenant")
+
+        retrieve_config = MagicMock(query_variable="qvar")
+        dataset_config = MagicMock(dataset_ids=["ds"], retrieve_config=retrieve_config)
+        additional_features = MagicMock(show_retrieve_source=True)
+        app_config = _build_app_config(
+            dataset=dataset_config,
+            external_tools=["tool"],
+            additional_features=additional_features,
+        )
+
+        file_upload_config = MagicMock()
+        file_upload_config.image_config.detail = ImagePromptMessageContent.DETAIL.HIGH
+
+        app_generate_entity = _build_generate_entity(app_config, file_upload_config=file_upload_config)
+
+        runner.organize_prompt_messages = MagicMock(side_effect=[(["pm1"], ["stop"]), (["pm2"], ["stop"])])
+        runner.moderation_for_inputs = MagicMock(return_value=(None, app_generate_entity.inputs, "query"))
+        runner.fill_in_inputs_from_external_data_tools = MagicMock(return_value=app_generate_entity.inputs)
+        runner.check_hosting_moderation = MagicMock(return_value=False)
+        runner.recalc_llm_max_tokens = MagicMock()
+        runner._handle_invoke_result = MagicMock()
+
+        dataset_retrieval = MagicMock()
+        dataset_retrieval.retrieve.return_value = ("ctx", ["file1"])
+        mocker.patch.object(module, "DatasetRetrieval", return_value=dataset_retrieval)
+
+        model_instance = MagicMock()
+        model_instance.invoke_llm.return_value = "invoke_result"
+        mocker.patch.object(module, "ModelInstance", return_value=model_instance)
+
+        with patched_create_session(return_value=app_record):
+            runner.run(app_generate_entity, MagicMock(), MagicMock(id="msg", tenant_id="tenant"), MagicMock())
+
+        dataset_retrieval.retrieve.assert_called_once()
+        assert dataset_retrieval.retrieve.call_args.kwargs["query"] == "query_from_input"
+        runner._handle_invoke_result.assert_called_once()
+
+    def test_run_closes_explicit_session_before_stream_consumption(self, runner, mocker: MockerFixture):
+        app_record = MagicMock(id="app1", tenant_id="tenant")
+        app_config = _build_app_config()
+        app_generate_entity = _build_generate_entity(app_config)
+        queue_manager = MagicMock()
+
+        events = []
+        session = MagicMock()
+        session.commit.side_effect = lambda: events.append("commit")
+        session.close.side_effect = lambda: events.append("close")
+        runner.organize_prompt_messages = MagicMock(return_value=([], None))
+        runner.moderation_for_inputs = MagicMock(return_value=(None, app_generate_entity.inputs, "query"))
+        runner.check_hosting_moderation = MagicMock(return_value=False)
+        runner.recalc_llm_max_tokens = MagicMock()
+        runner._handle_invoke_result = MagicMock(side_effect=lambda invoke_result, **kwargs: list(invoke_result))
+
+        model_instance = MagicMock()
+
+        def invoke_stream():
+            events.append("first-chunk")
+            yield "chunk"
+
+        def invoke_llm(**kwargs):
+            events.append("invoke")
+            return invoke_stream()
+
+        model_instance.invoke_llm.side_effect = invoke_llm
+        mocker.patch.object(module, "ModelInstance", return_value=model_instance)
+
+        with patched_create_session(return_value=app_record):
+            runner.run(app_generate_entity, queue_manager, MagicMock(id="msg"), session)
+
+        assert events == ["commit", "close", "invoke", "first-chunk"]
+        runner._handle_invoke_result.assert_called_once_with(
+            invoke_result=ANY,
+            queue_manager=queue_manager,
+            stream=True,
+            message_id="msg",
+            user_id="user",
+            tenant_id="tenant",
+        )
+
+    def test_run_uses_low_image_detail_default(self, runner, mocker: MockerFixture):
+        app_record = MagicMock(id="app1", tenant_id="tenant")
+
+        app_config = _build_app_config()
+        app_generate_entity = _build_generate_entity(app_config, file_upload_config=None)
+
+        runner.organize_prompt_messages = MagicMock(return_value=([], None))
+        runner.moderation_for_inputs = MagicMock(return_value=(None, app_generate_entity.inputs, "query"))
+        runner.check_hosting_moderation = MagicMock(return_value=True)
+
+        with patched_create_session(return_value=app_record):
+            runner.run(app_generate_entity, MagicMock(), MagicMock(id="msg"), MagicMock())
+
+        assert (
+            runner.organize_prompt_messages.call_args.kwargs["image_detail_config"]
+            == ImagePromptMessageContent.DETAIL.LOW
+        )

api/tests/unit_tests/core/app/apps/completion/test_completion_completion_app_generator.py

@@ -376,26 +376,18 @@ class TestCompletionAppGenerator:
         create_session.return_value = session_context
         mocker.patch.object(module.db, "session")
 
-        message = MagicMock()
-        mocker.patch.object(generator, "_get_message", return_value=message)
+        mocker.patch.object(generator, "_get_message", return_value=MagicMock())
 
         runner_instance = MagicMock()
         runner_instance.run.side_effect = error
-        mocker.patch.object(module, "CompletionWorkflowRunner", return_value=runner_instance)
+        mocker.patch.object(module, "CompletionAppRunner", return_value=runner_instance)
 
         queue_manager = MagicMock()
-        application_generate_entity = MagicMock()
         generator._generate_worker(
             flask_app=flask_app,
-            application_generate_entity=application_generate_entity,
+            application_generate_entity=MagicMock(),
             queue_manager=queue_manager,
             message_id="msg",
         )
 
-        runner_instance.run.assert_called_once_with(
-            application_generate_entity=application_generate_entity,
-            queue_manager=queue_manager,
-            message=message,
-            session=session,
-        )
         assert queue_manager.publish_error.called is should_publish

api/tests/unit_tests/core/app/apps/completion/test_completion_runtime_workflow_builder.py

@@ -1,70 +0,0 @@
-import json
-from types import SimpleNamespace
-from unittest.mock import MagicMock
-
-from core.app.apps.completion.runtime_workflow_builder import build_runtime_completion_workflow
-from graphon.nodes import BuiltinNodeTypes
-from models.model import AppMode
-
-
-def test_builder_returns_runtime_graph_without_workflow_record() -> None:
-    app_model = SimpleNamespace(mode=AppMode.COMPLETION)
-    app_config = MagicMock()
-    workflow_converter = MagicMock(
-        build_graph_from_app_config=MagicMock(return_value=({"nodes": [{"id": "start"}], "edges": []}, {}))
-    )
-    session = MagicMock()
-
-    result = build_runtime_completion_workflow(
-        app_model=app_model,
-        app_config=app_config,
-        session=session,
-        workflow_converter=workflow_converter,
-    )
-
-    assert result.workflow_id.startswith("completion-runtime-")
-    assert result.root_node_id == "start"
-    assert result.graph_dict == {"nodes": [{"id": "start"}], "edges": []}
-    workflow_converter.build_graph_from_app_config.assert_called_once_with(
-        app_model=app_model,
-        app_config=app_config,
-        target_app_mode=AppMode.WORKFLOW,
-        session=session,
-    )
-
-
-def test_builder_routes_api_based_variable_query_to_runtime_sys_query() -> None:
-    app_model = SimpleNamespace(mode=AppMode.COMPLETION)
-    app_config = MagicMock()
-    request_body = {"params": {"query": ""}}
-    workflow_converter = MagicMock(
-        build_graph_from_app_config=MagicMock(
-            return_value=(
-                {
-                    "nodes": [
-                        {
-                            "id": "http_request_1",
-                            "data": {
-                                "type": BuiltinNodeTypes.HTTP_REQUEST,
-                                "body": {"type": "json", "data": json.dumps(request_body)},
-                            },
-                        }
-                    ],
-                    "edges": [],
-                },
-                {},
-            )
-        )
-    )
-    session = MagicMock()
-
-    result = build_runtime_completion_workflow(
-        app_model=app_model,
-        app_config=app_config,
-        session=session,
-        workflow_converter=workflow_converter,
-    )
-
-    http_node = result.graph_dict["nodes"][0]
-    body = json.loads(http_node["data"]["body"]["data"])
-    assert body["params"]["query"] == "{{#sys.query#}}"

api/tests/unit_tests/core/app/apps/completion/test_graph_event_adapter.py

@@ -1,172 +0,0 @@
-from datetime import UTC, datetime
-from types import SimpleNamespace
-from unittest.mock import MagicMock
-
-from core.app.apps.base_app_queue_manager import PublishFrom
-from core.app.apps.completion.graph_event_adapter import CompletionGraphEventAdapter
-from core.app.entities.queue_entities import (
-    QueueErrorEvent,
-    QueueLLMChunkEvent,
-    QueueMessageEndEvent,
-    QueueRetrieverResourcesEvent,
-    QueueStopEvent,
-)
-from graphon.enums import BuiltinNodeTypes, WorkflowNodeExecutionStatus
-from graphon.graph_events import (
-    GraphRunAbortedEvent,
-    GraphRunFailedEvent,
-    GraphRunSucceededEvent,
-    NodeRunRetrieverResourceEvent,
-    NodeRunStreamChunkEvent,
-    NodeRunSucceededEvent,
-)
-from graphon.model_runtime.entities.llm_entities import LLMUsage
-from graphon.model_runtime.entities.message_entities import UserPromptMessage
-from graphon.node_events import NodeRunResult
-
-
-def _adapter(*, show_retrieve_source: bool = True) -> tuple[CompletionGraphEventAdapter, MagicMock]:
-    queue_manager = MagicMock()
-    entity = SimpleNamespace(
-        model_conf=SimpleNamespace(model="model"),
-        app_config=SimpleNamespace(
-            additional_features=SimpleNamespace(show_retrieve_source=show_retrieve_source),
-        ),
-    )
-    return (
-        CompletionGraphEventAdapter(application_generate_entity=entity, queue_manager=queue_manager),
-        queue_manager,
-    )
-
-
-def test_stream_chunk_event_publishes_llm_chunk() -> None:
-    adapter, queue_manager = _adapter()
-    prompt_message = UserPromptMessage(content="prompt")
-    adapter.set_prompt_messages([prompt_message])
-
-    adapter.handle_event(
-        NodeRunStreamChunkEvent(
-            id="run",
-            node_id="llm",
-            node_type=BuiltinNodeTypes.LLM,
-            selector=["llm", "text"],
-            chunk="hello",
-        )
-    )
-
-    event = queue_manager.publish.call_args.args[0]
-    assert isinstance(event, QueueLLMChunkEvent)
-    assert event.chunk.delta.message.content == "hello"
-    assert event.chunk.prompt_messages == [prompt_message]
-    assert queue_manager.publish.call_args.args[1] == PublishFrom.APPLICATION_MANAGER
-
-
-def test_stream_chunk_event_skips_final_empty_chunk() -> None:
-    adapter, queue_manager = _adapter()
-
-    adapter.handle_event(
-        NodeRunStreamChunkEvent(
-            id="run",
-            node_id="llm",
-            node_type=BuiltinNodeTypes.LLM,
-            selector=["llm", "text"],
-            chunk="",
-            is_final=True,
-        )
-    )
-
-    queue_manager.publish.assert_not_called()
-
-
-def test_retriever_resource_event_publishes_legacy_retriever_resources() -> None:
-    adapter, queue_manager = _adapter()
-
-    adapter.handle_event(
-        NodeRunRetrieverResourceEvent(
-            id="run",
-            node_id="knowledge_retrieval",
-            node_type=BuiltinNodeTypes.KNOWLEDGE_RETRIEVAL,
-            retriever_resources=[{"dataset_id": "dataset", "content": "hit"}],
-            context="hit",
-        )
-    )
-
-    event = queue_manager.publish.call_args.args[0]
-    assert isinstance(event, QueueRetrieverResourcesEvent)
-    assert event.retriever_resources[0].dataset_id == "dataset"
-
-
-def test_retriever_resource_event_is_hidden_when_feature_is_disabled() -> None:
-    adapter, queue_manager = _adapter(show_retrieve_source=False)
-
-    adapter.handle_event(
-        NodeRunRetrieverResourceEvent(
-            id="run",
-            node_id="knowledge_retrieval",
-            node_type=BuiltinNodeTypes.KNOWLEDGE_RETRIEVAL,
-            retriever_resources=[{"dataset_id": "dataset", "content": "hit"}],
-            context="hit",
-        )
-    )
-
-    queue_manager.publish.assert_not_called()
-
-
-def test_llm_success_then_graph_success_publishes_message_end() -> None:
-    adapter, queue_manager = _adapter()
-    usage = LLMUsage.empty_usage()
-    prompt_message = UserPromptMessage(content="prompt")
-    adapter.set_prompt_messages([prompt_message])
-    adapter.handle_event(
-        NodeRunSucceededEvent(
-            id="run",
-            node_id="llm",
-            node_type=BuiltinNodeTypes.LLM,
-            start_at=datetime.now(UTC),
-            node_run_result=NodeRunResult(
-                status=WorkflowNodeExecutionStatus.SUCCEEDED,
-                outputs={"text": "final"},
-                llm_usage=usage,
-            ),
-        )
-    )
-
-    adapter.handle_event(GraphRunSucceededEvent(outputs={"result": "final"}))
-
-    event = queue_manager.publish.call_args.args[0]
-    assert isinstance(event, QueueMessageEndEvent)
-    assert event.llm_result is not None
-    assert event.llm_result.message.content == "final"
-    assert event.llm_result.prompt_messages == [prompt_message]
-    assert event.llm_result.usage is usage
-
-
-def test_graph_success_uses_outputs_result_when_llm_success_was_not_seen() -> None:
-    adapter, queue_manager = _adapter()
-
-    adapter.handle_event(GraphRunSucceededEvent(outputs={"result": "final from graph"}))
-
-    event = queue_manager.publish.call_args.args[0]
-    assert isinstance(event, QueueMessageEndEvent)
-    assert event.llm_result is not None
-    assert event.llm_result.message.content == "final from graph"
-
-
-def test_failed_graph_publishes_error() -> None:
-    adapter, queue_manager = _adapter()
-
-    adapter.handle_event(GraphRunFailedEvent(error="boom"))
-
-    event = queue_manager.publish.call_args.args[0]
-    assert isinstance(event, QueueErrorEvent)
-    assert str(event.error) == "boom"
-
-
-def test_user_abort_publishes_legacy_stop() -> None:
-    adapter, queue_manager = _adapter()
-
-    adapter.handle_event(GraphRunAbortedEvent(reason="Stopped by user."))
-
-    event = queue_manager.publish.call_args.args[0]
-    assert isinstance(event, QueueStopEvent)
-    assert event.stopped_by == QueueStopEvent.StopBy.USER_MANUAL

api/tests/unit_tests/core/app/apps/completion/test_workflow_runner.py

@@ -1,278 +0,0 @@
-from types import SimpleNamespace
-from unittest.mock import MagicMock
-
-import pytest
-
-from core.app.apps.completion.workflow_runner import CompletionWorkflowRunner, ModeratedCompletionInputs
-from core.app.apps.exc import GenerateTaskStoppedError
-from core.app.entities.app_invoke_entities import InvokeFrom, UserFrom
-from core.moderation.base import ModerationError
-from core.workflow.node_runtime import DIFY_BEFORE_LLM_INVOKE_KEY
-from graphon.model_runtime.entities.message_entities import ImagePromptMessageContent
-from models.model import AppMode
-
-
-def _entity() -> SimpleNamespace:
-    return SimpleNamespace(
-        app_config=SimpleNamespace(app_id="app", tenant_id="tenant", prompt_template=MagicMock()),
-        model_conf=SimpleNamespace(model="model"),
-        user_id="user",
-        invoke_from=InvokeFrom.SERVICE_API,
-        task_id="task",
-        call_depth=2,
-        inputs={"name": "Ada"},
-        query="question",
-        files=[],
-        file_upload_config=None,
-        extras={"trace_session_id": "trace"},
-        stream=True,
-        trace_manager=None,
-    )
-
-
-def test_runner_builds_workflow_entry_and_adapts_events(monkeypatch) -> None:
-    from core.app.apps.completion import workflow_runner as module
-
-    app = SimpleNamespace(id="app", tenant_id="tenant", mode=AppMode.COMPLETION)
-    entity = _entity()
-    message = SimpleNamespace(id="message", conversation_id="conv")
-    queue_manager = SimpleNamespace(graph_runtime_state=None)
-    runtime_workflow = SimpleNamespace(
-        workflow_id="completion-runtime-1",
-        root_node_id="start",
-        graph_dict={"nodes": [{"id": "start", "data": {"type": "start"}}], "edges": []},
-    )
-    build_runtime_workflow = MagicMock(return_value=runtime_workflow)
-    graph = MagicMock()
-    adapter = MagicMock()
-    workflow_entry = MagicMock()
-    session = MagicMock()
-    lifecycle_events: list[str] = []
-    session.commit.side_effect = lambda: lifecycle_events.append("commit")
-    session.close.side_effect = lambda: lifecycle_events.append("close")
-
-    def run_workflow():
-        lifecycle_events.append("run")
-        yield "event"
-
-    workflow_entry.run.return_value = run_workflow()
-
-    init_graph = MagicMock(return_value=graph)
-    workflow_entry_class = MagicMock(return_value=workflow_entry)
-    adapter_class = MagicMock(return_value=adapter)
-    build_system_variables = MagicMock(return_value=["sys"])
-    build_bootstrap_variables = MagicMock(return_value=["boot"])
-    add_variables_to_pool = MagicMock()
-    add_node_inputs_to_pool = MagicMock()
-
-    monkeypatch.setattr(module, "init_graph", init_graph)
-    monkeypatch.setattr(module, "build_runtime_completion_workflow", build_runtime_workflow)
-    monkeypatch.setattr(module, "WorkflowEntry", workflow_entry_class)
-    monkeypatch.setattr(module, "CompletionGraphEventAdapter", adapter_class)
-    monkeypatch.setattr(module, "RedisChannel", MagicMock())
-    monkeypatch.setattr(module, "redis_client", MagicMock())
-    monkeypatch.setattr(module, "build_system_variables", build_system_variables)
-    monkeypatch.setattr(module, "build_bootstrap_variables", build_bootstrap_variables)
-    monkeypatch.setattr(module, "add_variables_to_pool", add_variables_to_pool)
-    monkeypatch.setattr(module, "add_node_inputs_to_pool", add_node_inputs_to_pool)
-
-    runner = CompletionWorkflowRunner()
-    monkeypatch.setattr(runner, "_get_app", MagicMock(return_value=app))
-    before_llm_invoke_hook = MagicMock()
-    build_before_llm_invoke_hook = MagicMock(return_value=before_llm_invoke_hook)
-    monkeypatch.setattr(runner, "_build_before_llm_invoke_hook", build_before_llm_invoke_hook)
-    monkeypatch.setattr(
-        runner,
-        "_run_input_moderation",
-        MagicMock(return_value=ModeratedCompletionInputs(stopped=False, inputs={"name": "Grace"}, query="moderated")),
-    )
-
-    runner.run(
-        application_generate_entity=entity,
-        queue_manager=queue_manager,
-        message=message,
-        session=session,
-    )
-
-    build_runtime_workflow.assert_called_once_with(
-        app_model=app,
-        app_config=entity.app_config,
-        session=session,
-    )
-    assert lifecycle_events == ["commit", "close", "run"]
-    add_node_inputs_to_pool.assert_called_once()
-    assert add_node_inputs_to_pool.call_args.kwargs["node_id"] == "start"
-    assert add_node_inputs_to_pool.call_args.kwargs["inputs"] == {"name": "Grace"}
-    build_system_variables.assert_called_once()
-    assert build_system_variables.call_args.kwargs["query"] == "moderated"
-    assert build_system_variables.call_args.kwargs["conversation_id"] == "conv"
-    workflow_entry_class.assert_called_once()
-    assert workflow_entry_class.call_args.kwargs["workflow_id"] == "completion-runtime-1"
-    assert workflow_entry_class.call_args.kwargs["user_from"] == UserFrom.END_USER
-    assert workflow_entry_class.call_args.kwargs["call_depth"] == 2
-    build_before_llm_invoke_hook.assert_called_once_with(
-        application_generate_entity=entity,
-        queue_manager=queue_manager,
-        adapter=adapter,
-    )
-    init_graph.assert_called_once()
-    assert init_graph.call_args.kwargs["app_id"] == "app"
-    assert init_graph.call_args.kwargs["graph_config"] == runtime_workflow.graph_dict
-    assert init_graph.call_args.kwargs["root_node_id"] == "start"
-    assert init_graph.call_args.kwargs["call_depth"] == 2
-    assert init_graph.call_args.kwargs["extra_context"][DIFY_BEFORE_LLM_INVOKE_KEY] is before_llm_invoke_hook
-    workflow_entry.graph_engine.layer.assert_not_called()
-    adapter_class.assert_called_once_with(application_generate_entity=entity, queue_manager=queue_manager)
-    adapter.handle_event.assert_called_once_with("event")
-
-
-def test_runner_returns_when_input_moderation_stops(monkeypatch) -> None:
-    app = SimpleNamespace(id="app", tenant_id="tenant", mode=AppMode.COMPLETION)
-    entity = _entity()
-    build_runtime_workflow = MagicMock()
-    runner = CompletionWorkflowRunner()
-    monkeypatch.setattr(
-        "core.app.apps.completion.workflow_runner.build_runtime_completion_workflow",
-        build_runtime_workflow,
-    )
-    monkeypatch.setattr(runner, "_get_app", MagicMock(return_value=app))
-    monkeypatch.setattr(
-        runner,
-        "_run_input_moderation",
-        MagicMock(return_value=ModeratedCompletionInputs(stopped=True, inputs={}, query="")),
-    )
-
-    runner.run(
-        application_generate_entity=entity,
-        queue_manager=MagicMock(),
-        message=SimpleNamespace(id="message"),
-        session=MagicMock(),
-    )
-
-    build_runtime_workflow.assert_not_called()
-
-
-def test_runner_get_app_raises_when_record_is_missing() -> None:
-    runner = CompletionWorkflowRunner()
-    session = MagicMock()
-    session.scalar.return_value = None
-
-    with pytest.raises(ValueError, match="App not found"):
-        runner._get_app(app_id="missing-app", tenant_id="tenant", session=session)
-
-
-def test_runner_get_app_returns_record() -> None:
-    app = SimpleNamespace(id="app")
-    runner = CompletionWorkflowRunner()
-    session = MagicMock()
-    session.scalar.return_value = app
-
-    assert runner._get_app(app_id="app", tenant_id="tenant", session=session) is app
-
-
-def test_runner_direct_outputs_on_input_moderation() -> None:
-    runner = CompletionWorkflowRunner()
-    app_record = SimpleNamespace(id="app", tenant_id="tenant")
-    entity = _entity()
-    message = SimpleNamespace(id="message")
-    queue_manager = MagicMock()
-    runner.organize_prompt_messages = MagicMock(return_value=(["prompt"], None))
-    runner.moderation_for_inputs = MagicMock(side_effect=ModerationError("blocked"))
-    runner.direct_output = MagicMock()
-
-    result = runner._run_input_moderation(
-        app_record=app_record,
-        application_generate_entity=entity,
-        queue_manager=queue_manager,
-        message=message,
-    )
-
-    assert result.stopped is True
-    assert result.inputs == {"name": "Ada"}
-    assert result.query == "question"
-    runner.direct_output.assert_called_once()
-
-
-def test_runner_returns_moderated_inputs_when_input_moderation_passes() -> None:
-    runner = CompletionWorkflowRunner()
-    app_record = SimpleNamespace(id="app", tenant_id="tenant")
-    entity = _entity()
-    message = SimpleNamespace(id="message")
-    runner.organize_prompt_messages = MagicMock(return_value=(["prompt"], None))
-    runner.moderation_for_inputs = MagicMock(return_value=(None, {"name": "Grace"}, "moderated query"))
-
-    result = runner._run_input_moderation(
-        app_record=app_record,
-        application_generate_entity=entity,
-        queue_manager=MagicMock(),
-        message=message,
-    )
-
-    assert result == ModeratedCompletionInputs(stopped=False, inputs={"name": "Grace"}, query="moderated query")
-
-
-def test_runner_before_llm_invoke_hook_captures_and_moderates_final_prompt() -> None:
-    runner = CompletionWorkflowRunner()
-    entity = _entity()
-    queue_manager = MagicMock()
-    adapter = MagicMock()
-    runner.check_hosting_moderation = MagicMock(return_value=True)
-
-    hook = runner._build_before_llm_invoke_hook(
-        application_generate_entity=entity,
-        queue_manager=queue_manager,
-        adapter=adapter,
-    )
-
-    with pytest.raises(GenerateTaskStoppedError):
-        hook(["final prompt"], {"max_tokens": 128})
-
-    adapter.set_prompt_messages.assert_called_once_with(["final prompt"])
-    runner.check_hosting_moderation.assert_called_once_with(
-        application_generate_entity=entity,
-        queue_manager=queue_manager,
-        prompt_messages=["final prompt"],
-    )
-
-
-def test_runner_before_llm_invoke_hook_recalculates_graph_model_parameters() -> None:
-    runner = CompletionWorkflowRunner()
-    entity = _entity()
-    queue_manager = MagicMock()
-    adapter = MagicMock()
-    runner.check_hosting_moderation = MagicMock(return_value=False)
-
-    def recalc(*, model_parameters, **kwargs) -> None:
-        model_parameters["max_tokens"] = 64
-
-    runner.recalc_llm_max_tokens = MagicMock(side_effect=recalc)
-    hook = runner._build_before_llm_invoke_hook(
-        application_generate_entity=entity,
-        queue_manager=queue_manager,
-        adapter=adapter,
-    )
-
-    result = hook(["final prompt"], {"max_tokens": 128, "temperature": 0.2})
-
-    assert result == {"max_tokens": 64, "temperature": 0.2}
-    runner.recalc_llm_max_tokens.assert_called_once_with(
-        model_config=entity.model_conf,
-        prompt_messages=["final prompt"],
-        model_parameters=result,
-    )
-
-
-def test_runner_resolves_account_user_from() -> None:
-    entity = _entity()
-    entity.invoke_from = InvokeFrom.EXPLORE
-
-    assert CompletionWorkflowRunner._resolve_user_from(entity) == UserFrom.ACCOUNT
-
-
-def test_runner_resolves_configured_image_detail() -> None:
-    entity = _entity()
-    entity.file_upload_config = SimpleNamespace(
-        image_config=SimpleNamespace(detail=ImagePromptMessageContent.DETAIL.HIGH),
-    )
-
-    assert CompletionWorkflowRunner._resolve_image_detail_config(entity) == ImagePromptMessageContent.DETAIL.HIGH

api/tests/unit_tests/core/app/apps/test_base_app_runner.py

@@ -133,33 +133,6 @@ class TestAppRunner:
 
         assert runner.recalc_llm_max_tokens(model_config, prompt_messages=[]) == -1
 
-    def test_recalc_llm_max_tokens_can_update_runtime_parameters(self, monkeypatch: pytest.MonkeyPatch):
-        runner = AppRunner()
-        model_schema = AIModelEntity.model_construct(
-            model_properties={ModelPropertyKey.CONTEXT_SIZE: 100},
-            parameter_rules=[_DummyParameterRule("max_tokens")],
-        )
-        model_config = ModelConfigWithCredentialsEntity.model_construct(
-            provider_model_bundle=object(),
-            model="mock",
-            model_schema=model_schema,
-            parameters={"max_tokens": 30},
-        )
-        runtime_parameters = {"max_tokens": 40}
-        monkeypatch.setattr(
-            "core.app.apps.base_app_runner.ModelInstance",
-            lambda provider_model_bundle, model: _TokenCountingModel(80),
-        )
-
-        runner.recalc_llm_max_tokens(
-            model_config,
-            prompt_messages=[AssistantPromptMessage(content="hi")],
-            model_parameters=runtime_parameters,
-        )
-
-        assert runtime_parameters["max_tokens"] == 20
-        assert model_config.parameters["max_tokens"] == 30
-
     def test_direct_output_streaming_publishes_chunks_and_end(self):
         runner = AppRunner()
         queue = _queue_manager()

api/tests/unit_tests/core/app/apps/test_workflow_app_runner_core.py

@@ -5,7 +5,7 @@ from types import SimpleNamespace
 
 import pytest
 
-from core.app.apps.workflow_app_runner import WorkflowBasedAppRunner, init_graph
+from core.app.apps.workflow_app_runner import WorkflowBasedAppRunner
 from core.app.entities.app_invoke_entities import DIFY_RUN_CONTEXT_KEY, InvokeFrom, UserFrom
 from core.app.entities.queue_entities import (
     QueueAgentLogEvent,
@@ -119,40 +119,6 @@ class TestWorkflowBasedAppRunner:
 
         assert captured["run_context"][DIFY_RUN_CONTEXT_KEY].trace_session_id == "session-1"
 
-    def test_init_graph_accepts_call_depth_and_extra_context(self, monkeypatch: pytest.MonkeyPatch):
-        runtime_state = GraphRuntimeState(
-            variable_pool=VariablePool.from_bootstrap(system_variables=default_system_variables()),
-            start_at=0.0,
-        )
-        hook = object()
-        captured = {}
-
-        def fake_from_graph_init_context(**kwargs):
-            graph_init_context = kwargs["graph_init_context"]
-            captured["run_context"] = graph_init_context.run_context
-            captured["call_depth"] = graph_init_context.call_depth
-            return SimpleNamespace()
-
-        monkeypatch.setattr(
-            "core.app.apps.workflow_app_runner.DifyNodeFactory.from_graph_init_context",
-            fake_from_graph_init_context,
-        )
-        monkeypatch.setattr("core.app.apps.workflow_app_runner.Graph.init", lambda **_kwargs: SimpleNamespace())
-
-        init_graph(
-            app_id="app",
-            graph_config={"nodes": [], "edges": []},
-            graph_runtime_state=runtime_state,
-            user_from=UserFrom.ACCOUNT,
-            invoke_from=InvokeFrom.DEBUGGER,
-            root_node_id="root",
-            call_depth=2,
-            extra_context={"hook": hook},
-        )
-
-        assert captured["call_depth"] == 2
-        assert captured["run_context"]["hook"] is hook
-
     def test_prepare_single_node_execution_requires_run(self):
         runner = WorkflowBasedAppRunner(queue_manager=SimpleNamespace(), app_id="app")
 

api/tests/unit_tests/core/app/apps/workflow/test_generate_task_pipeline_core.py

@@ -1,11 +1,11 @@
 from __future__ import annotations
 
 import logging
-from contextlib import contextmanager
 from types import SimpleNamespace
-from unittest.mock import MagicMock
 
 import pytest
+from sqlalchemy import select
+from sqlalchemy.orm import Session
 
 from core.app.app_config.entities import AppAdditionalFeatures, WorkflowUIBasedAppConfig
 from core.app.apps.workflow.generate_task_pipeline import WorkflowAppGenerateTaskPipeline
@@ -54,6 +54,7 @@ from graphon.runtime import GraphRuntimeState, VariablePool
 from libs.datetime_utils import naive_utc_now
 from models.enums import CreatorUserRole
 from models.model import AppMode, EndUser
+from models.workflow import WorkflowAppLog
 from tests.workflow_test_utils import build_test_variable_pool
 
 
@@ -193,7 +194,7 @@ class TestWorkflowGenerateTaskPipeline:
 
         assert isinstance(responses[0], ValueError)
 
-    def test_handle_workflow_started_event_sets_run_id(self, monkeypatch: pytest.MonkeyPatch):
+    def test_handle_workflow_started_event_sets_run_id(self, monkeypatch: pytest.MonkeyPatch, sqlite_engine):
         pipeline = _make_pipeline()
         pipeline._graph_runtime_state = GraphRuntimeState(
             variable_pool=build_test_variable_pool(variables=build_system_variables(workflow_execution_id="run-id")),
@@ -201,11 +202,10 @@ class TestWorkflowGenerateTaskPipeline:
         )
         pipeline._workflow_response_converter.workflow_start_to_stream_response = lambda **kwargs: "started"
 
-        @contextmanager
-        def _fake_session():
-            yield SimpleNamespace()
-
-        monkeypatch.setattr(pipeline, "_database_session", _fake_session)
+        monkeypatch.setattr(
+            "core.app.apps.workflow.generate_task_pipeline.db",
+            SimpleNamespace(engine=sqlite_engine),
+        )
         monkeypatch.setattr(pipeline, "_save_workflow_app_log", lambda **kwargs: None)
 
         responses = list(pipeline._handle_workflow_started_event(QueueWorkflowStartedEvent()))
@@ -339,19 +339,18 @@ class TestWorkflowGenerateTaskPipeline:
 
         assert responses == ["finish"]
 
-    def test_save_workflow_app_log_created_from(self):
+    @pytest.mark.parametrize("sqlite_session", [(WorkflowAppLog,)], indirect=True)
+    def test_save_workflow_app_log_created_from(self, sqlite_session: Session):
         pipeline = _make_pipeline()
         pipeline._application_generate_entity.invoke_from = InvokeFrom.SERVICE_API
         pipeline._user_id = "user"
-        added: list[object] = []
+        pipeline._save_workflow_app_log(session=sqlite_session, workflow_run_id="run-id")
+        sqlite_session.flush()
 
-        class _Session:
-            def add(self, item):
-                added.append(item)
-
-        pipeline._save_workflow_app_log(session=_Session(), workflow_run_id="run-id")
-
-        assert added
+        saved_log = sqlite_session.scalar(select(WorkflowAppLog))
+        assert saved_log is not None
+        assert saved_log.workflow_run_id == "run-id"
+        assert saved_log.created_from == "service-api"
 
     def test_iteration_loop_and_human_input_handlers(self):
         pipeline = _make_pipeline()
@@ -674,35 +673,29 @@ class TestWorkflowGenerateTaskPipeline:
         assert "Fails to get audio trunk, task_id: task" in caplog.messages
         assert any(isinstance(item, MessageAudioEndStreamResponse) for item in responses)
 
-    def test_database_session_rolls_back_on_error(self, monkeypatch: pytest.MonkeyPatch):
+    @pytest.mark.parametrize("sqlite_session", [(WorkflowAppLog,)], indirect=True)
+    def test_database_session_rolls_back_on_error(
+        self, monkeypatch: pytest.MonkeyPatch, sqlite_engine, sqlite_session: Session
+    ):
         pipeline = _make_pipeline()
-        calls = {"enter": 0, "exit_exc": None}
+        pipeline._application_generate_entity.invoke_from = InvokeFrom.SERVICE_API
+        pipeline._user_id = "user"
+        monkeypatch.setattr(
+            "core.app.apps.workflow.generate_task_pipeline.db",
+            SimpleNamespace(engine=sqlite_engine),
+        )
 
-        class _BeginContext:
-            def __enter__(self):
-                calls["enter"] += 1
-                return MagicMock()
-
-            def __exit__(self, exc_type, exc, tb):
-                calls["exit_exc"] = exc_type
-                return False
-
-        class _Sessionmaker:
-            def __init__(self, *args, **kwargs):
-                pass
-
-            def begin(self):
-                return _BeginContext()
-
-        monkeypatch.setattr("core.app.apps.workflow.generate_task_pipeline.sessionmaker", _Sessionmaker)
-        monkeypatch.setattr("core.app.apps.workflow.generate_task_pipeline.db", SimpleNamespace(engine=object()))
-
-        with pytest.raises(RuntimeError, match="db error"):
-            with pipeline._database_session():
+        def persist_then_fail() -> None:
+            with pipeline._database_session() as session:
+                pipeline._save_workflow_app_log(session=session, workflow_run_id="run-id")
+                session.flush()
                 raise RuntimeError("db error")
 
-        assert calls["enter"] == 1
-        assert calls["exit_exc"] is RuntimeError
+        with pytest.raises(RuntimeError, match="db error"):
+            persist_then_fail()
+
+        sqlite_session.expire_all()
+        assert sqlite_session.scalar(select(WorkflowAppLog)) is None
 
     def test_node_retry_and_started_handlers_cover_none_and_value(self):
         pipeline = _make_pipeline()
@@ -862,31 +855,30 @@ class TestWorkflowGenerateTaskPipeline:
         pipeline._handle_workflow_failed_and_stop_events = lambda event, **kwargs: iter(["stopped"])
         assert list(pipeline._process_stream_response()) == ["stopped"]
 
-    def test_save_workflow_app_log_covers_invoke_from_variants(self):
+    @pytest.mark.parametrize("sqlite_session", [(WorkflowAppLog,)], indirect=True)
+    def test_save_workflow_app_log_covers_invoke_from_variants(self, sqlite_session: Session):
         pipeline = _make_pipeline()
         pipeline._user_id = "user-id"
-        added: list[object] = []
-
-        class _Session:
-            def add(self, item):
-                added.append(item)
 
         pipeline._application_generate_entity.invoke_from = InvokeFrom.EXPLORE
-        pipeline._save_workflow_app_log(session=_Session(), workflow_run_id="run-id")
-        assert added[-1].created_from == "installed-app"
+        pipeline._save_workflow_app_log(session=sqlite_session, workflow_run_id="run-id")
 
         pipeline._application_generate_entity.invoke_from = InvokeFrom.WEB_APP
-        pipeline._save_workflow_app_log(session=_Session(), workflow_run_id="run-id")
-        assert added[-1].created_from == "web-app"
+        pipeline._save_workflow_app_log(session=sqlite_session, workflow_run_id="run-id-2")
+        sqlite_session.flush()
+        saved_logs = sqlite_session.scalars(select(WorkflowAppLog).order_by(WorkflowAppLog.workflow_run_id)).all()
+        assert [log.created_from for log in saved_logs] == ["installed-app", "web-app"]
 
-        count_before = len(added)
+        count_before = len(saved_logs)
         pipeline._application_generate_entity.invoke_from = InvokeFrom.DEBUGGER
-        pipeline._save_workflow_app_log(session=_Session(), workflow_run_id="run-id")
-        assert len(added) == count_before
+        pipeline._save_workflow_app_log(session=sqlite_session, workflow_run_id="run-id-3")
+        sqlite_session.flush()
+        assert len(sqlite_session.scalars(select(WorkflowAppLog)).all()) == count_before
 
         pipeline._application_generate_entity.invoke_from = InvokeFrom.WEB_APP
-        pipeline._save_workflow_app_log(session=_Session(), workflow_run_id=None)
-        assert len(added) == count_before
+        pipeline._save_workflow_app_log(session=sqlite_session, workflow_run_id=None)
+        sqlite_session.flush()
+        assert len(sqlite_session.scalars(select(WorkflowAppLog)).all()) == count_before
 
     def test_save_output_for_event_writes_draft_variables(self):
         pipeline = _make_pipeline()

api/tests/unit_tests/core/app/layers/test_trigger_post_layer.py

@@ -1,9 +1,13 @@
 import logging
+from collections.abc import Iterator
+from dataclasses import dataclass
 from datetime import UTC, datetime, timedelta
 from types import SimpleNamespace
 from unittest.mock import Mock, patch
 
 import pytest
+from sqlalchemy import Engine, event
+from sqlalchemy.orm import Session, sessionmaker
 
 from core.app.layers.trigger_post_layer import TriggerPostLayer
 from core.workflow.system_variables import build_system_variables
@@ -13,19 +17,63 @@ from graphon.graph_events import (
     GraphRunSucceededEvent,
 )
 from graphon.runtime import VariablePool
-from models.enums import WorkflowTriggerStatus
+from models.enums import AppTriggerType, CreatorUserRole, WorkflowTriggerStatus
+from models.trigger import WorkflowTriggerLog
+
+
+@dataclass(frozen=True)
+class TriggerDatabase:
+    session: Session
+    statements: list[str]
+
+
+@pytest.fixture(autouse=True)
+def trigger_database(monkeypatch: pytest.MonkeyPatch, sqlite_engine: Engine) -> Iterator[TriggerDatabase]:
+    """Create the trigger-log table and bind layer-owned sessions to SQLite."""
+    WorkflowTriggerLog.metadata.create_all(sqlite_engine, tables=[WorkflowTriggerLog.__table__])
+    sqlite_session_maker = sessionmaker(bind=sqlite_engine, expire_on_commit=False)
+    monkeypatch.setattr("core.db.session_factory._session_maker", sqlite_session_maker)
+    statements: list[str] = []
+
+    def record_statement(_connection, _cursor, statement, _parameters, _context, _executemany) -> None:
+        statements.append(statement)
+
+    event.listen(sqlite_engine, "before_cursor_execute", record_statement)
+    with sqlite_session_maker() as session:
+        try:
+            yield TriggerDatabase(session=session, statements=statements)
+        finally:
+            event.remove(sqlite_engine, "before_cursor_execute", record_statement)
+
+
+def _persist_trigger_log(database: TriggerDatabase, *, trigger_log_id: str = "log-1") -> WorkflowTriggerLog:
+    trigger_log = WorkflowTriggerLog(
+        tenant_id="tenant-1",
+        app_id="app-1",
+        workflow_id="workflow-1",
+        workflow_run_id=None,
+        root_node_id=None,
+        trigger_metadata="{}",
+        trigger_type=AppTriggerType.TRIGGER_WEBHOOK,
+        trigger_data="{}",
+        inputs="{}",
+        outputs=None,
+        status=WorkflowTriggerStatus.RUNNING,
+        error=None,
+        queue_name="workflow",
+        celery_task_id=None,
+        created_by_role=CreatorUserRole.ACCOUNT,
+        created_by="account-1",
+    )
+    trigger_log.id = trigger_log_id
+    database.session.add(trigger_log)
+    database.session.commit()
+    return trigger_log
 
 
 class TestTriggerPostLayer:
-    def test_on_event_updates_trigger_log(self):
-        trigger_log = SimpleNamespace(
-            status=None,
-            workflow_run_id=None,
-            outputs=None,
-            elapsed_time=None,
-            total_tokens=None,
-            finished_at=None,
-        )
+    def test_on_event_updates_trigger_log(self, trigger_database: TriggerDatabase):
+        trigger_log = _persist_trigger_log(trigger_database)
         runtime_state = SimpleNamespace(
             outputs={"answer": "ok"},
             variable_pool=VariablePool.from_bootstrap(
@@ -35,19 +83,10 @@ class TestTriggerPostLayer:
         )
 
         with (
-            patch("core.app.layers.trigger_post_layer.session_factory") as mock_session_factory,
-            patch("core.app.layers.trigger_post_layer.SQLAlchemyWorkflowTriggerLogRepository") as mock_repo_cls,
             patch("core.app.layers.trigger_post_layer.datetime") as mock_datetime,
         ):
             mock_datetime.now.return_value = datetime(2026, 2, 20, tzinfo=UTC)
 
-            session = Mock()
-            mock_session_factory.create_session.return_value.__enter__.return_value = session
-
-            repo = Mock()
-            repo.get_by_id.return_value = trigger_log
-            mock_repo_cls.return_value = repo
-
             layer = TriggerPostLayer(
                 cfs_plan_scheduler_entity=Mock(),
                 start_time=datetime(2026, 2, 20, tzinfo=UTC) - timedelta(seconds=10),
@@ -57,25 +96,18 @@ class TestTriggerPostLayer:
 
             layer.on_event(GraphRunSucceededEvent())
 
-        assert trigger_log.status == WorkflowTriggerStatus.SUCCEEDED
-        assert trigger_log.workflow_run_id == "run-1"
-        assert trigger_log.outputs is not None
-        assert trigger_log.elapsed_time is not None
-        assert trigger_log.total_tokens == 12
-        assert trigger_log.finished_at is not None
-        repo.update.assert_called_once_with(trigger_log)
-        session.commit.assert_called_once()
+        trigger_database.session.expire_all()
+        persisted_log = trigger_database.session.get(WorkflowTriggerLog, trigger_log.id)
+        assert persisted_log is not None
+        assert persisted_log.status == WorkflowTriggerStatus.SUCCEEDED
+        assert persisted_log.workflow_run_id == "run-1"
+        assert persisted_log.outputs == '{"answer":"ok"}'
+        assert persisted_log.elapsed_time == 10
+        assert persisted_log.total_tokens == 12
+        assert persisted_log.finished_at is not None
 
-    def test_on_event_updates_trigger_log_for_aborted_event(self):
-        trigger_log = SimpleNamespace(
-            status=None,
-            workflow_run_id=None,
-            outputs=None,
-            error=None,
-            elapsed_time=None,
-            total_tokens=None,
-            finished_at=None,
-        )
+    def test_on_event_updates_trigger_log_for_aborted_event(self, trigger_database: TriggerDatabase):
+        trigger_log = _persist_trigger_log(trigger_database)
         runtime_state = SimpleNamespace(
             outputs={"partial": "ok"},
             variable_pool=VariablePool.from_bootstrap(
@@ -85,19 +117,10 @@ class TestTriggerPostLayer:
         )
 
         with (
-            patch("core.app.layers.trigger_post_layer.session_factory") as mock_session_factory,
-            patch("core.app.layers.trigger_post_layer.SQLAlchemyWorkflowTriggerLogRepository") as mock_repo_cls,
             patch("core.app.layers.trigger_post_layer.datetime") as mock_datetime,
         ):
             mock_datetime.now.return_value = datetime(2026, 2, 20, tzinfo=UTC)
 
-            session = Mock()
-            mock_session_factory.create_session.return_value.__enter__.return_value = session
-
-            repo = Mock()
-            repo.get_by_id.return_value = trigger_log
-            mock_repo_cls.return_value = repo
-
             layer = TriggerPostLayer(
                 cfs_plan_scheduler_entity=Mock(),
                 start_time=datetime(2026, 2, 20, tzinfo=UTC) - timedelta(seconds=10),
@@ -107,17 +130,22 @@ class TestTriggerPostLayer:
 
             layer.on_event(GraphRunAbortedEvent(reason="timeout"))
 
-        assert trigger_log.status == WorkflowTriggerStatus.FAILED
-        assert trigger_log.workflow_run_id == "run-1"
-        assert trigger_log.outputs is not None
-        assert trigger_log.error == "timeout"
-        assert trigger_log.elapsed_time is not None
-        assert trigger_log.total_tokens == 7
-        assert trigger_log.finished_at is not None
-        repo.update.assert_called_once_with(trigger_log)
-        session.commit.assert_called_once()
+        trigger_database.session.expire_all()
+        persisted_log = trigger_database.session.get(WorkflowTriggerLog, trigger_log.id)
+        assert persisted_log is not None
+        assert persisted_log.status == WorkflowTriggerStatus.FAILED
+        assert persisted_log.workflow_run_id == "run-1"
+        assert persisted_log.outputs == '{"partial":"ok"}'
+        assert persisted_log.error == "timeout"
+        assert persisted_log.elapsed_time == 10
+        assert persisted_log.total_tokens == 7
+        assert persisted_log.finished_at is not None
 
-    def test_on_event_handles_missing_trigger_log(self, caplog: pytest.LogCaptureFixture):
+    def test_on_event_handles_missing_trigger_log(
+        self,
+        caplog: pytest.LogCaptureFixture,
+        trigger_database: TriggerDatabase,
+    ):
         runtime_state = SimpleNamespace(
             outputs={},
             variable_pool=VariablePool.from_bootstrap(
@@ -126,31 +154,20 @@ class TestTriggerPostLayer:
             total_tokens=0,
         )
 
-        with (
-            patch("core.app.layers.trigger_post_layer.session_factory") as mock_session_factory,
-            patch("core.app.layers.trigger_post_layer.SQLAlchemyWorkflowTriggerLogRepository") as mock_repo_cls,
-        ):
-            session = Mock()
-            mock_session_factory.create_session.return_value.__enter__.return_value = session
+        layer = TriggerPostLayer(
+            cfs_plan_scheduler_entity=Mock(),
+            start_time=datetime(2026, 2, 20, tzinfo=UTC),
+            trigger_log_id="missing",
+        )
+        layer.initialize(runtime_state, Mock())
 
-            repo = Mock()
-            repo.get_by_id.return_value = None
-            mock_repo_cls.return_value = repo
-
-            layer = TriggerPostLayer(
-                cfs_plan_scheduler_entity=Mock(),
-                start_time=datetime(2026, 2, 20, tzinfo=UTC),
-                trigger_log_id="missing",
-            )
-            layer.initialize(runtime_state, Mock())
-
-            with caplog.at_level(logging.ERROR, logger="core.app.layers.trigger_post_layer"):
-                layer.on_event(GraphRunFailedEvent(error="boom"))
+        with caplog.at_level(logging.ERROR, logger="core.app.layers.trigger_post_layer"):
+            layer.on_event(GraphRunFailedEvent(error="boom"))
 
         assert any(record.levelno == logging.ERROR for record in caplog.records)
-        session.commit.assert_not_called()
+        assert trigger_database.session.get(WorkflowTriggerLog, "missing") is None
 
-    def test_on_event_ignores_non_status_events(self):
+    def test_on_event_ignores_non_status_events(self, trigger_database: TriggerDatabase):
         runtime_state = SimpleNamespace(
             outputs={},
             variable_pool=VariablePool.from_bootstrap(
@@ -159,14 +176,14 @@ class TestTriggerPostLayer:
             total_tokens=0,
         )
 
-        with patch("core.app.layers.trigger_post_layer.session_factory") as mock_session_factory:
-            layer = TriggerPostLayer(
-                cfs_plan_scheduler_entity=Mock(),
-                start_time=datetime(2026, 2, 20, tzinfo=UTC),
-                trigger_log_id="log-1",
-            )
-            layer.initialize(runtime_state, Mock())
+        layer = TriggerPostLayer(
+            cfs_plan_scheduler_entity=Mock(),
+            start_time=datetime(2026, 2, 20, tzinfo=UTC),
+            trigger_log_id="log-1",
+        )
+        layer.initialize(runtime_state, Mock())
 
-            layer.on_event(Mock())
+        trigger_database.statements.clear()
+        layer.on_event(Mock())
 
-        mock_session_factory.create_session.assert_not_called()
+        assert trigger_database.statements == []

api/tests/unit_tests/core/datasource/test_datasource_manager.py

@@ -1,10 +1,13 @@
 import types
-from collections.abc import Generator
+from collections.abc import Generator, Iterator
 
 import pytest
 from pytest_mock import MockerFixture
+from sqlalchemy.engine import Engine
+from sqlalchemy.orm import Session, sessionmaker
 
 from contexts.wrapper import RecyclableContextVar
+from core.datasource import datasource_manager as datasource_manager_module
 from core.datasource.datasource_manager import DatasourceManager
 from core.datasource.entities.datasource_entities import DatasourceMessage, DatasourceProviderType
 from core.datasource.errors import DatasourceProviderNotFoundError
@@ -12,6 +15,34 @@ from core.workflow.file_reference import parse_file_reference
 from graphon.enums import WorkflowNodeExecutionStatus
 from graphon.file import File, FileTransferMethod, FileType
 from graphon.node_events import StreamChunkEvent, StreamCompletedEvent
+from models.base import TypeBase
+from models.tools import ToolFile
+
+
+@pytest.fixture
+def tool_file_session(sqlite_engine: Engine, monkeypatch: pytest.MonkeyPatch) -> Iterator[Session]:
+    """Bind datasource-owned lookups to a SQLite ToolFile table."""
+    TypeBase.metadata.create_all(sqlite_engine, tables=[TypeBase.metadata.tables[ToolFile.__tablename__]])
+    session_maker = sessionmaker(bind=sqlite_engine, expire_on_commit=False)
+    monkeypatch.setattr(datasource_manager_module.session_factory, "create_session", session_maker)
+    with session_maker() as session:
+        yield session
+
+
+def _persist_tool_file(session: Session, *, file_id: str, tenant_id: str) -> ToolFile:
+    tool_file = ToolFile(
+        user_id="user-1",
+        tenant_id=tenant_id,
+        conversation_id=None,
+        file_key="files/image.png",
+        mimetype="image/png",
+        name="image.png",
+        size=10,
+    )
+    tool_file.id = file_id
+    session.add(tool_file)
+    session.commit()
+    return tool_file
 
 
 def _gen_messages_text_only(text: str) -> Generator[DatasourceMessage, None, None]:
@@ -373,7 +404,8 @@ def test_stream_node_events_emits_events_online_document(mocker: MockerFixture):
     assert events[-1].node_run_result.status == WorkflowNodeExecutionStatus.SUCCEEDED
 
 
-def test_stream_node_events_builds_file_and_variables_from_messages(mocker: MockerFixture):
+def test_stream_node_events_builds_file_and_variables_from_messages(mocker: MockerFixture, tool_file_session: Session):
+    _persist_tool_file(tool_file_session, file_id="tool_file_1", tenant_id="t1")
     mocker.patch.object(DatasourceManager, "stream_online_results", return_value=_gen_messages_text_only("ignored"))
 
     def _transformed(**_kwargs):
@@ -418,19 +450,6 @@ def test_stream_node_events_builds_file_and_variables_from_messages(mocker: Mock
         side_effect=_transformed,
     )
 
-    fake_tool_file = types.SimpleNamespace(mimetype="image/png")
-
-    class _Session:
-        def __enter__(self):
-            return self
-
-        def __exit__(self, *exc):
-            return False
-
-        def scalar(self, _stmt):
-            return fake_tool_file
-
-    mocker.patch("core.datasource.datasource_manager.session_factory.create_session", return_value=_Session())
     mocker.patch("core.datasource.datasource_manager.get_file_type_by_mime_type", return_value=FileType.IMAGE)
     built = File(
         file_type=FileType.IMAGE,
@@ -481,7 +500,8 @@ def test_stream_node_events_builds_file_and_variables_from_messages(mocker: Mock
     assert events[-1].node_run_result.outputs["x"] == 1
 
 
-def test_stream_node_events_raises_when_toolfile_missing(mocker: MockerFixture):
+def test_stream_node_events_raises_when_toolfile_missing(mocker: MockerFixture, tool_file_session: Session):
+    _persist_tool_file(tool_file_session, file_id="missing", tenant_id="other-tenant")
     mocker.patch.object(DatasourceManager, "stream_online_results", return_value=_gen_messages_text_only("ignored"))
 
     def _transformed(**_kwargs):
@@ -496,18 +516,6 @@ def test_stream_node_events_raises_when_toolfile_missing(mocker: MockerFixture):
         side_effect=_transformed,
     )
 
-    class _Session:
-        def __enter__(self):
-            return self
-
-        def __exit__(self, *exc):
-            return False
-
-        def scalar(self, _stmt):
-            return None
-
-    mocker.patch("core.datasource.datasource_manager.session_factory.create_session", return_value=_Session())
-
     with pytest.raises(ValueError, match="ToolFile not found for file_id=missing, tenant_id=t1"):
         list(
             DatasourceManager.stream_node_events(

api/tests/unit_tests/core/datasource/test_notion_provider.py

@@ -14,18 +14,64 @@ Tests follow the Arrange-Act-Assert pattern for clarity.
 """
 
 import json
+from collections.abc import Iterator
+from dataclasses import dataclass
 from typing import Any
 from unittest.mock import Mock, patch
+from uuid import uuid4
 
 import httpx
 import pytest
+from sqlalchemy.engine import Engine
+from sqlalchemy.orm import Session
 
 from core.datasource.entities.datasource_entities import DatasourceProviderType
 from core.datasource.online_document.online_document_provider import (
     OnlineDocumentDatasourcePluginProviderController,
 )
+from core.rag.extractor import notion_extractor as notion_extractor_module
 from core.rag.extractor.notion_extractor import NotionExtractor
 from core.rag.models.document import Document
+from models.base import TypeBase
+from models.dataset import Document as DocumentModel
+from models.enums import DataSourceType, DocumentCreatedFrom
+
+
+@dataclass(frozen=True)
+class _Database:
+    """Expose the real SQLite session used by the extractor update."""
+
+    session: Session
+
+
+@pytest.fixture
+def database(sqlite_engine: Engine, monkeypatch: pytest.MonkeyPatch) -> Iterator[_Database]:
+    """Bind a real session for Notion document metadata persistence."""
+
+    TypeBase.metadata.create_all(sqlite_engine, tables=[DocumentModel.__table__])
+    with Session(sqlite_engine, expire_on_commit=False) as session:
+        database = _Database(session)
+        monkeypatch.setattr(notion_extractor_module, "db", database)
+        yield database
+
+
+@pytest.fixture
+def persisted_document(database: _Database) -> DocumentModel:
+    document = DocumentModel(
+        id=str(uuid4()),
+        tenant_id=str(uuid4()),
+        dataset_id=str(uuid4()),
+        position=1,
+        data_source_type=DataSourceType.NOTION_IMPORT,
+        data_source_info=json.dumps({"last_edited_time": "2024-01-01T00:00:00.000Z"}),
+        batch="batch",
+        name="Notion page",
+        created_from=DocumentCreatedFrom.WEB,
+        created_by=str(uuid4()),
+    )
+    database.session.add(document)
+    database.session.commit()
+    return document
 
 
 class TestNotionExtractorAuthentication:
@@ -763,9 +809,14 @@ class TestNotionExtractorLastEditedTime:
         call_args = mock_request.call_args
         assert "databases/database-789" in call_args[0][1]
 
-    @patch("core.rag.extractor.notion_extractor.db")
     @patch("httpx.request")
-    def test_update_last_edited_time(self, mock_request, mock_db, extractor_page, mock_document_model):
+    def test_update_last_edited_time(
+        self,
+        mock_request: Mock,
+        extractor_page: NotionExtractor,
+        database: _Database,
+        persisted_document: DocumentModel,
+    ):
         """Test updating document model with last edited time."""
         # Arrange
         mock_response = Mock()
@@ -777,11 +828,11 @@ class TestNotionExtractorLastEditedTime:
         mock_request.return_value = mock_response
 
         # Act
-        extractor_page.update_last_edited_time(mock_document_model)
+        extractor_page.update_last_edited_time(persisted_document)
 
         # Assert
-        assert mock_document_model.data_source_info_dict["last_edited_time"] == "2024-11-27T18:00:00.000Z"
-        mock_db.session.commit.assert_called_once()
+        database.session.expire(persisted_document)
+        assert persisted_document.data_source_info_dict["last_edited_time"] == "2024-11-27T18:00:00.000Z"
 
     def test_update_last_edited_time_no_document(self, extractor_page):
         """Test update_last_edited_time with None document model."""
@@ -807,9 +858,10 @@ class TestNotionExtractorIntegration:
         mock_doc.data_source_info_dict = {"last_edited_time": "2024-01-01T00:00:00.000Z"}
         return mock_doc
 
-    @patch("core.rag.extractor.notion_extractor.db")
     @patch("httpx.request")
-    def test_extract_page_complete_workflow(self, mock_request, mock_db, mock_document_model):
+    def test_extract_page_complete_workflow(
+        self, mock_request: Mock, database: _Database, persisted_document: DocumentModel
+    ):
         """Test complete page extraction workflow."""
         # Arrange
         extractor = NotionExtractor(
@@ -818,7 +870,7 @@ class TestNotionExtractorIntegration:
             notion_page_type="page",
             tenant_id="tenant-789",
             notion_access_token="test-token",
-            document_model=mock_document_model,
+            document_model=persisted_document,
         )
 
         # Mock last edited time request
@@ -869,11 +921,18 @@ class TestNotionExtractorIntegration:
         assert isinstance(documents[0], Document)
         assert "# Test Page" in documents[0].page_content
         assert "Test content" in documents[0].page_content
+        database.session.expire(persisted_document)
+        assert persisted_document.data_source_info_dict["last_edited_time"] == "2024-11-27T20:00:00.000Z"
 
-    @patch("core.rag.extractor.notion_extractor.db")
     @patch("httpx.post")
     @patch("httpx.request")
-    def test_extract_database_complete_workflow(self, mock_request, mock_post, mock_db, mock_document_model):
+    def test_extract_database_complete_workflow(
+        self,
+        mock_request: Mock,
+        mock_post: Mock,
+        database: _Database,
+        persisted_document: DocumentModel,
+    ):
         """Test complete database extraction workflow."""
         # Arrange
         extractor = NotionExtractor(
@@ -882,7 +941,7 @@ class TestNotionExtractorIntegration:
             notion_page_type="database",
             tenant_id="tenant-789",
             notion_access_token="test-token",
-            document_model=mock_document_model,
+            document_model=persisted_document,
         )
 
         # Mock last edited time request
@@ -921,6 +980,8 @@ class TestNotionExtractorIntegration:
         assert isinstance(documents[0], Document)
         assert "Name:Item 1" in documents[0].page_content
         assert "Status:Active" in documents[0].page_content
+        database.session.expire(persisted_document)
+        assert persisted_document.data_source_info_dict["last_edited_time"] == "2024-11-27T20:00:00.000Z"
 
     def test_extract_invalid_page_type(self):
         """Test extract with invalid page type."""

api/tests/unit_tests/core/rag/extractor/test_excel_extractor.py

@@ -2,9 +2,21 @@ from types import SimpleNamespace
 
 import pandas as pd
 import pytest
+from sqlalchemy import Engine, select
+from sqlalchemy.orm import Session, sessionmaker
 
 import core.rag.extractor.excel_extractor as excel_module
 from core.rag.extractor.excel_extractor import ExcelExtractor
+from models.base import TypeBase
+from models.model import UploadFile
+
+
+@pytest.fixture
+def database_session_maker(sqlite_engine: Engine, monkeypatch: pytest.MonkeyPatch) -> sessionmaker[Session]:
+    TypeBase.metadata.create_all(sqlite_engine, tables=[UploadFile.__table__])
+    session_maker = sessionmaker(bind=sqlite_engine, expire_on_commit=False)
+    monkeypatch.setattr(excel_module.session_factory, "create_session", session_maker)
+    return session_maker
 
 
 class _FakeCell:
@@ -58,82 +70,22 @@ class _FakeImage:
         return self._raw_data
 
 
-class _FieldExpression:
-    def __eq__(self, other):
-        return ("eq", other)
-
-    def in_(self, values):
-        return ("in", tuple(values))
-
-
-class _SelectStub:
-    def where(self, *args, **kwargs):
-        return self
-
-
-class _FakeUploadFile:
-    tenant_id = _FieldExpression()
-    key = _FieldExpression()
-    _i = 0
-
-    def __init__(self, **kwargs):
-        type(self)._i += 1
-        self.id = f"u{self._i}"
-        self.key = kwargs["key"]
-
-
-class _PersistentSession:
-    def __init__(self, persisted):
-        self._persisted = persisted
-        self.added = []
-        self.commit_count = 0
-
-    def __enter__(self):
-        return self
-
-    def __exit__(self, exc_type, exc, tb):
-        return False
-
-    def scalars(self, _stmt):
-        return SimpleNamespace(all=lambda: list(self._persisted.values()))
-
-    def add_all(self, objects) -> None:
-        self.added.extend(objects)
-
-    def commit(self) -> None:
-        self.commit_count += 1
-        for upload_file in self.added:
-            self._persisted[upload_file.key] = upload_file
-        self.added.clear()
-
-
-class _PersistentSessionFactory:
-    def __init__(self):
-        self.persisted = {}
-        self.sessions = []
-
-    def create_session(self):
-        session = _PersistentSession(self.persisted)
-        self.sessions.append(session)
-        return session
-
-
 def _patch_image_persistence(monkeypatch: pytest.MonkeyPatch):
     saves: list[tuple[str, bytes]] = []
-    session_factory = _PersistentSessionFactory()
 
     def save(key: str, data: bytes) -> None:
         saves.append((key, data))
 
-    _FakeUploadFile._i = 0
-    monkeypatch.setattr(excel_module, "storage", SimpleNamespace(save=save))
-    monkeypatch.setattr(excel_module, "session_factory", session_factory)
-    monkeypatch.setattr(excel_module, "select", lambda *args, **kwargs: _SelectStub())
-    monkeypatch.setattr(excel_module, "UploadFile", _FakeUploadFile)
+    monkeypatch.setattr(excel_module.storage, "save", save)
     monkeypatch.setattr(excel_module.dify_config, "FILES_URL", "http://files.local", raising=False)
     monkeypatch.setattr(excel_module.dify_config, "STORAGE_TYPE", "local", raising=False)
 
-    return saves, session_factory
+    return saves
+
+
+def _get_upload_files(session_maker: sessionmaker[Session]) -> list[UploadFile]:
+    with session_maker() as session:
+        return list(session.scalars(select(UploadFile)).all())
 
 
 class TestExcelExtractor:
@@ -160,7 +112,11 @@ class TestExcelExtractor:
         assert docs[1].page_content == '"Name":"";"Link":"123"'
         assert all(doc.metadata["source"] == "/tmp/sample.xlsx" for doc in docs)
 
-    def test_extract_xlsx_turns_embedded_images_into_markdown_links(self, monkeypatch: pytest.MonkeyPatch):
+    def test_extract_xlsx_turns_embedded_images_into_markdown_links(
+        self,
+        monkeypatch: pytest.MonkeyPatch,
+        database_session_maker: sessionmaker[Session],
+    ):
         image_bytes = b"\x89PNG\r\n\x1a\nexcel-image"
         sheet = _FakeSheet(
             header_rows=[("Question", "Answer", "Image")],
@@ -175,7 +131,7 @@ class TestExcelExtractor:
         )
         workbook = _FakeWorkbook({"Data": sheet})
         monkeypatch.setattr(excel_module, "load_workbook", lambda *args, **kwargs: workbook)
-        saves, session_factory = _patch_image_persistence(monkeypatch)
+        saves = _patch_image_persistence(monkeypatch)
 
         extractor = ExcelExtractor(
             "/tmp/sample.xlsx",
@@ -184,23 +140,30 @@ class TestExcelExtractor:
             source_file_id="source-file-1",
         )
         docs = extractor.extract()
+        upload_files = _get_upload_files(database_session_maker)
 
         assert workbook.closed is True
         assert len(docs) == 2
+        assert len(upload_files) == 1
         assert docs[0].page_content == (
             '"Question":"Q1";"Answer":"A1";'
-            '"Image":"![image](http://files.local/files/u1/file-preview) '
-            '![image](http://files.local/files/u1/file-preview)"'
+            f'"Image":"![image](http://files.local/files/{upload_files[0].id}/file-preview) '
+            f'![image](http://files.local/files/{upload_files[0].id}/file-preview)"'
         )
         assert docs[1].page_content == '"Question":"Q2";"Answer":"A2";"Image":""'
         assert len(saves) == 1
         assert saves[0][0].startswith("image_files/tenant-1/source-file-1/")
         assert saves[0][0].endswith(".png")
         assert saves[0][1] == image_bytes
-        assert len(session_factory.persisted) == 1
-        assert [session.commit_count for session in session_factory.sessions] == [1]
+        assert upload_files[0].tenant_id == "tenant-1"
+        assert upload_files[0].key == saves[0][0]
+        assert upload_files[0].used is True
 
-    def test_extract_xlsx_keeps_rows_with_only_embedded_images(self, monkeypatch: pytest.MonkeyPatch):
+    def test_extract_xlsx_keeps_rows_with_only_embedded_images(
+        self,
+        monkeypatch: pytest.MonkeyPatch,
+        database_session_maker: sessionmaker[Session],
+    ):
         image_bytes = b"\x89PNG\r\n\x1a\nimage-only-row"
         sheet = _FakeSheet(
             header_rows=[("Question", "Answer", "Image")],
@@ -212,7 +175,7 @@ class TestExcelExtractor:
         )
         workbook = _FakeWorkbook({"Data": sheet})
         monkeypatch.setattr(excel_module, "load_workbook", lambda *args, **kwargs: workbook)
-        saves, session_factory = _patch_image_persistence(monkeypatch)
+        saves = _patch_image_persistence(monkeypatch)
 
         extractor = ExcelExtractor(
             "/tmp/sample.xlsx",
@@ -221,17 +184,21 @@ class TestExcelExtractor:
             source_file_id="source-file-1",
         )
         docs = extractor.extract()
+        upload_files = _get_upload_files(database_session_maker)
 
         assert workbook.closed is True
         assert len(docs) == 1
+        assert len(upload_files) == 1
         assert docs[0].page_content == (
-            '"Question":"";"Answer":"";"Image":"![image](http://files.local/files/u1/file-preview)"'
+            f'"Question":"";"Answer":"";"Image":"![image](http://files.local/files/{upload_files[0].id}/file-preview)"'
         )
         assert len(saves) == 1
-        assert len(session_factory.persisted) == 1
-        assert [session.commit_count for session in session_factory.sessions] == [1]
 
-    def test_extract_xlsx_reuses_existing_embedded_image_uploads_on_retry(self, monkeypatch: pytest.MonkeyPatch):
+    def test_extract_xlsx_reuses_existing_embedded_image_uploads_on_retry(
+        self,
+        monkeypatch: pytest.MonkeyPatch,
+        database_session_maker: sessionmaker[Session],
+    ):
         image_bytes = b"\x89PNG\r\n\x1a\nretry-safe-image"
         workbooks = [
             _FakeWorkbook(
@@ -254,7 +221,7 @@ class TestExcelExtractor:
             ),
         ]
         monkeypatch.setattr(excel_module, "load_workbook", lambda *args, **kwargs: workbooks.pop(0))
-        saves, session_factory = _patch_image_persistence(monkeypatch)
+        saves = _patch_image_persistence(monkeypatch)
 
         extractor = ExcelExtractor(
             "/tmp/sample.xlsx",
@@ -264,16 +231,17 @@ class TestExcelExtractor:
         )
         first_docs = extractor.extract()
         second_docs = extractor.extract()
+        upload_files = _get_upload_files(database_session_maker)
+        assert len(upload_files) == 1
 
         expected_page_content = (
-            '"Question":"Q1";"Answer":"A1";"Image":"![image](http://files.local/files/u1/file-preview)"'
+            '"Question":"Q1";"Answer":"A1";'
+            f'"Image":"![image](http://files.local/files/{upload_files[0].id}/file-preview)"'
         )
 
         assert first_docs[0].page_content == expected_page_content
         assert second_docs[0].page_content == expected_page_content
         assert len(saves) == 1
-        assert len(session_factory.persisted) == 1
-        assert [session.commit_count for session in session_factory.sessions] == [1, 0]
 
     def test_extract_xls_path(self, monkeypatch: pytest.MonkeyPatch):
         class FakeExcelFile:

api/tests/unit_tests/core/workflow/nodes/agent_v2/test_runtime_request_builder.py

@@ -5,6 +5,7 @@ from typing import cast
 
 import pytest
 from agenton.compositor import CompositorSessionSnapshot
+from dify_agent.layers.config import DifyConfigSkillConfig
 from dify_agent.layers.dify_core_tools import DifyCoreToolConfig, DifyCoreToolsLayerConfig
 from dify_agent.layers.dify_plugin import DifyPluginToolConfig, DifyPluginToolsLayerConfig
 from dify_agent.protocol import DIFY_AGENT_HISTORY_LAYER_ID, DIFY_AGENT_MODEL_LAYER_ID
@@ -40,6 +41,14 @@ from models.agent_config_entities import (
 )
 
 
+@pytest.fixture(autouse=True)
+def _no_runtime_agent_skills(monkeypatch: pytest.MonkeyPatch):
+    monkeypatch.setattr(
+        "core.workflow.nodes.agent_v2.runtime_request_builder.load_runtime_agent_skill_configs",
+        lambda *, tenant_id, agent_id: [],
+    )
+
+
 class FakeCredentialsProvider:
     def fetch(self, provider_name: str, model_name: str) -> dict[str, object]:
         assert provider_name == "openai"
@@ -1420,6 +1429,30 @@ def test_build_config_layer_config_includes_soul_context_and_mentions():
     assert warnings == []
 
 
+def test_build_config_layer_config_includes_runtime_agent_skills():
+    from core.workflow.nodes.agent_v2.runtime_request_builder import build_config_layer_config
+
+    soul = AgentSoulConfig(
+        prompt={"system_prompt": "Use [§skill:workspace-skill:Workspace Skill§]."},
+        model=AgentSoulModelConfig(plugin_id="langgenius/openai", model_provider="openai", model="gpt-test"),
+    )
+    config, warnings = build_config_layer_config(
+        soul,
+        runtime_config_skills=[
+            DifyConfigSkillConfig(
+                name="workspace-skill",
+                description="Bound workspace skill.",
+                size=123,
+                mime_type="application/zip",
+            )
+        ],
+    )
+
+    assert [skill.name for skill in config.skills] == ["workspace-skill"]
+    assert config.mentioned_skill_names == ["workspace-skill"]
+    assert warnings == []
+
+
 def test_build_config_layer_config_returns_empty_config_for_empty_agent_soul():
     from core.workflow.nodes.agent_v2.runtime_request_builder import build_config_layer_config
 
@@ -1505,6 +1538,33 @@ def test_workflow_run_request_contains_config_layer():
     assert any(spec.name == DIFY_CONFIG_LAYER_ID and spec.type == "dify.config" for spec in specs)
 
 
+def test_workflow_run_request_includes_bound_workspace_skills(monkeypatch: pytest.MonkeyPatch):
+    monkeypatch.setattr(
+        "core.workflow.nodes.agent_v2.runtime_request_builder.load_runtime_agent_skill_configs",
+        lambda *, tenant_id, agent_id: [
+            DifyConfigSkillConfig(
+                name="workspace-skill",
+                description="Bound workspace skill.",
+                size=123,
+                mime_type="application/zip",
+            )
+        ],
+    )
+    context = _context()
+    context.snapshot.config_snapshot = AgentSoulConfig(
+        prompt={"system_prompt": "Use [§skill:workspace-skill:Workspace Skill§]."},
+        model=AgentSoulModelConfig(plugin_id="langgenius/openai", model_provider="openai", model="gpt-test"),
+    )
+
+    result = WorkflowAgentRuntimeRequestBuilder(credentials_provider=FakeCredentialsProvider()).build(context)
+
+    config = next(layer for layer in result.request.composition.layers if layer.name == DIFY_CONFIG_LAYER_ID)
+    assert [skill.name for skill in config.config.skills] == ["workspace-skill"]
+    assert config.config.mentioned_skill_names == ["workspace-skill"]
+    soul_prompt = next(layer for layer in result.request.composition.layers if layer.name == "agent_soul_prompt")
+    assert soul_prompt.config.prefix == "Use workspace-skill."
+
+
 def test_workflow_runtime_expands_config_mentions_in_agent_soul_prompt():
     context = _context()
     context.snapshot.config_snapshot = _soul_with_config_assets()

api/tests/unit_tests/core/workflow/test_node_factory.py

@@ -461,7 +461,6 @@ class TestDifyNodeFactoryCreateNode:
     def factory(self):
         factory = object.__new__(node_factory.DifyNodeFactory)
         factory.graph_init_params = sentinel.graph_init_params
-        factory.graph_init_params.run_context = {}
         factory.graph_runtime_state = SimpleNamespace(variable_pool=MagicMock())
         factory._dify_context = SimpleNamespace(
             tenant_id="tenant-id",
@@ -703,44 +702,6 @@ class TestDifyNodeFactoryCreateNode:
             node_data=node_data,
             model_instance=sentinel.model_instance,
             request_metadata={"app_id": "app-id"},
-            before_invoke=None,
-        )
-        assert kwargs["model_instance"] is wrapped_model_instance
-
-    def test_build_llm_compatible_node_init_kwargs_passes_before_llm_hook(self, factory):
-        before_llm_invoke = MagicMock()
-        factory.graph_init_params.run_context[node_factory.DIFY_BEFORE_LLM_INVOKE_KEY] = before_llm_invoke
-        node_data = LLMNodeData.model_validate(
-            {
-                "type": BuiltinNodeTypes.LLM,
-                "title": "LLM",
-                "model": {"provider": "provider", "name": "model", "mode": "chat", "completion_params": {}},
-                "prompt_template": [{"role": "system", "text": "x"}],
-                "context": {"enabled": False, "variable_selector": []},
-                "vision": {"enabled": False},
-            }
-        )
-        wrapped_model_instance = sentinel.wrapped_model_instance
-        factory._build_model_instance_for_llm_node = MagicMock(return_value=sentinel.model_instance)
-        factory._build_memory_for_llm_node = MagicMock(return_value=sentinel.memory)
-
-        with patch.object(factory, "_wrap_model_instance_for_node", return_value=wrapped_model_instance) as wrap_model:
-            kwargs = factory._build_llm_compatible_node_init_kwargs(
-                node_class=sentinel.node_class,
-                node_data=node_data,
-                wrap_model_instance=True,
-                include_http_client=False,
-                include_llm_file_saver=False,
-                include_prompt_message_serializer=False,
-                include_retriever_attachment_loader=False,
-                include_jinja2_template_renderer=False,
-            )
-
-        wrap_model.assert_called_once_with(
-            node_data=node_data,
-            model_instance=sentinel.model_instance,
-            request_metadata={"app_id": "app-id"},
-            before_invoke=before_llm_invoke,
         )
         assert kwargs["model_instance"] is wrapped_model_instance
 

api/tests/unit_tests/core/workflow/test_node_runtime.py

@@ -228,12 +228,7 @@ def test_dify_prepared_llm_wraps_model_instance_calls() -> None:
     model_schema = _build_model_schema()
     model_instance = _ModelInstanceStub(model_schema=model_schema)
     model_type_instance = model_instance.model_type_instance
-    before_invoke = Mock(return_value={"temperature": 0.05})
-    prepared = DifyPreparedLLM(
-        model_instance,
-        request_metadata={"app_id": "app-id"},
-        before_invoke=before_invoke,
-    )
+    prepared = DifyPreparedLLM(model_instance, request_metadata={"app_id": "app-id"})
 
     assert prepared.provider == "langgenius/openai/openai"
     assert prepared.model_name == "gpt-4o-mini"
@@ -253,10 +248,9 @@ def test_dify_prepared_llm_wraps_model_instance_calls() -> None:
     )
 
     model_type_instance.get_model_schema.assert_called_once_with("gpt-4o-mini", {"api_key": "secret"})
-    before_invoke.assert_called_once_with([], {"temperature": 0.1})
     model_instance.invoke_llm.assert_called_once_with(
         prompt_messages=[],
-        model_parameters={"temperature": 0.05},
+        model_parameters={"temperature": 0.1},
         tools=[],
         stop=[],
         stream=False,
@@ -275,8 +269,7 @@ def test_dify_prepared_llm_requires_model_schema() -> None:
 
 def test_dify_prepared_llm_delegates_structured_output_helper(monkeypatch: pytest.MonkeyPatch) -> None:
     model_instance = _ModelInstanceStub(model_schema=_build_model_schema())
-    before_invoke = Mock(return_value={"temperature": 0.15})
-    prepared = DifyPreparedLLM(model_instance, before_invoke=before_invoke)
+    prepared = DifyPreparedLLM(model_instance)
     invoke_structured = MagicMock(return_value=sentinel.structured)
     monkeypatch.setattr(node_runtime, "invoke_llm_with_structured_output", invoke_structured)
 
@@ -289,14 +282,13 @@ def test_dify_prepared_llm_delegates_structured_output_helper(monkeypatch: pytes
     )
 
     assert result is sentinel.structured
-    before_invoke.assert_called_once_with([], {"temperature": 0.2})
     invoke_structured.assert_called_once_with(
         provider="langgenius/openai/openai",
         model_schema=prepared.get_model_schema(),
         model_instance=model_instance,
         prompt_messages=[],
         json_schema={"type": "object"},
-        model_parameters={"temperature": 0.15},
+        model_parameters={"temperature": 0.2},
         stop=["done"],
         stream=True,
     )
@@ -328,8 +320,7 @@ def test_dify_prepared_polling_llm_delegates_to_plugin_runtime() -> None:
         model_runtime=plugin_runtime,
     )
 
-    before_invoke = Mock(return_value={"temperature": 0.05})
-    prepared = DifyPreparedPollingLLM(model_instance, before_invoke=before_invoke)
+    prepared = DifyPreparedPollingLLM(model_instance)
 
     assert isinstance(prepared, LLMPollingCapableProtocol)
     assert (
@@ -342,7 +333,6 @@ def test_dify_prepared_polling_llm_delegates_to_plugin_runtime() -> None:
         )
         == polling_result
     )
-    before_invoke.assert_called_once_with([], {"temperature": 0.1})
     assert (
         prepared.check_llm_polling(
             plugin_state={"task_id": "poll-1"},
@@ -354,7 +344,7 @@ def test_dify_prepared_polling_llm_delegates_to_plugin_runtime() -> None:
         model="gpt-4o-mini",
         credentials={"api_key": "secret"},
         prompt_messages=[],
-        model_parameters={"temperature": 0.05},
+        model_parameters={"temperature": 0.1},
         tools=[],
         stop=("END",),
         json_schema={"type": "object"},

api/tests/unit_tests/libs/test_helper.py

@@ -2,7 +2,7 @@ from datetime import datetime
 
 import pytest
 
-from libs.helper import OptionalTimestampField, email, escape_like_pattern, extract_tenant_id
+from libs.helper import OptionalTimestampField, alphanumeric, email, escape_like_pattern, extract_tenant_id
 from models.account import Account
 from models.model import EndUser
 
@@ -153,3 +153,47 @@ class TestEmailValidator:
     def test_invalid_email_rejected(self):
         with pytest.raises(ValueError, match="not a valid email"):
             email("not-an-email")
+
+
+class TestAlphanumericValidator:
+    """Tests for the alphanumeric() validator — regression for #39666."""
+
+    def test_valid_alphanumeric_accepted(self):
+        assert alphanumeric("tool_name") == "tool_name"
+        assert alphanumeric("Tool123") == "Tool123"
+        assert alphanumeric("_underscore_start") == "_underscore_start"
+        assert alphanumeric("a") == "a"
+
+    def test_trailing_newline_rejected(self):
+        # re.match with $ accepts a trailing \n in Python; re.fullmatch does not.
+        # This was the pre-fix behaviour: alphanumeric("tool\n") returned "tool\n".
+        with pytest.raises(ValueError, match="not a valid alphanumeric value"):
+            alphanumeric("tool_name\n")
+
+    def test_trailing_carriage_return_rejected(self):
+        with pytest.raises(ValueError, match="not a valid alphanumeric value"):
+            alphanumeric("tool_name\r")
+
+    def test_trailing_crlf_rejected(self):
+        with pytest.raises(ValueError, match="not a valid alphanumeric value"):
+            alphanumeric("tool_name\r\n")
+
+    def test_leading_newline_rejected(self):
+        with pytest.raises(ValueError, match="not a valid alphanumeric value"):
+            alphanumeric("\ntool_name")
+
+    def test_embedded_whitespace_rejected(self):
+        with pytest.raises(ValueError, match="not a valid alphanumeric value"):
+            alphanumeric("tool name")
+
+    def test_empty_string_rejected(self):
+        with pytest.raises(ValueError, match="not a valid alphanumeric value"):
+            alphanumeric("")
+
+    def test_special_characters_rejected(self):
+        with pytest.raises(ValueError, match="not a valid alphanumeric value"):
+            alphanumeric("tool-name")
+        with pytest.raises(ValueError, match="not a valid alphanumeric value"):
+            alphanumeric("tool.name")
+        with pytest.raises(ValueError, match="not a valid alphanumeric value"):
+            alphanumeric("tool/name")

api/tests/unit_tests/services/agent/test_skill_package_service.py

@@ -13,7 +13,7 @@ from services.agent import skill_package_service as skill_package_service_module
 from services.agent.skill_package_service import NormalizedSkillPackage, SkillPackageError, SkillPackageService
 
 _SKILL_MD = """---
-name: PDF Toolkit
+name: pdf-toolkit
 description: Tools for working with PDF files.
 ---
 
@@ -43,7 +43,7 @@ def _archive_members(content: bytes) -> list[str]:
 def test_valid_skill_normalizes_manifest():
     manifest = _normalize({"SKILL.md": _SKILL_MD.encode(), "scripts/run.py": b"print('hi')\n"}).manifest
 
-    assert manifest.name == "PDF Toolkit"
+    assert manifest.name == "pdf-toolkit"
     assert manifest.description == "Tools for working with PDF files."
     assert manifest.entry_path == "SKILL.md"
     assert set(manifest.files) == {"SKILL.md", "scripts/run.py"}
@@ -51,10 +51,10 @@ def test_valid_skill_normalizes_manifest():
     assert len(manifest.hash) == 64
 
 
-def test_name_falls_back_to_heading_without_frontmatter():
-    manifest = _normalize({"SKILL.md": b"# Heading Name\n\nbody"}).manifest
-    assert manifest.name == "Heading Name"
-    assert manifest.description == ""
+def test_name_and_description_are_required_in_frontmatter():
+    with pytest.raises(SkillPackageError) as exc_info:
+        _normalize({"SKILL.md": b"# heading-name\n\nbody"})
+    assert exc_info.value.code == "missing_skill_name"
 
 
 def test_shallowest_skill_md_preferred_during_normalization():
@@ -155,7 +155,18 @@ def test_validate_and_normalize_strips_deeper_selected_skill_root():
         ({"README.md": b"x"}, "skill.zip", "missing_skill_md"),
         ({"SKILL.md": _SKILL_MD.encode()}, "skill.tar", "unsupported_extension"),
         ({"SKILL.md": b""}, "skill.zip", "empty_skill_md"),
-        ({"SKILL.md": b"no name here"}, "skill.zip", "missing_skill_name"),
+        ({"SKILL.md": b"---\ndescription: valid\n---\n# no name here"}, "skill.zip", "missing_skill_name"),
+        ({"SKILL.md": b"---\nname: pdf-toolkit\n---\n# no description"}, "skill.zip", "missing_skill_description"),
+        (
+            {"SKILL.md": b"---\nname: PDF Toolkit\ndescription: valid\n---\n# invalid name"},
+            "skill.zip",
+            "invalid_skill_name",
+        ),
+        (
+            {"SKILL.md": f"---\nname: pdf-toolkit\ndescription: {'x' * 1025}\n---\n# long".encode()},
+            "skill.zip",
+            "invalid_skill_description",
+        ),
         ({"SKILL.md": b"\xff\xfenot utf8"}, "skill.zip", "skill_md_not_utf8"),
     ],
 )
@@ -224,10 +235,10 @@ def test_bad_frontmatter_yaml_rejected():
     assert exc_info.value.code == "invalid_frontmatter"
 
 
-def test_unterminated_frontmatter_falls_back_to_heading():
-    # leading '---' with no closing fence -> no frontmatter, use the heading
-    manifest = _normalize({"SKILL.md": b"---\n# Heading Wins\nbody"}).manifest
-    assert manifest.name == "Heading Wins"
+def test_unterminated_frontmatter_rejected():
+    with pytest.raises(SkillPackageError) as exc_info:
+        _normalize({"SKILL.md": b"---\n# heading-wins\nbody"})
+    assert exc_info.value.code == "missing_skill_name"
 
 
 def test_validate_and_normalize_rejects_files_outside_selected_skill_root():

api/tests/unit_tests/services/agent/test_skill_standardize_service.py

@@ -20,7 +20,7 @@ _AGENT_ID = "22222222-2222-2222-2222-222222222222"
 _USER_ID = "33333333-3333-3333-3333-333333333333"
 
 _SKILL_MD = b"""---
-name: PDF Toolkit
+name: pdf-toolkit
 description: Work with PDFs.
 ---
 
@@ -121,7 +121,7 @@ def test_standardize_creates_drive_owned_toolfiles_and_commits_archive_manifest(
     assert skill_row.is_skill is True
     assert skill_row.skill_metadata is not None
     skill_metadata = DriveSkillMetadata.model_validate_json(skill_row.skill_metadata)
-    assert skill_metadata.name == "PDF Toolkit"
+    assert skill_metadata.name == "pdf-toolkit"
     assert skill_metadata.manifest_files == ["SKILL.md", "scripts/run.py"]
     assert archive_row.file_kind == AgentDriveFileKind.TOOL_FILE
     assert archive_row.file_id == archive_tool_file.id
@@ -132,7 +132,7 @@ def test_standardize_creates_drive_owned_toolfiles_and_commits_archive_manifest(
     # The returned upload response carries only the drive-derived fields the UI needs.
     skill = result["skill"]
     assert skill["path"] == "pdf-toolkit"
-    assert skill["name"] == "PDF Toolkit"
+    assert skill["name"] == "pdf-toolkit"
     assert skill["archive_key"] == "pdf-toolkit/.DIFY-SKILL-FULL.zip"
     assert skill["skill_md_key"] == "pdf-toolkit/SKILL.md"
     assert result["manifest"]["entry_path"] == "SKILL.md"

api/tests/unit_tests/services/retention/workflow_run/test_restore_archived_workflow_run.py

@@ -10,14 +10,19 @@ import io
 import json
 import logging
 import zipfile
+from collections.abc import Iterator
+from dataclasses import dataclass
 from datetime import datetime
-from unittest.mock import Mock, create_autospec, patch
+from unittest.mock import Mock, patch
 
 import pytest
 from pydantic import ValidationError
-from sqlalchemy import Column, Integer, MetaData, String, Table
+from sqlalchemy import Column, Engine, Integer, MetaData, String, Table, delete, event, func, select
+from sqlalchemy.dialects.sqlite import insert as sqlite_insert
+from sqlalchemy.orm import Session, sessionmaker
 
 from libs.archive_storage import ArchiveStorageNotConfiguredError
+from models.enums import CreatorUserRole
 from models.trigger import WorkflowTriggerLog
 from models.workflow import (
     WorkflowAppLog,
@@ -28,6 +33,7 @@ from models.workflow import (
     WorkflowPauseReason,
     WorkflowRun,
 )
+from services.retention.workflow_run import restore_archived_workflow_run as restore_module
 from services.retention.workflow_run.restore_archived_workflow_run import (
     SCHEMA_MAPPERS,
     TABLE_MODELS,
@@ -36,24 +42,49 @@ from services.retention.workflow_run.restore_archived_workflow_run import (
 )
 
 
+@dataclass(frozen=True)
+class Database:
+    """Explicit SQLite engine, caller session, and real service-owned session factory."""
+
+    engine: Engine
+    session: Session
+    session_maker: sessionmaker[Session]
+
+
+@pytest.fixture
+def database(sqlite_engine: Engine, monkeypatch: pytest.MonkeyPatch) -> Iterator[Database]:
+    WorkflowRun.metadata.create_all(
+        sqlite_engine,
+        tables=[WorkflowRun.__table__, WorkflowAppLog.__table__, WorkflowArchiveLog.__table__],
+    )
+    session_maker = sessionmaker(bind=sqlite_engine, expire_on_commit=False)
+    with session_maker() as session:
+        database = Database(engine=sqlite_engine, session=session, session_maker=session_maker)
+        monkeypatch.setattr(restore_module, "db", database)
+        # Production constructs PostgreSQL's equivalent statement; SQLite's
+        # dialect keeps the conflict behavior executable in these tests.
+        monkeypatch.setattr(restore_module, "pg_insert", sqlite_insert)
+        yield database
+
+
 class WorkflowRunRestoreTestDataFactory:
     """
-    Factory for creating test data and mock objects.
+    Factory for creating persisted-model-compatible test data.
 
     Provides reusable methods to create consistent mock objects for testing
     workflow run restore operations.
     """
 
     @staticmethod
-    def create_workflow_run_mock(
+    def create_workflow_run(
         run_id: str = "run-123",
         tenant_id: str = "tenant-123",
         app_id: str = "app-123",
         created_at: datetime | None = None,
         **kwargs,
-    ) -> Mock:
+    ) -> WorkflowRun:
         """
-        Create a mock WorkflowRun object.
+        Create a concrete WorkflowRun object.
 
         Args:
             run_id: Unique identifier for the workflow run
@@ -63,27 +94,44 @@ class WorkflowRunRestoreTestDataFactory:
             **kwargs: Additional attributes to set on the mock
 
         Returns:
-            Mock WorkflowRun object with specified attributes
+            WorkflowRun object with specified attributes
         """
-        run = create_autospec(WorkflowRun, instance=True)
-        run.id = run_id
-        run.tenant_id = tenant_id
-        run.app_id = app_id
-        run.created_at = created_at or datetime(2024, 1, 1, 12, 0, 0)
-        for key, value in kwargs.items():
-            setattr(run, key, value)
+        attrs = {
+            "id": run_id,
+            "tenant_id": tenant_id,
+            "app_id": app_id,
+            "workflow_id": "workflow-123",
+            "type": "workflow",
+            "triggered_from": "app-run",
+            "version": "1",
+            "graph": None,
+            "inputs": None,
+            "status": "succeeded",
+            "outputs": "{}",
+            "error": None,
+            "elapsed_time": 0,
+            "total_tokens": 0,
+            "total_steps": 0,
+            "created_by_role": CreatorUserRole.ACCOUNT,
+            "created_by": "user-123",
+            "created_at": created_at or datetime(2024, 1, 1, 12, 0, 0),
+            "finished_at": None,
+            "exceptions_count": 0,
+        }
+        attrs.update(kwargs)
+        run = WorkflowRun(**attrs)
         return run
 
     @staticmethod
-    def create_workflow_archive_log_mock(
+    def create_workflow_archive_log(
         run_id: str = "run-123",
         tenant_id: str = "tenant-123",
         app_id: str = "app-123",
         created_at: datetime | None = None,
         **kwargs,
-    ) -> Mock:
+    ) -> WorkflowArchiveLog:
         """
-        Create a mock WorkflowArchiveLog object.
+        Create a concrete WorkflowArchiveLog object.
 
         Args:
             run_id: Unique identifier for the workflow run
@@ -93,16 +141,32 @@ class WorkflowRunRestoreTestDataFactory:
             **kwargs: Additional attributes to set on the mock
 
         Returns:
-            Mock WorkflowArchiveLog object with specified attributes
+            WorkflowArchiveLog object with specified attributes
         """
-        archive_log = create_autospec(WorkflowArchiveLog, instance=True)
-        archive_log.workflow_run_id = run_id
-        archive_log.tenant_id = tenant_id
-        archive_log.app_id = app_id
-        archive_log.run_created_at = created_at or datetime(2024, 1, 1, 12, 0, 0)
-        for key, value in kwargs.items():
-            setattr(archive_log, key, value)
-        return archive_log
+        attrs = {
+            "tenant_id": tenant_id,
+            "app_id": app_id,
+            "workflow_id": "workflow-123",
+            "workflow_run_id": run_id,
+            "created_by_role": CreatorUserRole.ACCOUNT,
+            "created_by": "user-123",
+            "log_id": None,
+            "log_created_at": None,
+            "log_created_from": None,
+            "run_version": "1",
+            "run_status": "succeeded",
+            "run_triggered_from": "app-run",
+            "run_error": None,
+            "run_elapsed_time": 0,
+            "run_total_tokens": 0,
+            "run_total_steps": 0,
+            "run_created_at": created_at or datetime(2024, 1, 1, 12, 0, 0),
+            "run_finished_at": None,
+            "run_exceptions_count": 0,
+            "trigger_metadata": None,
+        }
+        attrs.update(kwargs)
+        return WorkflowArchiveLog(**attrs)
 
     @staticmethod
     def create_archive_zip_mock(
@@ -137,7 +201,7 @@ class WorkflowRunRestoreTestDataFactory:
                         "app_id": "app-123",
                         "workflow_id": "workflow-123",
                         "type": "workflow",
-                        "triggered_from": "app",
+                        "triggered_from": "app-run",
                         "version": "1",
                         "status": "succeeded",
                         "created_by_role": "account",
@@ -151,7 +215,7 @@ class WorkflowRunRestoreTestDataFactory:
                         "app_id": "app-123",
                         "workflow_id": "workflow-123",
                         "workflow_run_id": "run-123",
-                        "created_from": "app",
+                        "created_from": "service-api",
                         "created_by_role": "account",
                         "created_by": "user-123",
                     },
@@ -161,7 +225,7 @@ class WorkflowRunRestoreTestDataFactory:
                         "app_id": "app-123",
                         "workflow_id": "workflow-123",
                         "workflow_run_id": "run-123",
-                        "created_from": "app",
+                        "created_from": "service-api",
                         "created_by_role": "account",
                         "created_by": "user-123",
                     },
@@ -225,14 +289,10 @@ class TestGetWorkflowRunRepo:
     """Tests for WorkflowRunRestore._get_workflow_run_repo method."""
 
     @patch("services.retention.workflow_run.restore_archived_workflow_run.DifyAPIRepositoryFactory")
-    @patch("services.retention.workflow_run.restore_archived_workflow_run.sessionmaker")
-    @patch("services.retention.workflow_run.restore_archived_workflow_run.db")
-    def test_first_call_creates_repo(self, mock_db, mock_sessionmaker, mock_factory):
+    def test_first_call_creates_repo(self, mock_factory, database: Database):
         """First call should create and cache repository."""
         restore = WorkflowRunRestore()
 
-        mock_session = Mock()
-        mock_sessionmaker.return_value = mock_session
         mock_repo = Mock()
         mock_factory.create_api_workflow_run_repository.return_value = mock_repo
 
@@ -240,8 +300,9 @@ class TestGetWorkflowRunRepo:
 
         assert result is mock_repo
         assert restore.workflow_run_repo is mock_repo
-        mock_sessionmaker.assert_called_once_with(bind=mock_db.engine, expire_on_commit=False)
-        mock_factory.create_api_workflow_run_repository.assert_called_once_with(mock_session)
+        session_maker = mock_factory.create_api_workflow_run_repository.call_args.args[0]
+        assert isinstance(session_maker, sessionmaker)
+        assert session_maker.kw["bind"] is database.engine
 
     def test_cached_repo_returned(self):
         """Subsequent calls should return cached repository."""
@@ -492,47 +553,27 @@ class TestGetModelColumnInfo:
 class TestRestoreTableRecords:
     """Tests for WorkflowRunRestore._restore_table_records method."""
 
-    @patch("services.retention.workflow_run.restore_archived_workflow_run.TABLE_MODELS")
-    def test_unknown_table_returns_zero(self, mock_table_models, caplog: pytest.LogCaptureFixture):
+    def test_unknown_table_returns_zero(self, database: Database, caplog: pytest.LogCaptureFixture):
         """Should return 0 for unknown table."""
         restore = WorkflowRunRestore()
-        mock_table_models.get.return_value = None
-
-        mock_session = Mock()
         records = [{"id": "test"}]
         caplog.set_level(logging.WARNING, logger="services.retention.workflow_run.restore_archived_workflow_run")
 
-        result = restore._restore_table_records(mock_session, "unknown_table", records, schema_version="1.0")
+        result = restore._restore_table_records(database.session, "unknown_table", records, schema_version="1.0")
 
         assert result == 0
         assert "Unknown table: unknown_table" in caplog.messages
 
-    def test_empty_records_returns_zero(self):
+    def test_empty_records_returns_zero(self, database: Database):
         """Should return 0 for empty records list."""
         restore = WorkflowRunRestore()
-        mock_session = Mock()
-
-        result = restore._restore_table_records(mock_session, "workflow_runs", [], schema_version="1.0")
+        result = restore._restore_table_records(database.session, "workflow_runs", [], schema_version="1.0")
         assert result == 0
 
-    @patch("services.retention.workflow_run.restore_archived_workflow_run.pg_insert")
-    @patch("services.retention.workflow_run.restore_archived_workflow_run.cast")
-    def test_successful_restore(self, mock_cast, mock_pg_insert):
+    def test_successful_restore(self, database: Database):
         """Should successfully restore records."""
         restore = WorkflowRunRestore()
 
-        # Mock session and execution
-        mock_session = Mock()
-        mock_result = Mock()
-        mock_result.rowcount = 2
-        mock_session.execute.return_value = mock_result
-        mock_cast.return_value = mock_result
-
-        # Mock insert statement
-        mock_stmt = Mock()
-        mock_stmt.on_conflict_do_nothing.return_value = mock_stmt
-        mock_pg_insert.return_value = mock_stmt
-
         records = [
             {
                 "id": "test1",
@@ -540,7 +581,7 @@ class TestRestoreTableRecords:
                 "app_id": "app-123",
                 "workflow_id": "workflow-123",
                 "type": "workflow",
-                "triggered_from": "app",
+                "triggered_from": "app-run",
                 "version": "1",
                 "status": "succeeded",
                 "created_by_role": "account",
@@ -552,7 +593,7 @@ class TestRestoreTableRecords:
                 "app_id": "app-123",
                 "workflow_id": "workflow-123",
                 "type": "workflow",
-                "triggered_from": "app",
+                "triggered_from": "app-run",
                 "version": "1",
                 "status": "succeeded",
                 "created_by_role": "account",
@@ -560,38 +601,20 @@ class TestRestoreTableRecords:
             },
         ]
 
-        result = restore._restore_table_records(mock_session, "workflow_runs", records, schema_version="1.0")
+        result = restore._restore_table_records(database.session, "workflow_runs", records, schema_version="1.0")
 
         assert result == 2
-        mock_session.execute.assert_called_once()
+        assert database.session.scalar(select(func.count(WorkflowRun.id))) == 2
+        assert restore._restore_table_records(database.session, "workflow_runs", records, schema_version="1.0") == 0
 
-    def test_missing_required_columns_raises_error(self):
+    def test_missing_required_columns_raises_error(self, database: Database):
         """Should raise ValueError for missing required columns."""
         restore = WorkflowRunRestore()
 
-        mock_session = Mock()
-        # Use a dedicated mock model to isolate required-column validation behavior.
-        mock_model = Mock()
+        records = [{"id": "test"}]
 
-        # Mock a required column
-        required_column = Mock()
-        required_column.key = "required_field"
-        required_column.nullable = False
-        required_column.default = None
-        required_column.server_default = None
-        required_column.autoincrement = False
-        required_column.type = Mock()
-
-        # Mock the __table__ attribute properly
-        mock_table = Mock()
-        mock_table.columns = [required_column]
-        mock_model.__table__ = mock_table
-
-        records = [{"name": "test"}]  # Missing required 'required_field'
-
-        with patch.dict(TABLE_MODELS, {"test_table": mock_model}):
-            with pytest.raises(ValueError, match="Missing required columns for test_table"):
-                restore._restore_table_records(mock_session, "test_table", records, schema_version="1.0")
+        with pytest.raises(ValueError, match="Missing required columns for workflow_runs"):
+            restore._restore_table_records(database.session, "workflow_runs", records, schema_version="1.0")
 
 
 # ---------------------------------------------------------------------------
@@ -603,38 +626,38 @@ class TestRestoreFromRun:
     """Tests for WorkflowRunRestore._restore_from_run method."""
 
     @patch("services.retention.workflow_run.restore_archived_workflow_run.get_archive_storage")
-    def test_archive_storage_not_configured(self, mock_get_storage):
+    def test_archive_storage_not_configured(self, mock_get_storage, database: Database):
         """Should handle ArchiveStorageNotConfiguredError."""
         restore = WorkflowRunRestore()
         mock_get_storage.side_effect = ArchiveStorageNotConfiguredError("Storage not configured")
 
-        run = WorkflowRunRestoreTestDataFactory.create_workflow_run_mock()
+        run = WorkflowRunRestoreTestDataFactory.create_workflow_run()
 
         with patch("services.retention.workflow_run.restore_archived_workflow_run.click") as mock_click:
-            result = restore._restore_from_run(run, session_maker=lambda: Mock())
+            result = restore._restore_from_run(run, session_maker=database.session_maker)
 
         assert result.success is False
         assert "Storage not configured" in result.error
         assert result.elapsed_time > 0
 
     @patch("services.retention.workflow_run.restore_archived_workflow_run.get_archive_storage")
-    def test_archive_bundle_not_found(self, mock_get_storage):
+    def test_archive_bundle_not_found(self, mock_get_storage, database: Database):
         """Should handle FileNotFoundError when archive bundle is missing."""
         restore = WorkflowRunRestore()
         mock_storage = Mock()
         mock_storage.get_object.side_effect = FileNotFoundError("Bundle not found")
         mock_get_storage.return_value = mock_storage
 
-        run = WorkflowRunRestoreTestDataFactory.create_workflow_run_mock()
+        run = WorkflowRunRestoreTestDataFactory.create_workflow_run()
 
         with patch("services.retention.workflow_run.restore_archived_workflow_run.click") as mock_click:
-            result = restore._restore_from_run(run, session_maker=lambda: Mock())
+            result = restore._restore_from_run(run, session_maker=database.session_maker)
 
         assert result.success is False
         assert "Archive bundle not found" in result.error
 
     @patch("services.retention.workflow_run.restore_archived_workflow_run.get_archive_storage")
-    def test_dry_run_mode(self, mock_get_storage):
+    def test_dry_run_mode(self, mock_get_storage, database: Database):
         """Should handle dry run mode correctly."""
         restore = WorkflowRunRestore(dry_run=True)
 
@@ -644,23 +667,16 @@ class TestRestoreFromRun:
         mock_storage.get_object.return_value = archive_data
         mock_get_storage.return_value = mock_storage
 
-        run = WorkflowRunRestoreTestDataFactory.create_workflow_run_mock()
+        run = WorkflowRunRestoreTestDataFactory.create_workflow_run()
 
-        # Create a proper mock session with context manager support
-        mock_session = Mock()
-        mock_session.__enter__ = Mock(return_value=mock_session)
-        mock_session.__exit__ = Mock(return_value=None)
-
-        result = restore._restore_from_run(run, session_maker=lambda: mock_session)
+        result = restore._restore_from_run(run, session_maker=database.session_maker)
 
         assert result.success is True
         assert result.restored_counts["workflow_runs"] == 1
         assert result.restored_counts["workflow_app_logs"] == 2
 
     @patch("services.retention.workflow_run.restore_archived_workflow_run.get_archive_storage")
-    @patch("services.retention.workflow_run.restore_archived_workflow_run.pg_insert")
-    @patch("services.retention.workflow_run.restore_archived_workflow_run.cast")
-    def test_successful_restore(self, mock_cast, mock_pg_insert, mock_get_storage):
+    def test_successful_restore(self, mock_get_storage, database: Database):
         """Should successfully restore from archive."""
         restore = WorkflowRunRestore()
 
@@ -670,53 +686,57 @@ class TestRestoreFromRun:
         mock_storage.get_object.return_value = archive_data
         mock_get_storage.return_value = mock_storage
 
-        # Mock session with context manager support
-        mock_session = Mock()
-        mock_session.__enter__ = Mock(return_value=mock_session)
-        mock_session.__exit__ = Mock(return_value=None)
-
-        def session_maker():
-            return mock_session
-
-        # Mock database execution to return integer counts
-        mock_result_workflow_runs = Mock()
-        mock_result_workflow_runs.rowcount = 1
-        mock_result_app_logs = Mock()
-        mock_result_app_logs.rowcount = 2
-
-        # Configure session.execute to return different results based on the table
-        def mock_execute(stmt):
-            if "workflow_runs" in str(stmt):
-                return mock_result_workflow_runs
-            else:
-                return mock_result_app_logs
-
-        mock_session.execute.side_effect = mock_execute
-        mock_cast.return_value = mock_result_workflow_runs
-
-        # Mock insert statement
-        mock_stmt = Mock()
-        mock_stmt.on_conflict_do_nothing.return_value = mock_stmt
-        mock_pg_insert.return_value = mock_stmt
-
-        run = WorkflowRunRestoreTestDataFactory.create_workflow_run_mock()
+        run = WorkflowRunRestoreTestDataFactory.create_workflow_run()
+        archive_log = WorkflowRunRestoreTestDataFactory.create_workflow_archive_log()
+        database.session.add(archive_log)
+        database.session.commit()
 
         # Mock repository methods
         with patch.object(restore, "_get_workflow_run_repo") as mock_get_repo:
             mock_repo = Mock()
+            mock_repo.delete_archive_log_by_run_id.side_effect = lambda session, run_id: session.execute(
+                delete(WorkflowArchiveLog).where(WorkflowArchiveLog.workflow_run_id == run_id)
+            )
             mock_get_repo.return_value = mock_repo
 
             with patch("services.retention.workflow_run.restore_archived_workflow_run.click") as mock_click:
-                result = restore._restore_from_run(run, session_maker=session_maker)
+                result = restore._restore_from_run(run, session_maker=database.session_maker)
 
         assert result.success is True
         assert result.restored_counts["workflow_runs"] == 1
-        assert result.restored_counts["workflow_app_logs"] >= 1  # Just check it's restored
-        mock_session.commit.assert_called_once()
-        mock_repo.delete_archive_log_by_run_id.assert_called_once_with(mock_session, run.id)
+        assert result.restored_counts["workflow_app_logs"] == 2
+        database.session.expire_all()
+        assert database.session.scalar(select(func.count(WorkflowRun.id))) == 1
+        assert database.session.scalar(select(func.count(WorkflowAppLog.id))) == 2
+        assert database.session.scalar(select(func.count(WorkflowArchiveLog.id))) == 0
 
     @patch("services.retention.workflow_run.restore_archived_workflow_run.get_archive_storage")
-    def test_invalid_archive_bundle(self, mock_get_storage):
+    def test_insert_failure_rolls_back_all_tables(self, mock_get_storage, database: Database):
+        """A later table failure must roll back earlier restored rows."""
+        restore = WorkflowRunRestore()
+        mock_storage = Mock()
+        mock_storage.get_object.return_value = WorkflowRunRestoreTestDataFactory.create_archive_zip_mock()
+        mock_get_storage.return_value = mock_storage
+        run = WorkflowRunRestoreTestDataFactory.create_workflow_run()
+
+        def fail_app_log_insert(_connection, _cursor, statement, _parameters, _context, _executemany):
+            if statement.startswith("INSERT INTO workflow_app_logs"):
+                raise RuntimeError("forced app-log insert failure")
+
+        event.listen(database.engine, "before_cursor_execute", fail_app_log_insert)
+        try:
+            with patch("services.retention.workflow_run.restore_archived_workflow_run.click"):
+                result = restore._restore_from_run(run, session_maker=database.session_maker)
+        finally:
+            event.remove(database.engine, "before_cursor_execute", fail_app_log_insert)
+
+        assert result.success is False
+        assert result.error == "forced app-log insert failure"
+        assert database.session.scalar(select(func.count(WorkflowRun.id))) == 0
+        assert database.session.scalar(select(func.count(WorkflowAppLog.id))) == 0
+
+    @patch("services.retention.workflow_run.restore_archived_workflow_run.get_archive_storage")
+    def test_invalid_archive_bundle(self, mock_get_storage, database: Database):
         """Should handle invalid archive bundle."""
         restore = WorkflowRunRestore()
 
@@ -725,22 +745,17 @@ class TestRestoreFromRun:
         mock_storage.get_object.return_value = b"invalid zip data"
         mock_get_storage.return_value = mock_storage
 
-        run = WorkflowRunRestoreTestDataFactory.create_workflow_run_mock()
-
-        # Create proper mock session
-        mock_session = Mock()
-        mock_session.__enter__ = Mock(return_value=mock_session)
-        mock_session.__exit__ = Mock(return_value=None)
+        run = WorkflowRunRestoreTestDataFactory.create_workflow_run()
 
         with patch("services.retention.workflow_run.restore_archived_workflow_run.click") as mock_click:
-            result = restore._restore_from_run(run, session_maker=lambda: mock_session)
+            result = restore._restore_from_run(run, session_maker=database.session_maker)
 
         assert result.success is False
         # The error message comes from zipfile.BadZipFile which says "File is not a zip file"
         assert "File is not a zip file" in result.error
 
     @patch("services.retention.workflow_run.restore_archived_workflow_run.get_archive_storage")
-    def test_workflow_archive_log_input(self, mock_get_storage):
+    def test_workflow_archive_log_input(self, mock_get_storage, database: Database):
         """Should handle WorkflowArchiveLog input correctly."""
         restore = WorkflowRunRestore(dry_run=True)
 
@@ -750,14 +765,11 @@ class TestRestoreFromRun:
         mock_storage.get_object.return_value = archive_data
         mock_get_storage.return_value = mock_storage
 
-        archive_log = WorkflowRunRestoreTestDataFactory.create_workflow_archive_log_mock()
+        archive_log = WorkflowRunRestoreTestDataFactory.create_workflow_archive_log()
+        database.session.add(archive_log)
+        database.session.commit()
 
-        # Create proper mock session
-        mock_session = Mock()
-        mock_session.__enter__ = Mock(return_value=mock_session)
-        mock_session.__exit__ = Mock(return_value=None)
-
-        result = restore._restore_from_run(archive_log, session_maker=lambda: mock_session)
+        result = restore._restore_from_run(archive_log, session_maker=database.session_maker)
 
         assert result.success is True
         assert result.run_id == archive_log.workflow_run_id
@@ -772,39 +784,29 @@ class TestRestoreFromRun:
 class TestRestoreBatch:
     """Tests for WorkflowRunRestore.restore_batch method."""
 
-    @patch("services.retention.workflow_run.restore_archived_workflow_run.sessionmaker")
-    def test_empty_tenant_ids_returns_empty(self, mock_sessionmaker):
+    def test_empty_tenant_ids_returns_empty(self, database: Database):
         """Should return empty list when tenant_ids is empty list."""
         restore = WorkflowRunRestore()
 
-        # Mock db.engine to avoid SQLAlchemy issues
-        with patch("services.retention.workflow_run.restore_archived_workflow_run.db") as mock_db:
-            mock_db.engine = Mock()
-            result = restore.restore_batch(
-                tenant_ids=[],
-                start_date=datetime(2024, 1, 1),
-                end_date=datetime(2024, 1, 2),
-            )
+        result = restore.restore_batch(
+            tenant_ids=[],
+            start_date=datetime(2024, 1, 1),
+            end_date=datetime(2024, 1, 2),
+        )
 
         assert result == []
 
     @patch("services.retention.workflow_run.restore_archived_workflow_run.ThreadPoolExecutor")
-    def test_successful_batch_restore(self, mock_executor):
+    def test_successful_batch_restore(self, mock_executor, database: Database):
         """Should successfully restore batch of workflow runs."""
         restore = WorkflowRunRestore(workers=2)
 
-        # Mock session that supports context manager protocol
-        mock_session = Mock()
-        mock_session.__enter__ = Mock(return_value=mock_session)
-        mock_session.__exit__ = Mock(return_value=None)
-
-        # Mock session factory that returns context manager sessions
-        mock_session_factory = Mock(return_value=mock_session)
-
         # Mock repository and archive logs
         mock_repo = Mock()
-        archive_log1 = WorkflowRunRestoreTestDataFactory.create_workflow_archive_log_mock("run-1")
-        archive_log2 = WorkflowRunRestoreTestDataFactory.create_workflow_archive_log_mock("run-2")
+        archive_log1 = WorkflowRunRestoreTestDataFactory.create_workflow_archive_log("run-1")
+        archive_log2 = WorkflowRunRestoreTestDataFactory.create_workflow_archive_log("run-2")
+        database.session.add_all([archive_log1, archive_log2])
+        database.session.commit()
         mock_repo.get_archived_logs_by_time_range.return_value = [archive_log1, archive_log2]
 
         # Mock restore results
@@ -821,38 +823,25 @@ class TestRestoreBatch:
         with patch.object(restore, "_get_workflow_run_repo", return_value=mock_repo):
             with patch.object(restore, "_restore_from_run", side_effect=[result1, result2]):
                 with patch("services.retention.workflow_run.restore_archived_workflow_run.click") as mock_click:
-                    # Mock sessionmaker and db.engine to avoid SQLAlchemy issues
-                    with patch(
-                        "services.retention.workflow_run.restore_archived_workflow_run.sessionmaker"
-                    ) as mock_sessionmaker:
-                        mock_sessionmaker.return_value = mock_session_factory
-                        with patch("services.retention.workflow_run.restore_archived_workflow_run.db") as mock_db:
-                            mock_db.engine = Mock()
-                            results = restore.restore_batch(
-                                tenant_ids=["tenant-1"],
-                                start_date=datetime(2024, 1, 1),
-                                end_date=datetime(2024, 1, 2),
-                            )
+                    results = restore.restore_batch(
+                        tenant_ids=["tenant-1"],
+                        start_date=datetime(2024, 1, 1),
+                        end_date=datetime(2024, 1, 2),
+                    )
 
         assert len(results) == 2
         assert results[0].run_id == "run-1"
         assert results[1].run_id == "run-2"
 
     @patch("services.retention.workflow_run.restore_archived_workflow_run.ThreadPoolExecutor")
-    def test_dry_run_batch_restore(self, mock_executor):
+    def test_dry_run_batch_restore(self, mock_executor, database: Database):
         """Should handle dry run mode for batch restore."""
         restore = WorkflowRunRestore(dry_run=True)
 
-        # Mock session that supports context manager protocol
-        mock_session = Mock()
-        mock_session.__enter__ = Mock(return_value=mock_session)
-        mock_session.__exit__ = Mock(return_value=None)
-
-        # Mock session factory that returns context manager sessions
-        mock_session_factory = Mock(return_value=mock_session)
-
         mock_repo = Mock()
-        archive_log = WorkflowRunRestoreTestDataFactory.create_workflow_archive_log_mock()
+        archive_log = WorkflowRunRestoreTestDataFactory.create_workflow_archive_log()
+        database.session.add(archive_log)
+        database.session.commit()
         mock_repo.get_archived_logs_by_time_range.return_value = [archive_log]
 
         result = RestoreResult(run_id="run-1", tenant_id="tenant-1", success=True, restored_counts={"workflow_runs": 1})
@@ -867,18 +856,11 @@ class TestRestoreBatch:
         with patch.object(restore, "_get_workflow_run_repo", return_value=mock_repo):
             with patch.object(restore, "_restore_from_run", return_value=result):
                 with patch("services.retention.workflow_run.restore_archived_workflow_run.click") as mock_click:
-                    # Mock sessionmaker and db.engine to avoid SQLAlchemy issues
-                    with patch(
-                        "services.retention.workflow_run.restore_archived_workflow_run.sessionmaker"
-                    ) as mock_sessionmaker:
-                        mock_sessionmaker.return_value = mock_session_factory
-                        with patch("services.retention.workflow_run.restore_archived_workflow_run.db") as mock_db:
-                            mock_db.engine = Mock()
-                            results = restore.restore_batch(
-                                tenant_ids=["tenant-1"],
-                                start_date=datetime(2024, 1, 1),
-                                end_date=datetime(2024, 1, 2),
-                            )
+                    results = restore.restore_batch(
+                        tenant_ids=["tenant-1"],
+                        start_date=datetime(2024, 1, 1),
+                        end_date=datetime(2024, 1, 2),
+                    )
 
         assert len(results) == 1
         assert results[0].success is True
@@ -907,16 +889,14 @@ class TestRestoreByRunId:
         assert "not found" in result.error
         assert result.run_id == "nonexistent-run"
 
-    @patch("services.retention.workflow_run.restore_archived_workflow_run.sessionmaker")
-    def test_successful_restore_by_id(self, mock_sessionmaker):
+    def test_successful_restore_by_id(self, database: Database):
         """Should successfully restore by run ID."""
         restore = WorkflowRunRestore()
 
-        mock_session = Mock()
-        mock_sessionmaker.return_value = mock_session
-
         mock_repo = Mock()
-        archive_log = WorkflowRunRestoreTestDataFactory.create_workflow_archive_log_mock()
+        archive_log = WorkflowRunRestoreTestDataFactory.create_workflow_archive_log()
+        database.session.add(archive_log)
+        database.session.commit()
         mock_repo.get_archived_log_by_run_id.return_value = archive_log
 
         result = RestoreResult(run_id="run-1", tenant_id="tenant-1", success=True, restored_counts={})
@@ -924,24 +904,19 @@ class TestRestoreByRunId:
         with patch.object(restore, "_get_workflow_run_repo", return_value=mock_repo):
             with patch.object(restore, "_restore_from_run", return_value=result):
                 with patch("services.retention.workflow_run.restore_archived_workflow_run.click") as mock_click:
-                    # Mock db.engine to avoid SQLAlchemy issues
-                    with patch("services.retention.workflow_run.restore_archived_workflow_run.db") as mock_db:
-                        mock_db.engine = Mock()
-                        actual_result = restore.restore_by_run_id("run-1")
+                    actual_result = restore.restore_by_run_id("run-1")
 
         assert actual_result.success is True
         assert actual_result.run_id == "run-1"
 
-    @patch("services.retention.workflow_run.restore_archived_workflow_run.sessionmaker")
-    def test_dry_run_restore_by_id(self, mock_sessionmaker):
+    def test_dry_run_restore_by_id(self, database: Database):
         """Should handle dry run mode for restore by ID."""
         restore = WorkflowRunRestore(dry_run=True)
 
-        mock_session = Mock()
-        mock_sessionmaker.return_value = mock_session
-
         mock_repo = Mock()
-        archive_log = WorkflowRunRestoreTestDataFactory.create_workflow_archive_log_mock()
+        archive_log = WorkflowRunRestoreTestDataFactory.create_workflow_archive_log()
+        database.session.add(archive_log)
+        database.session.commit()
         mock_repo.get_archived_log_by_run_id.return_value = archive_log
 
         result = RestoreResult(run_id="run-1", tenant_id="tenant-1", success=True, restored_counts={"workflow_runs": 1})
@@ -949,10 +924,7 @@ class TestRestoreByRunId:
         with patch.object(restore, "_get_workflow_run_repo", return_value=mock_repo):
             with patch.object(restore, "_restore_from_run", return_value=result):
                 with patch("services.retention.workflow_run.restore_archived_workflow_run.click") as mock_click:
-                    # Mock db.engine to avoid SQLAlchemy issues
-                    with patch("services.retention.workflow_run.restore_archived_workflow_run.db") as mock_db:
-                        mock_db.engine = Mock()
-                        actual_result = restore.restore_by_run_id("run-1")
+                    actual_result = restore.restore_by_run_id("run-1")
 
         assert actual_result.success is True
         assert actual_result.run_id == "run-1"
@@ -1038,8 +1010,7 @@ class TestIntegration:
     """Integration tests combining multiple components."""
 
     @patch("services.retention.workflow_run.restore_archived_workflow_run.get_archive_storage")
-    @patch("services.retention.workflow_run.restore_archived_workflow_run.ThreadPoolExecutor")
-    def test_full_restore_flow(self, mock_executor, mock_get_storage):
+    def test_full_restore_flow(self, mock_get_storage, database: Database):
         """Test complete restore flow with all components."""
         restore = WorkflowRunRestore(workers=1)
 
@@ -1059,7 +1030,7 @@ class TestIntegration:
                     "app_id": "app-123",
                     "workflow_id": "workflow-123",
                     "type": "workflow",
-                    "triggered_from": "app",
+                    "triggered_from": "app-run",
                     "version": "1",
                     "status": "succeeded",
                     "created_by_role": "account",
@@ -1072,48 +1043,20 @@ class TestIntegration:
         mock_storage.get_object.return_value = archive_data
         mock_get_storage.return_value = mock_storage
 
-        # Mock session that supports context manager protocol
-        mock_session = Mock()
-        mock_session.__enter__ = Mock(return_value=mock_session)
-        mock_session.__exit__ = Mock(return_value=None)
-
-        # Mock session factory that returns context manager sessions
-        mock_session_factory = Mock(return_value=mock_session)
-
-        mock_result = Mock()
-        mock_result.rowcount = 1
-        mock_session.execute.return_value = mock_result
-
         # Mock repository
         mock_repo = Mock()
-        archive_log = WorkflowRunRestoreTestDataFactory.create_workflow_archive_log_mock()
+        archive_log = WorkflowRunRestoreTestDataFactory.create_workflow_archive_log()
+        database.session.add(archive_log)
+        database.session.commit()
         mock_repo.get_archived_log_by_run_id.return_value = archive_log
-
-        # Mock ThreadPoolExecutor (not actually used in restore_by_run_id but needed for patch)
-        mock_executor_instance = Mock()
-        mock_executor_instance.__enter__ = Mock(return_value=mock_executor_instance)
-        mock_executor_instance.__exit__ = Mock(return_value=None)
-        mock_executor_instance.map = Mock(return_value=[])
-        mock_executor.return_value = mock_executor_instance
+        mock_repo.delete_archive_log_by_run_id.side_effect = lambda session, run_id: session.execute(
+            delete(WorkflowArchiveLog).where(WorkflowArchiveLog.workflow_run_id == run_id)
+        )
 
         with patch.object(restore, "_get_workflow_run_repo", return_value=mock_repo):
-            with patch("services.retention.workflow_run.restore_archived_workflow_run.pg_insert") as mock_insert:
-                mock_stmt = Mock()
-                mock_stmt.on_conflict_do_nothing.return_value = mock_stmt
-                mock_insert.return_value = mock_stmt
-
-                with patch("services.retention.workflow_run.restore_archived_workflow_run.cast") as mock_cast:
-                    mock_cast.return_value = mock_result
-
-                    with patch("services.retention.workflow_run.restore_archived_workflow_run.click") as mock_click:
-                        # Mock sessionmaker and db.engine to avoid SQLAlchemy issues
-                        with patch(
-                            "services.retention.workflow_run.restore_archived_workflow_run.sessionmaker"
-                        ) as mock_sessionmaker:
-                            mock_sessionmaker.return_value = mock_session_factory
-                            with patch("services.retention.workflow_run.restore_archived_workflow_run.db") as mock_db:
-                                mock_db.engine = Mock()
-                                result = restore.restore_by_run_id("run-123")
+            with patch("services.retention.workflow_run.restore_archived_workflow_run.click"):
+                result = restore.restore_by_run_id("run-123")
 
         assert result.success is True
         assert result.restored_counts.get("workflow_runs") == 1
+        assert database.session.scalar(select(func.count(WorkflowRun.id))) == 1

api/tests/unit_tests/services/test_agent_config_service.py

@@ -63,6 +63,7 @@ def _target(
 ) -> AgentConfigTarget:
     agent_soul = soul or _soul()
     return AgentConfigTarget(
+        tenant_id=TENANT,
         agent_id=AGENT,
         version_id=version_id,
         kind=kind,
@@ -508,7 +509,9 @@ def test_manifest_uses_items_shape_without_download_urls() -> None:
         ),
     )
 
-    manifest = AgentConfigService._manifest_for_target(target)
+    with patch(f"{MODULE}.SkillManagementService") as skill_management_service:
+        skill_management_service.return_value.list_runtime_agent_skills.return_value = []
+        manifest = AgentConfigService._manifest_for_target(target)
 
     assert manifest == {
         "agent_id": AGENT,
@@ -557,7 +560,9 @@ def test_manifest_preserves_missing_config_assets_and_pull_rejects_them() -> Non
     target = _target(kind=AgentConfigVersionKind.DRAFT, writable=False, soul=soul)
     service = AgentConfigService()
 
-    manifest = service._manifest_for_target(target)
+    with patch(f"{MODULE}.SkillManagementService") as skill_management_service:
+        skill_management_service.return_value.list_runtime_agent_skills.return_value = []
+        manifest = service._manifest_for_target(target)
 
     assert manifest["skills"]["items"][0]["is_missing"] is True  # type: ignore[index]
     assert manifest["files"]["items"][0]["is_missing"] is True  # type: ignore[index]
@@ -606,6 +611,44 @@ def test_config_asset_refs_require_file_id_unless_marked_missing() -> None:
         )
 
 
+def test_manifest_appends_published_workspace_skills() -> None:
+    target = _target(
+        kind=AgentConfigVersionKind.DRAFT,
+        writable=False,
+        soul=_soul(
+            config_skills=[
+                AgentConfigSkillRefConfig(name="alpha", description="Alpha skill", file_id="tool-file-1")
+            ]
+        ),
+    )
+
+    with patch(f"{MODULE}.SkillManagementService") as skill_management_service:
+        skill_management_service.return_value.list_runtime_agent_skills.return_value = [
+            {
+                "id": "workspace-skill-id",
+                "name": "beta",
+                "file_id": "tool-file-2",
+                "description": "Beta workspace skill",
+                "size": 123,
+                "hash": "sha256:beta",
+                "mime_type": "application/zip",
+            },
+            {
+                "id": "duplicate",
+                "name": "alpha",
+                "file_id": "tool-file-ignored",
+                "description": "Duplicate workspace skill",
+                "size": 456,
+                "hash": "sha256:ignored",
+                "mime_type": "application/zip",
+            },
+        ]
+        manifest = AgentConfigService._manifest_for_target(target)
+
+    assert [item["name"] for item in manifest["skills"]["items"]] == ["alpha", "beta"]
+    assert manifest["skills"]["items"][1]["file_id"] == "tool-file-2"
+
+
 def test_preview_skill_file_returns_text_preview() -> None:
     service = AgentConfigService()
     target = _target(

api/tests/unit_tests/services/test_app_task_service.py

@@ -14,7 +14,7 @@ class TestAppTaskService:
         ("app_mode", "should_call_graph_engine"),
         [
             (AppMode.CHAT, False),
-            (AppMode.COMPLETION, True),
+            (AppMode.COMPLETION, False),
             (AppMode.AGENT_CHAT, False),
             (AppMode.AGENT, False),
             (AppMode.CHANNEL, False),

api/tests/unit_tests/services/test_workflow_app_service_metadata.py

@@ -0,0 +1,88 @@
+"""Unit tests for workflow app log views and trigger metadata helpers."""
+
+import json
+import uuid
+from unittest.mock import patch
+
+import pytest
+
+from models.enums import AppTriggerType, CreatorUserRole
+from models.workflow import WorkflowAppLog, WorkflowAppLogCreatedFrom
+from services.workflow_app_service import LogView, WorkflowAppService
+
+
+class TestLogView:
+    def test_details_and_proxy_attributes(self) -> None:
+        log = WorkflowAppLog(
+            tenant_id="tenant-1",
+            app_id="app-1",
+            workflow_id="workflow-1",
+            workflow_run_id="run-1",
+            created_from=WorkflowAppLogCreatedFrom.WEB_APP,
+            created_by_role=CreatorUserRole.ACCOUNT,
+            created_by="account-1",
+        )
+        log.id = "log-1"
+
+        view = LogView(log=log, details={"trigger_metadata": {"type": "plugin"}})
+
+        assert view.details == {"trigger_metadata": {"type": "plugin"}}
+        assert view.id == "log-1"
+
+
+class TestHandleTriggerMetadata:
+    def test_returns_empty_dict_when_metadata_missing(self) -> None:
+        assert WorkflowAppService().handle_trigger_metadata("tenant-1", None) == {}
+
+    def test_enriches_plugin_icons(self) -> None:
+        metadata = {
+            "type": AppTriggerType.TRIGGER_PLUGIN.value,
+            "icon_filename": "light.png",
+            "icon_dark_filename": "dark.png",
+        }
+        with patch(
+            "services.workflow_app_service.PluginService.get_plugin_icon_url",
+            side_effect=["https://cdn/light.png", "https://cdn/dark.png"],
+        ) as mock_icon:
+            result = WorkflowAppService().handle_trigger_metadata("tenant-1", json.dumps(metadata))
+
+        assert result["icon"] == "https://cdn/light.png"
+        assert result["icon_dark"] == "https://cdn/dark.png"
+        assert mock_icon.call_count == 2
+
+    def test_non_plugin_metadata_without_icon_lookup(self) -> None:
+        metadata = {"type": AppTriggerType.TRIGGER_WEBHOOK.value}
+        with patch("services.workflow_app_service.PluginService.get_plugin_icon_url") as mock_icon:
+            result = WorkflowAppService().handle_trigger_metadata("tenant-1", json.dumps(metadata))
+
+        assert result["type"] == AppTriggerType.TRIGGER_WEBHOOK.value
+        mock_icon.assert_not_called()
+
+
+class TestSafeJsonLoads:
+    @pytest.mark.parametrize(
+        ("value", "expected"),
+        [
+            (None, None),
+            ("", None),
+            ('{"k":"v"}', {"k": "v"}),
+            ("not-json", None),
+            ({"raw": True}, {"raw": True}),
+        ],
+    )
+    def test_handles_various_inputs(self, value, expected) -> None:
+        assert WorkflowAppService._safe_json_loads(value) == expected
+
+
+class TestSafeParseUuid:
+    def test_returns_none_for_short_or_invalid_values(self) -> None:
+        assert WorkflowAppService._safe_parse_uuid("short") is None
+        assert WorkflowAppService._safe_parse_uuid("x" * 40) is None
+
+    def test_returns_uuid_for_valid_string(self) -> None:
+        raw = str(uuid.uuid4())
+
+        result = WorkflowAppService._safe_parse_uuid(raw)
+
+        assert result is not None
+        assert str(result) == raw

api/tests/unit_tests/services/workflow/test_workflow_converter_additional.py

@@ -219,13 +219,7 @@ def test__convert_to_knowledge_retrieval_node_for_workflow_app() -> None:
 def test__convert_to_llm_node_for_chatbot_simple_chat_model(default_variables: list[VariableEntity]) -> None:
     workflow_converter = WorkflowConverter()
     graph = {"nodes": [workflow_converter._convert_to_start_node(default_variables)], "edges": []}
-    model_config = ModelConfigEntity(
-        provider="openai",
-        model="gpt-4",
-        mode=LLMMode.CHAT.value,
-        parameters={"temperature": 0.2},
-        stop=["END"],
-    )
+    model_config = ModelConfigEntity(provider="openai", model="gpt-4", mode=LLMMode.CHAT.value, parameters={}, stop=[])
     prompt_template = PromptTemplateEntity(
         prompt_type=PromptTemplateEntity.PromptType.SIMPLE,
         simple_prompt_template="You are a helper for {{text_input}} and {{paragraph}}",
@@ -243,8 +237,6 @@ def test__convert_to_llm_node_for_chatbot_simple_chat_model(default_variables: l
     assert node["data"]["memory"] is not None
     assert node["data"]["prompt_template"][0]["role"] == "user"
     assert "{{#start.text_input#}}" in node["data"]["prompt_template"][0]["text"]
-    assert node["data"]["model"]["completion_params"] == {"temperature": 0.2, "stop": ["END"]}
-    assert model_config.parameters == {"temperature": 0.2}
 
 
 def test__convert_to_llm_node_for_chatbot_simple_chat_model_with_empty_template(
@@ -607,94 +599,6 @@ def test_convert_app_model_config_to_workflow_should_build_workflow_mode_with_en
     assert set(features.keys()) == {"text_to_speech", "file_upload", "sensitive_word_avoidance"}
 
 
-def test_build_graph_from_app_config_for_completion_does_not_create_workflow(
-    converter: WorkflowConverter,
-) -> None:
-    app_model = _app_model(id="app-1", tenant_id="tenant-1", mode=AppMode.COMPLETION)
-    app_config = SimpleNamespace(
-        variables=[],
-        external_data_variables=[],
-        dataset=None,
-        model=_build_model_config(mode=LLMMode.CHAT),
-        prompt_template=PromptTemplateEntity(
-            prompt_type=PromptTemplateEntity.PromptType.SIMPLE,
-            simple_prompt_template="Hello",
-        ),
-        additional_features=None,
-        app_model_config_dict={
-            "text_to_speech": {"enabled": False},
-            "file_upload": {"enabled": False},
-            "sensitive_word_avoidance": {"enabled": False},
-        },
-    )
-    db_session = SimpleNamespace(add=MagicMock(), commit=MagicMock())
-
-    graph, features = converter.build_graph_from_app_config(
-        app_model=app_model,
-        app_config=app_config,
-        target_app_mode=AppMode.WORKFLOW,
-        session=db_session,
-    )
-
-    assert [node["id"] for node in graph["nodes"]] == ["start", "llm", "end"]
-    assert features == {
-        "text_to_speech": {"enabled": False},
-        "file_upload": {"enabled": False},
-        "sensitive_word_avoidance": {"enabled": False},
-    }
-    db_session.add.assert_not_called()
-    db_session.commit.assert_not_called()
-
-
-def test_build_graph_from_app_config_preserves_api_based_variable_nodes(
-    converter: WorkflowConverter,
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    app_model = _app_model(id="app-1", tenant_id="tenant-1", mode=AppMode.COMPLETION)
-    app_config = SimpleNamespace(
-        variables=[VariableEntity(variable="city", label="City", type=VariableEntityType.TEXT_INPUT)],
-        external_data_variables=[
-            ExternalDataVariableEntity(
-                variable="weather",
-                type="api",
-                config={"api_based_extension_id": "api_based_extension_id"},
-            )
-        ],
-        dataset=None,
-        model=_build_model_config(mode=LLMMode.CHAT),
-        prompt_template=PromptTemplateEntity(
-            prompt_type=PromptTemplateEntity.PromptType.SIMPLE,
-            simple_prompt_template="Weather: {{weather}}",
-        ),
-        additional_features=None,
-        app_model_config_dict={},
-    )
-    extension = SimpleNamespace(
-        name="Weather API",
-        api_endpoint="https://example.com/weather",
-        api_key="encrypted-token",
-    )
-    monkeypatch.setattr(converter, "_get_api_based_extension", MagicMock(return_value=extension))
-    monkeypatch.setattr(converter_module.encrypter, "decrypt_token", MagicMock(return_value="plain-token"))
-
-    graph, _ = converter.build_graph_from_app_config(
-        app_model=app_model,
-        app_config=app_config,
-        target_app_mode=AppMode.WORKFLOW,
-        session=MagicMock(),
-    )
-
-    assert [node["data"]["type"] for node in graph["nodes"]] == [
-        BuiltinNodeTypes.START,
-        BuiltinNodeTypes.HTTP_REQUEST,
-        BuiltinNodeTypes.CODE,
-        BuiltinNodeTypes.LLM,
-        BuiltinNodeTypes.END,
-    ]
-    llm_node = next(node for node in graph["nodes"] if node["id"] == "llm")
-    assert "{{#code_1.result#}}" in llm_node["data"]["prompt_template"][0]["text"]
-
-
 def test_convert_to_app_config_should_route_to_correct_manager(
     converter: WorkflowConverter,
     monkeypatch: pytest.MonkeyPatch,

docker/.env.example

@@ -157,9 +157,6 @@ ENABLE_WEBSITE_JINAREADER=true
 ENABLE_WEBSITE_FIRECRAWL=true
 ENABLE_WEBSITE_WATERCRAWL=true
 NEXT_PUBLIC_ENABLE_SINGLE_DOLLAR_LATEX=false
-# Enable preview features still in development (currently the /create and
-# /refine slash commands in the "Go to Anything" command palette).
-NEXT_PUBLIC_ENABLE_FEATURE_PREVIEW=true
 NEXT_PUBLIC_ENABLE_AGENT_V2=true
 EXPERIMENTAL_ENABLE_VINEXT=false
 

packages/contracts/generated/api/console/agent/zod.gen.ts

@@ -997,11 +997,15 @@ export const zSandboxListResponse = z.object({
  * Validated metadata extracted from a Skill package.
  */
 export const zSkillManifest = z.object({
-  description: z.string(),
+  description: z.string().min(1).max(1024),
   entry_path: z.string(),
   files: z.array(z.string()),
   hash: z.string(),
-  name: z.string(),
+  name: z
+    .string()
+    .min(1)
+    .max(64)
+    .regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/),
   size: z.int(),
 })
 

packages/contracts/generated/api/console/apps/zod.gen.ts

@@ -1373,11 +1373,15 @@ export const zAgentLogMetaResponse = z.object({
  * Validated metadata extracted from a Skill package.
  */
 export const zSkillManifest = z.object({
-  description: z.string(),
+  description: z.string().min(1).max(1024),
   entry_path: z.string(),
   files: z.array(z.string()),
   hash: z.string(),
-  name: z.string(),
+  name: z
+    .string()
+    .min(1)
+    .max(64)
+    .regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/),
   size: z.int(),
 })
 

packages/contracts/generated/api/console/tag-bindings/types.gen.ts

@@ -20,7 +20,7 @@ export type TagBindingRemovePayload = {
   type: TagType
 }
 
-export type TagType = 'app' | 'knowledge' | 'snippet'
+export type TagType = 'app' | 'knowledge' | 'skill' | 'snippet'
 
 export type PostTagBindingsData = {
   body: TagBindingPayload

packages/contracts/generated/api/console/tag-bindings/zod.gen.ts

@@ -14,7 +14,7 @@ export const zSimpleResultResponse = z.object({
  *
  * Tag type
  */
-export const zTagType = z.enum(['app', 'knowledge', 'snippet'])
+export const zTagType = z.enum(['app', 'knowledge', 'skill', 'snippet'])
 
 /**
  * TagBindingPayload

packages/contracts/generated/api/console/tags/types.gen.ts

@@ -22,14 +22,14 @@ export type TagUpdateRequestPayload = {
   name: string
 }
 
-export type TagType = 'app' | 'knowledge' | 'snippet'
+export type TagType = 'app' | 'knowledge' | 'skill' | 'snippet'
 
 export type GetTagsData = {
   body?: never
   path?: never
   query?: {
     keyword?: string
-    type?: '' | 'app' | 'knowledge' | 'snippet'
+    type?: '' | 'app' | 'knowledge' | 'skill' | 'snippet'
   }
   url: '/tags'
 }

packages/contracts/generated/api/console/tags/zod.gen.ts

@@ -29,7 +29,7 @@ export const zTagUpdateRequestPayload = z.object({
  *
  * Tag type
  */
-export const zTagType = z.enum(['app', 'knowledge', 'snippet'])
+export const zTagType = z.enum(['app', 'knowledge', 'skill', 'snippet'])
 
 /**
  * TagBasePayload
@@ -41,7 +41,7 @@ export const zTagBasePayload = z.object({
 
 export const zGetTagsQuery = z.object({
   keyword: z.string().optional(),
-  type: z.enum(['', 'app', 'knowledge', 'snippet']).optional().default(''),
+  type: z.enum(['', 'app', 'knowledge', 'skill', 'snippet']).optional().default(''),
 })
 
 /**

packages/contracts/generated/api/console/workspaces/types.gen.ts

@@ -32,6 +32,16 @@ export type AgentProviderListResponse = Array<{
   [key: string]: unknown
 }>
 
+export type AgentSkillBindingsResponse = {
+  agent_id: string
+  data?: Array<AgentSkillBindingItemResponse>
+  skill_ids?: Array<string>
+}
+
+export type AgentSkillBindingsPayload = {
+  skill_ids?: Array<string>
+}
+
 export type SnippetPaginationResponse = {
   data: Array<SnippetListItemResponse>
   has_more: boolean
@@ -635,6 +645,194 @@ export type WorkspaceAccessMatrix = {
   pagination?: Pagination | null
 }
 
+export type SkillListResponse = {
+  data?: Array<SkillResponse>
+  has_more?: boolean
+  limit?: number
+  page?: number
+  total?: number
+}
+
+export type SkillCreatePayload = {
+  description?: string
+  display_name?: string | null
+  icon?: string
+  name?: string | null
+  tags?: Array<string>
+}
+
+export type SkillDetailResponse = {
+  created_at: number
+  created_by?: string | null
+  created_by_name?: string | null
+  description: string
+  display_name: string
+  files?: Array<SkillFileResponse>
+  icon: string
+  id: string
+  latest_published_version_id?: string | null
+  name: string
+  name_manually_edited?: boolean
+  reference_count?: number
+  tags?: Array<string>
+  updated_at: number
+  updated_by?: string | null
+  updated_by_name?: string | null
+  visibility: string
+}
+
+export type SkillFileUploadResponse = {
+  hash: string
+  id: string
+  mime_type: string
+  name: string
+  size: number
+}
+
+export type SkillTagListResponse = {
+  data?: Array<SkillTagResponse>
+}
+
+export type SkillDeletePayload = {
+  confirmation_name?: string | null
+}
+
+export type SkillDeleteResponse = {
+  deleted: boolean
+  id: string
+}
+
+export type SkillMetadataPayload = {
+  display_name?: string | null
+  expected_updated_at?: number | null
+  icon?: string | null
+  tags?: Array<string> | null
+}
+
+export type SkillResponse = {
+  created_at: number
+  created_by?: string | null
+  created_by_name?: string | null
+  description: string
+  display_name: string
+  icon: string
+  id: string
+  latest_published_version_id?: string | null
+  name: string
+  name_manually_edited?: boolean
+  reference_count?: number
+  tags?: Array<string>
+  updated_at: number
+  updated_by?: string | null
+  updated_by_name?: string | null
+  visibility: string
+}
+
+export type SkillAssistModelPayload = {
+  model: string
+  model_settings?: { [key: string]: unknown } | null
+  plugin_id?: string | null
+  provider: string
+}
+
+export type SkillAssistAttachmentPayload = {
+  mime_type?: string | null
+  name: string
+  size?: number | null
+  tool_file_id: string
+}
+
+export type SkillAssistMessagePayload = {
+  attachments?: Array<SkillAssistAttachmentPayload>
+  message: string
+  model?: SkillAssistModelPayload | null
+  target_path?: string | null
+}
+
+export type SkillDraftFileOperationPayload = {
+  content?: string | null
+  expected_updated_at?: number | null
+  hash?: string | null
+  mime_type?: string | null
+  operation: SkillDraftFileOperation
+  path: string
+  size?: number | null
+  target_path?: string | null
+  tool_file_id?: string | null
+}
+
+export type SkillDraftTreePayload = {
+  expected_updated_at?: number | null
+  files?: Array<SkillDraftTreeItemPayload>
+}
+
+export type SkillFilePreviewResponse = {
+  content: string
+  hash: string
+  mime_type: string
+  path: string
+  size: number
+}
+
+export type SkillPublishPayload = {
+  publish_note?: string
+  version_name?: string | null
+}
+
+export type SkillVersionResponse = {
+  archive_size: number
+  created_at: number
+  hash_code: string
+  id: string
+  is_latest?: boolean
+  publish_note: string
+  published_by?: string | null
+  published_by_name?: string | null
+  skill_id: string
+  version_name: string
+  version_number: number
+}
+
+export type SkillReferenceListResponse = {
+  data?: Array<SkillReferenceResponse>
+}
+
+export type SkillRestorePayload = {
+  publish_note?: string
+  version_id: string
+  version_name?: string | null
+}
+
+export type SkillVersionListResponse = {
+  data?: Array<SkillVersionResponse>
+}
+
+export type SkillVersionDeleteResponse = {
+  deleted: boolean
+  id: string
+  latest_published_version_id?: string | null
+}
+
+export type SkillVersionDetailResponse = {
+  archive_size: number
+  created_at: number
+  files?: Array<SkillFileResponse>
+  hash_code: string
+  id: string
+  is_latest?: boolean
+  publish_note: string
+  published_by?: string | null
+  published_by_name?: string | null
+  skill_id: string
+  version_name: string
+  version_number: number
+}
+
+export type SkillVersionUpdatePayload = {
+  publish_note?: string
+  version_name?: string | null
+}
+
 export type ToolLabelListResponse = Array<ToolLabel>
 
 export type ApiToolProviderAddPayload = {
@@ -1042,6 +1240,21 @@ export type WorkspaceCustomConfigResponse = {
   replace_webapp_logo?: string | null
 }
 
+export type AgentSkillBindingItemResponse = {
+  description: string
+  display_name: string
+  file_count: number
+  icon: string
+  id: string
+  latest_published_at?: number | null
+  latest_published_version_id?: string | null
+  name: string
+  priority: number
+  status: string
+  tags?: Array<string>
+  updated_at: number
+}
+
 export type SnippetListItemResponse = {
   author_name: string | null
   created_at: number
@@ -1502,6 +1715,60 @@ export type AccessPolicyRole = {
   role_tag?: string
 }
 
+export type SkillFileResponse = {
+  content?: string | null
+  hash?: string | null
+  id?: string | null
+  kind: string
+  mime_type?: string | null
+  path: string
+  size?: number | null
+  storage?: string | null
+  tool_file_id?: string | null
+}
+
+export type SkillTagResponse = {
+  count: number
+  tag: string
+}
+
+export type SkillDraftFileOperation =
+  | 'delete'
+  | 'mkdir'
+  | 'rename'
+  | 'upsert_text'
+  | 'upsert_tool_file'
+
+export type SkillDraftTreeItemPayload = {
+  content?: string | null
+  hash?: string | null
+  kind?: SkillFileKind
+  mime_type?: string | null
+  path: string
+  size?: number | null
+  storage?: SkillFileStorage | null
+  tool_file_id?: string | null
+}
+
+export type SkillReferenceResponse = {
+  agent_id: string
+  agent_icon?: string | null
+  agent_icon_background?: string | null
+  agent_icon_type?: string | null
+  app_id?: string | null
+  display_name: string
+  name: string
+  node_id?: string | null
+  node_name?: string | null
+  type: string
+  workflow_icon?: string | null
+  workflow_icon_background?: string | null
+  workflow_icon_type?: string | null
+  workflow_id?: string | null
+  workflow_name?: string | null
+  workflow_version?: string | null
+}
+
 export type ToolLabel = {
   icon: string
   label: I18nObject
@@ -1978,6 +2245,10 @@ export type PermissionCatalogItem = {
   name: string
 }
 
+export type SkillFileKind = 'directory' | 'file'
+
+export type SkillFileStorage = 'text' | 'tool_file'
+
 export type ToolParameter = {
   auto_generate?: PluginParameterAutoGenerate | null
   default?:
@@ -2473,6 +2744,38 @@ export type GetWorkspacesCurrentAgentProvidersResponses = {
 export type GetWorkspacesCurrentAgentProvidersResponse =
   GetWorkspacesCurrentAgentProvidersResponses[keyof GetWorkspacesCurrentAgentProvidersResponses]
 
+export type GetWorkspacesCurrentAgentsByAgentIdSkillsData = {
+  body?: never
+  path: {
+    agent_id: string
+  }
+  query?: never
+  url: '/workspaces/current/agents/{agent_id}/skills'
+}
+
+export type GetWorkspacesCurrentAgentsByAgentIdSkillsResponses = {
+  200: AgentSkillBindingsResponse
+}
+
+export type GetWorkspacesCurrentAgentsByAgentIdSkillsResponse =
+  GetWorkspacesCurrentAgentsByAgentIdSkillsResponses[keyof GetWorkspacesCurrentAgentsByAgentIdSkillsResponses]
+
+export type PutWorkspacesCurrentAgentsByAgentIdSkillsData = {
+  body: AgentSkillBindingsPayload
+  path: {
+    agent_id: string
+  }
+  query?: never
+  url: '/workspaces/current/agents/{agent_id}/skills'
+}
+
+export type PutWorkspacesCurrentAgentsByAgentIdSkillsResponses = {
+  200: AgentSkillBindingsResponse
+}
+
+export type PutWorkspacesCurrentAgentsByAgentIdSkillsResponse =
+  PutWorkspacesCurrentAgentsByAgentIdSkillsResponses[keyof PutWorkspacesCurrentAgentsByAgentIdSkillsResponses]
+
 export type GetWorkspacesCurrentCustomizedSnippetsData = {
   body?: never
   path?: never
@@ -4625,6 +4928,369 @@ export type GetWorkspacesCurrentRbacWorkspaceDatasetsAccessPolicyResponses = {
 export type GetWorkspacesCurrentRbacWorkspaceDatasetsAccessPolicyResponse =
   GetWorkspacesCurrentRbacWorkspaceDatasetsAccessPolicyResponses[keyof GetWorkspacesCurrentRbacWorkspaceDatasetsAccessPolicyResponses]
 
+export type GetWorkspacesCurrentSkillsData = {
+  body?: never
+  path?: never
+  query?: {
+    keyword?: string
+    limit?: number
+    page?: number
+    tag?: Array<string>
+  }
+  url: '/workspaces/current/skills'
+}
+
+export type GetWorkspacesCurrentSkillsResponses = {
+  200: SkillListResponse
+}
+
+export type GetWorkspacesCurrentSkillsResponse =
+  GetWorkspacesCurrentSkillsResponses[keyof GetWorkspacesCurrentSkillsResponses]
+
+export type PostWorkspacesCurrentSkillsData = {
+  body: SkillCreatePayload
+  path?: never
+  query?: never
+  url: '/workspaces/current/skills'
+}
+
+export type PostWorkspacesCurrentSkillsResponses = {
+  201: SkillDetailResponse
+}
+
+export type PostWorkspacesCurrentSkillsResponse =
+  PostWorkspacesCurrentSkillsResponses[keyof PostWorkspacesCurrentSkillsResponses]
+
+export type PostWorkspacesCurrentSkillsFilesUploadData = {
+  body: {
+    file: Blob | File
+  }
+  path?: never
+  query?: never
+  url: '/workspaces/current/skills/files/upload'
+}
+
+export type PostWorkspacesCurrentSkillsFilesUploadResponses = {
+  201: SkillFileUploadResponse
+}
+
+export type PostWorkspacesCurrentSkillsFilesUploadResponse =
+  PostWorkspacesCurrentSkillsFilesUploadResponses[keyof PostWorkspacesCurrentSkillsFilesUploadResponses]
+
+export type PostWorkspacesCurrentSkillsImportData = {
+  body?: never
+  path?: never
+  query?: never
+  url: '/workspaces/current/skills/import'
+}
+
+export type PostWorkspacesCurrentSkillsImportResponses = {
+  201: SkillDetailResponse
+}
+
+export type PostWorkspacesCurrentSkillsImportResponse =
+  PostWorkspacesCurrentSkillsImportResponses[keyof PostWorkspacesCurrentSkillsImportResponses]
+
+export type GetWorkspacesCurrentSkillsTagsData = {
+  body?: never
+  path?: never
+  query?: never
+  url: '/workspaces/current/skills/tags'
+}
+
+export type GetWorkspacesCurrentSkillsTagsResponses = {
+  200: SkillTagListResponse
+}
+
+export type GetWorkspacesCurrentSkillsTagsResponse =
+  GetWorkspacesCurrentSkillsTagsResponses[keyof GetWorkspacesCurrentSkillsTagsResponses]
+
+export type DeleteWorkspacesCurrentSkillsBySkillIdData = {
+  body: SkillDeletePayload
+  path: {
+    skill_id: string
+  }
+  query?: never
+  url: '/workspaces/current/skills/{skill_id}'
+}
+
+export type DeleteWorkspacesCurrentSkillsBySkillIdResponses = {
+  200: SkillDeleteResponse
+}
+
+export type DeleteWorkspacesCurrentSkillsBySkillIdResponse =
+  DeleteWorkspacesCurrentSkillsBySkillIdResponses[keyof DeleteWorkspacesCurrentSkillsBySkillIdResponses]
+
+export type GetWorkspacesCurrentSkillsBySkillIdData = {
+  body?: never
+  path: {
+    skill_id: string
+  }
+  query?: never
+  url: '/workspaces/current/skills/{skill_id}'
+}
+
+export type GetWorkspacesCurrentSkillsBySkillIdResponses = {
+  200: SkillDetailResponse
+}
+
+export type GetWorkspacesCurrentSkillsBySkillIdResponse =
+  GetWorkspacesCurrentSkillsBySkillIdResponses[keyof GetWorkspacesCurrentSkillsBySkillIdResponses]
+
+export type PatchWorkspacesCurrentSkillsBySkillIdData = {
+  body: SkillMetadataPayload
+  path: {
+    skill_id: string
+  }
+  query?: never
+  url: '/workspaces/current/skills/{skill_id}'
+}
+
+export type PatchWorkspacesCurrentSkillsBySkillIdResponses = {
+  200: SkillResponse
+}
+
+export type PatchWorkspacesCurrentSkillsBySkillIdResponse =
+  PatchWorkspacesCurrentSkillsBySkillIdResponses[keyof PatchWorkspacesCurrentSkillsBySkillIdResponses]
+
+export type PostWorkspacesCurrentSkillsBySkillIdAssistMessagesData = {
+  body: SkillAssistMessagePayload
+  path: {
+    skill_id: string
+  }
+  query?: never
+  url: '/workspaces/current/skills/{skill_id}/assist/messages'
+}
+
+export type PostWorkspacesCurrentSkillsBySkillIdAssistMessagesResponses = {
+  200: {
+    [key: string]: unknown
+  }
+}
+
+export type PostWorkspacesCurrentSkillsBySkillIdAssistMessagesResponse =
+  PostWorkspacesCurrentSkillsBySkillIdAssistMessagesResponses[keyof PostWorkspacesCurrentSkillsBySkillIdAssistMessagesResponses]
+
+export type PostWorkspacesCurrentSkillsBySkillIdDuplicateData = {
+  body?: never
+  path: {
+    skill_id: string
+  }
+  query?: never
+  url: '/workspaces/current/skills/{skill_id}/duplicate'
+}
+
+export type PostWorkspacesCurrentSkillsBySkillIdDuplicateResponses = {
+  201: SkillDetailResponse
+}
+
+export type PostWorkspacesCurrentSkillsBySkillIdDuplicateResponse =
+  PostWorkspacesCurrentSkillsBySkillIdDuplicateResponses[keyof PostWorkspacesCurrentSkillsBySkillIdDuplicateResponses]
+
+export type GetWorkspacesCurrentSkillsBySkillIdExportData = {
+  body?: never
+  path: {
+    skill_id: string
+  }
+  query?: never
+  url: '/workspaces/current/skills/{skill_id}/export'
+}
+
+export type GetWorkspacesCurrentSkillsBySkillIdExportResponses = {
+  200: {
+    [key: string]: unknown
+  }
+}
+
+export type GetWorkspacesCurrentSkillsBySkillIdExportResponse =
+  GetWorkspacesCurrentSkillsBySkillIdExportResponses[keyof GetWorkspacesCurrentSkillsBySkillIdExportResponses]
+
+export type PatchWorkspacesCurrentSkillsBySkillIdFilesData = {
+  body: SkillDraftFileOperationPayload
+  path: {
+    skill_id: string
+  }
+  query?: never
+  url: '/workspaces/current/skills/{skill_id}/files'
+}
+
+export type PatchWorkspacesCurrentSkillsBySkillIdFilesResponses = {
+  200: SkillDetailResponse
+}
+
+export type PatchWorkspacesCurrentSkillsBySkillIdFilesResponse =
+  PatchWorkspacesCurrentSkillsBySkillIdFilesResponses[keyof PatchWorkspacesCurrentSkillsBySkillIdFilesResponses]
+
+export type PutWorkspacesCurrentSkillsBySkillIdFilesData = {
+  body: SkillDraftTreePayload
+  path: {
+    skill_id: string
+  }
+  query?: never
+  url: '/workspaces/current/skills/{skill_id}/files'
+}
+
+export type PutWorkspacesCurrentSkillsBySkillIdFilesResponses = {
+  200: SkillDetailResponse
+}
+
+export type PutWorkspacesCurrentSkillsBySkillIdFilesResponse =
+  PutWorkspacesCurrentSkillsBySkillIdFilesResponses[keyof PutWorkspacesCurrentSkillsBySkillIdFilesResponses]
+
+export type GetWorkspacesCurrentSkillsBySkillIdFilesContentData = {
+  body?: never
+  path: {
+    skill_id: string
+  }
+  query: {
+    download?: string
+    path: string
+    version_id?: string
+  }
+  url: '/workspaces/current/skills/{skill_id}/files/content'
+}
+
+export type GetWorkspacesCurrentSkillsBySkillIdFilesContentResponses = {
+  200: BinaryFileResponse
+}
+
+export type GetWorkspacesCurrentSkillsBySkillIdFilesContentResponse =
+  GetWorkspacesCurrentSkillsBySkillIdFilesContentResponses[keyof GetWorkspacesCurrentSkillsBySkillIdFilesContentResponses]
+
+export type GetWorkspacesCurrentSkillsBySkillIdFilesPreviewData = {
+  body?: never
+  path: {
+    skill_id: string
+  }
+  query: {
+    path: string
+    version_id?: string
+  }
+  url: '/workspaces/current/skills/{skill_id}/files/preview'
+}
+
+export type GetWorkspacesCurrentSkillsBySkillIdFilesPreviewResponses = {
+  200: SkillFilePreviewResponse
+}
+
+export type GetWorkspacesCurrentSkillsBySkillIdFilesPreviewResponse =
+  GetWorkspacesCurrentSkillsBySkillIdFilesPreviewResponses[keyof GetWorkspacesCurrentSkillsBySkillIdFilesPreviewResponses]
+
+export type PostWorkspacesCurrentSkillsBySkillIdPublishData = {
+  body: SkillPublishPayload
+  path: {
+    skill_id: string
+  }
+  query?: never
+  url: '/workspaces/current/skills/{skill_id}/publish'
+}
+
+export type PostWorkspacesCurrentSkillsBySkillIdPublishResponses = {
+  200: SkillVersionResponse
+}
+
+export type PostWorkspacesCurrentSkillsBySkillIdPublishResponse =
+  PostWorkspacesCurrentSkillsBySkillIdPublishResponses[keyof PostWorkspacesCurrentSkillsBySkillIdPublishResponses]
+
+export type GetWorkspacesCurrentSkillsBySkillIdReferencesData = {
+  body?: never
+  path: {
+    skill_id: string
+  }
+  query?: never
+  url: '/workspaces/current/skills/{skill_id}/references'
+}
+
+export type GetWorkspacesCurrentSkillsBySkillIdReferencesResponses = {
+  200: SkillReferenceListResponse
+}
+
+export type GetWorkspacesCurrentSkillsBySkillIdReferencesResponse =
+  GetWorkspacesCurrentSkillsBySkillIdReferencesResponses[keyof GetWorkspacesCurrentSkillsBySkillIdReferencesResponses]
+
+export type PostWorkspacesCurrentSkillsBySkillIdRestoreData = {
+  body: SkillRestorePayload
+  path: {
+    skill_id: string
+  }
+  query?: never
+  url: '/workspaces/current/skills/{skill_id}/restore'
+}
+
+export type PostWorkspacesCurrentSkillsBySkillIdRestoreResponses = {
+  200: SkillVersionResponse
+}
+
+export type PostWorkspacesCurrentSkillsBySkillIdRestoreResponse =
+  PostWorkspacesCurrentSkillsBySkillIdRestoreResponses[keyof PostWorkspacesCurrentSkillsBySkillIdRestoreResponses]
+
+export type GetWorkspacesCurrentSkillsBySkillIdVersionsData = {
+  body?: never
+  path: {
+    skill_id: string
+  }
+  query?: never
+  url: '/workspaces/current/skills/{skill_id}/versions'
+}
+
+export type GetWorkspacesCurrentSkillsBySkillIdVersionsResponses = {
+  200: SkillVersionListResponse
+}
+
+export type GetWorkspacesCurrentSkillsBySkillIdVersionsResponse =
+  GetWorkspacesCurrentSkillsBySkillIdVersionsResponses[keyof GetWorkspacesCurrentSkillsBySkillIdVersionsResponses]
+
+export type DeleteWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdData = {
+  body?: never
+  path: {
+    skill_id: string
+    version_id: string
+  }
+  query?: never
+  url: '/workspaces/current/skills/{skill_id}/versions/{version_id}'
+}
+
+export type DeleteWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdResponses = {
+  200: SkillVersionDeleteResponse
+}
+
+export type DeleteWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdResponse =
+  DeleteWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdResponses[keyof DeleteWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdResponses]
+
+export type GetWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdData = {
+  body?: never
+  path: {
+    skill_id: string
+    version_id: string
+  }
+  query?: never
+  url: '/workspaces/current/skills/{skill_id}/versions/{version_id}'
+}
+
+export type GetWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdResponses = {
+  200: SkillVersionDetailResponse
+}
+
+export type GetWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdResponse =
+  GetWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdResponses[keyof GetWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdResponses]
+
+export type PatchWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdData = {
+  body: SkillVersionUpdatePayload
+  path: {
+    skill_id: string
+    version_id: string
+  }
+  query?: never
+  url: '/workspaces/current/skills/{skill_id}/versions/{version_id}'
+}
+
+export type PatchWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdResponses = {
+  200: SkillVersionResponse
+}
+
+export type PatchWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdResponse =
+  PatchWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdResponses[keyof PatchWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdResponses]
+
 export type GetWorkspacesCurrentToolLabelsData = {
   body?: never
   path?: never

packages/contracts/generated/api/console/workspaces/zod.gen.ts

@@ -12,6 +12,13 @@ export const zAgentProviderResponse = z.record(z.string(), z.unknown())
  */
 export const zAgentProviderListResponse = z.array(z.record(z.string(), z.unknown()))
 
+/**
+ * AgentSkillBindingsPayload
+ */
+export const zAgentSkillBindingsPayload = z.object({
+  skill_ids: z.array(z.string()).optional(),
+})
+
 /**
  * SnippetImportPayload
  *
@@ -436,6 +443,155 @@ export const zReplaceBindingsRequest = z.object({
   role_ids: z.array(z.string()).optional(),
 })
 
+/**
+ * SkillCreatePayload
+ */
+export const zSkillCreatePayload = z.object({
+  description: z.string().optional().default(''),
+  display_name: z.string().nullish(),
+  icon: z.string().optional().default('📄'),
+  name: z.string().nullish(),
+  tags: z.array(z.string()).optional(),
+})
+
+/**
+ * SkillFileUploadResponse
+ */
+export const zSkillFileUploadResponse = z.object({
+  hash: z.string(),
+  id: z.string(),
+  mime_type: z.string(),
+  name: z.string(),
+  size: z.int(),
+})
+
+/**
+ * SkillDeletePayload
+ */
+export const zSkillDeletePayload = z.object({
+  confirmation_name: z.string().nullish(),
+})
+
+/**
+ * SkillDeleteResponse
+ */
+export const zSkillDeleteResponse = z.object({
+  deleted: z.boolean(),
+  id: z.string(),
+})
+
+/**
+ * SkillMetadataPayload
+ */
+export const zSkillMetadataPayload = z.object({
+  display_name: z.string().nullish(),
+  expected_updated_at: z.int().nullish(),
+  icon: z.string().nullish(),
+  tags: z.array(z.string()).nullish(),
+})
+
+/**
+ * SkillResponse
+ */
+export const zSkillResponse = z.object({
+  created_at: z.int(),
+  created_by: z.string().nullish(),
+  created_by_name: z.string().nullish(),
+  description: z.string(),
+  display_name: z.string(),
+  icon: z.string(),
+  id: z.string(),
+  latest_published_version_id: z.string().nullish(),
+  name: z.string(),
+  name_manually_edited: z.boolean().optional().default(false),
+  reference_count: z.int().optional().default(0),
+  tags: z.array(z.string()).optional(),
+  updated_at: z.int(),
+  updated_by: z.string().nullish(),
+  updated_by_name: z.string().nullish(),
+  visibility: z.string(),
+})
+
+/**
+ * SkillListResponse
+ */
+export const zSkillListResponse = z.object({
+  data: z.array(zSkillResponse).optional(),
+  has_more: z.boolean().optional().default(false),
+  limit: z.int().optional().default(20),
+  page: z.int().optional().default(1),
+  total: z.int().optional().default(0),
+})
+
+/**
+ * SkillFilePreviewResponse
+ */
+export const zSkillFilePreviewResponse = z.object({
+  content: z.string(),
+  hash: z.string(),
+  mime_type: z.string(),
+  path: z.string(),
+  size: z.int(),
+})
+
+/**
+ * SkillPublishPayload
+ */
+export const zSkillPublishPayload = z.object({
+  publish_note: z.string().max(1024).optional().default(''),
+  version_name: z.string().max(128).nullish(),
+})
+
+/**
+ * SkillVersionResponse
+ */
+export const zSkillVersionResponse = z.object({
+  archive_size: z.int(),
+  created_at: z.int(),
+  hash_code: z.string(),
+  id: z.string(),
+  is_latest: z.boolean().optional().default(false),
+  publish_note: z.string(),
+  published_by: z.string().nullish(),
+  published_by_name: z.string().nullish(),
+  skill_id: z.string(),
+  version_name: z.string(),
+  version_number: z.int(),
+})
+
+/**
+ * SkillRestorePayload
+ */
+export const zSkillRestorePayload = z.object({
+  publish_note: z.string().max(1024).optional().default(''),
+  version_id: z.string(),
+  version_name: z.string().max(128).nullish(),
+})
+
+/**
+ * SkillVersionListResponse
+ */
+export const zSkillVersionListResponse = z.object({
+  data: z.array(zSkillVersionResponse).optional(),
+})
+
+/**
+ * SkillVersionDeleteResponse
+ */
+export const zSkillVersionDeleteResponse = z.object({
+  deleted: z.boolean(),
+  id: z.string(),
+  latest_published_version_id: z.string().nullish(),
+})
+
+/**
+ * SkillVersionUpdatePayload
+ */
+export const zSkillVersionUpdatePayload = z.object({
+  publish_note: z.string().max(1024).optional().default(''),
+  version_name: z.string().max(128).nullish(),
+})
+
 /**
  * ApiToolProviderDeletePayload
  */
@@ -656,6 +812,33 @@ export const zSwitchWorkspaceResponse = z.object({
   result: z.string(),
 })
 
+/**
+ * AgentSkillBindingItemResponse
+ */
+export const zAgentSkillBindingItemResponse = z.object({
+  description: z.string(),
+  display_name: z.string(),
+  file_count: z.int(),
+  icon: z.string(),
+  id: z.string(),
+  latest_published_at: z.int().nullish(),
+  latest_published_version_id: z.string().nullish(),
+  name: z.string(),
+  priority: z.int(),
+  status: z.string(),
+  tags: z.array(z.string()).optional(),
+  updated_at: z.int(),
+})
+
+/**
+ * AgentSkillBindingsResponse
+ */
+export const zAgentSkillBindingsResponse = z.object({
+  agent_id: z.string(),
+  data: z.array(zAgentSkillBindingItemResponse).optional(),
+  skill_ids: z.array(z.string()).optional(),
+})
+
 /**
  * IconInfo
  *
@@ -1244,6 +1427,164 @@ export const zWorkspaceAccessMatrix = z.object({
   pagination: zPagination.nullish(),
 })
 
+/**
+ * SkillFileResponse
+ */
+export const zSkillFileResponse = z.object({
+  content: z.string().nullish(),
+  hash: z.string().nullish(),
+  id: z.string().nullish(),
+  kind: z.string(),
+  mime_type: z.string().nullish(),
+  path: z.string(),
+  size: z.int().nullish(),
+  storage: z.string().nullish(),
+  tool_file_id: z.string().nullish(),
+})
+
+/**
+ * SkillDetailResponse
+ */
+export const zSkillDetailResponse = z.object({
+  created_at: z.int(),
+  created_by: z.string().nullish(),
+  created_by_name: z.string().nullish(),
+  description: z.string(),
+  display_name: z.string(),
+  files: z.array(zSkillFileResponse).optional(),
+  icon: z.string(),
+  id: z.string(),
+  latest_published_version_id: z.string().nullish(),
+  name: z.string(),
+  name_manually_edited: z.boolean().optional().default(false),
+  reference_count: z.int().optional().default(0),
+  tags: z.array(z.string()).optional(),
+  updated_at: z.int(),
+  updated_by: z.string().nullish(),
+  updated_by_name: z.string().nullish(),
+  visibility: z.string(),
+})
+
+/**
+ * SkillVersionDetailResponse
+ */
+export const zSkillVersionDetailResponse = z.object({
+  archive_size: z.int(),
+  created_at: z.int(),
+  files: z.array(zSkillFileResponse).optional(),
+  hash_code: z.string(),
+  id: z.string(),
+  is_latest: z.boolean().optional().default(false),
+  publish_note: z.string(),
+  published_by: z.string().nullish(),
+  published_by_name: z.string().nullish(),
+  skill_id: z.string(),
+  version_name: z.string(),
+  version_number: z.int(),
+})
+
+/**
+ * SkillTagResponse
+ */
+export const zSkillTagResponse = z.object({
+  count: z.int(),
+  tag: z.string(),
+})
+
+/**
+ * SkillTagListResponse
+ */
+export const zSkillTagListResponse = z.object({
+  data: z.array(zSkillTagResponse).optional(),
+})
+
+/**
+ * SkillAssistAttachmentPayload
+ */
+export const zSkillAssistAttachmentPayload = z.object({
+  mime_type: z.string().min(1).max(255).nullish(),
+  name: z.string().min(1).max(255),
+  size: z.int().gte(0).nullish(),
+  tool_file_id: z.string().min(1),
+})
+
+/**
+ * SkillAssistModelPayload
+ */
+export const zSkillAssistModelPayload = z.object({
+  model: z.string().min(1).max(255),
+  model_settings: z.record(z.string(), z.unknown()).nullish(),
+  plugin_id: z.string().min(1).max(255).nullish(),
+  provider: z.string().min(1).max(255),
+})
+
+/**
+ * SkillAssistMessagePayload
+ *
+ * One user message and optional uploaded context for the read-only Skill Authoring assistant.
+ */
+export const zSkillAssistMessagePayload = z.object({
+  attachments: z.array(zSkillAssistAttachmentPayload).max(10).optional(),
+  message: z.string().min(1).max(8000),
+  model: zSkillAssistModelPayload.nullish(),
+  target_path: z.string().nullish(),
+})
+
+/**
+ * SkillDraftFileOperation
+ */
+export const zSkillDraftFileOperation = z.enum([
+  'delete',
+  'mkdir',
+  'rename',
+  'upsert_text',
+  'upsert_tool_file',
+])
+
+/**
+ * SkillDraftFileOperationPayload
+ */
+export const zSkillDraftFileOperationPayload = z.object({
+  content: z.string().nullish(),
+  expected_updated_at: z.int().nullish(),
+  hash: z.string().nullish(),
+  mime_type: z.string().nullish(),
+  operation: zSkillDraftFileOperation,
+  path: z.string(),
+  size: z.int().gte(0).nullish(),
+  target_path: z.string().nullish(),
+  tool_file_id: z.string().nullish(),
+})
+
+/**
+ * SkillReferenceResponse
+ */
+export const zSkillReferenceResponse = z.object({
+  agent_id: z.string(),
+  agent_icon: z.string().nullish(),
+  agent_icon_background: z.string().nullish(),
+  agent_icon_type: z.string().nullish(),
+  app_id: z.string().nullish(),
+  display_name: z.string(),
+  name: z.string(),
+  node_id: z.string().nullish(),
+  node_name: z.string().nullish(),
+  type: z.string(),
+  workflow_icon: z.string().nullish(),
+  workflow_icon_background: z.string().nullish(),
+  workflow_icon_type: z.string().nullish(),
+  workflow_id: z.string().nullish(),
+  workflow_name: z.string().nullish(),
+  workflow_version: z.string().nullish(),
+})
+
+/**
+ * SkillReferenceListResponse
+ */
+export const zSkillReferenceListResponse = z.object({
+  data: z.array(zSkillReferenceResponse).optional(),
+})
+
 /**
  * ToolEmojiIcon
  */
@@ -2096,6 +2437,42 @@ export const zPermissionCatalogResponse = z.object({
   groups: z.array(zPermissionCatalogGroup).optional(),
 })
 
+/**
+ * SkillFileKind
+ *
+ * Draft file entry kind.
+ */
+export const zSkillFileKind = z.enum(['directory', 'file'])
+
+/**
+ * SkillFileStorage
+ *
+ * How a draft file's content is stored.
+ */
+export const zSkillFileStorage = z.enum(['text', 'tool_file'])
+
+/**
+ * SkillDraftTreeItemPayload
+ */
+export const zSkillDraftTreeItemPayload = z.object({
+  content: z.string().nullish(),
+  hash: z.string().nullish(),
+  kind: zSkillFileKind.optional().default('file'),
+  mime_type: z.string().nullish(),
+  path: z.string(),
+  size: z.int().gte(0).nullish(),
+  storage: zSkillFileStorage.nullish(),
+  tool_file_id: z.string().nullish(),
+})
+
+/**
+ * SkillDraftTreePayload
+ */
+export const zSkillDraftTreePayload = z.object({
+  expected_updated_at: z.int().nullish(),
+  files: z.array(zSkillDraftTreeItemPayload).optional(),
+})
+
 /**
  * Option
  */
@@ -3421,6 +3798,26 @@ export const zGetWorkspacesCurrentAgentProviderByProviderNameResponse = zAgentPr
  */
 export const zGetWorkspacesCurrentAgentProvidersResponse = zAgentProviderListResponse
 
+export const zGetWorkspacesCurrentAgentsByAgentIdSkillsPath = z.object({
+  agent_id: z.string(),
+})
+
+/**
+ * Agent Skill bindings
+ */
+export const zGetWorkspacesCurrentAgentsByAgentIdSkillsResponse = zAgentSkillBindingsResponse
+
+export const zPutWorkspacesCurrentAgentsByAgentIdSkillsBody = zAgentSkillBindingsPayload
+
+export const zPutWorkspacesCurrentAgentsByAgentIdSkillsPath = z.object({
+  agent_id: z.string(),
+})
+
+/**
+ * Agent Skill bindings replaced
+ */
+export const zPutWorkspacesCurrentAgentsByAgentIdSkillsResponse = zAgentSkillBindingsResponse
+
 export const zGetWorkspacesCurrentCustomizedSnippetsQuery = z.object({
   creators: z.array(z.string()).optional(),
   is_published: z.boolean().optional(),
@@ -4694,6 +5091,234 @@ export const zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdR
  */
 export const zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPolicyResponse = zWorkspaceAccessMatrix
 
+export const zGetWorkspacesCurrentSkillsQuery = z.object({
+  keyword: z.string().optional(),
+  limit: z.int().gte(1).lte(100).optional().default(20),
+  page: z.int().gte(1).lte(99999).optional().default(1),
+  tag: z.array(z.string()).optional(),
+})
+
+/**
+ * Workspace skills
+ */
+export const zGetWorkspacesCurrentSkillsResponse = zSkillListResponse
+
+export const zPostWorkspacesCurrentSkillsBody = zSkillCreatePayload
+
+/**
+ * Skill created
+ */
+export const zPostWorkspacesCurrentSkillsResponse = zSkillDetailResponse
+
+export const zPostWorkspacesCurrentSkillsFilesUploadBody = z.object({
+  file: z.custom<Blob | File>((value) => value instanceof Blob || value instanceof File),
+})
+
+/**
+ * Skill draft file uploaded
+ */
+export const zPostWorkspacesCurrentSkillsFilesUploadResponse = zSkillFileUploadResponse
+
+/**
+ * Skill imported
+ */
+export const zPostWorkspacesCurrentSkillsImportResponse = zSkillDetailResponse
+
+/**
+ * Workspace Skill tags
+ */
+export const zGetWorkspacesCurrentSkillsTagsResponse = zSkillTagListResponse
+
+export const zDeleteWorkspacesCurrentSkillsBySkillIdBody = zSkillDeletePayload
+
+export const zDeleteWorkspacesCurrentSkillsBySkillIdPath = z.object({
+  skill_id: z.string(),
+})
+
+/**
+ * Skill deleted
+ */
+export const zDeleteWorkspacesCurrentSkillsBySkillIdResponse = zSkillDeleteResponse
+
+export const zGetWorkspacesCurrentSkillsBySkillIdPath = z.object({
+  skill_id: z.string(),
+})
+
+/**
+ * Skill detail
+ */
+export const zGetWorkspacesCurrentSkillsBySkillIdResponse = zSkillDetailResponse
+
+export const zPatchWorkspacesCurrentSkillsBySkillIdBody = zSkillMetadataPayload
+
+export const zPatchWorkspacesCurrentSkillsBySkillIdPath = z.object({
+  skill_id: z.string(),
+})
+
+/**
+ * Skill updated
+ */
+export const zPatchWorkspacesCurrentSkillsBySkillIdResponse = zSkillResponse
+
+export const zPostWorkspacesCurrentSkillsBySkillIdAssistMessagesBody = zSkillAssistMessagePayload
+
+export const zPostWorkspacesCurrentSkillsBySkillIdAssistMessagesPath = z.object({
+  skill_id: z.string(),
+})
+
+/**
+ * Skill Authoring assistant event stream
+ */
+export const zPostWorkspacesCurrentSkillsBySkillIdAssistMessagesResponse = z.record(
+  z.string(),
+  z.unknown(),
+)
+
+export const zPostWorkspacesCurrentSkillsBySkillIdDuplicatePath = z.object({
+  skill_id: z.string(),
+})
+
+/**
+ * Skill duplicated
+ */
+export const zPostWorkspacesCurrentSkillsBySkillIdDuplicateResponse = zSkillDetailResponse
+
+export const zGetWorkspacesCurrentSkillsBySkillIdExportPath = z.object({
+  skill_id: z.string(),
+})
+
+/**
+ * Published Skill zip archive
+ */
+export const zGetWorkspacesCurrentSkillsBySkillIdExportResponse = z.record(z.string(), z.unknown())
+
+export const zPatchWorkspacesCurrentSkillsBySkillIdFilesBody = zSkillDraftFileOperationPayload
+
+export const zPatchWorkspacesCurrentSkillsBySkillIdFilesPath = z.object({
+  skill_id: z.string(),
+})
+
+/**
+ * Draft file operation applied
+ */
+export const zPatchWorkspacesCurrentSkillsBySkillIdFilesResponse = zSkillDetailResponse
+
+export const zPutWorkspacesCurrentSkillsBySkillIdFilesBody = zSkillDraftTreePayload
+
+export const zPutWorkspacesCurrentSkillsBySkillIdFilesPath = z.object({
+  skill_id: z.string(),
+})
+
+/**
+ * Draft files replaced
+ */
+export const zPutWorkspacesCurrentSkillsBySkillIdFilesResponse = zSkillDetailResponse
+
+export const zGetWorkspacesCurrentSkillsBySkillIdFilesContentPath = z.object({
+  skill_id: z.string(),
+})
+
+export const zGetWorkspacesCurrentSkillsBySkillIdFilesContentQuery = z.object({
+  download: z.string().optional(),
+  path: z.string(),
+  version_id: z.string().optional(),
+})
+
+/**
+ * Skill file content
+ */
+export const zGetWorkspacesCurrentSkillsBySkillIdFilesContentResponse = zBinaryFileResponse
+
+export const zGetWorkspacesCurrentSkillsBySkillIdFilesPreviewPath = z.object({
+  skill_id: z.string(),
+})
+
+export const zGetWorkspacesCurrentSkillsBySkillIdFilesPreviewQuery = z.object({
+  path: z.string(),
+  version_id: z.string().optional(),
+})
+
+/**
+ * Skill file text preview
+ */
+export const zGetWorkspacesCurrentSkillsBySkillIdFilesPreviewResponse = zSkillFilePreviewResponse
+
+export const zPostWorkspacesCurrentSkillsBySkillIdPublishBody = zSkillPublishPayload
+
+export const zPostWorkspacesCurrentSkillsBySkillIdPublishPath = z.object({
+  skill_id: z.string(),
+})
+
+/**
+ * Skill published
+ */
+export const zPostWorkspacesCurrentSkillsBySkillIdPublishResponse = zSkillVersionResponse
+
+export const zGetWorkspacesCurrentSkillsBySkillIdReferencesPath = z.object({
+  skill_id: z.string(),
+})
+
+/**
+ * Skill references
+ */
+export const zGetWorkspacesCurrentSkillsBySkillIdReferencesResponse = zSkillReferenceListResponse
+
+export const zPostWorkspacesCurrentSkillsBySkillIdRestoreBody = zSkillRestorePayload
+
+export const zPostWorkspacesCurrentSkillsBySkillIdRestorePath = z.object({
+  skill_id: z.string(),
+})
+
+/**
+ * Skill version restored
+ */
+export const zPostWorkspacesCurrentSkillsBySkillIdRestoreResponse = zSkillVersionResponse
+
+export const zGetWorkspacesCurrentSkillsBySkillIdVersionsPath = z.object({
+  skill_id: z.string(),
+})
+
+/**
+ * Skill versions
+ */
+export const zGetWorkspacesCurrentSkillsBySkillIdVersionsResponse = zSkillVersionListResponse
+
+export const zDeleteWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdPath = z.object({
+  skill_id: z.string(),
+  version_id: z.string(),
+})
+
+/**
+ * Skill version deleted
+ */
+export const zDeleteWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdResponse =
+  zSkillVersionDeleteResponse
+
+export const zGetWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdPath = z.object({
+  skill_id: z.string(),
+  version_id: z.string(),
+})
+
+/**
+ * Skill version detail
+ */
+export const zGetWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdResponse =
+  zSkillVersionDetailResponse
+
+export const zPatchWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdBody =
+  zSkillVersionUpdatePayload
+
+export const zPatchWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdPath = z.object({
+  skill_id: z.string(),
+  version_id: z.string(),
+})
+
+/**
+ * Skill version updated
+ */
+export const zPatchWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdResponse =
+  zSkillVersionResponse
+
 /**
  * Tool labels retrieved successfully
  */

packages/contracts/non-json-openapi-responses.md

@@ -18,6 +18,7 @@ The current Flask-RESTX generator still emits these response entries under `appl
 | service | GET    | `/files/{file_id}/preview`                                              | Original file MIME type, optionally attachment | `BinaryFileResponse`  |
 | console | GET    | `/workspaces/current/plugin/icon`                                       | Plugin asset MIME type                         | `BinaryFileResponse`  |
 | console | GET    | `/workspaces/current/plugin/asset`                                      | `application/octet-stream`                     | `BinaryFileResponse`  |
+| console | GET    | `/workspaces/current/skills/{skill_id}/files/content`                   | Skill file MIME type, optionally attachment    | `BinaryFileResponse`  |
 | console | GET    | `/workspaces/current/tool-provider/builtin/{provider}/icon`             | Tool icon MIME type                            | `BinaryFileResponse`  |
 | console | GET    | `/workspaces/current/trigger-provider/{provider}/icon`                  | Trigger icon response                          | `BinaryFileResponse`  |
 | console | GET    | `/workspaces/{tenant_id}/model-providers/{provider}/{icon_type}/{lang}` | Model provider icon MIME type                  | `BinaryFileResponse`  |

web/app/(commonLayout)/skills/[skillId]/page.tsx

@@ -0,0 +1,5 @@
+import SkillDetailPage from '@/features/skills/detail-page'
+
+export default function Page() {
+  return <SkillDetailPage />
+}

web/app/(commonLayout)/skills/page.tsx

@@ -0,0 +1,5 @@
+import SkillsPage from '@/features/skills/page'
+
+export default function Page() {
+  return <SkillsPage />
+}

web/app/components/app/log/__tests__/archived-logs-notice.spec.tsx

@@ -1,4 +1,5 @@
-import { fireEvent, screen } from '@testing-library/react'
+import { screen, within } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
 import { createMockProviderContextValue } from '@/__mocks__/provider-context'
 import { defaultPlan } from '@/app/components/billing/config'
 import { Plan } from '@/app/components/billing/type'
@@ -67,11 +68,16 @@ describe('ArchivedLogsNotice', () => {
     )
   })
 
-  it('should show notice for paid workspace managers', () => {
+  it('should show an accessible notice for paid workspace managers', async () => {
+    const user = userEvent.setup()
     renderNotice()
 
-    expect(screen.getByText('appLog.archives.notice.description')).toBeInTheDocument()
-    fireEvent.click(screen.getByRole('button', { name: 'appLog.archives.notice.action' }))
+    const notice = screen.getByRole('status')
+    expect(notice).toHaveAttribute('aria-live', 'polite')
+    expect(notice).toHaveAttribute('aria-atomic', 'true')
+    expect(within(notice).getByText('appLog.archives.notice.description')).toBeInTheDocument()
+
+    await user.click(within(notice).getByRole('button', { name: 'appLog.archives.notice.action' }))
     expect(setShowAccountSettingModal).toHaveBeenCalledWith({
       payload: ACCOUNT_SETTING_TAB.WORKFLOW_LOG_ARCHIVES,
     })

web/app/components/app/log/__tests__/filter.spec.tsx

@@ -1,9 +1,37 @@
 import type { QueryParam } from '../index'
-import { fireEvent, render, screen } from '@testing-library/react'
+import { fireEvent, render, screen, within } from '@testing-library/react'
 import Filter, { TIME_PERIOD_MAPPING } from '../filter'
 
 let mockAnnotationsCountLoading = false
 let mockAnnotationsCountData: { count: number } | null = { count: 10 }
+const mockRuntime = vi.hoisted(() => ({
+  deploymentEdition: 'CLOUD',
+  enableBilling: true,
+  isFetchedPlan: true,
+  isFetchedPlanInfo: true,
+  planType: 'professional',
+}))
+
+vi.mock('@tanstack/react-query', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@tanstack/react-query')>()
+  return {
+    ...actual,
+    useSuspenseQuery: () => ({ data: mockRuntime.deploymentEdition }),
+  }
+})
+
+vi.mock('@/context/provider-context', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@/context/provider-context')>()
+  return {
+    ...actual,
+    useProviderContext: () => ({
+      enableBilling: mockRuntime.enableBilling,
+      isFetchedPlan: mockRuntime.isFetchedPlan,
+      isFetchedPlanInfo: mockRuntime.isFetchedPlanInfo,
+      plan: { type: mockRuntime.planType },
+    }),
+  }
+})
 
 vi.mock('@/service/use-log', () => ({
   useAnnotationsCount: () => ({
@@ -12,28 +40,43 @@ vi.mock('@/service/use-log', () => ({
   }),
 }))
 
-vi.mock('@/app/components/base/chip', () => ({
-  default: ({
-    items,
-    value,
-    onSelect,
-    onClear,
-  }: {
-    items: Array<{ value: string; name: string }>
-    value?: string
-    onSelect: (item: { value: string; name: string }) => void
-    onClear: () => void
-  }) => {
-    const currentItem = items.find((item) => item.value === value) ?? items[0]
-    return (
-      <div>
-        <div>{currentItem?.name}</div>
-        <button onClick={() => onSelect(items.at(-1)!)}>{`select-${items.at(-1)?.value}`}</button>
-        <button onClick={onClear}>clear-chip</button>
-      </div>
-    )
-  },
-}))
+vi.mock('@/app/components/base/chip', async () => {
+  const { useState } = await import('react')
+
+  return {
+    default: function MockChip({
+      items,
+      value,
+      onSelect,
+      onClear,
+    }: {
+      items: Array<{ value: string; name: string }>
+      value?: string
+      onSelect: (item: { value: string; name: string }) => void
+      onClear: () => void
+    }) {
+      const [isOpen, setIsOpen] = useState(false)
+      const currentItem = items.find((item) => item.value === value) ?? items[0]
+      return (
+        <div>
+          <div>{currentItem?.name}</div>
+          <button aria-label={`open-options-${items[0]?.value}`} onClick={() => setIsOpen(true)}>
+            open-chip
+          </button>
+          {isOpen && (
+            <ul aria-label={`options-${items[0]?.value}`}>
+              {items.map((item) => (
+                <li key={item.value}>{item.name}</li>
+              ))}
+            </ul>
+          )}
+          <button onClick={() => onSelect(items.at(-1)!)}>{`select-${items.at(-1)?.value}`}</button>
+          <button onClick={onClear}>clear-chip</button>
+        </div>
+      )
+    },
+  }
+})
 
 vi.mock('@/app/components/base/sort', () => ({
   default: ({ onSelect }: { onSelect: (value: string) => void }) => (
@@ -59,6 +102,11 @@ describe('Filter', () => {
     vi.clearAllMocks()
     mockAnnotationsCountLoading = false
     mockAnnotationsCountData = { count: 10 }
+    mockRuntime.deploymentEdition = 'CLOUD'
+    mockRuntime.enableBilling = true
+    mockRuntime.isFetchedPlan = true
+    mockRuntime.isFetchedPlanInfo = true
+    mockRuntime.planType = 'professional'
   })
 
   describe('Rendering', () => {
@@ -124,6 +172,77 @@ describe('Filter', () => {
   })
 
   describe('User Interactions', () => {
+    it('should only show supported periods for Cloud sandbox workspaces', () => {
+      mockRuntime.deploymentEdition = 'CLOUD'
+      mockRuntime.planType = 'sandbox'
+
+      render(<Filter {...defaultProps} queryParams={{ ...defaultQueryParams, period: '2' }} />)
+
+      fireEvent.click(screen.getByRole('button', { name: 'open-options-1' }))
+
+      const periodOptions = within(screen.getByRole('list', { name: 'options-1' }))
+      expect(periodOptions.getAllByRole('listitem').map((item) => item.textContent)).toEqual([
+        expect.stringMatching(/(?:^|\.)filter\.period\.today(?=$|:)/),
+        expect.stringMatching(/(?:^|\.)filter\.period\.last7days(?=$|:)/),
+        expect.stringMatching(/(?:^|\.)filter\.period\.last30days(?=$|:)/),
+      ])
+    })
+
+    it('should only show supported periods while the Cloud plan is pending', () => {
+      mockRuntime.isFetchedPlan = false
+      mockRuntime.isFetchedPlanInfo = false
+
+      render(<Filter {...defaultProps} queryParams={{ ...defaultQueryParams, period: '2' }} />)
+
+      fireEvent.click(screen.getByRole('button', { name: 'open-options-1' }))
+
+      const periodOptions = within(screen.getByRole('list', { name: 'options-1' }))
+      expect(periodOptions.getAllByRole('listitem').map((item) => item.textContent)).toEqual([
+        expect.stringMatching(/(?:^|\.)filter\.period\.today(?=$|:)/),
+        expect.stringMatching(/(?:^|\.)filter\.period\.last7days(?=$|:)/),
+        expect.stringMatching(/(?:^|\.)filter\.period\.last30days(?=$|:)/),
+      ])
+    })
+
+    it('should keep all periods when Cloud billing is known to be disabled', () => {
+      mockRuntime.enableBilling = false
+      mockRuntime.isFetchedPlan = false
+      mockRuntime.isFetchedPlanInfo = true
+
+      render(<Filter {...defaultProps} queryParams={{ ...defaultQueryParams, period: '2' }} />)
+
+      fireEvent.click(screen.getByRole('button', { name: 'open-options-1' }))
+
+      const periodOptions = within(screen.getByRole('list', { name: 'options-1' }))
+      expect(periodOptions.getAllByRole('listitem')).toHaveLength(9)
+    })
+
+    it('should keep all periods for sandbox workspaces outside Cloud', () => {
+      mockRuntime.deploymentEdition = 'COMMUNITY'
+      mockRuntime.planType = 'sandbox'
+
+      render(<Filter {...defaultProps} queryParams={{ ...defaultQueryParams, period: '2' }} />)
+
+      fireEvent.click(screen.getByRole('button', { name: 'open-options-1' }))
+
+      const periodOptions = within(screen.getByRole('list', { name: 'options-1' }))
+      expect(periodOptions.getAllByRole('listitem')).toHaveLength(9)
+    })
+
+    it('should reset the Cloud sandbox period to today when cleared', () => {
+      mockRuntime.deploymentEdition = 'CLOUD'
+      mockRuntime.planType = 'sandbox'
+
+      render(<Filter {...defaultProps} queryParams={{ ...defaultQueryParams, period: '2' }} />)
+
+      fireEvent.click(screen.getAllByText('clear-chip')[0]!)
+
+      expect(mockSetQueryParams).toHaveBeenCalledWith({
+        ...defaultQueryParams,
+        period: '1',
+      })
+    })
+
     it('should update keyword when typing in search input', () => {
       render(<Filter {...defaultProps} />)
 

web/app/components/app/log/__tests__/index.spec.tsx

@@ -1,5 +1,8 @@
 /* oxlint-disable typescript/no-explicit-any */
+import type { CloudSandboxPlanState } from '../cloud-sandbox-retention'
 import { fireEvent, render, screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import dayjs from 'dayjs'
 import { APP_PAGE_LIMIT } from '@/config'
 import { AppModeEnum } from '@/types/app'
 import Logs from '../index'
@@ -11,11 +14,27 @@ vi.mock('@/context/i18n', () => ({
 const mockReplace = vi.fn()
 const mockUseChatConversations = vi.fn()
 const mockUseCompletionConversations = vi.fn()
+const mockPlanState = vi.hoisted(() => ({
+  value: 'unrestricted' as CloudSandboxPlanState,
+}))
+const mockDebouncedPeriod = vi.hoisted(() => ({
+  value: null as string | null,
+}))
 
 let mockSearchParams = new URLSearchParams()
 vi.mock('ahooks', async () => {
   return {
-    useDebounce: <T,>(value: T) => value,
+    useDebounce: <T,>(value: T) => {
+      if (
+        mockDebouncedPeriod.value === null ||
+        typeof value !== 'object' ||
+        value === null ||
+        !('period' in value)
+      )
+        return value
+
+      return { ...value, period: mockDebouncedPeriod.value }
+    },
   }
 })
 
@@ -33,28 +52,19 @@ vi.mock('@/next/navigation', () => ({
 vi.mock('@/service/use-log', () => ({
   useChatConversations: (...args: unknown[]) => mockUseChatConversations(...args),
   useCompletionConversations: (...args: unknown[]) => mockUseCompletionConversations(...args),
+  useAnnotationsCount: () => ({
+    data: { count: 0 },
+    isLoading: false,
+  }),
 }))
 
-vi.mock('../filter', () => ({
-  TIME_PERIOD_MAPPING: {
-    2: { value: 7 },
-    9: { value: 0 },
-  },
-  default: ({ setQueryParams }: { setQueryParams: (next: Record<string, string>) => void }) => (
-    <button
-      onClick={() =>
-        setQueryParams({
-          period: '9',
-          annotation_status: 'all',
-          sort_by: '-created_at',
-          keyword: 'hello',
-        })
-      }
-    >
-      filter-controls
-    </button>
-  ),
-}))
+vi.mock('../cloud-sandbox-retention', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../cloud-sandbox-retention')>()
+  return {
+    ...actual,
+    useCloudSandboxPlanStatus: () => mockPlanState.value,
+  }
+})
 
 vi.mock('../list', () => ({
   default: ({ logs }: { logs: { total?: number } }) => (
@@ -69,6 +79,10 @@ vi.mock('../empty-element', () => ({
   default: () => <div>empty-logs</div>,
 }))
 
+vi.mock('../retention-upgrade-notice', () => ({
+  RetentionUpgradeNotice: () => <div>retention-upgrade-notice</div>,
+}))
+
 vi.mock('@/app/components/base/loading', () => ({
   default: () => <div>loading-logs</div>,
 }))
@@ -85,6 +99,8 @@ describe('Logs', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mockSearchParams = new URLSearchParams()
+    mockPlanState.value = 'unrestricted'
+    mockDebouncedPeriod.value = null
     mockUseChatConversations.mockReturnValue({
       data: undefined,
       refetch: vi.fn(),
@@ -117,6 +133,7 @@ describe('Logs', () => {
     expect(
       screen.getByRole('link', { name: /(?:^|\.)operation\.learnMore(?=$|:)/ }),
     ).toHaveAttribute('href', 'https://docs.example.com/use-dify/monitor/logs')
+    expect(screen.getByText('retention-upgrade-notice')).toBeInTheDocument()
     expect(screen.getByText('loading-logs')).toBeInTheDocument()
   })
 
@@ -166,4 +183,101 @@ describe('Logs', () => {
 
     expect(mockReplace).toHaveBeenCalledWith('/apps/app-1/logs?page=2', { scroll: false })
   })
+
+  it('should query the last 30 days when a Sandbox user selects the longest period', async () => {
+    const user = userEvent.setup()
+    mockPlanState.value = 'sandbox'
+    mockUseChatConversations.mockReturnValue({
+      data: { total: 0 },
+      refetch: vi.fn(),
+    })
+
+    render(
+      <Logs
+        appDetail={
+          {
+            id: 'app-sandbox-last-30-days',
+            mode: AppModeEnum.CHAT,
+          } as any
+        }
+      />,
+    )
+
+    await user.click(screen.getByRole('combobox', { name: /appLog\.filter\.period\.last7days/ }))
+    await user.click(await screen.findByText(/appLog\.filter\.period\.last30days/))
+
+    expect(
+      screen.getByRole('combobox', { name: /appLog\.filter\.period\.last30days/ }),
+    ).toBeInTheDocument()
+    expect(mockUseChatConversations.mock.calls.at(-1)?.[0]).toEqual(
+      expect.objectContaining({
+        params: expect.objectContaining({
+          start: dayjs().subtract(30, 'day').startOf('day').format('YYYY-MM-DD HH:mm'),
+          end: dayjs().endOf('day').format('YYYY-MM-DD HH:mm'),
+        }),
+      }),
+    )
+  })
+
+  it('should use a valid period for the real Chip and request when a cached period settles to Sandbox', async () => {
+    const user = userEvent.setup()
+    const appDetail = {
+      id: 'app-period-transition',
+      mode: AppModeEnum.CHAT,
+    } as any
+    mockUseChatConversations.mockReturnValue({
+      data: { total: 0 },
+      refetch: vi.fn(),
+    })
+
+    const unrestrictedRender = render(<Logs appDetail={appDetail} />)
+
+    await user.click(screen.getByRole('combobox', { name: /appLog\.filter\.period\.last7days/ }))
+    await user.click(await screen.findByText(/appLog\.filter\.period\.allTime/))
+    expect(mockUseChatConversations.mock.calls.at(-1)?.[0]).toEqual(
+      expect.objectContaining({
+        params: expect.not.objectContaining({
+          start: expect.anything(),
+          end: expect.anything(),
+        }),
+      }),
+    )
+    unrestrictedRender.unmount()
+
+    mockPlanState.value = 'pending'
+    mockDebouncedPeriod.value = '9'
+    const pendingRender = render(<Logs appDetail={appDetail} />)
+
+    expect(
+      screen.getByRole('combobox', { name: /appLog\.filter\.period\.today/ }),
+    ).toBeInTheDocument()
+    expect(
+      screen.getByRole('button', {
+        name: /common\.operation\.clear appLog\.filter\.period\.today/,
+      }),
+    ).toBeInTheDocument()
+    expect(mockUseChatConversations.mock.calls.at(-1)?.[0]).toEqual(
+      expect.objectContaining({
+        params: expect.objectContaining({
+          start: dayjs().startOf('day').format('YYYY-MM-DD HH:mm'),
+          end: expect.any(String),
+        }),
+      }),
+    )
+
+    mockPlanState.value = 'sandbox'
+    pendingRender.rerender(<Logs appDetail={appDetail} />)
+
+    expect(
+      screen.getByRole('combobox', { name: /appLog\.filter\.period\.today/ }),
+    ).toBeInTheDocument()
+    expect(mockUseChatConversations.mock.calls.at(-1)?.[0]).toEqual(
+      expect.objectContaining({
+        params: expect.objectContaining({
+          start: dayjs().startOf('day').format('YYYY-MM-DD HH:mm'),
+          end: expect.any(String),
+        }),
+      }),
+    )
+  })
 })

web/app/components/app/log/__tests__/retention-upgrade-notice.spec.tsx

@@ -0,0 +1,117 @@
+import type { DeploymentEdition } from '@dify/contracts/api/console/system-features/types.gen'
+import { screen, within } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { createMockProviderContextValue } from '@/__mocks__/provider-context'
+import { defaultPlan } from '@/app/components/billing/config'
+import { Plan } from '@/app/components/billing/type'
+import { useModalContext } from '@/context/modal-context'
+import { useProviderContext } from '@/context/provider-context'
+import { createConsoleQueryWrapper } from '@/test/console/query-data'
+import { render } from '@/test/console/render'
+import { RetentionUpgradeNotice } from '../retention-upgrade-notice'
+
+vi.mock('@/context/provider-context', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@/context/provider-context')>()
+  return {
+    ...actual,
+    useProviderContext: vi.fn(),
+  }
+})
+
+vi.mock('@/context/modal-context', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@/context/modal-context')>()
+  return {
+    ...actual,
+    useModalContext: vi.fn(),
+  }
+})
+
+const mockUseProviderContext = vi.mocked(useProviderContext)
+const mockUseModalContext = vi.mocked(useModalContext)
+
+describe('RetentionUpgradeNotice', () => {
+  const setShowPricingModal = vi.fn()
+
+  function mockProvider({
+    enableBilling = true,
+    isFetchedPlan = true,
+    isFetchedPlanInfo = true,
+    planType = Plan.sandbox,
+  }: {
+    enableBilling?: boolean
+    isFetchedPlan?: boolean
+    isFetchedPlanInfo?: boolean
+    planType?: Plan
+  } = {}) {
+    mockUseProviderContext.mockReturnValue(
+      createMockProviderContextValue({
+        enableBilling,
+        isFetchedPlan,
+        isFetchedPlanInfo,
+        plan: {
+          ...defaultPlan,
+          type: planType,
+        },
+      }),
+    )
+  }
+
+  function renderNotice(deploymentEdition: DeploymentEdition = 'CLOUD') {
+    const { wrapper } = createConsoleQueryWrapper({
+      systemFeatures: { deployment_edition: deploymentEdition },
+    })
+    return render(<RetentionUpgradeNotice />, { wrapper })
+  }
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockProvider()
+    mockUseModalContext.mockReturnValue({
+      setShowPricingModal,
+    } as unknown as ReturnType<typeof useModalContext>)
+  })
+
+  it('should show accessible upgrade guidance for Cloud sandbox workspaces', async () => {
+    const user = userEvent.setup()
+    renderNotice()
+
+    const notice = screen.getByRole('status')
+    expect(notice).toHaveAttribute('aria-live', 'polite')
+    expect(notice).toHaveAttribute('aria-atomic', 'true')
+    expect(within(notice).getByText('appLog.retention.upgradeTip.description')).toBeInTheDocument()
+
+    await user.click(
+      within(notice).getByRole('button', { name: 'billing.upgradeBtn.encourageShort' }),
+    )
+    expect(setShowPricingModal).toHaveBeenCalledOnce()
+  })
+
+  it.each([
+    {
+      name: 'paid Cloud workspaces',
+      provider: { planType: Plan.professional },
+      deploymentEdition: 'CLOUD',
+    },
+    {
+      name: 'self-hosted sandbox workspaces',
+      provider: { planType: Plan.sandbox },
+      deploymentEdition: 'COMMUNITY',
+    },
+    {
+      name: 'workspaces without billing',
+      provider: { enableBilling: false },
+      deploymentEdition: 'CLOUD',
+    },
+    {
+      name: 'workspaces before plan loading completes',
+      provider: { isFetchedPlan: false, isFetchedPlanInfo: false },
+      deploymentEdition: 'CLOUD',
+    },
+  ] as const)('should not show guidance for $name', ({ provider, deploymentEdition }) => {
+    mockProvider(provider)
+
+    renderNotice(deploymentEdition)
+
+    expect(screen.queryByRole('status')).not.toBeInTheDocument()
+  })
+})

web/app/components/app/log/archived-logs-notice.tsx

@@ -1,5 +1,6 @@
 'use client'
 
+import { Button } from '@langgenius/dify-ui/button'
 import { useSuspenseQuery } from '@tanstack/react-query'
 import { useAtomValue } from 'jotai'
 import { useTranslation } from 'react-i18next'
@@ -31,16 +32,27 @@ export function ArchivedLogsNotice() {
     return null
 
   return (
-    <div className="mb-3 flex items-start gap-2 rounded-lg border border-util-colors-warning-warning-200 bg-util-colors-warning-warning-50 px-3 py-2">
-      <span
-        aria-hidden
-        className="mt-0.5 i-ri-information-line size-4 shrink-0 text-util-colors-warning-warning-600"
+    <div
+      role="status"
+      aria-live="polite"
+      aria-atomic="true"
+      className="relative mb-3 shrink-0 overflow-hidden rounded-xl border border-components-panel-border bg-components-panel-bg-blur shadow-lg shadow-shadow-shadow-5 backdrop-blur-[5px]"
+    >
+      <div
+        aria-hidden="true"
+        className="absolute -inset-px bg-linear-to-r from-components-badge-status-light-normal-halo to-background-gradient-mask-transparent opacity-40"
       />
-      <div className="min-w-0 flex-1 system-xs-regular text-util-colors-warning-warning-700">
-        {t(($) => $['archives.notice.description'], { ns: 'appLog' })}
-        <button
-          type="button"
-          className="ml-1 system-xs-semibold text-util-colors-warning-warning-700 underline underline-offset-2 hover:text-text-primary"
+      <div className="relative flex items-center gap-3 px-3 py-2">
+        <span
+          aria-hidden="true"
+          className="i-ri-information-2-fill size-5 shrink-0 text-text-accent"
+        />
+        <p className="min-w-0 flex-1 system-sm-semibold wrap-break-word text-text-primary">
+          {t(($) => $['archives.notice.description'], { ns: 'appLog' })}
+        </p>
+        <Button
+          variant="primary"
+          className="shrink-0"
           onClick={() =>
             setShowAccountSettingModal({
               payload: ACCOUNT_SETTING_TAB.WORKFLOW_LOG_ARCHIVES,
@@ -48,7 +60,7 @@ export function ArchivedLogsNotice() {
           }
         >
           {t(($) => $['archives.notice.action'], { ns: 'appLog' })}
-        </button>
+        </Button>
       </div>
     </div>
   )

web/app/components/app/log/cloud-sandbox-retention.ts

@@ -0,0 +1,54 @@
+'use client'
+
+import { useSuspenseQuery } from '@tanstack/react-query'
+import { Plan } from '@/app/components/billing/type'
+import { useProviderContext } from '@/context/provider-context'
+import { systemFeaturesQueryOptions } from '@/features/system-features/client'
+
+export const CLOUD_SANDBOX_TIME_PERIOD_KEYS = new Set(['1', '2', '3'])
+export const CLOUD_SANDBOX_CLEARED_TIME_PERIOD = '1'
+
+const CLOUD_SANDBOX_LONGEST_TIME_PERIOD = '3'
+const CLOUD_SANDBOX_LONGEST_TIME_PERIOD_OPTION = {
+  value: 30,
+  name: 'last30days',
+} as const
+
+export type CloudSandboxPlanState = 'pending' | 'sandbox' | 'unrestricted'
+
+export function isLogTimePeriodRestricted(planState: CloudSandboxPlanState) {
+  return planState !== 'unrestricted'
+}
+
+export function resolveLogTimePeriod(period: string, planState: CloudSandboxPlanState) {
+  if (!isLogTimePeriodRestricted(planState) || CLOUD_SANDBOX_TIME_PERIOD_KEYS.has(period))
+    return period
+
+  return CLOUD_SANDBOX_CLEARED_TIME_PERIOD
+}
+
+export function resolveLogTimePeriodOption<T extends { value: number; name: string }>(
+  period: string,
+  option: T,
+  planState: CloudSandboxPlanState,
+) {
+  if (isLogTimePeriodRestricted(planState) && period === CLOUD_SANDBOX_LONGEST_TIME_PERIOD)
+    return CLOUD_SANDBOX_LONGEST_TIME_PERIOD_OPTION
+
+  return option
+}
+
+export function useCloudSandboxPlanStatus(): CloudSandboxPlanState {
+  const { data: deploymentEdition } = useSuspenseQuery({
+    ...systemFeaturesQueryOptions(),
+    select: ({ deployment_edition }) => deployment_edition,
+  })
+  const { enableBilling, isFetchedPlan, isFetchedPlanInfo, plan } = useProviderContext()
+
+  if (deploymentEdition !== 'CLOUD') return 'unrestricted'
+  if (!isFetchedPlanInfo) return 'pending'
+  if (!enableBilling) return 'unrestricted'
+  if (!isFetchedPlan) return 'pending'
+
+  return plan.type === Plan.sandbox ? 'sandbox' : 'unrestricted'
+}

web/app/components/app/log/filter.tsx

@@ -11,6 +11,13 @@ import Chip from '@/app/components/base/chip'
 import Input from '@/app/components/base/input'
 import Sort from '@/app/components/base/sort'
 import { useAnnotationsCount } from '@/service/use-log'
+import {
+  CLOUD_SANDBOX_CLEARED_TIME_PERIOD,
+  CLOUD_SANDBOX_TIME_PERIOD_KEYS,
+  isLogTimePeriodRestricted,
+  resolveLogTimePeriodOption,
+  useCloudSandboxPlanStatus,
+} from './cloud-sandbox-retention'
 
 dayjs.extend(quarterOfYear)
 
@@ -45,6 +52,12 @@ const Filter: FC<IFilterProps> = ({
 }: IFilterProps) => {
   const { data, isLoading } = useAnnotationsCount(appId)
   const { t } = useTranslation()
+  const planState = useCloudSandboxPlanStatus()
+  const isTimePeriodRestricted = isLogTimePeriodRestricted(planState)
+  const timePeriodEntries = Object.entries(TIME_PERIOD_MAPPING)
+    .filter(([key]) => !isTimePeriodRestricted || CLOUD_SANDBOX_TIME_PERIOD_KEYS.has(key))
+    .map(([key, option]) => [key, resolveLogTimePeriodOption(key, option, planState)] as const)
+
   if (isLoading || !data) return null
   return (
     <div className="mb-2 flex flex-row flex-wrap items-center gap-2">
@@ -56,8 +69,13 @@ const Filter: FC<IFilterProps> = ({
         onSelect={(item) => {
           setQueryParams({ ...queryParams, period: item.value })
         }}
-        onClear={() => setQueryParams({ ...queryParams, period: '9' })}
-        items={Object.entries(TIME_PERIOD_MAPPING).map(([k, v]) => ({
+        onClear={() =>
+          setQueryParams({
+            ...queryParams,
+            period: isTimePeriodRestricted ? CLOUD_SANDBOX_CLEARED_TIME_PERIOD : '9',
+          })
+        }
+        items={timePeriodEntries.map(([k, v]) => ({
           value: k,
           name: t(($) => $[`filter.period.${v.name}`], { ns: 'appLog' }),
         }))}

web/app/components/app/log/index.tsx

@@ -15,9 +15,15 @@ import { usePathname, useRouter, useSearchParams } from '@/next/navigation'
 import { useChatConversations, useCompletionConversations } from '@/service/use-log'
 import { AppModeEnum } from '@/types/app'
 import PageTitle from '../log-annotation/page-title'
+import {
+  resolveLogTimePeriod,
+  resolveLogTimePeriodOption,
+  useCloudSandboxPlanStatus,
+} from './cloud-sandbox-retention'
 import EmptyElement from './empty-element'
 import Filter, { TIME_PERIOD_MAPPING } from './filter'
 import List from './list'
+import { RetentionUpgradeNotice } from './retention-upgrade-notice'
 
 type ILogsProps = {
   appDetail: App
@@ -57,6 +63,7 @@ const Logs: FC<ILogsProps> = ({ appDetail }) => {
     return pageParam - 1
   }, [searchParams])
   const cachedState = logsStateCache.get(appDetail.id)
+  const cloudSandboxPlanState = useCloudSandboxPlanStatus()
   const [queryParams, setQueryParams] = useState<QueryParam>(
     cachedState?.queryParams ?? defaultQueryParams,
   )
@@ -64,7 +71,15 @@ const Logs: FC<ILogsProps> = ({ appDetail }) => {
     () => cachedState?.currPage ?? getPageFromParams(),
   )
   const [limit, setLimit] = React.useState<number>(cachedState?.limit ?? APP_PAGE_LIMIT)
+  const effectivePeriod = resolveLogTimePeriod(queryParams.period, cloudSandboxPlanState)
+  const effectiveQueryParams = { ...queryParams, period: effectivePeriod }
   const debouncedQueryParams = useDebounce(queryParams, { wait: 500 })
+  const requestQueryParams = { ...debouncedQueryParams, period: effectivePeriod }
+  const requestTimePeriod = resolveLogTimePeriodOption(
+    requestQueryParams.period,
+    TIME_PERIOD_MAPPING[requestQueryParams.period]!,
+    cloudSandboxPlanState,
+  )
 
   useEffect(() => {
     const pageFromParams = getPageFromParams()
@@ -85,17 +100,17 @@ const Logs: FC<ILogsProps> = ({ appDetail }) => {
   const query = {
     page: currPage + 1,
     limit,
-    ...(debouncedQueryParams.period !== '9'
+    ...(requestQueryParams.period !== '9'
       ? {
           start: dayjs()
-            .subtract(TIME_PERIOD_MAPPING[debouncedQueryParams.period]!.value, 'day')
+            .subtract(requestTimePeriod.value, 'day')
             .startOf('day')
             .format('YYYY-MM-DD HH:mm'),
           end: dayjs().endOf('day').format('YYYY-MM-DD HH:mm'),
         }
       : {}),
-    ...(isChatMode ? { sort_by: debouncedQueryParams.sort_by } : {}),
-    ...omit(debouncedQueryParams, ['period']),
+    ...(isChatMode ? { sort_by: requestQueryParams.sort_by } : {}),
+    ...omit(requestQueryParams, ['period']),
   }
 
   // When the details are obtained, proceed to the next request
@@ -143,9 +158,10 @@ const Logs: FC<ILogsProps> = ({ appDetail }) => {
         <Filter
           isChatMode={isChatMode}
           appId={appDetail.id}
-          queryParams={queryParams}
+          queryParams={effectiveQueryParams}
           setQueryParams={handleQueryParamsChange}
         />
+        <RetentionUpgradeNotice />
         {total === undefined ? (
           <Loading type="app" />
         ) : total > 0 ? (

web/app/components/app/log/retention-upgrade-notice.tsx

@@ -0,0 +1,43 @@
+'use client'
+
+import { useTranslation } from 'react-i18next'
+import UpgradeBtn from '@/app/components/billing/upgrade-btn'
+import { useCloudSandboxPlanStatus } from './cloud-sandbox-retention'
+
+export function RetentionUpgradeNotice() {
+  const { t } = useTranslation()
+  const planState = useCloudSandboxPlanStatus()
+
+  if (planState !== 'sandbox') return null
+
+  return (
+    <div
+      role="status"
+      aria-live="polite"
+      aria-atomic="true"
+      className="relative mb-3 shrink-0 overflow-hidden rounded-xl border border-components-panel-border bg-components-panel-bg-blur shadow-lg shadow-shadow-shadow-5 backdrop-blur-[5px]"
+    >
+      <div
+        aria-hidden="true"
+        className="absolute -inset-px bg-linear-to-r from-components-badge-status-light-normal-halo to-background-gradient-mask-transparent opacity-40"
+      />
+      <div className="relative flex items-center gap-3 px-3 py-2">
+        <span
+          aria-hidden="true"
+          className="flex size-8 shrink-0 items-center justify-center rounded-lg bg-components-button-primary-bg"
+        >
+          <span className="i-ri-file-list-3-fill size-4 text-components-button-primary-text" />
+        </span>
+        <p className="min-w-0 flex-1 system-sm-medium wrap-break-word text-text-primary">
+          {t(($) => $['retention.upgradeTip.description'], { ns: 'appLog' })}
+        </p>
+        <UpgradeBtn
+          isShort
+          size="custom"
+          className="h-8! shrink-0 rounded-lg! px-2"
+          loc="logs-retention"
+        />
+      </div>
+    </div>
+  )
+}

web/app/components/app/workflow-log/__tests__/filter.spec.tsx

@@ -17,6 +17,35 @@ import Filter, { TIME_PERIOD_MAPPING } from '../filter'
 // Mocks
 // ============================================================================
 
+const mockRuntime = vi.hoisted(() => ({
+  deploymentEdition: 'CLOUD',
+  enableBilling: true,
+  isFetchedPlan: true,
+  isFetchedPlanInfo: true,
+  planType: 'professional',
+}))
+
+vi.mock('@tanstack/react-query', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@tanstack/react-query')>()
+  return {
+    ...actual,
+    useSuspenseQuery: () => ({ data: mockRuntime.deploymentEdition }),
+  }
+})
+
+vi.mock('@/context/provider-context', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@/context/provider-context')>()
+  return {
+    ...actual,
+    useProviderContext: () => ({
+      enableBilling: mockRuntime.enableBilling,
+      isFetchedPlan: mockRuntime.isFetchedPlan,
+      isFetchedPlanInfo: mockRuntime.isFetchedPlanInfo,
+      plan: { type: mockRuntime.planType },
+    }),
+  }
+})
+
 const mockTrackEvent = vi.fn()
 vi.mock('@/app/components/base/amplitude/utils', () => ({
   trackEvent: (...args: unknown[]) => mockTrackEvent(...args),
@@ -41,6 +70,11 @@ describe('Filter', () => {
 
   beforeEach(() => {
     vi.clearAllMocks()
+    mockRuntime.deploymentEdition = 'CLOUD'
+    mockRuntime.enableBilling = true
+    mockRuntime.isFetchedPlan = true
+    mockRuntime.isFetchedPlanInfo = true
+    mockRuntime.planType = 'professional'
   })
 
   // --------------------------------------------------------------------------
@@ -176,6 +210,69 @@ describe('Filter', () => {
   // Time Period Filter Tests
   // --------------------------------------------------------------------------
   describe('Time Period Filter', () => {
+    it('should only show supported periods for Cloud sandbox workspaces', async () => {
+      const user = userEvent.setup()
+      mockRuntime.deploymentEdition = 'CLOUD'
+      mockRuntime.planType = 'sandbox'
+
+      render(
+        <Filter queryParams={createDefaultQueryParams()} setQueryParams={defaultSetQueryParams} />,
+      )
+
+      await user.click(screen.getByRole('combobox', { name: 'appLog.filter.period.last7days' }))
+
+      const listbox = await screen.findByRole('listbox')
+      expect(
+        within(listbox)
+          .getAllByRole('option')
+          .map((option) => option.textContent),
+      ).toEqual([
+        'appLog.filter.period.today',
+        'appLog.filter.period.last7days',
+        'appLog.filter.period.last30days',
+      ])
+    })
+
+    it('should keep all periods for sandbox workspaces outside Cloud', async () => {
+      const user = userEvent.setup()
+      mockRuntime.deploymentEdition = 'COMMUNITY'
+      mockRuntime.planType = 'sandbox'
+
+      render(
+        <Filter queryParams={createDefaultQueryParams()} setQueryParams={defaultSetQueryParams} />,
+      )
+
+      await user.click(screen.getByRole('combobox', { name: 'appLog.filter.period.last7days' }))
+
+      const listbox = await screen.findByRole('listbox')
+      expect(within(listbox).getAllByRole('option')).toHaveLength(9)
+    })
+
+    it('should reset the Cloud sandbox period to today when cleared', async () => {
+      const user = userEvent.setup()
+      const setQueryParams = vi.fn()
+      mockRuntime.deploymentEdition = 'CLOUD'
+      mockRuntime.planType = 'sandbox'
+
+      render(
+        <Filter
+          queryParams={createDefaultQueryParams({ period: '3' })}
+          setQueryParams={setQueryParams}
+        />,
+      )
+
+      await user.click(
+        screen.getByRole('button', {
+          name: /common\.operation\.clear appLog\.filter\.period\.last30days/,
+        }),
+      )
+
+      expect(setQueryParams).toHaveBeenCalledWith({
+        status: 'all',
+        period: '1',
+      })
+    })
+
     it('should display current period value', () => {
       render(
         <Filter

web/app/components/app/workflow-log/__tests__/index.spec.tsx

@@ -15,11 +15,13 @@ import type { UseQueryResult } from '@tanstack/react-query'
  * - trigger-by-display.spec.tsx
  */
 import type { MockedFunction } from 'vitest'
+import type { CloudSandboxPlanState } from '../../log/cloud-sandbox-retention'
 import type { ILogsProps } from '../index'
 import type { WorkflowAppLogDetail, WorkflowLogsResponse, WorkflowRunDetail } from '@/models/log'
 import type { App, AppIconType, AppModeEnum } from '@/types/app'
 import { screen, waitFor } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
+import dayjs from 'dayjs'
 import { APP_PAGE_LIMIT } from '@/config'
 import { WorkflowRunTriggeredFrom } from '@/models/log'
 import * as useLogModule from '@/service/use-log'
@@ -31,10 +33,35 @@ import Logs from '../index'
 // Mocks
 // ============================================================================
 
+const mockPlanState = vi.hoisted(() => ({
+  value: 'unrestricted' as CloudSandboxPlanState,
+}))
+const mockDebouncedPeriod = vi.hoisted(() => ({
+  value: null as string | null,
+}))
+
 vi.mock('@/service/use-log')
 
+vi.mock('../../log/cloud-sandbox-retention', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../log/cloud-sandbox-retention')>()
+  return {
+    ...actual,
+    useCloudSandboxPlanStatus: () => mockPlanState.value,
+  }
+})
+
 vi.mock('ahooks', () => ({
-  useDebounce: <T,>(value: T) => value,
+  useDebounce: <T,>(value: T) => {
+    if (
+      mockDebouncedPeriod.value === null ||
+      typeof value !== 'object' ||
+      value === null ||
+      !('period' in value)
+    )
+      return value
+
+    return { ...value, period: mockDebouncedPeriod.value }
+  },
   useDebounceFn: (fn: (value: string) => void) => ({ run: fn }),
   useBoolean: (initial: boolean) => {
     const setters = {
@@ -58,6 +85,10 @@ vi.mock('@/next/link', () => ({
   ),
 }))
 
+vi.mock('../../log/retention-upgrade-notice', () => ({
+  RetentionUpgradeNotice: () => <div>retention-upgrade-notice</div>,
+}))
+
 // Mock the Run component to avoid complex dependencies
 vi.mock('@/app/components/workflow/run', () => ({
   default: ({ runDetailUrl, tracingListUrl }: { runDetailUrl: string; tracingListUrl: string }) => (
@@ -237,6 +268,8 @@ describe('Logs Container', () => {
 
   beforeEach(() => {
     vi.clearAllMocks()
+    mockPlanState.value = 'unrestricted'
+    mockDebouncedPeriod.value = null
   })
 
   // --------------------------------------------------------------------------
@@ -272,6 +305,7 @@ describe('Logs Container', () => {
 
       // Assert
       expect(screen.getByPlaceholderText('common.operation.search')).toBeInTheDocument()
+      expect(screen.getByText('retention-upgrade-notice')).toBeInTheDocument()
     })
   })
 
@@ -444,6 +478,76 @@ describe('Logs Container', () => {
       })
     })
 
+    it('should query the last 30 days when a Sandbox user selects the longest period', async () => {
+      const user = userEvent.setup()
+      mockPlanState.value = 'sandbox'
+      mockedUseWorkflowLogs.mockReturnValue(
+        createMockQueryResult<WorkflowLogsResponse>({
+          data: createMockLogsResponse([], 0),
+        }),
+      )
+
+      renderWithQueryClient(<Logs {...defaultProps} />)
+
+      await user.click(screen.getByText('appLog.filter.period.last7days'))
+      await user.click(await screen.findByText('appLog.filter.period.last30days'))
+
+      expect(
+        screen.getByRole('combobox', { name: 'appLog.filter.period.last30days' }),
+      ).toBeInTheDocument()
+      const params = getMockCallParams()?.params
+      expect(
+        dayjs(String(params?.created_at__before)).diff(String(params?.created_at__after), 'day'),
+      ).toBe(30)
+    })
+
+    it('should use a valid period for the real Chip and request when plan state settles to Sandbox', async () => {
+      const user = userEvent.setup()
+      mockedUseWorkflowLogs.mockReturnValue(
+        createMockQueryResult<WorkflowLogsResponse>({
+          data: createMockLogsResponse([], 0),
+        }),
+      )
+      const rendered = renderWithQueryClient(<Logs {...defaultProps} />)
+
+      await user.click(screen.getByText('appLog.filter.period.last7days'))
+      await user.click(await screen.findByText('appLog.filter.period.allTime'))
+      expect(getMockCallParams()?.params).not.toHaveProperty('created_at__after')
+      expect(getMockCallParams()?.params).not.toHaveProperty('created_at__before')
+
+      mockPlanState.value = 'pending'
+      mockDebouncedPeriod.value = '9'
+      rendered.rerender(<Logs {...defaultProps} />)
+
+      expect(
+        screen.getByRole('combobox', { name: 'appLog.filter.period.today' }),
+      ).toBeInTheDocument()
+      expect(
+        screen.getByRole('button', {
+          name: /common\.operation\.clear appLog\.filter\.period\.today/,
+        }),
+      ).toBeInTheDocument()
+      expect(getMockCallParams()?.params).toEqual(
+        expect.objectContaining({
+          created_at__after: expect.any(String),
+          created_at__before: expect.any(String),
+        }),
+      )
+
+      mockPlanState.value = 'sandbox'
+      rendered.rerender(<Logs {...defaultProps} />)
+
+      expect(
+        screen.getByRole('combobox', { name: 'appLog.filter.period.today' }),
+      ).toBeInTheDocument()
+      expect(getMockCallParams()?.params).toEqual(
+        expect.objectContaining({
+          created_at__after: expect.any(String),
+          created_at__before: expect.any(String),
+        }),
+      )
+    })
+
     it('should update query when typing keyword', async () => {
       // Arrange
       const user = userEvent.setup()

web/app/components/app/workflow-log/filter.tsx

@@ -10,6 +10,13 @@ import { useTranslation } from 'react-i18next'
 import { trackEvent } from '@/app/components/base/amplitude/utils'
 import Chip from '@/app/components/base/chip'
 import Input from '@/app/components/base/input'
+import {
+  CLOUD_SANDBOX_CLEARED_TIME_PERIOD,
+  CLOUD_SANDBOX_TIME_PERIOD_KEYS,
+  isLogTimePeriodRestricted,
+  resolveLogTimePeriodOption,
+  useCloudSandboxPlanStatus,
+} from '../log/cloud-sandbox-retention'
 
 dayjs.extend(quarterOfYear)
 
@@ -36,6 +43,12 @@ type IFilterProps = {
 
 const Filter: FC<IFilterProps> = ({ queryParams, setQueryParams }: IFilterProps) => {
   const { t } = useTranslation()
+  const planState = useCloudSandboxPlanStatus()
+  const isTimePeriodRestricted = isLogTimePeriodRestricted(planState)
+  const timePeriodEntries = Object.entries(TIME_PERIOD_MAPPING)
+    .filter(([key]) => !isTimePeriodRestricted || CLOUD_SANDBOX_TIME_PERIOD_KEYS.has(key))
+    .map(([key, option]) => [key, resolveLogTimePeriodOption(key, option, planState)] as const)
+
   return (
     <div className="mb-2 flex flex-row flex-wrap gap-2">
       <Chip
@@ -63,8 +76,13 @@ const Filter: FC<IFilterProps> = ({ queryParams, setQueryParams }: IFilterProps)
         onSelect={(item) => {
           setQueryParams({ ...queryParams, period: item.value })
         }}
-        onClear={() => setQueryParams({ ...queryParams, period: '9' })}
-        items={Object.entries(TIME_PERIOD_MAPPING).map(([k, v]) => ({
+        onClear={() =>
+          setQueryParams({
+            ...queryParams,
+            period: isTimePeriodRestricted ? CLOUD_SANDBOX_CLEARED_TIME_PERIOD : '9',
+          })
+        }
+        items={timePeriodEntries.map(([k, v]) => ({
           value: k,
           name: t(($) => $[`filter.period.${v.name}`], { ns: 'appLog' }),
         }))}

web/app/components/app/workflow-log/index.tsx

@@ -19,6 +19,12 @@ import { useWorkflowLogs } from '@/service/use-log'
 import PageTitle from '../log-annotation/page-title'
 import { ArchivedLogsNotice } from '../log/archived-logs-notice'
 import { shouldShowArchivedLogsNotice } from '../log/archived-logs-notice-utils'
+import {
+  resolveLogTimePeriod,
+  resolveLogTimePeriodOption,
+  useCloudSandboxPlanStatus,
+} from '../log/cloud-sandbox-retention'
+import { RetentionUpgradeNotice } from '../log/retention-upgrade-notice'
 import Filter, { TIME_PERIOD_MAPPING } from './filter'
 import List from './list'
 
@@ -43,26 +49,35 @@ const Logs: FC<ILogsProps> = ({ appDetail }) => {
   })
   const [queryParams, setQueryParams] = useState<QueryParam>({ status: 'all', period: '2' })
   const [currPage, setCurrPage] = React.useState<number>(0)
+  const cloudSandboxPlanState = useCloudSandboxPlanStatus()
+  const effectivePeriod = resolveLogTimePeriod(queryParams.period, cloudSandboxPlanState)
+  const effectiveQueryParams = { ...queryParams, period: effectivePeriod }
   const debouncedQueryParams = useDebounce(queryParams, { wait: 500 })
+  const requestQueryParams = { ...debouncedQueryParams, period: effectivePeriod }
+  const requestTimePeriod = resolveLogTimePeriodOption(
+    requestQueryParams.period,
+    TIME_PERIOD_MAPPING[requestQueryParams.period]!,
+    cloudSandboxPlanState,
+  )
   const [limit, setLimit] = React.useState<number>(APP_PAGE_LIMIT)
 
   const query = {
     page: currPage + 1,
     detail: true,
     limit,
-    ...(debouncedQueryParams.status !== 'all' ? { status: debouncedQueryParams.status } : {}),
-    ...(debouncedQueryParams.keyword ? { keyword: debouncedQueryParams.keyword } : {}),
-    ...(debouncedQueryParams.period !== '9'
+    ...(requestQueryParams.status !== 'all' ? { status: requestQueryParams.status } : {}),
+    ...(requestQueryParams.keyword ? { keyword: requestQueryParams.keyword } : {}),
+    ...(requestQueryParams.period !== '9'
       ? {
           created_at__after: dayjs()
-            .subtract(TIME_PERIOD_MAPPING[debouncedQueryParams.period]!.value, 'day')
+            .subtract(requestTimePeriod.value, 'day')
             .startOf('day')
             .tz(timezone)
             .format('YYYY-MM-DDTHH:mm:ssZ'),
           created_at__before: dayjs().endOf('day').tz(timezone).format('YYYY-MM-DDTHH:mm:ssZ'),
         }
       : {}),
-    ...omit(debouncedQueryParams, ['period', 'status']),
+    ...omit(requestQueryParams, ['period', 'status']),
   }
 
   const { data: workflowLogs, refetch: mutate } = useWorkflowLogs({
@@ -72,7 +87,7 @@ const Logs: FC<ILogsProps> = ({ appDetail }) => {
   const total = workflowLogs?.total
   const totalPages = total ? Math.max(Math.ceil(total / limit), 1) : 1
   const showArchivedLogsNotice = shouldShowArchivedLogsNotice(
-    queryParams.period,
+    effectiveQueryParams.period,
     TIME_PERIOD_MAPPING,
   )
 
@@ -83,7 +98,8 @@ const Logs: FC<ILogsProps> = ({ appDetail }) => {
         description={t(($) => $.workflowSubtitle, { ns: 'appLog' })}
       />
       <div className="flex max-h-[calc(100%-16px)] flex-1 flex-col py-4">
-        <Filter queryParams={queryParams} setQueryParams={setQueryParams} />
+        <Filter queryParams={effectiveQueryParams} setQueryParams={setQueryParams} />
+        <RetentionUpgradeNotice />
         {showArchivedLogsNotice && <ArchivedLogsNotice />}
         {/* workflow log */}
         {total === undefined ? (

web/app/components/base/chat/chat/answer/__tests__/agent-roster-response-content.spec.tsx

@@ -91,9 +91,12 @@ describe('AgentRosterResponseContent', () => {
     await user.click(processToggle)
 
     expect(processToggle).toHaveAttribute('aria-expanded', 'true')
-    await waitFor(() => {
-      expect(screen.getByText('history answer')).toBeInTheDocument()
-    })
+    await waitFor(
+      () => {
+        expect(screen.getByText('history answer')).toBeInTheDocument()
+      },
+      { timeout: 5000 },
+    )
 
     expect(screen.queryByText('internal thought should not render')).not.toBeInTheDocument()
   })
@@ -122,9 +125,12 @@ describe('AgentRosterResponseContent', () => {
     render(<AgentRosterResponseContent item={item} />)
     await user.click(screen.getByRole('button', { name: 'Thinking' }))
 
-    await waitFor(() => {
-      expect(screen.getByText('const answer = 42').tagName).toBe('CODE')
-    })
+    await waitFor(
+      () => {
+        expect(screen.getByText('const answer = 42').tagName).toBe('CODE')
+      },
+      { timeout: 5000 },
+    )
   })
 
   it('should keep one collapsible thinking timeline while response parts interleave', async () => {

web/app/components/header/account-setting/model-provider-page/model-parameter-modal/__tests__/index.spec.tsx

@@ -1,416 +1,73 @@
-import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import type { ReactNode } from 'react'
+import { fireEvent, render, screen } from '@testing-library/react'
 import ModelParameterModal from '../index'
 
-let parameterRules: Array<Record<string, unknown>> | undefined = [
-  {
-    name: 'temperature',
-    label: { en_US: 'Temperature' },
-    type: 'float',
-    default: 0.7,
-    min: 0,
-    max: 1,
-    help: { en_US: 'Control randomness' },
-  },
-]
-let isRulesLoading = false
-let isRulesPending = false
-let currentProvider: Record<string, unknown> | undefined = {
-  provider: 'openai',
-  label: { en_US: 'OpenAI' },
-}
-let currentModel: Record<string, unknown> | undefined = {
-  model: 'gpt-3.5-turbo',
-  status: 'active',
-  model_properties: { mode: 'chat' },
-}
-let activeTextGenerationModelList: Array<Record<string, unknown>> = [
-  {
-    provider: 'openai',
-    models: [
-      {
-        model: 'gpt-3.5-turbo',
-        model_properties: { mode: 'chat' },
-        features: ['vision'],
-      },
-      {
-        model: 'gpt-4.1',
-        model_properties: { mode: 'chat' },
-        features: ['vision', 'tool-call'],
-      },
-    ],
-  },
-]
+const mocks = vi.hoisted(() => ({
+  openIntegrationsSetting: vi.fn(),
+}))
 
-vi.mock('@/context/provider-context', () => ({
-  useProviderContext: () => ({
-    isAPIKeySet: true,
-  }),
+vi.mock('@/app/components/header/account-setting/use-integrations-setting', () => ({
+  useIntegrationsSetting: () => mocks.openIntegrationsSetting,
 }))
 
 vi.mock('@/service/use-common', () => ({
   useModelParameterRules: () => ({
     data: {
-      data: parameterRules,
+      data: [],
     },
-    isLoading: isRulesLoading,
-    isPending: isRulesPending,
+    isLoading: false,
   }),
 }))
 
 vi.mock('../../hooks', () => ({
   useTextGenerationCurrentProviderAndModelAndModelList: () => ({
-    currentProvider,
-    currentModel,
-    activeTextGenerationModelList,
+    activeTextGenerationModelList: [],
+    currentModel: undefined,
+    currentProvider: undefined,
   }),
 }))
 
-vi.mock('../parameter-item', () => ({
-  default: ({
-    parameterRule,
-    onChange,
-    onSwitch,
-    nodesOutputVars,
-    availableNodes,
-  }: {
-    parameterRule: { name: string; label: { en_US: string } }
-    onChange: (v: number) => void
-    onSwitch: (checked: boolean, val: unknown) => void
-    nodesOutputVars?: unknown[]
-    availableNodes?: unknown[]
-  }) => (
-    <div
-      data-testid={`param-${parameterRule.name}`}
-      data-has-nodes-output-vars={!!nodesOutputVars}
-      data-has-available-nodes={!!availableNodes}
-    >
-      {parameterRule.label.en_US}
-      <button onClick={() => onChange(0.9)}>Change</button>
-      <button onClick={() => onSwitch(false, undefined)}>Remove</button>
-      <button onClick={() => onSwitch(true, 'assigned')}>Add</button>
-    </div>
+vi.mock('../../model-selector', () => ({
+  default: ({ onConfigureEmptyState }: { onConfigureEmptyState?: () => void }) => (
+    <button type="button" onClick={onConfigureEmptyState}>
+      configure-empty-model
+    </button>
   ),
 }))
 
-vi.mock('../../model-selector', () => ({
-  default: ({
-    onHide,
-    onSelect,
-  }: {
-    onHide: () => void
-    onSelect: (value: { provider: string; model: string }) => void
-  }) => (
-    <div data-testid="model-selector">
-      <button onClick={() => onSelect({ provider: 'openai', model: 'gpt-4.1' })}>
-        Select GPT-4.1
-      </button>
-      <button onClick={onHide}>hide</button>
-    </div>
-  ),
+vi.mock('@/app/components/base/loading', () => ({
+  default: () => <div>loading</div>,
+}))
+
+vi.mock('../parameter-item', () => ({
+  default: () => <div>parameter-item</div>,
 }))
 
 vi.mock('../presets-parameter', () => ({
-  default: ({
-    onSelect,
-    supportedParameterNames,
-  }: {
-    onSelect: (id: number) => void
-    supportedParameterNames?: string[]
-  }) => {
-    if (supportedParameterNames && !supportedParameterNames.includes('temperature')) return null
-
-    return <button onClick={() => onSelect(1)}>Preset 1</button>
-  },
+  default: ({ children }: { children?: ReactNode }) => <div>{children}</div>,
 }))
 
-vi.mock('../presets-parameter-utils', () => ({
-  getSupportedPresetConfig: (_toneId: number, supportedParameterNames?: string[]) => {
-    if (supportedParameterNames && !supportedParameterNames.includes('temperature')) return {}
-
-    return { temperature: 0.8 }
-  },
-}))
-
-vi.mock('../trigger', () => ({
-  default: () => <button type="button">Open Settings</button>,
-}))
-
-vi.mock('@/config', async (importOriginal) => {
-  const actual = await importOriginal<typeof import('@/config')>()
-  return {
-    ...actual,
-    PROVIDER_WITH_PRESET_TONE: ['openai'],
-  }
-})
-
 describe('ModelParameterModal', () => {
-  const openSettings = () =>
-    fireEvent.click(screen.getByRole('button', { name: /modelProvider\.modelSettings/i }))
-  const defaultProps = {
-    isAdvancedMode: false,
-    modelId: 'gpt-3.5-turbo',
-    provider: 'openai',
-    setModel: vi.fn(),
-    completionParams: { temperature: 0.7 },
-    onCompletionParamsChange: vi.fn(),
-    hideDebugWithMultipleModel: false,
-    debugWithMultipleModel: false,
-    onDebugWithMultipleModelChange: vi.fn(),
-    readonly: false,
-  }
-
   beforeEach(() => {
     vi.clearAllMocks()
-    isRulesLoading = false
-    isRulesPending = false
-    parameterRules = [
-      {
-        name: 'temperature',
-        label: { en_US: 'Temperature' },
-        type: 'float',
-        default: 0.7,
-        min: 0,
-        max: 1,
-        help: { en_US: 'Control randomness' },
-      },
-    ]
-    currentProvider = { provider: 'openai', label: { en_US: 'OpenAI' } }
-    currentModel = {
-      model: 'gpt-3.5-turbo',
-      status: 'active',
-      model_properties: { mode: 'chat' },
-    }
-    activeTextGenerationModelList = [
-      {
-        provider: 'openai',
-        models: [
-          {
-            model: 'gpt-3.5-turbo',
-            model_properties: { mode: 'chat' },
-            features: ['vision'],
-          },
-          {
-            model: 'gpt-4.1',
-            model_properties: { mode: 'chat' },
-            features: ['vision', 'tool-call'],
-          },
-        ],
-      },
-    ]
   })
 
-  it('should render trigger and open modal content when trigger is clicked', () => {
-    render(<ModelParameterModal {...defaultProps} />)
-
-    openSettings()
-    expect(screen.getByTestId('model-selector')).toBeInTheDocument()
-    expect(screen.getByTestId('param-temperature')).toBeInTheDocument()
-  })
-
-  it('should keep model selection and model settings as separate actions', () => {
-    render(<ModelParameterModal {...defaultProps} />)
-
-    expect(screen.getByTestId('model-selector')).toBeInTheDocument()
-    expect(screen.queryByTestId('param-temperature')).not.toBeInTheDocument()
-
-    fireEvent.click(screen.getByText('Select GPT-4.1'))
-
-    expect(defaultProps.setModel).toHaveBeenCalledWith({
-      modelId: 'gpt-4.1',
-      provider: 'openai',
-      mode: 'chat',
-      features: ['vision', 'tool-call'],
-    })
-    expect(screen.queryByTestId('param-temperature')).not.toBeInTheDocument()
-
-    fireEvent.click(screen.getByRole('button', { name: /modelProvider\.modelSettings/i }))
-
-    expect(screen.getByTestId('param-temperature')).toBeInTheDocument()
-  })
-
-  it('should disable model settings when no model is selected', () => {
-    render(<ModelParameterModal {...defaultProps} provider="" modelId="" />)
-
-    expect(screen.getByTestId('model-selector')).toBeInTheDocument()
-    expect(screen.getByRole('button', { name: /modelProvider\.modelSettings/i })).toBeDisabled()
-  })
-
-  it('should call onCompletionParamsChange when parameter changes and switch actions happen', () => {
-    render(<ModelParameterModal {...defaultProps} />)
-    openSettings()
-
-    fireEvent.click(screen.getByText('Change'))
-    expect(defaultProps.onCompletionParamsChange).toHaveBeenCalledWith({
-      ...defaultProps.completionParams,
-      temperature: 0.9,
-    })
-
-    fireEvent.click(screen.getByText('Remove'))
-    expect(defaultProps.onCompletionParamsChange).toHaveBeenCalledWith({})
-
-    fireEvent.click(screen.getByText('Add'))
-    expect(defaultProps.onCompletionParamsChange).toHaveBeenCalledWith({
-      ...defaultProps.completionParams,
-      temperature: 'assigned',
-    })
-  })
-
-  it('should call onCompletionParamsChange when preset is selected', () => {
-    render(<ModelParameterModal {...defaultProps} />)
-    openSettings()
-    fireEvent.click(screen.getByText('Preset 1'))
-    expect(defaultProps.onCompletionParamsChange).toHaveBeenCalledWith({
-      ...defaultProps.completionParams,
-      temperature: 0.8,
-    })
-  })
-
-  it('should not render preset control when visible parameters do not support preset keys', () => {
-    parameterRules = [
-      {
-        name: 'max_tokens',
-        label: { en_US: 'Max Tokens' },
-        type: 'int',
-        default: 256,
-        min: 1,
-        max: 4096,
-      },
-    ]
-
-    render(<ModelParameterModal {...defaultProps} />)
-    openSettings()
-
-    expect(screen.queryByText('Preset 1')).not.toBeInTheDocument()
-  })
-
-  it('should call setModel when model selector picks another model', () => {
-    render(<ModelParameterModal {...defaultProps} />)
-    openSettings()
-    fireEvent.click(screen.getByText('Select GPT-4.1'))
-
-    expect(defaultProps.setModel).toHaveBeenCalledWith({
-      modelId: 'gpt-4.1',
-      provider: 'openai',
-      mode: 'chat',
-      features: ['vision', 'tool-call'],
-    })
-  })
-
-  it('should toggle debug mode when debug footer is clicked', () => {
-    render(<ModelParameterModal {...defaultProps} />)
-    openSettings()
-    fireEvent.click(screen.getByText(/debugAsMultipleModel/i))
-    expect(defaultProps.onDebugWithMultipleModelChange).toHaveBeenCalled()
-  })
-
-  it('should render loading state when parameter rules are loading', () => {
-    isRulesLoading = true
-    isRulesPending = true
-    render(<ModelParameterModal {...defaultProps} />)
-    openSettings()
-    expect(screen.getByRole('status')).toBeInTheDocument()
-  })
-
-  it('should not render parameter loading when model is not configured and parameter rules query is pending but disabled', () => {
-    isRulesPending = true
-    parameterRules = []
-
-    render(<ModelParameterModal {...defaultProps} provider="" modelId="" />)
-    openSettings()
-
-    expect(screen.queryByRole('status')).not.toBeInTheDocument()
-    expect(screen.getByTestId('model-selector')).toBeInTheDocument()
-  })
-
-  it('should not open content when readonly is true', () => {
-    render(<ModelParameterModal {...defaultProps} readonly />)
-    expect(screen.getByRole('button', { name: /modelProvider\.modelSettings/i })).toBeDisabled()
-    expect(screen.queryByTestId('param-temperature')).not.toBeInTheDocument()
-  })
-
-  it('should render no parameter items when rules are undefined', () => {
-    parameterRules = undefined
-    render(<ModelParameterModal {...defaultProps} />)
-    openSettings()
-    expect(screen.queryByTestId('param-temperature')).not.toBeInTheDocument()
-    expect(screen.getByTestId('model-selector')).toBeInTheDocument()
-  })
-
-  it('should pass nodesOutputVars and availableNodes to ParameterItem', () => {
-    const mockNodesOutputVars = [{ nodeId: 'n1', title: 'Node', vars: [] }]
-    const mockAvailableNodes = [{ id: 'n1', data: { title: 'Node', type: 'llm' } }]
-
+  it('opens provider settings from the model selector empty state', () => {
     render(
       <ModelParameterModal
-        {...defaultProps}
-        isInWorkflow
-        nodesOutputVars={mockNodesOutputVars as never}
-        availableNodes={mockAvailableNodes as never}
-      />,
-    )
-
-    openSettings()
-
-    const paramEl = screen.getByTestId('param-temperature')
-    expect(paramEl).toHaveAttribute('data-has-nodes-output-vars', 'true')
-    expect(paramEl).toHaveAttribute('data-has-available-nodes', 'true')
-  })
-
-  it('should support custom triggers, workflow mode, and missing default model values', async () => {
-    render(
-      <ModelParameterModal
-        {...defaultProps}
-        provider=""
+        isAdvancedMode
         modelId=""
-        isInWorkflow
-        renderTrigger={({ open }) => <span>{open ? 'Custom Open' : 'Custom Closed'}</span>}
+        provider=""
+        completionParams={{}}
+        setModel={vi.fn()}
+        onCompletionParamsChange={vi.fn()}
       />,
     )
 
-    fireEvent.click(screen.getByText('Custom Closed'))
+    fireEvent.click(screen.getByText('configure-empty-model'))
 
-    expect(screen.getByText('Custom Open')).toBeInTheDocument()
-    expect(screen.getByTestId('model-selector')).toBeInTheDocument()
-
-    fireEvent.click(screen.getByText('hide'))
-
-    await waitFor(() => {
-      expect(screen.queryByTestId('model-selector')).not.toBeInTheDocument()
+    expect(mocks.openIntegrationsSetting).toHaveBeenCalledWith({
+      payload: 'provider',
     })
   })
-
-  it('should append the stop parameter in advanced mode and show the single-model debug label', () => {
-    render(<ModelParameterModal {...defaultProps} isAdvancedMode debugWithMultipleModel />)
-
-    openSettings()
-
-    expect(screen.getByTestId('param-stop')).toBeInTheDocument()
-    expect(screen.getByText(/debugAsSingleModel/i)).toBeInTheDocument()
-  })
-
-  it('should render the empty loading fallback when rules resolve to an empty list', () => {
-    parameterRules = []
-    isRulesLoading = true
-    isRulesPending = true
-
-    render(<ModelParameterModal {...defaultProps} />)
-    openSettings()
-
-    expect(screen.getByRole('status')).toBeInTheDocument()
-    expect(screen.queryByTestId('param-temperature')).not.toBeInTheDocument()
-  })
-
-  it('should support custom trigger placement outside workflow mode', () => {
-    render(
-      <ModelParameterModal
-        {...defaultProps}
-        renderTrigger={({ open }) => <span>{open ? 'Popup Open' : 'Popup Closed'}</span>}
-      />,
-    )
-
-    fireEvent.click(screen.getByText('Popup Closed'))
-
-    expect(screen.getByText('Popup Open')).toBeInTheDocument()
-    expect(screen.getByTestId('model-selector')).toBeInTheDocument()
-  })
 })

web/app/components/header/account-setting/model-provider-page/model-parameter-modal/index.tsx

@@ -1,5 +1,5 @@
 import type { FC, ReactNode } from 'react'
-import type { DefaultModel, FormValue, ModelParameterRule } from '../declarations'
+import type { DefaultModel, FormValue, Model, ModelParameterRule } from '../declarations'
 import type { ParameterValue } from './parameter-item'
 import type { TriggerProps } from './types'
 import type { Node, NodeOutPutVar } from '@/app/components/workflow/types'
@@ -7,8 +7,9 @@ import { cn } from '@langgenius/dify-ui/cn'
 import { Popover, PopoverClose, PopoverContent, PopoverTrigger } from '@langgenius/dify-ui/popover'
 import { useMemo, useState } from 'react'
 import { useTranslation } from 'react-i18next'
-import { ArrowNarrowLeft } from '@/app/components/base/icons/src/vender/line/arrows'
 import Loading from '@/app/components/base/loading'
+import { ACCOUNT_SETTING_TAB } from '@/app/components/header/account-setting/constants'
+import { useIntegrationsSetting } from '@/app/components/header/account-setting/use-integrations-setting'
 import { PROVIDER_WITH_PRESET_TONE, STOP_PARAMETER_RULE } from '@/config'
 import { useModelParameterRules } from '@/service/use-common'
 import { useTextGenerationCurrentProviderAndModelAndModelList } from '../hooks'
@@ -34,8 +35,10 @@ export type ModelParameterModalProps = {
   debugWithMultipleModel?: boolean
   onDebugWithMultipleModelChange?: () => void
   renderTrigger?: (v: TriggerProps) => ReactNode
+  triggerContainerClassName?: string
   readonly?: boolean
   isInWorkflow?: boolean
+  modelList?: Model[]
   scope?: string
   nodesOutputVars?: NodeOutPutVar[]
   availableNodes?: Node[]
@@ -53,17 +56,25 @@ const ModelParameterModal: FC<ModelParameterModalProps> = ({
   debugWithMultipleModel,
   onDebugWithMultipleModelChange,
   renderTrigger,
+  triggerContainerClassName,
   readonly,
   isInWorkflow,
+  modelList,
   nodesOutputVars,
   availableNodes,
 }) => {
   const { t } = useTranslation()
   const [open, setOpen] = useState(false)
+  const openIntegrationsSetting = useIntegrationsSetting()
   const { data: parameterRulesData, isLoading } = useModelParameterRules(provider, modelId)
   const isRulesLoading = !!provider && !!modelId && isLoading
   const { currentProvider, currentModel, activeTextGenerationModelList } =
     useTextGenerationCurrentProviderAndModelAndModelList({ provider, model: modelId })
+  const availableTextGenerationModelList = modelList ?? activeTextGenerationModelList
+  const selectedProvider =
+    modelList?.find((modelItem) => modelItem.provider === provider) ?? currentProvider
+  const selectedModel =
+    selectedProvider?.models?.find((modelItem) => modelItem.model === modelId) ?? currentModel
 
   const parameterRules: ModelParameterRule[] = useMemo(() => {
     return parameterRulesData?.data || []
@@ -71,6 +82,7 @@ const ModelParameterModal: FC<ModelParameterModalProps> = ({
   const supportedPresetParameterNames = useMemo(() => {
     return parameterRules.map((parameterRule) => parameterRule.name)
   }, [parameterRules])
+  const hasSelectedModel = !!provider && !!modelId
 
   const handleParamChange = (key: string, value: ParameterValue) => {
     onCompletionParamsChange({
@@ -80,10 +92,10 @@ const ModelParameterModal: FC<ModelParameterModalProps> = ({
   }
 
   const handleChangeModel = ({ provider, model }: DefaultModel) => {
-    const targetProvider = activeTextGenerationModelList.find(
+    const targetProvider = availableTextGenerationModelList.find(
       (modelItem) => modelItem.provider === provider,
     )
-    const targetModelItem = targetProvider?.models.find((modelItem) => modelItem.model === model)
+    const targetModelItem = targetProvider?.models?.find((modelItem) => modelItem.model === model)
     setModel({
       modelId: model,
       provider,
@@ -91,6 +103,15 @@ const ModelParameterModal: FC<ModelParameterModalProps> = ({
       features: targetModelItem?.features || [],
     })
   }
+  const handleOpenModelSettings = () => {
+    if (readonly || !hasSelectedModel) return
+    setOpen(true)
+  }
+  const handleConfigureEmptyState = () => {
+    if (readonly) return
+
+    openIntegrationsSetting({ payload: ACCOUNT_SETTING_TAB.PROVIDER })
+  }
 
   const handleSwitch = (key: string, value: boolean, assignValue: ParameterValue) => {
     if (!value) {
@@ -114,8 +135,6 @@ const ModelParameterModal: FC<ModelParameterModalProps> = ({
     })
   }
 
-  const hasSelectedModel = !!provider && !!modelId
-
   return (
     <Popover
       open={open}
@@ -133,8 +152,8 @@ const ModelParameterModal: FC<ModelParameterModalProps> = ({
             >
               {renderTrigger({
                 open,
-                currentProvider,
-                currentModel,
+                currentProvider: selectedProvider,
+                currentModel: selectedModel,
                 providerName: provider,
                 modelId,
               })}
@@ -142,11 +161,16 @@ const ModelParameterModal: FC<ModelParameterModalProps> = ({
           }
         />
       ) : (
-        <div className="flex h-8 min-w-[296px] items-center gap-px overflow-hidden rounded-lg">
+        <div
+          className={cn(
+            'flex h-8 min-w-[296px] items-center gap-px overflow-hidden rounded-lg',
+            triggerContainerClassName,
+          )}
+        >
           <div className="min-w-0 flex-1">
             <ModelSelector
               defaultModel={provider || modelId ? { provider, model: modelId } : undefined}
-              modelList={activeTextGenerationModelList}
+              modelList={availableTextGenerationModelList}
               readonly={readonly}
               triggerClassName={cn(
                 'h-8! w-full rounded-r-none!',
@@ -154,6 +178,8 @@ const ModelParameterModal: FC<ModelParameterModalProps> = ({
                   'border border-workflow-block-parma-bg bg-workflow-block-parma-bg hover:bg-workflow-block-parma-bg',
               )}
               onSelect={handleChangeModel}
+              onConfigureEmptyState={handleConfigureEmptyState}
+              onOpenProviderSettings={handleOpenModelSettings}
             />
           </div>
           <PopoverTrigger
@@ -187,8 +213,9 @@ const ModelParameterModal: FC<ModelParameterModalProps> = ({
             <div className="px-4 pt-2 pb-4">
               <ModelSelector
                 defaultModel={hasSelectedModel ? { provider, model: modelId } : undefined}
-                modelList={activeTextGenerationModelList}
+                modelList={availableTextGenerationModelList}
                 onSelect={handleChangeModel}
+                onOpenProviderSettings={handleOpenModelSettings}
                 onHide={() => setOpen(false)}
               />
             </div>
@@ -249,7 +276,10 @@ const ModelParameterModal: FC<ModelParameterModalProps> = ({
             {debugWithMultipleModel
               ? t(($) => $.debugAsSingleModel, { ns: 'appDebug' })
               : t(($) => $.debugAsMultipleModel, { ns: 'appDebug' })}
-            <ArrowNarrowLeft className="size-3 rotate-180" />
+            <span
+              aria-hidden
+              className="i-custom-vender-line-arrows-arrow-narrow-left size-3 rotate-180"
+            />
           </div>
         )}
       </PopoverContent>

web/app/components/header/account-setting/model-provider-page/model-selector/index.tsx

@@ -33,6 +33,7 @@ type ModelSelectorProps = {
   hideProviderSettingsFooter?: boolean
   onConfigureEmptyState?: () => void
   onOpenMarketplace?: () => void
+  onOpenProviderSettings?: () => void
   providerSettingsSource?: 'agent'
   showModelMeta?: boolean
   modelPredicate?: ModelSelectorModelPredicate
@@ -52,6 +53,7 @@ function ModelSelector({
   hideProviderSettingsFooter,
   onConfigureEmptyState,
   onOpenMarketplace,
+  onOpenProviderSettings,
   providerSettingsSource,
   showModelMeta,
   modelPredicate,
@@ -180,6 +182,7 @@ function ModelSelector({
           modelSuggestionPredicate={modelSuggestionPredicate}
           onConfigureEmptyState={onConfigureEmptyState ? handleConfigureEmptyState : undefined}
           onOpenMarketplace={onOpenMarketplace}
+          onOpenProviderSettings={onOpenProviderSettings}
           onInputValueChange={setInputValue}
           onHide={handleHide}
         />

web/app/components/header/account-setting/model-provider-page/model-selector/popup-item.tsx

@@ -9,7 +9,6 @@ import { StatusDot } from '@langgenius/dify-ui/status-dot'
 import { Tooltip, TooltipContent, TooltipTrigger } from '@langgenius/dify-ui/tooltip'
 import { useCallback, useMemo, useState } from 'react'
 import { useTranslation } from 'react-i18next'
-import { CreditsCoin } from '@/app/components/base/icons/src/vender/line/financeAndECommerce'
 import { useModalContext } from '@/context/modal-context'
 import { useProviderContext } from '@/context/provider-context'
 import { useCredentialPermissions } from '@/hooks/use-credential-permissions'
@@ -57,7 +56,8 @@ function PopupItem({
   const updateModelProviders = useUpdateModelProviders()
   const currentProvider = modelProviders.find((provider) => provider.provider === model.provider)
   const { canUseCredential, canCreateCredential, canManageCredential } = useCredentialPermissions()
-  const canOpenCredentialDropdown = canUseCredential || canCreateCredential || canManageCredential
+  const canOpenCredentialDropdown =
+    !!currentProvider && (canUseCredential || canCreateCredential || canManageCredential)
   const handleOpenModelModal = () => {
     if (!canCreateCredential) return
 
@@ -77,7 +77,8 @@ function PopupItem({
     })
   }
 
-  const state = useCredentialPanelState(currentProvider)
+  // oxlint-disable-next-line eslint-react/use-state -- This domain hook returns credential panel state, not a React useState tuple.
+  const credentialPanelState = useCredentialPanelState(currentProvider)
   const { isChangingPriority, handleChangePriority } = useChangeProviderPriority(currentProvider)
   const groupItems = useMemo(
     () =>
@@ -90,10 +91,11 @@ function PopupItem({
     [model.models, model.provider],
   )
 
-  const isUsingCredits = state.priority === 'credits'
-  const hasCredits = !state.isCreditsExhausted
-  const isApiKeyActive = state.variant === 'api-active' || state.variant === 'api-fallback'
-  const { credentialName } = state
+  const isUsingCredits = credentialPanelState.priority === 'credits'
+  const hasCredits = !credentialPanelState.isCreditsExhausted
+  const isApiKeyActive =
+    credentialPanelState.variant === 'api-active' || credentialPanelState.variant === 'api-fallback'
+  const { credentialName } = credentialPanelState
 
   const handleCloseDropdown = useCallback(() => {
     setDropdownOpen(false)
@@ -129,7 +131,10 @@ function PopupItem({
                 {isUsingCredits ? (
                   hasCredits ? (
                     <>
-                      <CreditsCoin className="size-3" />
+                      <span
+                        aria-hidden
+                        className="i-custom-vender-line-financeandecommerce-credits-coin size-3"
+                      />
                       <span className="ml-1 truncate">
                         {t(($) => $['modelProvider.selector.aiCredits'], { ns: 'common' })}
                       </span>
@@ -161,15 +166,17 @@ function PopupItem({
               </button>
             }
           />
-          <PopoverContent placement="bottom-end">
-            <DropdownContent
-              provider={currentProvider}
-              state={state}
-              isChangingPriority={isChangingPriority}
-              onChangePriority={handleChangePriority}
-              onClose={handleCloseDropdown}
-            />
-          </PopoverContent>
+          {currentProvider && (
+            <PopoverContent placement="bottom-end">
+              <DropdownContent
+                provider={currentProvider}
+                state={credentialPanelState}
+                isChangingPriority={isChangingPriority}
+                onChangePriority={handleChangePriority}
+                onClose={handleCloseDropdown}
+              />
+            </PopoverContent>
+          )}
         </Popover>
       </div>
       {!collapsed &&
@@ -215,7 +222,7 @@ function PopupItem({
                 </ModelName>
               </div>
               {defaultModel?.model === modelItem.model &&
-                defaultModel.provider === currentProvider.provider && (
+                defaultModel.provider === model.provider && (
                   <ComboboxItemIndicator className="shrink-0 text-text-accent">
                     <span
                       className="i-custom-vender-line-general-check size-4"

web/app/components/header/account-setting/model-provider-page/model-selector/popup.tsx

@@ -69,6 +69,7 @@ export type PopupProps = {
   onConfigureEmptyState?: () => void
   onInputValueChange: (value: string) => void
   onOpenMarketplace?: () => void
+  onOpenProviderSettings?: () => void
   onHide: () => void
 }
 function Popup({
@@ -83,6 +84,7 @@ function Popup({
   onConfigureEmptyState,
   onInputValueChange,
   onOpenMarketplace,
+  onOpenProviderSettings,
   onHide,
 }: PopupProps) {
   const { t } = useTranslation()
@@ -255,11 +257,16 @@ function Popup({
 
   const handleOpenSettings = useCallback(() => {
     onHide()
+    if (onOpenProviderSettings) {
+      onOpenProviderSettings()
+      return
+    }
+
     openIntegrationsSetting({
       payload: ACCOUNT_SETTING_TAB.PROVIDER,
       source: providerSettingsSource,
     })
-  }, [onHide, openIntegrationsSetting, providerSettingsSource])
+  }, [onHide, onOpenProviderSettings, openIntegrationsSetting, providerSettingsSource])
   const handleClosePreviewCard = useCallback(() => {
     previewCardHandle.close()
   }, [previewCardHandle])

web/app/components/main-nav/__tests__/index.spec.tsx

@@ -564,6 +564,10 @@ describe('MainNav', () => {
     expect(screen.getByRole('link', { name: /common.menus.apps/ })).toHaveAttribute('href', '/apps')
     expect(screen.getByRole('link', { name: /Agents/ })).toHaveAttribute('href', '/agents')
     expect(screen.getByRole('link', { name: /Agents common.menus.status/ })).toBeInTheDocument()
+    expect(screen.getByRole('link', { name: /common.mainNav.skills/ })).toHaveAttribute(
+      'href',
+      '/skills',
+    )
     expect(screen.getByRole('link', { name: /common.menus.datasets/ })).toHaveAttribute(
       'href',
       '/datasets',
@@ -584,6 +588,10 @@ describe('MainNav', () => {
     renderMainNav()
 
     expect(screen.queryByRole('link', { name: /Agents/ })).not.toBeInTheDocument()
+    expect(screen.getByRole('link', { name: /common.mainNav.skills/ })).toHaveAttribute(
+      'href',
+      '/skills',
+    )
   })
 
   it('hides the roster entry when the user lacks agent.manage', () => {
@@ -743,6 +751,7 @@ describe('MainNav', () => {
     expect(screen.getByRole('link', { name: /common.mainNav.home/ })).toHaveAttribute('href', '/')
     expect(screen.getByRole('link', { name: /common.menus.apps/ })).toHaveAttribute('href', '/apps')
     expect(screen.queryByRole('link', { name: /Agents/ })).not.toBeInTheDocument()
+    expect(screen.queryByRole('link', { name: /common.mainNav.skills/ })).not.toBeInTheDocument()
     expect(screen.getByRole('link', { name: /common.menus.datasets/ })).toHaveAttribute(
       'href',
       '/datasets',

web/app/components/main-nav/routes.ts

@@ -32,6 +32,8 @@ export type DetailSidebarVisibilityOptions = Pick<
 const VISIBLE_TO_ALL: MainNavRouteVisibility = () => true
 const CAN_MANAGE_AGENTS: MainNavRouteVisibility = (options) => options.canManageAgents
 const CAN_USE_APP_DEPLOY: MainNavRouteVisibility = (options) => options.canUseAppDeploy
+const NOT_DATASET_OPERATOR: MainNavRouteVisibility = (options) =>
+  !options.isCurrentWorkspaceDatasetOperator
 
 function isPathUnderRoute(pathname: string, route: string) {
   return pathname === route || pathname.startsWith(`${route}/`)
@@ -69,6 +71,15 @@ export const MAIN_NAV_ROUTES = [
     visibility: CAN_MANAGE_AGENTS,
     feature: 'agentV2',
   },
+  {
+    key: 'skills',
+    href: '/skills',
+    labelKey: 'mainNav.skills',
+    active: (path: string) => isPathUnderRoute(path, '/skills'),
+    icon: 'i-ri-box-3-line',
+    activeIcon: 'i-ri-box-3-fill',
+    visibility: NOT_DATASET_OPERATOR,
+  },
   {
     key: 'datasets',
     href: '/datasets',

web/app/components/workflow/panel/debug-and-preview/__tests__/conversation-variable-modal.spec.tsx

@@ -119,8 +119,10 @@ describe('ConversationVariableModal', () => {
     })
 
     expect(screen.getAllByText('session_state')).toHaveLength(2)
-    expect(screen.getByText((content) => content.includes('formatted-100'))).toBeInTheDocument()
-    expect(screen.getByTestId('conversation-code-editor')).toHaveTextContent('{"latest":1}')
+    expect(
+      await screen.findByText((content) => content.includes('formatted-100')),
+    ).toBeInTheDocument()
+    expect(await screen.findByTestId('conversation-code-editor')).toHaveTextContent('{"latest":1}')
 
     await user.click(screen.getByText('summary'))
     expect(screen.getByText('latest text')).toBeInTheDocument()

web/app/install/installForm.spec.tsx

@@ -16,6 +16,10 @@ vi.mock('@/next/navigation', () => ({
   useRouter: () => ({ push: mockPush, replace: mockReplace }),
 }))
 
+vi.mock('@/hooks/use-document-title', () => ({
+  default: vi.fn(),
+}))
+
 vi.mock('@/service/common', () => ({
   fetchSetupStatus: vi.fn(),
   fetchInitValidateStatus: vi.fn(),

web/app/layout.tsx

@@ -27,6 +27,23 @@ export const viewport: Viewport = {
   viewportFit: 'cover',
 }
 
+const resizeObserverErrorFilterScript = `
+(() => {
+  const ignoredMessages = new Set([
+    'ResizeObserver loop completed with undelivered notifications.',
+    'ResizeObserver loop limit exceeded',
+  ]);
+  const ignore = (event) => {
+    const message = event?.message || event?.reason?.message;
+    if (!ignoredMessages.has(message)) return;
+    event.preventDefault();
+    event.stopImmediatePropagation();
+  };
+  window.addEventListener('error', ignore, true);
+  window.addEventListener('unhandledrejection', ignore, true);
+})();
+`
+
 export default async function RootLayout({ children }: { children: React.ReactNode }) {
   const datasetMap = getDatasetMap()
   const queryClient = getQueryClientServer()
@@ -43,6 +60,11 @@ export default async function RootLayout({ children }: { children: React.ReactNo
     <html lang={locale ?? 'en'} className="h-full" suppressHydrationWarning>
       <head>
         <link rel="manifest" href="/manifest.json" />
+        <script
+          nonce={nonce}
+          // oxlint-disable-next-line eslint-react/dom-no-dangerously-set-innerhtml -- Static early listener must run before the dev error overlay registers.
+          dangerouslySetInnerHTML={{ __html: resizeObserverErrorFilterScript }}
+        />
         <meta name="theme-color" content="#1C64F2" />
         <meta name="mobile-web-app-capable" content="yes" />
         <meta name="apple-mobile-web-app-capable" content="yes" />