fix: knip

.agents/skills/backend-code-review/SKILL.md

@@ -1,40 +1,168 @@
 ---
 name: backend-code-review
-description: Use only when the user explicitly requests a review or audit of backend code under `api/`. Supports pending-change, file-focused, and pasted-diff reviews. Do not use for implementation-only requests, diagnosis without review intent, frontend code, or backend code outside `api/`.
+description: Review backend code for quality, security, maintainability, and best practices based on established checklist rules. Use when the user requests a review, analysis, or improvement of backend files (e.g., `.py`) under the `api/` directory. Do NOT use for frontend files (e.g., `.tsx`, `.ts`, `.js`). Supports pending-change review, code snippets review, and file-focused review.
 ---
 
 # Backend Code Review
 
-Review the requested scope for concrete, reproducible defects. The nearest `AGENTS.md` owns package facts and commands; this skill owns the review workflow and routes to its bundled rule packs.
+## When to use this skill
 
-## Evidence First
+Use this skill whenever the user asks to **review, analyze, or improve** backend code (e.g., `.py`) under the `api/` directory. Supports the following review modes:
 
-1. Establish the requested review scope and inspect the relevant diff or files.
-2. Read the changed lines, their behavior owner, nearby tests, and local docstrings or comments that define contracts.
-3. Trace callers, persistence boundaries, authorization, generated schemas, or external I/O only when they decide correctness.
-4. Report only findings tied to an observable failure, violated contract, security boundary, data integrity risk, or demonstrated maintenance problem.
+- **Pending-change review**: when the user asks to review current changes (inspect staged/working-tree files slated for commit to get the changes).
+- **Code snippets review**: when the user pastes code snippets (e.g., a function/class/module excerpt) into the chat and asks for a review.
+- **File-focused review**: when the user points to specific files and asks for a review of those files (one file or a small, explicit set of files, e.g., `api/...`, `api/app.py`).
 
-## Rule Routing
+Do NOT use this skill when:
 
-Read only the packs matched by the diff:
+- The request is about frontend code or UI (e.g., `.tsx`, `.ts`, `.js`, `web/`).
+- The user is not asking for a review/analysis/improvement of backend code.
+- The scope is not under `api/` (unless the user explicitly asks to review backend-related changes outside `api/`).
 
-- Models or migrations: [`references/db-schema-rule.md`][db-schema]
-- Controller, service, core/domain, library, or model dependency direction: [`references/architecture-rule.md`][architecture]
-- Table access outside an established repository boundary: [`references/repositories-rule.md`][repositories]
-- SQLAlchemy sessions, queries, transactions, CRUD, concurrency, or raw SQL: [`references/sqlalchemy-rule.md`][sqlalchemy]
+## How to use this skill
 
-When no pack applies, review correctness, security, behavior changes, and test evidence directly. Check current official documentation only when local code and contracts do not settle framework or library behavior.
+Follow these steps when using this skill:
 
-## Severity And Output
+1. **Identify the review mode** (pending-change vs snippet vs file-focused) based on the user’s input. Keep the scope tight: review only what the user provided or explicitly referenced.
+2. Follow the rules defined in **Checklist** to perform the review. If no Checklist rule matches, apply **General Review Rules** as a fallback to perform the best-effort review.
+3. Compose the final output strictly follow the **Required Output Format**.
 
-- **P0**: security or privacy exposure, data loss, or a production-wide outage.
-- **P1**: user-visible regression, broken authorization or tenant isolation, invalid public contract, or failed primary workflow.
-- **P2**: concrete correctness, performance, maintainability, or test defect likely to cause incorrect behavior.
-- **P3**: minor actionable cleanup; omit unless the user requested a thorough audit.
+Notes when using this skill:
+- Always include actionable fixes or suggestions (including possible code snippets).
+- Use best-effort `File:Line` references when a file path and line numbers are available; otherwise, use the most specific identifier you can.
 
-Lead with findings ordered by severity. Include a tight file and line reference, the failing contract or reproduction path, impact, and a concrete fix direction. If there are no findings, say `No issues found.` and state any material verification gap. Do not add praise sections, speculative risks, or an unsolicited offer to implement fixes.
+## Checklist
 
-[architecture]: references/architecture-rule.md
-[db-schema]: references/db-schema-rule.md
-[repositories]: references/repositories-rule.md
-[sqlalchemy]: references/sqlalchemy-rule.md
+- db schema design: if the review scope includes code/files under `api/models/` or `api/migrations/`, follow [references/db-schema-rule.md](references/db-schema-rule.md) to perform the review
+- architecture: if the review scope involves controller/service/core-domain/libs/model layering, dependency direction, or moving responsibilities across modules, follow [references/architecture-rule.md](references/architecture-rule.md) to perform the review
+- repositories abstraction: if the review scope contains table/model operations (e.g., `select(...)`, `session.execute(...)`, joins, CRUD) and is not under `api/repositories`, `api/core/repositories`, or `api/extensions/*/repositories/`, follow [references/repositories-rule.md](references/repositories-rule.md) to perform the review
+- sqlalchemy patterns: if the review scope involves SQLAlchemy session/query usage, db transaction/crud usage, or raw SQL usage, follow [references/sqlalchemy-rule.md](references/sqlalchemy-rule.md) to perform the review
+
+## General Review Rules
+
+### 1. Security Review
+
+Check for:
+- SQL injection vulnerabilities
+- Server-Side Request Forgery (SSRF)
+- Command injection
+- Insecure deserialization
+- Hardcoded secrets/credentials
+- Improper authentication/authorization
+- Insecure direct object references
+
+### 2. Performance Review
+
+Check for:
+- N+1 queries
+- Missing database indexes
+- Memory leaks
+- Blocking operations in async code
+- Missing caching opportunities
+
+### 3. Code Quality Review
+
+Check for:
+- Code forward compatibility
+- Code duplication (DRY violations)
+- Functions doing too much (SRP violations)
+- Deep nesting / complex conditionals
+- Magic numbers/strings
+- Poor naming
+- Missing error handling
+- Incomplete type coverage
+
+### 4. Testing Review
+
+Check for:
+- Missing test coverage for new code
+- Tests that don't test behavior
+- Flaky test patterns
+- Missing edge cases
+
+## Required Output Format
+
+When this skill invoked, the response must exactly follow one of the two templates:
+
+### Template A (any findings)
+
+```markdown
+# Code Review Summary
+
+Found <X> critical issues need to be fixed:
+
+## 🔴 Critical (Must Fix)
+
+### 1. <brief description of the issue>
+
+FilePath: <path> line <line>
+<relevant code snippet or pointer>
+
+#### Explanation
+
+<detailed explanation and references of the issue>
+
+#### Suggested Fix
+
+1. <brief description of suggested fix>
+2. <code example> (optional, omit if not applicable)
+
+---
+... (repeat for each critical issue) ...
+
+Found <Y> suggestions for improvement:
+
+## 🟡 Suggestions (Should Consider)
+
+### 1. <brief description of the suggestion>
+
+FilePath: <path> line <line>
+<relevant code snippet or pointer>
+
+#### Explanation
+
+<detailed explanation and references of the suggestion>
+
+#### Suggested Fix
+
+1. <brief description of suggested fix>
+2. <code example> (optional, omit if not applicable)
+
+---
+... (repeat for each suggestion) ...
+
+Found <Z> optional nits:
+
+## 🟢 Nits (Optional)
+### 1. <brief description of the nit>
+
+FilePath: <path> line <line>
+<relevant code snippet or pointer>
+
+#### Explanation
+
+<explanation and references of the optional nit>
+
+#### Suggested Fix
+
+- <minor suggestions>
+
+---
+... (repeat for each nits) ...
+
+## ✅ What's Good
+
+- <Positive feedback on good patterns>
+```
+
+- If there are no critical issues or suggestions or option nits or good points, just omit that section.
+- If the issue number is more than 10, summarize as "Found 10+ critical issues/suggestions/optional nits" and only output the first 10 items.
+- Don't compress the blank lines between sections; keep them as-is for readability.
+- If there is any issue requires code changes, append a brief follow-up question to ask whether the user wants to apply the fix(es) after the structured output. For example: "Would you like me to use the Suggested fix(es) to address these issues?"
+
+### Template B (no issues)
+
+```markdown
+## Code Review Summary
+✅ No issues found.
+```

.agents/skills/backend-code-review/references/architecture-rule.md

@@ -7,6 +7,7 @@
 
 ### Keep business logic out of controllers
 - Category: maintainability
+- Severity: critical
 - Description: Controllers should parse input, call services, and return serialized responses. Business decisions inside controllers make behavior hard to reuse and test.
 - Suggested fix: Move domain/business logic into the service or core/domain layer. Keep controller handlers thin and orchestration-focused.
 - Example:
@@ -33,6 +34,7 @@
 
 ### Preserve layer dependency direction
 - Category: best practices
+- Severity: critical
 - Description: Controllers may depend on services, and services may depend on core/domain abstractions. Reversing this direction (for example, core importing controller/web modules) creates cycles and leaks transport concerns into domain code.
 - Suggested fix: Extract shared contracts into core/domain or service-level modules and make upper layers depend on lower, not the reverse.
 - Example:
@@ -41,7 +43,6 @@
     # core/policy/publish_policy.py
     from controllers.console.app import request_context
 
-
     def can_publish() -> bool:
         return request_context.current_user.is_admin
     ```
@@ -51,13 +52,13 @@
     def can_publish(role: str) -> bool:
         return role == "admin"
 
-
     # service layer adapts web/user context to domain input
     allowed = can_publish(role=current_user.role)
     ```
 
 ### Keep libs business-agnostic
 - Category: maintainability
+- Severity: critical
 - Description: Modules under `api/libs/` should remain reusable, business-agnostic building blocks. They must not encode product/domain-specific rules, workflow orchestration, or business decisions.
 - Suggested fix:
   - If business logic appears in `api/libs/`, extract it into the appropriate `services/` or `core/` module and keep `libs` focused on generic, cross-cutting helpers.
@@ -68,7 +69,6 @@
     # api/libs/conversation_filter.py
     from services.conversation_service import ConversationService
 
-
     def should_archive_conversation(conversation, tenant_id: str) -> bool:
         # Domain policy and service dependency are leaking into libs.
         service = ConversationService()
@@ -82,12 +82,10 @@
     def older_than_days(idle_days: int, threshold_days: int) -> bool:
         return idle_days > threshold_days
 
-
     # services/conversation_service.py (business logic stays in service/core)
     from libs.datetime_utils import older_than_days
 
-
     def should_archive_conversation(conversation, tenant_id: str) -> bool:
         threshold_days = 90 if has_paid_plan(tenant_id) else 30
         return older_than_days(conversation.idle_days, threshold_days)
-    ```
+    ```

.agents/skills/backend-code-review/references/db-schema-rule.md

@@ -8,6 +8,7 @@
 
 ### Do not query other tables inside `@property`
 - Category: [maintainability, performance]
+- Severity: critical
 - Description: A model `@property` must not open sessions or query other tables. This hides dependencies across models, tightly couples schema objects to data access, and can cause N+1 query explosions when iterating collections.
 - Suggested fix:
   - Keep model properties pure and local to already-loaded fields.
@@ -40,6 +41,7 @@
 
 ### Prefer including `tenant_id` in model definitions
 - Category: maintainability
+- Severity: suggestion
 - Description: In multi-tenant domains, include `tenant_id` in schema definitions whenever the entity belongs to tenant-owned data. This improves data isolation safety and keeps future partitioning/sharding strategies practical as data volume grows.
 - Suggested fix:
   - Add a `tenant_id` column and ensure related unique/index constraints include tenant dimension when applicable.
@@ -50,7 +52,6 @@
     ```python
     from sqlalchemy.orm import Mapped
 
-
     class Dataset(TypeBase):
         __tablename__ = "datasets"
         id: Mapped[str] = mapped_column(StringUUID, primary_key=True)
@@ -60,7 +61,6 @@
     ```python
     from sqlalchemy.orm import Mapped
 
-
     class Dataset(TypeBase):
         __tablename__ = "datasets"
         id: Mapped[str] = mapped_column(StringUUID, primary_key=True)
@@ -70,6 +70,7 @@
 
 ### Detect and avoid duplicate/redundant indexes
 - Category: performance
+- Severity: suggestion
 - Description: Review index definitions for leftmost-prefix redundancy. For example, index `(a, b, c)` can safely cover most lookups for `(a, b)`. Keeping both may increase write overhead and can mislead the optimizer into suboptimal execution plans.
 - Suggested fix:
   - Before adding an index, compare against existing composite indexes by leftmost-prefix rules.
@@ -93,6 +94,7 @@
 
 ### Avoid PostgreSQL-only dialect usage in models; wrap in `models.types`
 - Category: maintainability
+- Severity: critical
 - Description: Model/schema definitions should avoid PostgreSQL-only constructs directly in business models. When database-specific behavior is required, encapsulate it in `api/models/types.py` using both PostgreSQL and MySQL dialect implementations, then consume that abstraction from model code.
 - Suggested fix:
   - Do not directly place dialect-only types/operators in model columns when a portable wrapper can be used.
@@ -103,7 +105,6 @@
     from sqlalchemy.dialects.postgresql import JSONB
     from sqlalchemy.orm import Mapped
 
-
     class ToolConfig(TypeBase):
         __tablename__ = "tool_configs"
         config: Mapped[dict] = mapped_column(JSONB, nullable=False)
@@ -114,7 +115,6 @@
 
     from models.types import AdjustedJSON
 
-
     class ToolConfig(TypeBase):
         __tablename__ = "tool_configs"
         config: Mapped[dict] = mapped_column(AdjustedJSON(), nullable=False)
@@ -122,6 +122,7 @@
 
 ### Guard migration incompatibilities with dialect checks and shared types
 - Category: maintainability
+- Severity: critical
 - Description: Migration scripts under `api/migrations/versions/` must account for PostgreSQL/MySQL incompatibilities explicitly. For dialect-sensitive DDL or defaults, branch on the active dialect (for example, `conn.dialect.name == "postgresql"`), and prefer reusable compatibility abstractions from `models.types` where applicable.
 - Suggested fix:
   - In migration upgrades/downgrades, bind connection and branch by dialect for incompatible SQL fragments.
@@ -150,5 +151,7 @@
     default_expr = sa.text("'database'::character varying") if _is_pg(conn) else sa.text("'database'")
 
     with op.batch_alter_table("dataset_keyword_tables") as batch_op:
-        batch_op.add_column(sa.Column("data_source_type", sa.String(255), server_default=default_expr, nullable=False))
+        batch_op.add_column(
+            sa.Column("data_source_type", sa.String(255), server_default=default_expr, nullable=False)
+        )
     ```

.agents/skills/backend-code-review/references/repositories-rule.md

@@ -8,6 +8,7 @@
 
 ### Introduce repositories abstraction
 - Category: maintainability
+- Severity: suggestion
 - Description: If a table/model already has a repository abstraction, all reads/writes/queries for that table should use the existing repository. If no repository exists, introduce one only when complexity justifies it, such as large/high-volume tables, repeated complex query logic, or likely storage-strategy variation.
 - Suggested fix:
   - First check  `api/repositories`, `api/core/repositories`, and `api/extensions/*/repositories/` to verify whether the table/model already has a repository abstraction. If it exists, route all operations through it and add missing repository methods instead of bypassing it with ad-hoc SQLAlchemy access.
@@ -18,7 +19,9 @@
     # Existing repository is ignored and service uses ad-hoc table queries.
     class AppService:
         def archive_app(self, app_id: str, tenant_id: str) -> None:
-            app = self.session.execute(select(App).where(App.id == app_id, App.tenant_id == tenant_id)).scalar_one()
+            app = self.session.execute(
+                select(App).where(App.id == app_id, App.tenant_id == tenant_id)
+            ).scalar_one()
             app.archived = True
             self.session.commit()
     ```
@@ -31,7 +34,6 @@
             app.archived = True
             self.app_repo.save(app)
 
-
     # If the query is missing, extend the existing abstraction.
     active_apps = self.app_repo.list_active_for_tenant(tenant_id=tenant_id)
     ```
@@ -49,10 +51,9 @@
     class ConversationRepository(Protocol):
         def list_recent_for_app(self, app_id: str, tenant_id: str, limit: int) -> list[Conversation]: ...
 
-
     class SqlAlchemyConversationRepository:
-        def list_recent_for_app(self, app_id: str, tenant_id: str, limit: int) -> list[Conversation]: ...
-
+        def list_recent_for_app(self, app_id: str, tenant_id: str, limit: int) -> list[Conversation]:
+            ...
 
     class ConversationService:
         def __init__(self, conversation_repo: ConversationRepository):

.agents/skills/backend-code-review/references/sqlalchemy-rule.md

@@ -8,6 +8,7 @@
 
 ### Use Session context manager with explicit transaction control behavior
 - Category: best practices
+- Severity: critical
 - Description: Session and transaction lifecycle must be explicit and bounded on write paths. Missing commits can silently drop intended updates, while ad-hoc or long-lived transactions increase contention, lock duration, and deadlock risk.
 - Suggested fix:
   - Use **explicit `session.commit()`** after completing a related write unit.
@@ -46,6 +47,7 @@
 
 ### Enforce tenant_id scoping on shared-resource queries
 - Category: security
+- Severity: critical
 - Description: Reads and writes against shared tables must be scoped by `tenant_id` to prevent cross-tenant data leakage or corruption.
 - Suggested fix: Add `tenant_id` predicate to all tenant-owned entity queries and propagate tenant context through service/repository interfaces.
 - Example:
@@ -65,6 +67,7 @@
 
 ### Prefer SQLAlchemy expressions over raw SQL by default
 - Category: maintainability
+- Severity: suggestion
 - Description: Raw SQL should be exceptional. ORM/Core expressions are easier to evolve, safer to compose, and more consistent with the codebase.
 - Suggested fix: Rewrite straightforward raw SQL into SQLAlchemy `select/update/delete` expressions; keep raw SQL only when required by clear technical constraints.
 - Example:
@@ -86,6 +89,7 @@
 
 ### Protect write paths with concurrency safeguards
 - Category: quality
+- Severity: critical
 - Description: Multi-writer paths without explicit concurrency control can silently overwrite data. Choose the safeguard based on contention level, lock scope, and throughput cost instead of defaulting to one strategy.
 - Suggested fix:
   - **Optimistic locking**: Use when contention is usually low and retries are acceptable. Add a version (or updated_at) guard in `WHERE` and treat `rowcount == 0` as a conflict.
@@ -126,8 +130,10 @@
 
     # 3) Pessimistic lock with SELECT ... FOR UPDATE (high contention)
     run = session.execute(
-        select(WorkflowRun).where(WorkflowRun.id == run_id, WorkflowRun.tenant_id == tenant_id).with_for_update()
+        select(WorkflowRun)
+        .where(WorkflowRun.id == run_id, WorkflowRun.tenant_id == tenant_id)
+        .with_for_update()
     ).scalar_one()
     run.status = "cancelled"
     session.commit()
-    ```
+    ```

.agents/skills/e2e-cucumber-playwright/SKILL.md

@@ -1,33 +1,87 @@
 ---
 name: e2e-cucumber-playwright
-description: Use when writing, changing, or reviewing Cucumber and Playwright tests under `e2e/`, including feature files, step definitions, support code, scenario tags, locators, and assertions. Do not use for Vitest, React Testing Library, backend tests, or generic browser automation outside the E2E suite.
+description: Write, update, or review Dify end-to-end tests under `e2e/` that use Cucumber, Gherkin, and Playwright. Use when the task involves `.feature` files, `features/step-definitions/`, `features/support/`, `DifyWorld`, scenario tags, locator/assertion choices, or E2E testing best practices for this repository.
 ---
 
-# E2E Cucumber And Playwright
+# Dify E2E Cucumber + Playwright
 
-`e2e/AGENTS.md` owns the suite architecture, lifecycle, commands, tags, generated-client boundaries, fixtures, and cleanup contracts. Read the nearest feature-scoped `AGENTS.md` when one exists. This skill adds no parallel package policy.
+Use this skill for Dify's repository-level E2E suite in `e2e/`. Use [`e2e/AGENTS.md`](../../../e2e/AGENTS.md) as the canonical package guide for local architecture and conventions, then read any feature-scoped `AGENTS.md` that owns the target area. Apply Playwright/Cucumber best practices only where they fit the current suite.
 
-Cucumber owns scenario and hook execution and reporting. Playwright provides browser automation, contexts, pages, locators, actions, assertions, request, and tracing APIs; protocol exceptions remain with the package-defined owner. Their timeout domains remain separate, and importing from `@playwright/test` does not make Playwright Test runner configuration, fixtures, or retries applicable to this suite.
+## Scope
 
-## Topic Routing
+- Use this skill for `.feature` files, Cucumber step definitions, `DifyWorld`, hooks, tags, and E2E review work under `e2e/`.
+- Do not use this skill for Vitest or React Testing Library work under `web/`; use `frontend-testing` instead.
+- Do not use this skill for backend test or API review tasks under `api/`.
 
-Read only the bundled reference required by the change:
+## Read Order
 
-- Locator, assertion, isolation, or waiting decisions: [`references/playwright-best-practices.md`][playwright]
-- Scenario wording, step granularity, expressions, World state, hook visibility, or tag design: [`references/cucumber-best-practices.md`][cucumber]
+1. Read [`e2e/AGENTS.md`](../../../e2e/AGENTS.md) first.
+2. Read only the files directly involved in the task:
+   - target `.feature` files under `e2e/features/`
+   - related step files under `e2e/features/step-definitions/`
+   - `e2e/features/support/hooks.ts` and `e2e/features/support/world.ts` when session lifecycle or shared state matters
+   - `e2e/scripts/run-cucumber.ts` and `e2e/cucumber.config.ts` when tags or execution flow matter
+3. Read [`references/playwright-best-practices.md`](references/playwright-best-practices.md) only when locator, assertion, isolation, or waiting choices are involved.
+4. Read [`references/cucumber-best-practices.md`](references/cucumber-best-practices.md) only when scenario wording, step granularity, tags, or expression design are involved.
+5. Re-check official Playwright or Cucumber docs with the available documentation tools before introducing a new framework pattern.
 
-Check current official Playwright or Cucumber documentation before introducing a framework pattern that local code and references do not already establish.
+Keep this skill focused on Cucumber, Playwright, and package-level E2E guidance. Put feature-specific conventions in the owning feature's `AGENTS.md` instead of adding them here.
+
+## Local Rules
+
+- `e2e/` uses Cucumber for scenarios and Playwright as the browser layer.
+- `DifyWorld` is the per-scenario context object. Type `this` as `DifyWorld` and use `async function`, not arrow functions.
+- Keep glue organized by capability under `e2e/features/step-definitions/`; use `common/` only for broadly reusable steps.
+- Treat `e2e/AGENTS.md`, `features/support/hooks.ts`, and the Cucumber configuration as the owners of current session and tag semantics. Verify them when behavior depends on session state instead of copying a tag inventory into this skill.
+- Do not import Playwright Test runner patterns that bypass the current Cucumber + `DifyWorld` architecture unless the task is explicitly about changing that architecture.
+- Perform the behavior under test through Playwright. APIs are allowed for setup, seed preparation, persistence polling, and cleanup, but ordinary Console JSON and representable multipart operations must use the scenario- or process-owned generated oRPC client with request and response validation enabled. Keep the setup/cleanup API identity independent from an unauthenticated or logged-out behavior browser.
+- Consume generated operations directly. Do not add one-to-one API wrappers, handwritten endpoint URLs, response DTO casts, duplicate schemas, global mutable clients, or TanStack Query caching in Cucumber. Keep helpers only for real fixture construction, multi-operation orchestration, invariants, polling, derived test views, or protocol adapters.
+- Keep SSE, binary, redirect-only, external-service, and readiness exceptions centralized under their protocol owner. A contract mismatch must fail and be fixed at the backend schema owner followed by regeneration; never weaken validation to make E2E pass.
 
 ## Workflow
 
-1. Add E2E coverage only for a critical user journey with a cross-boundary outcome that cheaper owner-level tests do not already prove.
-2. Identify the user-visible behavior and its feature owner. Start from real product defaults and actor roles; setup may establish preconditions but must not manufacture the opposite state to make the scenario meaningful.
-3. Read the target scenario, matching step definitions, and lifecycle files only when session or shared state matters.
-4. Reuse an existing step when wording and behavior match; add one coherent scenario or step when they do not.
-5. Keep browser actions and assertions at the public user boundary; keep setup, seed, polling, and cleanup at their package-defined owners.
-6. For changes, run the narrowest tagged scenario and package checks documented in `e2e/AGENTS.md`; broaden only for shared hooks, tags, or support changes.
+1. Rebuild local context.
+   - Inspect the target feature area.
+   - Reuse an existing step when wording and behavior already match.
+   - Add a new step only for a genuinely new user action or assertion.
+   - Before adding several similar steps, scan the target capability for an existing domain noun that can be parameterized without hiding behavior.
+   - Keep edits close to the current capability folder unless the step is broadly reusable.
+2. Write behavior-first scenarios.
+   - Describe user-observable behavior, not DOM mechanics.
+   - Keep each scenario focused on one workflow or outcome.
+   - Keep scenarios independent and re-runnable.
+3. Write step definitions in the local style.
+   - Keep one step to one user-visible action or one assertion.
+   - Prefer Cucumber Expressions such as `{string}` and `{int}`.
+   - Use a bounded regex only when the accepted values are a small explicit domain set and Cucumber Expressions would make the Gherkin less natural.
+   - Do not create one-off steps for each case variant when the same domain action or outcome applies to named surfaces, modes, or resources.
+   - Scope locators to stable containers when the page has repeated elements.
+   - Avoid page-object layers or extra helper abstractions unless repeated complexity clearly justifies them.
+4. Use Playwright in the local style.
+   - Prefer user-facing locators: `getByRole`, `getByLabel`, `getByPlaceholder`, `getByText`, then `getByTestId` for explicit contracts.
+   - Use web-first `expect(...)` assertions.
+   - Do not use `waitForTimeout`, manual polling, or raw visibility checks when a locator action or retrying assertion already expresses the behavior.
+   - Use `expect.poll` for API persistence, backend eventual consistency, captured browser events, or other non-DOM state; prefer locator assertions for DOM readiness and visible UI state.
+   - If a product element has real user-facing semantics but no accessible name, prefer fixing that accessible contract over adding a test id.
+5. Validate narrowly.
+   - Run the narrowest tagged scenario or flow that exercises the change.
+   - Run the package-required static checks documented in `e2e/AGENTS.md`.
+   - Broaden verification only when the change affects hooks, tags, setup, or shared step semantics.
 
-For review requests, lead with reproducible correctness failures, flake sources, or demonstrated architecture drift. Report the behavior verified and any external-runtime, browser, or environment gap.
+## Review Checklist
 
-[cucumber]: references/cucumber-best-practices.md
-[playwright]: references/playwright-best-practices.md
+- Does the scenario describe behavior rather than implementation?
+- Does it fit the current session model, tags, and `DifyWorld` usage?
+- Should an existing step be reused instead of adding a new one?
+- Are locators user-facing and assertions web-first?
+- Does the change introduce hidden coupling across scenarios, tags, or instance state?
+- Does it document or implement behavior that differs from the real hooks or configuration?
+- Does setup/cleanup use the generated client directly, with any remaining helper owning more than a one-to-one endpoint forward?
+- Is every raw HTTP call a documented protocol or infrastructure exception rather than an ordinary Console operation?
+
+Lead findings with correctness, flake risk, and architecture drift.
+
+## References
+
+- [`references/playwright-best-practices.md`](references/playwright-best-practices.md)
+- [`references/cucumber-best-practices.md`](references/cucumber-best-practices.md)

.agents/skills/e2e-cucumber-playwright/references/cucumber-best-practices.md

@@ -1,21 +1,18 @@
-# Cucumber Best Practices
+# Cucumber Best Practices For Dify E2E
 
-Use this reference when writing or reviewing Gherkin scenarios, step definitions, parameter expressions, and step reuse.
+Use this reference when writing or reviewing Gherkin scenarios, step definitions, parameter expressions, and step reuse in Dify's `e2e/` suite.
 
 Official sources:
 
-- https://cucumber.io/docs/bdd/better-gherkin
-- https://cucumber.io/docs/gherkin/reference
-- https://cucumber.io/docs/gherkin/step-organization
-- https://cucumber.io/docs/cucumber/state
-- https://cucumber.io/docs/cucumber/cucumber-expressions
-- https://github.com/cucumber/cucumber-js/blob/main/docs/support_files/world.md
+- https://cucumber.io/docs/guides/10-minute-tutorial/
+- https://cucumber.io/docs/cucumber/step-definitions/
+- https://cucumber.io/docs/cucumber/cucumber-expressions/
 
 ## What Matters Most
 
 ### 1. Treat scenarios as executable specifications
 
-Cucumber scenarios should usually describe behavior declaratively, not reproduce an interaction script.
+Cucumber scenarios should describe examples of behavior, not test implementation recipes.
 
 Apply it like this:
 
@@ -23,15 +20,15 @@ Apply it like this:
 - avoid UI-internal wording such as selector details, DOM structure, or component names
 - keep language concrete enough that the scenario reads like living documentation
 
-Procedural detail is appropriate when the interaction mechanism is the behavior under test, such as keyboard navigation, focus movement, or a required multi-actor sequence.
-
 ### 2. Keep scenarios focused
 
-A scenario should prove one business rule or coherent outcome. Cucumber's three-to-five-step recommendation is a review heuristic, not a hard limit: when a scenario is longer, check for multiple outcomes, incidental setup, or UI procedure that can move behind a domain step.
+A scenario should usually prove one workflow or business outcome. If a scenario wanders across several unrelated behaviors, split it.
 
-Use `Given` for initial context, `When` for the event, and `Then` for the expected outcome. Restarting those phases is a prompt to review the narrative, not an automatic failure. Avoid hidden dependencies on another scenario's side effects.
+In Dify's suite, this means:
 
-Use `Rule` when several examples illustrate one named business rule. Use a short `Background` only for shared context the reader needs to understand; do not hide fixture preparation, runtime readiness, or long setup there.
+- one capability-focused scenario per feature path
+- no long setup chains when existing bootstrap or reusable steps already cover them
+- no hidden dependency on another scenario's side effects
 
 ### 3. Reuse steps, but only when behavior really matches
 
@@ -52,8 +49,6 @@ Write a new step when:
 
 Do not optimize for a low step count by making vague steps. Optimize for a small set of truthful, domain-owned steps.
 
-Step definitions share one global matching namespace regardless of their directory. Organize them by domain capability and avoid feature-coupled glue or expressions broad enough to overlap unrelated behavior.
-
 ### 4. Prefer Cucumber Expressions
 
 Use Cucumber Expressions for parameters unless regex is clearly necessary.
@@ -71,24 +66,33 @@ Use regex for a bounded natural-language alternative only when it keeps Gherkin
 
 ### 5. Keep step definitions thin and meaningful
 
-Step definitions are glue between Gherkin and automation, not a second abstraction language. A step should express one coherent domain action or outcome; it may call several implementation helpers when that keeps UI mechanics out of the specification.
+Step definitions are glue between Gherkin and automation, not a second abstraction language.
 
-Cucumber creates a new World for each scenario. Keep scenario state there rather than in module globals. Cucumber.js supports a `world` proxy for arrow functions, but this suite consistently uses typed `async function (this: DifyWorld, ...)` so ownership and TypeScript discovery remain explicit.
+For Dify:
 
-Hooks are invisible to feature readers. Keep them for low-level browser lifecycle, cleanup, and diagnostics; express business-relevant context in Gherkin.
+- type `this` as `DifyWorld`
+- use `async function`
+- keep each step to one user-visible action or assertion
+- rely on `DifyWorld` and existing support code for shared context
+- avoid leaking cross-scenario state
 
 ### 6. Use tags intentionally
 
-Tags may communicate stable capability grouping, selection, fixture dependency, or conditional-hook intent. A tag changes runtime behavior only when a runner, seed profile, or hook owns that meaning.
+Tags should communicate run scope or session semantics, not become ad hoc metadata.
+
+In Dify's current suite:
+
+- capability tags group related scenarios
+- `@unauthenticated` changes session behavior
+- `@authenticated` is descriptive/selective, not a behavior switch by itself
+- `@fresh` belongs to reset/full-install flows only
+
+If a proposed tag implies behavior, verify that hooks or runner configuration actually implement it.
 
 ## Review Questions
 
 - Does the scenario read like a real example of product behavior?
-- Does it prove one outcome, or combine several independent phases?
 - Are the steps behavior-oriented instead of implementation-oriented?
-- Is procedural wording necessary to the behavior being tested?
 - Is a reused step still truthful in this feature?
-- Could a new expression overlap an existing step in the global namespace?
-- Would `Rule` clarify the business rule, or would `Background` hide important setup?
 - Is a new tag documenting real behavior, or inventing semantics that the suite does not implement?
 - Would a new reader understand the outcome without opening the step-definition file?

.agents/skills/e2e-cucumber-playwright/references/playwright-best-practices.md

@@ -1,46 +1,49 @@
-# Playwright Best Practices
+# Playwright Best Practices For Dify E2E
 
-Use this reference when writing or reviewing locator, assertion, isolation, or synchronization logic.
+Use this reference when writing or reviewing locator, assertion, isolation, or synchronization logic for Dify's Cucumber-based E2E suite.
 
 Official sources:
 
 - https://playwright.dev/docs/best-practices
 - https://playwright.dev/docs/locators
-- https://playwright.dev/docs/actionability
 - https://playwright.dev/docs/test-assertions
-- https://playwright.dev/docs/test-timeouts
 - https://playwright.dev/docs/browser-contexts
-- https://playwright.dev/docs/events
-- https://playwright.dev/docs/trace-viewer
 
 ## What Matters Most
 
 ### 1. Keep scenarios isolated
 
-Playwright's model is built around clean browser contexts so one test does not leak into another.
+Playwright's model is built around clean browser contexts so one test does not leak into another. In Dify's suite, that principle maps to per-scenario session setup in `features/support/hooks.ts` and `DifyWorld`.
 
 Apply it like this:
 
 - do not depend on another scenario having run first
-- keep scenario state in the runner's scenario-owned context rather than module globals
-- model special authentication or session setup through explicit per-scenario fixtures rather than shared mutable state
+- do not persist ad hoc scenario state outside `DifyWorld`
+- do not couple ordinary scenarios to `@fresh` behavior
+- when a flow needs special auth/session semantics, express that through the existing tag model or explicit hook changes
 
-### 2. Select locators by user contract
+### 2. Prefer user-facing locators
 
-Prefer built-in locators that match how the target is exposed to users:
+Playwright recommends built-in locators that reflect what users perceive on the page.
 
-- interactive controls: role and accessible name
-- form controls: associated label; use placeholder when it is the relevant stable contract, especially when no label exists
-- non-interactive content: visible text or the relevant text alternative
-- elements without a meaningful user-facing contract: an intentional test id
+Preferred order in this repository:
 
-This is a semantic choice, not a fixed ranking. Do not add incorrect roles or accessible names solely to satisfy a locator. When the product element should have user-facing semantics, fix that contract instead.
+1. `getByRole`
+2. `getByLabel`
+3. `getByPlaceholder`
+4. `getByText`
+5. `getByTestId` when an explicit test contract is the most stable option
 
 Avoid raw CSS/XPath selectors unless no stable user-facing contract exists and adding one is not practical.
 
-Locators are strict for single-element actions. Scope to a stable region or use `filter({ has, hasText })` to make the intended target unique. Treat `.first()`, `.last()`, or `.nth()` as a review signal: the positional choice should be intentional and stable, not merely silence ambiguity.
+Also remember:
 
-### 3. Use web-first assertions with the right timeout owner
+- repeated content usually needs scoping to a stable container
+- exact text matching is often too brittle when role/name or label already exists
+- `getByTestId` is acceptable when semantics are weak but the contract is intentional
+- when a real UI region, card, status, or icon lacks an accessible name, prefer adding that semantic contract in product code before falling back to `getByTestId`
+
+### 3. Use web-first assertions
 
 Playwright assertions auto-wait and retry. Prefer them over manual state inspection.
 
@@ -62,8 +65,6 @@ If a condition genuinely needs custom retry logic, use Playwright's polling/asse
 
 Use `expect.poll` for non-DOM truth such as API state, backend eventual consistency, generated resources, or captured browser events. For DOM state, use locator assertions so Playwright can apply actionability and web-first retry semantics.
 
-Cucumber step and hook timeouts, Playwright locator/action timeouts, and Playwright assertion timeouts are separate budgets. `browserContext.setDefaultTimeout()` does not change the default five-second assertion timeout. Put an explicit longer assertion timeout only on the readiness owner that needs it; do not raise an outer timeout to mask a shorter inner failure.
-
 ### 4. Let actions wait for actionability
 
 Locator actions already wait for the element to be actionable. Do not preface every click/fill with extra timing logic unless the action needs a specific visible/ready assertion for clarity.
@@ -77,20 +78,22 @@ Bad pattern:
 
 - stack arbitrary waits before every action
 - wait on unstable implementation details instead of the visible state the user cares about
-- use `force: true` to bypass a real hit-target, overlay, or disabled-state failure
 
-When synchronizing on a one-shot popup, download, request, or response, create the wait before triggering the action, then await the event. A scenario-owned listener may instead capture events for a later assertion. Do not use `networkidle` as an application-readiness assertion; wait for the user-visible state or owned backend contract.
+### 5. Match debugging to the current suite
 
-### 5. Match debugging to the active harness
+Playwright's wider ecosystem supports traces and rich debugging tools. Dify's current suite already captures:
 
-Playwright supports traces, screenshots, page snapshots, and browser logs. Configure artifact capture in Cucumber hooks instead of adding parallel diagnostics to individual scenarios. If tracing is introduced, use `browserContext.tracing`; Playwright Test options such as `trace: 'on-first-retry'`, projects, workers, fixtures, reporters, and retries do not configure this harness.
+- full-page screenshots
+- page HTML
+- console errors
+- page errors
+
+Use the existing artifact flow by default. If a task is specifically about improving diagnostics, confirm the change fits the current Cucumber architecture before importing broader Playwright tooling.
 
 ## Review Questions
 
 - Would this locator survive DOM refactors that do not change user-visible behavior?
-- Is a positional locator expressing product order, or hiding an ambiguous match?
 - Is this assertion using Playwright's retrying semantics?
-- Does an explicit timeout belong to the condition that is actually slow?
-- Was an event wait registered before the action that emits it?
+- Is any explicit wait masking a real readiness problem?
 - Does this code preserve per-scenario isolation?
-- Is a new abstraction really needed, or does it bypass the runner's scenario-owned context and lifecycle?
+- Is a new abstraction really needed, or does it bypass the existing `DifyWorld` + step-definition model?

.agents/skills/frontend-code-review/SKILL.md

@@ -1,48 +1,94 @@
 ---
 name: frontend-code-review
-description: Use only when the user explicitly requests a review or audit of frontend code under `web/` or `packages/dify-ui/`. Supports pending-change, file-focused, and pasted-diff reviews. Do not use for implementation-only requests, diagnosis without review intent, or backend-only code.
+description: Review Dify frontend code for correctness, accessibility, component design, dify-ui usage, data/query boundaries, performance, and tests. Trigger for `.tsx`, `.ts`, `.js`, UI, React, Next.js, pending-change, or focused frontend review requests.
 ---
 
 # Frontend Code Review
 
-Review the requested scope for concrete defects and violations of explicit project contracts. This skill owns review decisions; its references route to canonical rules without activating another skill's implementation workflow.
+## When To Use
 
-## Evidence First
+Use this skill when the user asks to review, audit, analyze, or sanity-check frontend code under `web/`, `packages/dify-ui/`, or frontend-adjacent TypeScript files.
 
-1. Establish the review scope from the requested files or current diff.
-2. Read the changed lines, their behavior owner, and the nearest scoped `AGENTS.md`.
-3. Trace public consumers, generated contracts, primitive APIs, or runtime configuration only when they decide correctness.
-4. Report findings tied to an observable failure, violated contract, security boundary, or demonstrated maintenance risk. Explicit team conventions are contracts: establish their scope and exceptions, and do not invent user impact to justify a convention finding.
+Supported modes:
 
-## Rule Routing
+- **Pending-change review**: inspect staged and working-tree changes.
+- **File-focused review**: inspect explicitly named files or paths.
+- **Diff/snippet review**: review pasted diffs or snippets using best-effort references.
 
-Read only the packs matched by the diff:
+Do not use this skill for backend-only code under `api/`; use `backend-code-review` instead.
 
-- DOM semantics, focus, keyboard, forms, disabled state, or visible interaction: [`references/accessibility-ui.md`][accessibility]
-- Dify UI imports, Base UI wrappers, overlays, tokens, or primitive contracts: [`references/dify-ui.md`][dify-ui]
-- Component ownership, props, state, Effects, navigation, or module boundaries: [`references/component-architecture.md`][component-architecture]
-- Generated clients, Query, mutations, auth, SSR, URL state, or persistence: [`references/data-query-contracts.md`][data-query]
-- Test files or a concrete missing-regression-test finding: [`references/testing.md`][testing]
-- Bundle, waterfall, rendering, or subscription cost supported by evidence: [`references/performance.md`][performance]
-- Stable Dify runtime invariants in the named paths: [`references/dify-invariants.md`][dify-invariants]
-- General TypeScript or styling quality not owned above: [`references/code-quality.md`][code-quality]
+## Required Context
 
-Read `packages/dify-ui/README.md`, `packages/dify-ui/AGENTS.md`, `packages/dify-ui/docs/overlays.md`, or `web/docs/test.md` only when the reviewed code falls under that contract. Check current official documentation when local code and bundled references do not settle a framework, browser, or accessibility behavior.
+Before reviewing, read the relevant local contracts:
 
-## Severity And Output
+- `web/AGENTS.md` for Dify frontend workflow, overlays, design tokens, state, and tests.
+- `packages/dify-ui/README.md` and `packages/dify-ui/AGENTS.md` when code uses or changes `@langgenius/dify-ui/*`.
+- `web/docs/overlay.md` when reviewing dialogs, drawers, popovers, tooltips, menus, selects, comboboxes, or other floating UI.
+- `web/docs/test.md` and the `frontend-testing` skill when reviewing tests or testability.
+- `karpathy-guidelines` for scope control and focused, verifiable changes.
+- `how-to-write-component` when reviewing React component structure, ownership, effects, query/mutation contracts, or memoization.
 
-- **P0**: security or privacy leak, data loss, production crash, or inaccessible critical workflow.
-- **P1**: user-visible regression, invalid API or authorization contract, hydration failure, or broken primary interaction.
-- **P2**: concrete maintainability, performance, test, or accessibility defect, or a material violation of an explicit project contract.
-- **P3**: minor actionable cleanup; omit unless the user requested a thorough audit.
+For any UI, UX, or accessibility review, fetch the latest Web Interface Guidelines before finalizing findings. Treat them as a required baseline, not the complete source of accessibility truth:
 
-Lead with findings ordered by severity. Include a tight file and line reference, the observed failure or applicable project rule, and a concrete fix direction. Explain the rule's applicability for convention findings; describe downstream consequences only when supported by evidence. When no findings remain, say so briefly and state any material verification gap. Do not add praise sections, speculative risks, or an unsolicited offer to implement fixes.
+```text
+https://raw.githubusercontent.com/vercel-labs/web-interface-guidelines/main/command.md
+```
 
-[accessibility]: references/accessibility-ui.md
-[code-quality]: references/code-quality.md
-[component-architecture]: references/component-architecture.md
-[data-query]: references/data-query-contracts.md
-[dify-invariants]: references/dify-invariants.md
-[dify-ui]: references/dify-ui.md
-[performance]: references/performance.md
-[testing]: references/testing.md
+If the review depends on a current framework, SDK, browser API, or accessibility behavior and local code does not settle it, check the current official docs first. For browser compatibility, deprecation, or behavior-sensitive frontend APIs, verify MDN or the relevant standard.
+
+## Rule Packs
+
+Apply every relevant rule pack:
+
+- [references/accessibility-ui.md](references/accessibility-ui.md) — accessibility, semantic HTML, focus, forms, keyboard, disabled states, copy, and long-content behavior. Combines Web Interface Guidelines with Dify UI, Base UI, MDN, and local primitive contracts.
+- [references/dify-ui.md](references/dify-ui.md) — Dify UI primitive usage, Base UI semantics, overlays, forms, tokens, radius mapping, and primitive boundaries.
+- [references/component-architecture.md](references/component-architecture.md) — component ownership, props, state, effects, exports, wrappers, and feature organization.
+- [references/data-query-contracts.md](references/data-query-contracts.md) — generated contracts, TanStack Query, mutations, workspace/auth/SSR boundaries, URL/local storage state.
+- [references/performance.md](references/performance.md) — React/Next performance review rules from Vercel guidance, scoped to real risk.
+- [references/testing.md](references/testing.md) — frontend test review rules.
+- [references/dify-invariants.md](references/dify-invariants.md) — stable Dify-specific runtime invariants that generic React/a11y rules will not catch.
+- [references/code-quality.md](references/code-quality.md) — general TypeScript, styling, naming, and maintainability rules.
+
+## Review Process
+
+1. Identify the review scope. For pending changes, inspect `git diff --stat`, `git diff`, and staged diff if relevant. For file-focused reviews, stay within the named files unless a referenced owner/contract must be read.
+2. Read code around the changed lines and the owning module. Do not review by isolated snippets when nearby ownership, labels, query inputs, or overlay structure decide correctness.
+3. Check user-visible regressions first: accessibility, broken interaction, auth/permission leaks, query/hydration errors, data loss, navigation mistakes, and impossible states.
+4. Then check maintainability and performance: ownership, effects, wrappers, memoization, bundle/waterfall risks, tests, and design-system drift.
+5. Report only actionable findings. Do not list speculative risks, style preferences, or broad refactors unless they are directly tied to a reproducible issue in scope.
+
+## Severity
+
+- **P0**: security/privacy/auth leak, data loss, production crash, inaccessible critical flow, or broken primary workflow.
+- **P1**: user-visible regression, hydration/SSR failure, invalid API/query contract, broken keyboard/focus behavior, or serious design-system/a11y violation.
+- **P2**: maintainability or performance issue likely to cause bugs, duplicated state, incorrect ownership, missing tests for risky behavior, or non-critical a11y issue.
+- **P3**: minor cleanup with clear value. Omit unless the user asked for a thorough audit.
+
+## Output Format
+
+Lead with findings, ordered by severity. Use this structure:
+
+```markdown
+## Findings
+
+- [P1] Short issue title
+  File: `path/to/file.tsx:123`
+  Why it matters and how to reproduce or reason about it.
+  Suggested fix: concrete fix direction.
+
+## Open Questions
+
+- Question or assumption, if any.
+
+## Summary
+
+Brief secondary context. Mention tests not run or residual risk.
+```
+
+Rules:
+
+- If there are no findings, say `No issues found.` and mention any test gaps or residual risk.
+- Always include file and line when available.
+- Keep findings concrete and reproducible.
+- Do not include praise sections by default.
+- Do not ask to apply fixes unless the user explicitly wants review plus implementation.

.agents/skills/frontend-code-review/references/accessibility-ui.md

@@ -2,51 +2,32 @@
 
 Accessibility findings are first-class review findings. Treat broken keyboard access, missing accessible names, focus loss, and unreachable popup content as correctness bugs, not polish.
 
-## Review Evidence
+Before finalizing UI or accessibility findings, fetch the latest Web Interface Guidelines as a required baseline:
 
-Use the sources relevant to the changed contract:
+```text
+https://raw.githubusercontent.com/vercel-labs/web-interface-guidelines/main/command.md
+```
+
+Do not treat that document as the complete accessibility rule set. Combine it with:
 
 - `packages/dify-ui/README.md`, `packages/dify-ui/AGENTS.md`, and the relevant primitive implementation when code uses `@langgenius/dify-ui/*`.
 - Base UI docs and local `.d.ts` contracts when primitive semantics, focus target, labels, or popup reachability are unclear.
 - MDN or relevant WAI-ARIA/browser standards when behavior, compatibility, or deprecation status matters.
 - The current feature's product semantics, because an accessible primitive can still be used in an inaccessible workflow.
 
-Consult current official documentation or standards when these sources leave a behavior unresolved. The [Web Interface Guidelines] are an optional broader UI reference, not a required fetch for each review.
-
 ## Semantic HTML
 
 Flag:
 
 - Clickable `div` or `span` used for actions.
 - Router navigation implemented with button or `onClick` when a `Link` / `<a>` is the real semantic element.
-- Icon-only controls without an accessible name; follow the naming rules below and the Dify UI `IconButton` contract.
+- Icon-only buttons without `aria-label` or `aria-labelledby`.
 - Decorative icons missing `aria-hidden="true"`.
 - Images without `alt`; use `alt=""` only when truly decorative.
 - Heading levels that skip hierarchy in page-level content.
 
 Prefer semantic HTML before ARIA.
 
-## Page Landmarks
-
-When reviewing Web page layouts, navigation, or landmark changes, read [Page landmarks].
-Inspect the composed page with its parent layouts for missing or duplicate main regions,
-inappropriate nesting or roles, and ambiguous or broken landmark names. Check affected
-unit and E2E locators when semantic elements change. Web owns these composition rules;
-use the existing naming contract for label-source decisions.
-
-## Accessible Names And Descriptions
-
-Read [Accessible names and descriptions] when a change affects labels, ARIA naming, help/error relationships, or hidden text. That document owns the shared implementation and review contract.
-
-Flag violations supported by the final rendered behavior:
-
-- Missing or insufficient names, redundant name overrides, or naming attributes prohibited by the element's role.
-- Overrides that omit visible label wording or suppress necessary descendant information.
-- Broken or stale label/description references, including relationships lost when responsive content or overlays unmount.
-- Descriptions used instead of names, repeated help text, or essential structured content available only as a flattened description.
-
-Inspect the computed name and description in the relevant state. Matching an `aria-label` string to nearby text alone does not prove redundancy.
-
 ## Keyboard And Focus
 
 Flag:
@@ -67,6 +48,7 @@ Flag:
 - Missing stable `name` on form fields that submit or validate.
 - Incorrect input `type`, `inputMode`, `autoComplete`, or `spellCheck` for email, token, URL, number, search, code, or username fields.
 - Labels that are not clickable.
+- Submit buttons disabled before a request starts, preventing normal submit behavior.
 - Non-submit buttons inside forms missing `type="button"`.
 - Errors not associated with fields or not reachable by screen readers.
 - Error recovery that does not focus or expose the first invalid field.
@@ -74,20 +56,16 @@ Flag:
 - Placeholder text used as the only label.
 - Password managers accidentally triggered on non-auth fields because autocomplete is missing or wrong.
 
-Prefer visible labels and associate them through the appropriate field primitive, a native `label`, or `aria-labelledby`. Do not duplicate an existing label with hidden text or `aria-label`; follow [Accessible names and descriptions] when no suitable visible label exists.
+Prefer visible labels. If visible surrounding text already labels the control, use a visually hidden label or a precise `aria-label`.
 
 ## Disabled, Loading, And Async States
 
 Flag:
 
-- Loading controls whose accessible name disappears, or whose user-relevant progress has no
-  feature-owned status path. Follow the Dify UI Button contract for focused loading buttons; do not
-  add `aria-busy` to a button as a generic pending-state substitute.
-- The same pending state passed to both Dify UI Button `loading` and `disabled`, which duplicates
-  state ownership and obscures whether `disabled` expresses independent unavailability.
+- Loading state without `aria-busy`, `role="status"`, or another accessible update path when it changes user interaction.
 - Spinner or decorative loading icon exposed to screen readers.
 - Disabled controls that hide the reason users cannot proceed.
-- Controls marked `aria-disabled` that still activate through supported pointer or keyboard input. Check the primitive's handling before requesting manual event guards.
+- `aria-disabled` used without manually blocking click, Space, and Enter.
 - Toasts, inline validation, or async status changes that are not announced when users need the update to continue.
 - Icon-only loading/error affordances without text or accessible status where the state matters.
 
@@ -112,7 +90,7 @@ Use Popover for explanatory content, rich help, and infotips. Use Tooltip only a
 Flag:
 
 - Text in flex/grid children without `min-w-0` when it can overflow.
-- Long names, labels, or user content that overflow, obscure adjacent controls, or become unreadable in supported layouts.
+- Names, labels, file names, model names, workspace names, or user content lacking `truncate`, `line-clamp`, or `break-words`.
 - Right-side icons, badges, checks, or actions that shrink before the text area.
 - Empty arrays or empty strings rendering broken layout instead of an empty state.
 - Button, tab, badge, chip, menu item, or card text that can overlap sibling controls at common viewport widths.
@@ -129,7 +107,3 @@ Flag:
 - Images without dimensions.
 - Loading copy using `...` instead of `…`.
 - Hardcoded dates, times, numbers, or currency formats instead of `Intl.*`.
-
-[Accessible names and descriptions]: ../../../../packages/dify-ui/docs/accessible-names-and-descriptions.md
-[Page landmarks]: ../../../../web/docs/landmarks.md
-[Web Interface Guidelines]: https://raw.githubusercontent.com/vercel-labs/web-interface-guidelines/main/command.md

.agents/skills/frontend-code-review/references/code-quality.md

@@ -26,17 +26,15 @@ Prefer:
 
 ## Styling
 
-For Dify UI/Base UI state styling and callback composition, apply the package's [Styling] contract,
-including its documented reasons for direct state access.
-
 Flag:
 
 - New CSS modules or ad hoc CSS when Tailwind utilities and Dify tokens cover the need.
 - Component-level plain `.css` files or component CSS imported through `globals.css`; use scoped `*.module.css` only when Tailwind and component variants cannot express the style.
 - Generic color utilities where Dify semantic tokens exist.
-- Hardcoded magic class values for colors, spacing, radius, shadow, z-index, or typography when Dify tokens, component variants, or standard Tailwind radius classes match the required design value. Apply [Styling] when choosing radius classes.
+- Hardcoded magic class values for colors, spacing, radius, shadow, z-index, or typography when Dify tokens, component variants, or documented radius mappings exist.
 - `!` important modifiers or important CSS overrides without a narrow, documented reason.
-- Manual class-list assembly through string concatenation, template strings, array `.join(' ')`, or a custom conditional combiner instead of `cn(...)`. Conditional values passed to `cn(...)` remain valid.
+- Manual string concatenation, template strings, array `.join(' ')`, or custom ternaries for conditional or multi-line classes.
+- JS conditional class branches for primitive visual states already exposed by Dify UI/Base UI `data-*` selectors.
 - Incoming `className` placed before default classes in `cn(...)`, preventing call-site overrides.
 - Arbitrary z-index or one-off layering fixes on overlays.
 
@@ -45,6 +43,7 @@ Use:
 - `cn(...)` from the local package or utility already used by the file.
 - Dify semantic tokens and Tailwind v4 utilities.
 - Existing component variants before one-off class forks.
+- Primitive selectors such as `data-disabled:*`, `data-checked:*`, `data-highlighted:*`, `group-data-*`, `peer-data-*`, and `has-[:focus-visible]` before adding React state or boolean props solely for styling.
 - Component-level variants, semantic tokens, and normal cascade/order before `!` overrides. Use `!` only for a contained compatibility override that cannot be expressed through the component API or local selector structure.
 
 ## Imports
@@ -67,5 +66,3 @@ Flag:
 - Error messages that state only the failure and not the next step.
 
 Use feature-local translation keys by default. Alias only when crossing namespaces. `pnpm i18n:check --file <name>` should pass for any touched translation namespace.
-
-[Styling]: ../../../../packages/dify-ui/docs/styling.md

.agents/skills/frontend-code-review/references/component-architecture.md

@@ -1,31 +1,89 @@
-# Component Architecture Review
+# Component Architecture Rules
 
-Use the canonical reference for the changed concern. These links share rules; they do not activate the implementation skill or its workflow.
+Use these rules for React component structure, ownership, state, props, effects, and module organization.
 
-| Concern | Canonical rules |
-| --- | --- |
-| Vertical modules, public entrypoints, data/handler placement, wrappers, Props, and types | [Ownership] |
-| Local/Jotai state, form drafts, route identity, URL state, and persistence | [State] |
-| Effects, navigation, memoization, and subscriptions | [Runtime] |
-| Hotkeys, focus, and secondary surfaces | [Interactions] |
+## Ownership
 
-## Apply Rules In Their Actual Scope
+Flag:
 
-Explicit team conventions are reviewable contracts, including module organization and public API boundaries. Check the documented exception before reporting a violation. Do not infer an exception solely because the code appears to work, or invent a user-facing failure for a convention finding.
+- State, query, mutation, or handlers hoisted above the lowest component that actually uses them.
+- Parent components owning row/item actions that do not coordinate a workflow.
+- Prop drilling through multiple pass-through layers.
+- A page/tab-level section component becoming the data owner without needing a shared snapshot or shared loading/error/empty UI.
+- Feature code promoted to shared only because it appears once or might be reused later.
 
-- For owner placement, trace the consumers and required lifetime. Establish whether the parent coordinates a snapshot, submission, navigation, shared UI, or persistence before asking to move state or handlers.
-- For component boundaries, identify the ownership or encapsulation the proposed extraction would improve; file length alone establishes neither.
-- For props and types, check the domain contract and public API. Do not report private props typing style alone; declaration/export syntax matters only for a documented package rule or concrete type, export, or framework defect.
-- For state and Effects, trace the source of truth, external synchronization target, and mount/reset boundary. Controlledness alone does not prove that a draft is lifted or persisted; follow the form and overlay contracts linked by [State].
-- For navigation, distinguish ordinary links from mutation success, guarded redirects, command flows, and submission side effects.
+Accept repeated TanStack Query calls in siblings when each component independently consumes the data. Cache deduplication is not a reason to hoist by itself.
 
-## Preserve Existing Product Contracts
+## Component Boundaries
 
-During refactors, trace the interaction being moved through its real consumer. Navigation, sidebar, dropdown, webapp-list, and app-switching changes must preserve expansion controls, hover persistence, pin/delete actions, routing, keyboard/focus handling, and open-state ownership where present.
+Flag:
 
-Check that the changed owner still handles reachable empty, loading, and missing optional-data states, and that primitive wrappers preserve accessible semantics and the public controlled-state contract. Report the actual lost behavior or explicit rule violation; use the package testing policy when assessing regression coverage.
+- React component files over 300 lines when the file mixes multiple responsibilities that can be split into focused colocated components, hooks, or utilities.
+- Shallow wrappers that only rename props or hide the real primitive.
+- Extra DOM wrappers that do not provide layout, semantics, accessibility, state ownership, or library integration.
+- Dialog/dropdown/popover hidden surfaces that obscure the parent flow when they should be extracted into a small local component.
+- Business forms, menu bodies, or one-off helpers moved away from their owner without reuse or semantic value.
 
-[Interactions]: ../../how-to-write-component/references/interactions.md
-[Ownership]: ../../how-to-write-component/references/ownership.md
-[Runtime]: ../../how-to-write-component/references/runtime.md
-[State]: ../../how-to-write-component/references/state.md
+Prefer colocated components split by actual data and state needs.
+
+## Bad Component Design Patterns
+
+Flag:
+
+- Refactors of existing navigation, sidebar, dropdown, webapp list, or app-switching UI that do not preserve behavior-sensitive interactions such as expand/collapse arrows, hover persistence, pin/delete controls, routing, keyboard/focus handling, or open-state ownership.
+- Components that mix data fetching, mutation side effects, popup state, form validation, layout, and row rendering without a clear owner.
+- Generic components with many boolean props that encode one feature's workflow.
+- A shared component that imports feature-specific copy, routes, or API contracts.
+- A feature component that accepts pre-rendered fragments only to avoid placing ownership correctly.
+- A child component that receives both raw server data and separately derived flags for the same concept.
+- A wrapper that changes accessible semantics of the primitive it wraps.
+- A component that exposes controlled props but still keeps a competing private state for the same value.
+- A component that cannot render empty, loading, or missing optional API fields without caller-side preprocessing.
+
+When existing components already own interaction logic, prefer reusing or extending them. If a refactor is necessary, preserve the old interaction contract and add or update focused tests for changed behavior.
+
+## Props And Types
+
+Flag:
+
+- `React.FC` / `FC`.
+- Default exports outside framework-required files.
+- Named `Props` types for trivial one-off props where inline typing is clearer.
+- Props named by UI implementation instead of domain/API role.
+- API data converted too early or under a generic name that breaks traceability.
+- Callers duplicating fallback checks that the lowest rendering component already handles.
+
+Prefer top-level `function` declarations for components and module helpers. Use arrow functions for callbacks and local lambdas.
+
+## Effects
+
+Flag effects that:
+
+- Transform props/state for rendering.
+- Copy one state value into another representing the same concept.
+- Handle user actions that belong in event handlers.
+- Reset state from props when a keyed reset, stable ID, or render-time derivation would work.
+- Fetch data that belongs in framework APIs or TanStack Query.
+
+If an effect remains, it must synchronize with a named external system: browser API, subscription, timer, analytics-on-visibility, non-React widget, or imperative DOM integration.
+
+## State Modeling
+
+Flag:
+
+- Storing derived booleans, disabled flags, default tabs, or loading labels that can be calculated from current query/feature state.
+- Local state used to fake server data or generated contract fields.
+- UI state persisted to localStorage when it is live app state.
+- Feature-local mock shells wired to unrelated existing APIs before the real API is confirmed.
+
+Prefer render-time derivation. Keep true local state for user choices, transient input, controlled popups, and feature UI state that has no server source.
+
+## Navigation
+
+Flag:
+
+- Imperative router navigation for ordinary links.
+- Button semantics used for navigation.
+- Navigation state hidden in component state when URL state is required for shareable filters, tabs, or pagination.
+
+Use `Link` for normal navigation. Use router APIs for mutation success, guarded redirects, command flows, or form submission side effects.

.agents/skills/frontend-code-review/references/data-query-contracts.md

@@ -1,28 +1,74 @@
-# Data, Query, And Contract Review
+# Data, Query, And Contract Rules
 
-[Data and queries] owns generated-client, Query options, mutation/cache, imperative access, SSR, authentication, and tenant rules. [State ownership] owns URL state and persistence. Read only the reference needed by the diff; reading a shared reference does not activate its implementation skill.
+Use these rules for generated contracts, TanStack Query, mutations, auth/SSR boundaries, URL state, and client persistence.
 
-## Generated Contracts And Query Conventions
+## Generated Contracts
 
-Review explicit team conventions as contracts, including direct generated options, `skipToken` for missing required input, and shared cache policy. A lint rule may enforce part of a convention; neither a green lint result nor a suppression proves the full contract is satisfied.
+Flag:
 
-- Establish whether the changed call belongs to a new or migrated surface and whether the generated operation is ready. Check deprecated markers, schema shape, and the real UI consumer before prescribing a migration.
-- Distinguish a pass-through wrapper from a feature hook with actual orchestration. Check whether an independent execution condition or Promise composition justifies the documented query/mutation exception.
-- Trace generated input and output types through their boundaries. Identify the exact DTO mirror, field widening, placeholder input, or lost intentional empty value when reporting a violation.
-- Check whether a local mutation callback owns feature feedback or replaces shared invalidation, retry, or cache defaults. Match optimistic changes to the current list/detail owner.
+- New legacy service/helper wrappers around generated `queryOptions()` or `mutationOptions()`.
+- Continuing to use deprecated contract operations when a ready generated contract exists.
+- Assuming a generated file means an operation is ready without checking deprecated markers, schema shape, and the actual UI consumer.
+- Re-declaring API DTOs in components.
+- Adding compatibility layers instead of migrating the pointed line and deleting the old layer.
 
-## Imperative Access And SSR
+Use `web/contract/*` as the API shape source of truth. Follow existing `{ params, query?, body? }` input shape.
 
-- Check freshness, projection, retries, and the caller's execution condition separately against [Data and queries]. Trace Promise ownership to distinguish an awaited hard gate from soft prefetching with an explicit failure owner.
-- For Server Components, identify who renders the data and who may revalidate it. Check dehydration, the same-key client consumer, error handling, and the intended Suspense/server-rendered-content contract when the diff changes streaming.
-- For auth, setup, roles, branding, or availability, trace authoritative data and the loading/fallback path. A static redirect or placeholder value cannot stand in for a request-dependent decision.
+## Queries
 
-## Tenant, URL, And Persistence Boundaries
+Flag:
 
-- Trace the current workspace-switch flow and cache lifetime before reporting missing identity in a query key. Verify backend meaning before treating `workspace_id` and `tenant_id` as interchangeable.
-- For URL and storage changes, identify whether the value is shareable navigation state, live app state, a one-shot signal, or a low-frequency preference. Apply [State ownership] to that category and verify its write/reset owner.
+- `enabled` used to hide missing required input instead of `input: skipToken`.
+- Fake fallback IDs or placeholder inputs used to force a query to run.
+- Query results copied into local state for rendering.
+- Shared query behavior such as invalidation, stale defaults, or retry rules reimplemented at call sites.
+- `prefetchQuery` treated as a hard gate or as returning data/errors to the caller.
 
-Report the violated rule and applicable scope or the concrete failing path. Do not invent runtime impact when the finding is a team-convention violation.
+Use `useQuery(consoleQuery.xxx.queryOptions(...))` or `useQuery(marketplaceQuery.xxx.queryOptions(...))` directly unless a feature hook performs real orchestration.
 
-[Data and queries]: ../../how-to-write-component/references/data.md
-[State ownership]: ../../how-to-write-component/references/state.md
+## Mutations
+
+Flag:
+
+- Deprecated `useInvalid` or `useReset`.
+- `mutateAsync` used without a need for Promise semantics.
+- Awaited mutations without `try/catch`.
+- Components owning shared cache invalidation that belongs in query defaults.
+- Optimistic updates that do not match current list/detail ownership.
+
+Use generated `mutationOptions()` directly when possible. Put shared cache behavior in `createTanstackQueryUtils(...experimental_defaults...)`.
+
+## SSR, Auth, And Route Boundaries
+
+Flag:
+
+- Request-time auth, setup, workspace role, or tenant decisions moved into static `next.config redirects()`.
+- Dynamic role gates depending on `workspaces.current` implemented as static path redirects.
+- Authorization logic depending on soft `prefetchQuery`.
+- Removing a client fallback before server API unavailable behavior is defined.
+- Global placeholder query contracts introduced to solve a route-local Suspense issue.
+- Branding-sensitive UI reading placeholder defaults without checking pending/placeholder state.
+
+Separate hard gates from soft prefetches. `fetchQuery` can be a server decision boundary; `prefetchQuery` is cache warmup.
+
+## Workspace And Tenant
+
+Flag:
+
+- Treating workspace switch as ordinary CRUD invalidation when the current app flow performs server switch plus full reload.
+- Query keys that omit workspace/tenant identity when the query truly varies by workspace and no full reload boundary applies.
+- Mixing `workspace_id` and `tenant_id` without tracing the current backend/API contract.
+
+Current Dify workspace switch should be reviewed as a tenant cache boundary first.
+
+## URL State And Local Storage
+
+Flag:
+
+- Shareable filters, tabs, pagination, selected panels, or search state hidden only in component state.
+- One-shot navigation signals modeled as subscribed persistent state.
+- Live app state stored in localStorage.
+- Direct `window.localStorage`, `globalThis.localStorage`, or raw storage calls in app code.
+- High-frequency interaction state persisted on every change instead of on commit/settle.
+
+Use URL state for shareable UI state, feature/Jotai/store state for live UI state, and `@/hooks/use-local-storage` only for low-frequency client-only preferences, dismissed notices, and UI defaults.

.agents/skills/frontend-code-review/references/dify-ui.md

@@ -1,29 +1,141 @@
-# Dify UI Review Routing
+# Dify UI Rules
 
-Use this reference when a review touches `packages/dify-ui/` or consumes
-`@langgenius/dify-ui/*`. It routes to owner documentation; it does not redefine package
-contracts.
+Use these rules whenever a review touches `packages/dify-ui/` or code consuming `@langgenius/dify-ui/*`.
 
-Read `packages/dify-ui/AGENTS.md` and the primitive implementation first, then only the matching
-owner:
+Before finalizing findings for those files, read the current local docs that apply:
 
-| Review area                                | Canonical owner                                                     |
-| ------------------------------------------ | ------------------------------------------------------------------- |
-| Package boundary and document routing      | `packages/dify-ui/AGENTS.md`                                        |
-| Imports, exports, public types, and anatomy | `packages/dify-ui/docs/authoring.md`                                 |
-| Button or icon-only actions                | `packages/dify-ui/src/button/README.md`, `packages/dify-ui/src/icon-button/README.md` |
-| Compound inputs                            | `packages/dify-ui/src/input-group/README.md`                         |
-| Forms and field semantics                  | `packages/dify-ui/docs/forms.md`                                     |
-| Selection and typed values                 | `packages/dify-ui/docs/selection.md`                                 |
-| Portals, layers, and floating surfaces     | `packages/dify-ui/docs/overlays.md`                                  |
-| State styling, callbacks, and Tailwind     | `packages/dify-ui/docs/styling.md`                                   |
-| Package tests and Storybook                | `packages/dify-ui/docs/testing.md`                                   |
+- `packages/dify-ui/README.md`
+- `packages/dify-ui/AGENTS.md`
+- `web/docs/overlay.md` for floating UI
+- `packages/dify-ui/src/<primitive>/index.tsx` for the primitive being changed or consumed
 
-For consumer code under `web/`, also read `web/AGENTS.md` for application-owned reuse policy and
-`packages/dify-ui/README.md` for the available public subpaths.
+## Package Boundary
 
-Treat the implementation, public types, tests, and stories as evidence for the documented
-contract. If they disagree, identify the actual owner before reporting a finding. Read current
-official Base UI documentation and installed type declarations for upstream-derived behavior.
-Report only a reproducible contract violation or observable defect, not a preference inferred from
-this routing file.
+Flag in `packages/dify-ui`:
+
+- Imports from `web/`.
+- Dependencies on Next.js, i18n, ky, Jotai, Zustand, TanStack Query, oRPC, or business APIs.
+- Business-specific component behavior that belongs in `web/`.
+- Multiple unrelated primitives in one component folder.
+
+`packages/dify-ui` is a primitive layer: Base UI headless components + `cva` + `cn` + Dify design tokens.
+
+## Imports And Exports
+
+Flag:
+
+- Consumer imports from `@langgenius/dify-ui` without a subpath.
+- Missing `package.json#exports` entry for a new primitive.
+- Internal package imports using workspace subpaths instead of relative paths.
+- Exported props using internal-only types that consumers cannot import from the component subpath.
+- Canonical primitive boundaries or their associated public types using a redundant `Root` suffix when no higher-level convenience component exists in the same subpath.
+
+Consumers use subpath exports such as `@langgenius/dify-ui/button`.
+
+Canonical boundaries use the primitive name and matching public types (`Select` / `SelectProps`). Keep `Root` only to distinguish a low-level anatomy root from a higher-level convenience component (`CheckboxRoot` / `Checkbox`); implementation aliases should still show their Base UI source (`BaseSelect.Root.Props`).
+
+## Props And State
+
+Flag:
+
+- Flattened props where related values need a discriminated union, such as `value` / `defaultValue`, `multiple` / `value`, or `clearable` / `onChange`.
+- React state used only to mirror Base UI state for class names.
+- JavaScript conditional class logic for visual states that the Dify UI/Base UI primitive already exposes through `data-*` attributes or CSS variables.
+- Controlled props added when uncontrolled DOM state or CSS variables would be enough.
+- Thin wrappers that rename Base UI parts without adding semantics.
+- Generic Base UI selection primitives wrapped without preserving their value generics, such as `Select.Root<Value, Multiple>`, `RadioGroup<Value>`, or `Radio.Root<Value>`.
+- Shared select/radio option components that type selected values as `string` while callers pass enums, unions, booleans, numbers, objects, or nullable placeholder values.
+
+Prefer Base UI/Dify UI data attributes and CSS variables for visual state: `data-open`, `data-checked`, `data-disabled`, `data-highlighted`, `data-popup-open`, `group-data-*`, `peer-data-*`, `has-[:focus-visible]`, and primitive CSS variables such as anchor width or transform origin. Use JS conditional classes for product/business state that the primitive does not expose.
+
+For non-string `Select` and `RadioGroup` values, prefer explicit domain generics at the root and at child value carriers. JSX children do not inherit the parent generic, so `RadioGroup<PromptMode>` should compose with `Radio<PromptMode>`, `RadioItem<PromptMode>`, or option values from a typed collection. For `Select`, prefer the Base UI `items` collection pattern for typed value-to-label rendering, and flag string coercion helpers used only to recover display labels.
+
+## Forms
+
+Flag:
+
+- Form-like UI using unrelated `Input` and `Button` pieces without a submit boundary.
+- Text-like fields not composed through `Field`, `FieldLabel`, and `FieldControl` when using Dify UI form semantics.
+- Select fields using `FieldLabel` instead of `SelectLabel`.
+- Slider fields using a generic label instead of `SliderLabel`.
+- Checkbox/radio groups missing `Fieldset` and `FieldsetLegend`.
+- Field errors or descriptions rendered without `FieldDescription` / `FieldError` relationships.
+
+`Form` is the submit boundary. Dify UI form primitives are not a form state-management framework; business validation and schema-driven behavior belong in `web/`.
+
+## Overlay Contract
+
+Flag:
+
+- Legacy web overlay imports in new or modified code.
+- Manual portals around Dify UI overlay primitives.
+- Call-site `z-*` overrides on overlays.
+- Missing root `isolation: isolate` assumptions when debugging overlay stacking.
+- Repeated backdrop, z-index, or portal chrome at call sites.
+- Tooltip used for infotips, long text, or interactive content.
+
+All Dify UI body-portalled overlays use `z-50`. Toast uses `z-60`. DOM order handles stacking between overlays.
+
+## Primitive Selection
+
+Flag:
+
+- `Tabs` used for simple mode/filter/view selection where `SegmentedControl` is the semantic primitive.
+- `SegmentedControl` used where `tablist` / `tabpanel` semantics are required.
+- `Select` used for searchable or free-form input.
+- `Combobox` used for unrestricted search text where no selected option is remembered.
+- `Autocomplete` used for closed-list selection.
+- Tooltip or PreviewCard used for content that must be reachable on touch or by screen readers.
+
+Use:
+
+- `Autocomplete` for free-form text with optional suggestions.
+- `Combobox` for searchable selected values from a collection.
+- `Select` for closed, scannable option sets.
+- `Popover` for infotips, help text, rich content, or interactions.
+
+## Bad Usage Patterns To Flag
+
+Flag:
+
+- Manually recreating UI behavior or chrome already owned by `@langgenius/dify-ui/*` or `web/app/components/base/*`, such as buttons, inputs, toggle groups, popovers, dropdown menus, alert dialogs, switches, avatars, scroll areas, toasts, borders, focus states, disabled states, segmented controls, or existing feature components.
+- Styling a raw Base UI primitive directly in `web/` when a Dify UI primitive exists.
+- Wrapping a Dify UI primitive in a feature component that hides its label, error, disabled, or focus contract.
+- Replacing a semantic primitive with a generic `div` plus classes to match a screenshot.
+- Using `Tooltip` because it is visually convenient when the content is actually help text or needs touch access.
+- Adding a `z-*` override to make a child popup appear over a parent dialog.
+- Adding a new app-level wrapper around Dialog, Drawer, Popover, Select, or Combobox that repeats portal/backdrop/positioner logic.
+- Using dify-ui `Input` as a drop-in replacement for legacy inputs that include search, clear, copy, unit, localized placeholder, or number normalization behavior.
+- Building a form row from loose text and controls instead of the matching Field/Form primitives.
+- Adding component state only to style `data-open`, `data-checked`, `data-disabled`, or highlighted states that Base UI already exposes.
+- Passing booleans down only so children can toggle classes already expressible with primitive `data-*` selectors.
+
+## Tokens, Radius, And Styling
+
+Flag:
+
+- `radius-*` class names.
+- Custom Tailwind `borderRadius` extension for Figma radius values.
+- Generic colors where semantic Dify tokens exist.
+- Hardcoded design values where Dify tokens, component variants, or documented Figma radius mappings exist.
+- `!` important modifiers used to fight primitive styles instead of fixing the variant, selector, or component composition.
+- Manual class strings that duplicate primitive variants.
+- `min-w-(--anchor-width)` on picker popups when it defeats viewport clamping.
+
+Use the Figma radius mapping from `packages/dify-ui/AGENTS.md`; for example `--radius/sm` maps to `rounded-md`, and `--radius/md` maps to `rounded-lg`.
+
+Use `!` only for a tightly scoped compatibility override after confirming the primitive API, data attributes, and selector structure cannot express the state.
+
+## Focus Details
+
+Flag focus rings attached to the wrong element. For example, Base UI `Slider.Thumb` focuses an internal `input[type=range]`, so the visible thumb wrapper needs `has-[:focus-visible]` rather than direct wrapper `focus-visible`.
+
+## Custom SVG Icons
+
+Flag:
+
+- New generated React icon components or JSON files under `web/app/components/base/icons/src/...` for custom SVG icons.
+- Custom SVG icons consumed outside the Tailwind `i-custom-*` icon class pipeline.
+- Generated `packages/iconify-collections/custom-*/icons.json` diffs where unrelated existing icons lost or changed intrinsic `width` or `height`.
+
+New custom SVG icons belong in `packages/iconify-collections/assets/...`. Regenerate with `pnpm --filter @dify/iconify-collections generate`, validate with `pnpm --filter @dify/iconify-collections check:dimensions`, and consume the generated icon with Tailwind `i-custom-*` classes.

.agents/skills/frontend-code-review/references/performance.md

@@ -71,6 +71,8 @@ Flag:
 
 ## React Flow
 
-Use [Dify invariants] for React Flow node/edge consumption and provider availability in RAG Pipe template rendering. Callback-only reads or mutations can use `useStoreApi`.
+For workflow React Flow components, keep this Dify-specific rule:
 
-[Dify invariants]: dify-invariants.md
+- UI consumption should use React Flow hooks such as `useNodes` / `useEdges`.
+- Callback-only reads or mutations can use `useStoreApi`.
+- Node components under `web/app/components/workflow/nodes/[nodeName]/node.tsx` must not depend on workflow stores that are absent in RAG Pipe template rendering.

.agents/skills/frontend-code-review/references/testing.md

@@ -1,6 +1,6 @@
 # Testing Review Rules
 
-Use `web/docs/test.md` for tests owned by `web/` and `packages/dify-ui/docs/testing.md` for tests owned by Dify UI. These owners define their test boundaries, environments, and checks; this reference only adds review questions.
+`web/docs/test.md` is the canonical frontend testing policy. Use this file only to translate that policy into review findings.
 
 ## Request Missing Tests When Risk Justifies Them
 
@@ -9,11 +9,10 @@ Flag missing coverage when a change alters a reachable contract such as:
 - User interaction, navigation, form submission, validation, or permissions.
 - Query or mutation behavior, URL state, persistence, or one-shot signals.
 - Loading, error, empty, and recovery states that users can encounter.
-- A hidden surface whose close-and-reopen behavior changes whether in-progress state resets or persists.
 - Accessibility-critical labels, keyboard flow, focus, disabled state, or overlay behavior.
 - A regression-prone business rule or bug fix that can be reproduced through a public boundary.
 
-Do not request tests for mechanical changes, pass-through wrappers, implementation details, or incidental visual styling. Low coverage alone is not a finding.
+Do not request tests for mechanical changes, pass-through wrappers, implementation details, or visual-only styling unless they affect behavior. Low coverage alone is not a finding.
 
 ## Flag Low-Value or Fragile Tests
 
@@ -30,8 +29,8 @@ Flag tests that:
 
 - Prefer semantic queries and accessible names.
 - Prefer real feature components when integration semantics matter.
-- Check mocks against the owning package's policy; allowed mocks must preserve the public contract and leave the behavior under review real.
-- Apply the owning package's admission policy before requesting new automation. Real-browser verification can be a one-off review; a simulator limitation alone does not justify a permanent test.
-- Check that assertions prove the claimed outcome and add evidence beyond existing tests; a browser runtime does not make weak assertions stronger.
+- Allow intentional child or provider mocks when setup would dominate the test and that boundary is covered independently.
+- Do not accept semantically inaccurate mocks of Dify UI or legacy base primitives.
+- Require a real-browser or visual verification plan when `happy-dom` cannot represent the risk.
 
 Treat test quality, determinism, and regression value as the review criteria. Do not use test count or coverage percentage as a proxy for quality.

.agents/skills/frontend-testing/SKILL.md

@@ -1,13 +1,35 @@
 ---
 name: frontend-testing
-description: Use when writing or changing Vitest or React Testing Library tests under `web/` or `packages/dify-ui/`, or when the user explicitly requests frontend test strategy, including evaluation of an existing strategy. Do not use for frontend code-review-only requests, general testability discussion, Python tests, or Cucumber/Playwright E2E.
+description: Write, update, or review Dify frontend tests using Vitest and Testing Library. Trigger for frontend specs, test coverage requests, regressions, testability, or testing strategy under web/ or packages/dify-ui/.
 ---
 
-# Frontend Testing
+# Dify Frontend Testing
 
-Read the testing policy for the package that owns the changed tests:
+Use this skill for Vitest work under `web/` and `packages/dify-ui/`. Do not use it for Python tests or Cucumber/Playwright tests under `e2e/`.
 
-- `web/`: `web/docs/test.md` owns Web test boundaries, environments, and commands.
-- `packages/dify-ui/`: `packages/dify-ui/docs/testing.md` owns primitive test boundaries, environments, Storybook, and commands.
+## Required Source
 
-This skill adds no parallel policy or check sequence. Follow the selected owner's requirements, including its validation commands. Recommend deleting low-value tests as readily as adding missing behavior coverage, and report the contract verified and any material verification gap.
+Before writing, changing, or reviewing frontend tests, read `web/docs/test.md` completely. It is the single source of truth. This skill provides an execution checklist and must not redefine or extend that policy.
+
+## Workflow
+
+1. Read the source, its behavior owner, nearby specs, and relevant public dependencies.
+1. Apply the canonical guide to decide whether a test is needed and choose its boundary.
+1. For a behavior change or bug fix, write or identify the failing scenario first when practical.
+1. Implement one coherent scenario at a time and run the focused spec before expanding scope.
+1. Finish with the affected suite and relevant repository checks.
+1. Report what behavior was verified and any risk that still requires browser, visual, or end-to-end validation.
+
+When reviewing existing tests, recommend deleting low-value tests as readily as adding missing behavior coverage.
+
+Run focused tests from the owning workspace:
+
+```bash
+# web/
+vp test run path/to/spec-or-directory
+
+# packages/dify-ui/
+vp test run --project unit src/path/to/spec
+```
+
+Run Dify UI Storybook tests with `vp test --project storybook --run`. Run broader checks only after the focused behavior passes.

.agents/skills/how-to-write-component/SKILL.md

@@ -1,34 +1,144 @@
 ---
 name: how-to-write-component
-description: Use when implementing or refactoring React/TypeScript components and the task requires decisions about component ownership, feature boundaries, state, data flow, effects, or interaction ownership. Do not use for review-only requests, test-only work, copy-only edits, or styling-only changes.
+description: Use when writing, refactoring, or reviewing React/TypeScript components in Dify web, especially decisions about component ownership, props/types, URL/query state, Jotai state, async state, generated API contracts, queries/mutations, overlays, effects, navigation, performance, and empty states.
 ---
 
 # How To Write A Component
 
-Use this skill to route component architecture decisions to its bundled references. Read only the references required by the current change.
+Use this as the component decision guide for Dify web. Existing code is reference material, not automatic precedent; if touched code violates these rules, adapt it and fix equivalent patterns in the same feature branch.
 
-## Topic Routing
+## First Decisions
 
-- Component moves, module boundaries, props, types, or owner placement: read [`references/ownership.md`][ownership].
-- Dify UI wrappers or primitive state styling: read the package's [Public API authoring] and [Styling] contracts.
-- Jotai, form drafts, route identity, URL state, or persistence: read [`references/state.md`][state].
-- Generated contracts, nullable API data, Query, mutations, SSR, auth, or workspace state: read [`references/data.md`][data].
-- Hotkeys, focus, dialogs, menus, popovers, or other secondary surfaces: read [`references/interactions.md`][interactions] and the overlay guide it references when applicable. Also read [`references/state.md`][state] when the surface owns a draft or other local session state.
-- Effects, navigation, memoization, preloading, or render cost: read [`references/runtime.md`][runtime].
+| Question | Default | Promote or extract only when |
+| --- | --- | --- |
+| Where should code live? | Keep it local to the feature workflow, route, or owner. | Multiple verticals need the same stable primitive. |
+| How should route/tab folders be named? | Match the current route segment, tab name, or user-visible surface. | Keep a historical or broader parent only when it still owns multiple surfaces. |
+| Who owns state, data, and handlers? | The lowest component that uses them. | A parent coordinates shared loading, errors, empty UI, selection, submission, navigation, or one consistent snapshot. |
+| Should this become Jotai state? | Keep synchronous UI/form state in component or DOM state. | Siblings need one source of truth, the value drives atoms, or scoped workflow state must survive hidden/unmounted steps. |
+| Should URL state enter Jotai? | Let Next.js route params and `nuqs` own URL state and updates. | Query atoms or shared derived atoms need a read-only bridge hydrated at the route/surface boundary. |
+| Should this query/mutation become an atom? | Use TanStack Query hooks at the lowest owner. | It reads atom state, feeds derived atoms, or participates in shared Jotai workflow orchestration. |
+| Should this be a helper/wrapper? | Prefer direct readable code at the use site. | The name captures a stable domain rule or the wrapper owns real behavior, validation, state, error handling, or semantics. |
+| Where should a hotkey live? | Keep a single-owner hotkey constant in its component. | Multiple production files share one command, or the feature owns a real command registry with shared metadata and behavior. |
+| Is an Effect needed? | No. Derive during render or handle the user action in the event handler. | It synchronizes with an external system such as browser APIs, subscriptions, timers, analytics, or imperative DOM/non-React widgets. |
 
-## Scope And Verification
+## Core Defaults
 
-Identify the behavior owner, state lifetime, and public contract from the nearby implementation and relevant references. Keep the change within that vertical slice unless the contract requires changes elsewhere. Verify the changed behavior and complete the owning package's required checks. For Web, read `web/docs/test.md` for test work and `web/docs/lint.md` for static checks. Dify UI verification is owned by `packages/dify-ui/docs/testing.md`.
+- Search before adding UI, hooks, helpers, query utilities, or styling patterns. Reuse existing base components, feature components, hooks, utilities, and design styles when they fit.
+- Follow Dify's CSS-first Tailwind v4 contract from `packages/dify-ui/README.md` and `packages/dify-ui/AGENTS.md`. Prefer design-system tokens, utilities, and radius mappings over generic Tailwind choices.
+- Preserve visible keyboard focus states on the final focusable element. Prefer styled `@langgenius/dify-ui/*` controls when available, because components such as `Button` and form/control primitives carry the standard Dify UI `focus-visible` styling. Do not assume every Dify UI export provides visual focus styles: headless anatomy parts and direct Base UI re-exports such as dialog/popover/tooltip/drawer triggers usually only provide behavior and semantics. When using native `button` / `a`, custom trigger `render` props, clickable rows, icon buttons, menu-like items, or direct trigger parts, verify the rendered focusable element has a visible focus state. If it does not, add the standard Dify UI focus style: `outline-hidden focus-visible:ring-2 focus-visible:ring-state-accent-solid`. Do not hide outlines without an equivalent visible `focus-visible` indicator. Component-specific focus styles should follow an existing styled primitive pattern or a concrete design constraint, not a new ad hoc style.
+- Group feature code by workflow, route, or ownership area with route-aligned names: components, hooks, local types, query helpers, atoms, constants, tests, and small utilities should live near the code that changes with them.
+- For each feature module, keep a module-local `README.md` as a boundary note. Start with the module name, a brief one-sentence description, then split dependencies into `Internal Modules` and `External Modules` sections; keep both sections and write `None.` when one category is empty. `Internal Modules` lists modules inside the same overall feature using paths from that feature root, such as `shared/domain/runtime-status`; `External Modules` lists project modules outside the feature using paths from the web root without a `web/` prefix, such as `app/components/base/skeleton`. Omit npm packages, workspace package dependencies, and whitelisted plumbing modules. Do not copy caller-relative import paths into the README.
+- Module README whitelist: `@/service/client`, `@/next/*`.
+- Keep source/default selection, validation, dirty checks, and payload shaping close to the workflow that owns submit behavior. Do not hide flow-specific priority order, fallback behavior, or submit semantics in generic utilities.
+- Prefer direct conditionals for small branch-specific decisions, especially form source selection and request payload assembly.
+- Loading states for page sections, cards, lists, tables, forms, and drawers should be skeletons scoped to the content being loaded. Use spinners only for small inline busy indicators.
 
-## Tailwind CSS
+## Layout And Ownership
 
-- Write canonical Tailwind v4 classes; prefer canonical utilities over equivalent arbitrary values.
-- Common forms include `w-105` instead of `w-[420px]`, `px-2.25` instead of `px-[9px]`, `bg-linear-to-b` instead of `bg-gradient-to-b`, `wrap-break-word` instead of `break-words`, and `field-sizing-content` instead of `[field-sizing:content]`.
+- State-heavy wizards, drawers, modals, and secondary workflows can be a small feature surface: an entry file, one feature-local state file when Jotai is actually needed, and shallow `ui/` owners that match real visual regions.
+- The entry file handles route integration, provider wiring, close behavior, and surface mounting. The composition owner handles high-level workflow branching. The closest visual owner handles section branching.
+- When a page or tab maps to a route segment, name its feature folder after that route/tab surface instead of a stale parent grouping. Remove misleading intermediate folders when only one surface remains.
+- When a tab folder grows into several independent sections or action areas, split the first level by product/visual owners. Keep the root for the entry component and cross-owner state, colocate tests with the owner folder, and put truly shared local UI under a specifically named `components/` file.
+- Repeated TanStack query calls in sibling components are acceptable when each component independently consumes the data; TanStack Query deduplicates and shares cache.
+- Pass stable domain identity across boundaries. Do not forward derived presentation state when the receiver can derive it from its own data source.
+- A component that owns a visual surface should also own data access, loading, empty, and error states for content rendered inside it unless a parent truly coordinates that state.
+- Avoid prop drilling. One pass-through layer is acceptable; repeated forwarding means ownership should move down or into feature-scoped Jotai UI state. Keep server/cache state in Query and API flow.
+- Do not replace prop drilling with one large view-model hook threaded through section props. Move each hook, query, derived value, and handler to the concrete section that consumes it.
+- Keep callbacks in a parent only for workflow coordination such as form submission, shared selection, batch behavior, or navigation. Otherwise let the child, menu, or row own the action.
 
-[Public API authoring]: ../../../packages/dify-ui/docs/authoring.md
-[Styling]: ../../../packages/dify-ui/docs/styling.md
-[data]: references/data.md
-[interactions]: references/interactions.md
-[ownership]: references/ownership.md
-[runtime]: references/runtime.md
-[state]: references/state.md
+## Feature-Scoped Jotai
+
+- A Jotai-backed feature has one feature-local state file for shared primitive atoms, query atoms, derived atoms, write-only actions, mutation atoms, submission orchestration, provider exports, and optional scope configuration.
+- Keep component-owned synchronous UI state local even inside Jotai features: dialog open flags, menus/popovers, confirmations, field drafts, and selected local options usually belong in component state.
+- Use uncontrolled `@langgenius/dify-ui/form` and `@langgenius/dify-ui/field` controls for edit/create forms whose fields are read only at submit time. Initialize query-backed defaults with `defaultValue` and keyed remounts.
+- Promote form state to atoms only when another component must react to in-progress values, a draft must survive unmount/remount in the scoped workflow, or multiple steps share the same editable draft before submit.
+- Treat `useParams`, route args, and `nuqs` query state as framework-owned state. When atom logic needs those values, hydrate primitive atoms at the route or surface boundary, such as with `useHydrateAtoms(..., { dangerouslyForceHydrate: true })`; keep URL updates in the route/query-state APIs instead of write atoms.
+- Within a route-owned feature, choose one source for route identity. If route params are bridged into feature atoms, use that bridge consistently for route-derived queries and actions instead of also threading the same route id through page, tab, and section props.
+- For async work tied to atom state, use `atomWithQuery` or `atomWithMutation`; write atoms should update only the inputs that drive those atoms. This applies to pure frontend async work as well as network requests, so do not hand-roll loading/error/in-flight state with `useState` or `useRef` for atom-orchestrated async behavior. For component-owned remote work, use `useQuery` or `useMutation` directly.
+- `jotai-tanstack-query` query atoms do not support TanStack Query tracked properties. A component that reads `useAtomValue(queryAtom)` subscribes to the whole query result, even if it only accesses `data`, `isLoading`, or `isError`. Export field-specific derived atoms and have components read the exact fields they render; use `selectAtom(queryAtom, result => result.field)` for query-result fields so unchanged selections do not notify subscribers. Keep direct `useAtomValue(queryAtom)` only when the component or hook genuinely needs the full observer result.
+- Row-local async state belongs to the row owner unless it participates in a shared Jotai workflow or needs atom-scoped reset semantics.
+- Leave query and mutation atoms unscoped so they keep shared QueryClient cache and invalidation behavior. Scope resettable primitives and explicit hydration tuples; scope a derived atom only when every dependency should be private to that surface.
+- For scoped primitives that are always hydrated by `ScopeProvider`, prefer `atomWithLazy<T>(() => { throw new Error(...) })` when consumers should see a non-null type.
+- Order state files by dependency graph: types/constants, primitives, query atoms, query-data derived atoms, business/readiness derived atoms, write actions, mutation atoms, submission orchestration, provider exports.
+- Name derived atoms as business facts and write atoms as user or workflow commands. Components should read or write the exact atom they need with `useAtomValue` or `useSetAtom`.
+- Menu/dialog `open` state usually stays local, but a scoped atom is acceptable when a composed menu plus secondary surface would otherwise pass confusing `open`/`onClose` props through unrelated layers. Scope that primitive with the surface instance so reset behavior stays local.
+- Keep independent dialog lifecycles separate. Avoid one discriminated "current action dialog" atom when dialogs have separate open state, loading guards, or reset behavior.
+
+## Components, Props, And Types
+
+- Type component signatures directly; do not use `FC` or `React.FC`.
+- Prefer `function` for top-level components and module helpers. Use arrow functions for local callbacks, handlers, and lambda-style APIs.
+- Prefer named exports. Use default exports only where the framework requires them, such as Next.js route files.
+- Avoid barrel files that only re-export secondary owners. `index.tsx` is acceptable for a route/tab entry component; import header controls, switches, sections, and row owners from their concrete owner files.
+- Type simple one-off props inline. Use a named `Props` type only when reused, exported, complex, or clearer.
+- Use API-generated or API-returned types at component boundaries. Keep small UI conversion helpers and one-off UI extensions beside the component that needs them.
+- Preserve domain value types for selection components. Do not widen enum, union, boolean, numeric, object, or nullable select/radio values to `string`; keep wrappers and option value carriers typed from their feature option collection.
+- Avoid `common.tsx` buckets for shared UI. Use a feature-local `components/` folder with concrete filenames that describe the shared role.
+- Do not create type aliases that only rename another type. Use aliases only for real UI concepts, refinements, or reusable local contracts.
+- Name values by their domain role and backend API contract, especially persistent IDs and route params. Normalize framework or route params at the boundary.
+- Put fallback and invariant checks in the lowest component that already handles that state. Do not extract helpers whose only behavior is hiding missing display data.
+
+## Keyboard Shortcuts
+
+- Distinguish application commands from local keyboard semantics before choosing an API. Use `@tanstack/react-hotkeys` for application commands. Keep menu navigation, dialog Escape handling owned by a primitive, editor commands, and other widget-scoped ARIA interactions in their local component or primitive.
+- Use `useHotkey` or `useHotkeys` for registered commands. For a command intentionally owned by an existing `onKeyDown`, use `matchesKeyboardEvent` instead of hand-written `metaKey` / `ctrlKey` parsing or a second global listener.
+- Define a reusable string command with `satisfies Hotkey` and an object-form command with `satisfies RawHotkey`. Reserve `RegisterableHotkey` for API boundaries that intentionally accept either form. A one-time inline literal passed directly to TanStack is already type-checked; extract it when registration, display, metadata, or another production consumer needs the same source.
+- Keep registered hotkeys distinct from held keys and display-only accelerators. Use `IndividualKey` with `useKeyHold` for held-key interactions, and use an explicitly named `displayKey` for local widget accelerators that are not registered `Hotkey` values.
+- Keep registration and keycap/menu display derived from one canonical command. Do not maintain a hotkey string beside a separate `['Mod', ...]` display array.
+- Keep a single-owner command constant in its owning component. Create a feature-local `hotkeys.ts` only when multiple production files consume the same command. Keep a dedicated definitions/registry module when a feature owns a real command system with IDs, metadata, alternate bindings, and centralized registration. Tests do not count as another production owner, and file-name uniformity alone is not a reason to extract.
+- Make scope and availability explicit. Use `enabled` for business or surface lifecycle, `ignoreInputs` for whether input-like elements may trigger the command, and `target` when the command belongs to a concrete DOM subtree. Global application commands may use the document target; inline editors and composed overlays should prefer the actual editor or Base UI Popup ref when that owner is exposed.
+- Put a scoped ref on the real behavior owner. Do not add a wrapper DOM element solely to obtain a hotkey target. If a shared overlay convenience component hides the Popup ref, either rely on its modal lifecycle/focus boundary when that is sufficient or design the primitive API separately; do not create a fake owner at the call site.
+- Set `preventDefault` and `stopPropagation` according to the existing product behavior and browser interaction. Do not silently accept TanStack defaults when migrating from another listener if that changes typing, submission, or propagation semantics.
+- Test observable command behavior, disabled/input/target scope, and the shared registration/display contract at the owning feature boundary. Prefer partial mocks that retain TanStack formatting and matching behavior when a registration boundary must be isolated.
+
+## Generated API And Nullable Data
+
+- Treat generated contracts as authoritative at API, query, mutation, cache, and service boundaries. For enterprise APIs, use `packages/contracts/generated/enterprise/*`.
+- Do not hand-write DTO mirrors, widen generated fields/enums, or add parallel frontend enum/status layers unless they model product state not represented by the API.
+- Use generated enum objects and union types directly in props, comparisons, status logic, and i18n keys. Presentation-only tone maps should be keyed by generated enums.
+- Normalize or coerce only at real boundaries: user-entered forms, search, URL/query params, file names, DOM IDs, or legacy adapters.
+- Do not coerce nullable or optional API strings to `''` in query, derived model, or payload-building code. Keep `null` or `undefined` until the final boundary requiring a string.
+- Do not use `value || undefined` for mutation fields where `''` means "clear this value". Trim or normalize at the form boundary, then preserve intentional empty strings.
+- Prefer nullable-tolerant render props for API-returned rows. Narrow only where a real value is required, such as mutation params, route hrefs, select values, query input, or required React keys.
+- Build required values in the same branch that proves them, using `flatMap`, a local loop, or an early return. Avoid truthiness guards, `filter(Boolean)`, `filter(item => item.id)`, and `!` after filters.
+- Use conditional spreads or explicit pushes for conditional array items instead of `undefined` placeholders followed by narrowing filters.
+- Empty collection fallbacks are for not-yet-loaded query data or genuinely nullable collections at the owning render boundary, not for hiding required API fields.
+
+## Queries And Mutations
+
+- Keep `web/contract/*` as the API shape source of truth and follow the `{ params, query?, body? }` input shape.
+- Consume generated queries with `useQuery(consoleQuery.xxx.queryOptions(...))` or `useQuery(marketplaceQuery.xxx.queryOptions(...))`.
+- If a generated query input comes from an atom, including a route-identity bridge atom, keep the query in `atomWithQuery`; do not unwrap the atom in a component just to call `useQuery`.
+- Consume owner-local mutations with `useMutation(consoleQuery.xxx.mutationOptions(...))` or `useMutation(marketplaceQuery.xxx.mutationOptions(...))` when pending/error state is not consumed by feature atoms.
+- In `atomWithQuery`, `atomWithInfiniteQuery`, and `atomWithMutation`, return generated `queryOptions()`, `infiniteOptions()`, or `mutationOptions()` directly. Pass `enabled`, `retry`, `placeholderData`, `select`, and pagination options into the generated call instead of spreading options into a hand-built object.
+- For generated oRPC options with missing required input, branch the whole input with `input: condition ? validInput : skipToken` and `enabled: Boolean(condition)`. Never place `skipToken` inside a nested placeholder payload or coerce required IDs to `''`.
+- When prefetch and render use the same request, extract local query options or a query-options atom so `prefetchQuery` and `useQuery`/`atomWithQuery` share the exact options.
+- For custom query or mutation functions, wrap options with TanStack `queryOptions(...)` or `mutationOptions(...)`.
+- Do not extract generated `queryOptions(...)` into a helper solely to share input construction; extract only when prefetch/render must share exact options or the helper owns real domain behavior.
+- Avoid pass-through hooks and thin `web/service/use-*` wrappers that only rename generated options. Keep feature hooks for real orchestration, workflow state, or shared domain behavior.
+- Put shared cache behavior in `createTanstackQueryUtils(...experimental_defaults...)`. Component or atom callbacks may handle local toasts, closing dialogs, and navigation, but should not replace shared invalidation or patch shared server state locally.
+- For overlays that may open heavier secondary content, prefetch from the trigger/menu open event with `queryClient.prefetchQuery(queryOptions)` when `onOpenChange` is available. Do not mount hidden subscribers just to warm cache.
+- Do not use deprecated `useInvalid` or `useReset`.
+- Prefer `mutate(...)`; use `mutateAsync(...)` only when Promise semantics are required, and wrap awaited calls in `try/catch`.
+
+## Boundaries And Overlays
+
+- Use the first level below a page or tab to organize independent page sections when it adds structure or the root folder becomes noisy. This layer is layout/semantic first, not automatically the data owner.
+- Treat component names, semantic roles, and user- or design-marked visual regions as boundary constraints. Keep adjacent UI as a sibling owner or introduce a correctly named broader owner.
+- Keep cohesive forms, menu bodies, and one-off helpers local unless they need their own state, reuse, or semantic boundary.
+- Separate hidden secondary surfaces from the trigger's main flow. For dialogs, dropdowns, popovers, and similar branches, extract a small local component when hidden content would obscure the parent.
+- Preserve composability by separating behavior ownership from placement ownership: an action can own trigger/open/menu content while the caller owns slots, offsets, and alignment.
+- When a dialog, dropdown, or popover accepts controlled `open`, mount it unconditionally unless unmounting is required for performance or reset semantics. Use keyed scope or local state reset instead of `{open && <Surface />}` wrappers.
+- When opening a dialog from a menu item, keep the menu and dialog as sibling surfaces. Let the menu command open the dialog, and mount the dialog outside menu popup content.
+- For dialogs and alert dialogs, keep the root responsible for `open` wiring and put query/mutation hooks inside the content component when work should mount only after the overlay opens.
+- Prefer uncontrolled overlay roots when the library can own open state. Use `onOpenChange` for side effects and CSS/data selectors for open-state styling.
+- Avoid wrapper DOM unless it provides layout, semantics, accessibility, state ownership, or library integration. Avoid shallow wrappers, hook-to-props adapters, layout-only render props, children pass-through wrappers, and prop renaming unless they add real behavior or a real boundary.
+
+## Effects, Navigation, And Performance
+
+- Use Effects only to synchronize with external systems. Do not use Effects to transform props/state for rendering, handle user actions, copy state, reset state from props, or fetch data.
+- For forms initialized from query data, prefer keyed remounts or surface-entry atom hydration over Effects that copy query data into form state.
+- Prefer framework data APIs or TanStack Query for data fetching.
+- Prefer `Link` for normal navigation. Use router APIs only for command-flow side effects such as mutation success, guarded redirects, or form submission.
+- Before using `memo`, move changing state down to the smallest component that uses it. If state must wrap stable content, lift the stable content up and pass it as `children`.
+- Avoid `memo`, `useMemo`, and `useCallback` unless there is a clear performance reason.

.agents/skills/how-to-write-component/references/data.md

@@ -1,58 +0,0 @@
-# Component Data And Queries
-
-Read this document when a component consumes generated contracts, nullable API values, TanStack Query, mutations, prefetching, authentication, or workspace state.
-
-## Generated Contracts
-
-- Treat generated contracts as authoritative at API, query, mutation, cache, and service boundaries. Enterprise APIs use `packages/contracts/generated/enterprise/*`.
-- Backend Pydantic and OpenAPI schemas own API shape. Follow the generated `{ params, query?, body? }` input shape; when it is wrong, fix the backend schema and regenerate `packages/contracts/generated/*`.
-- Do not hand-write DTO mirrors, widen generated fields or enums, edit generated output, or add a parallel frontend status layer unless it models product state absent from the API.
-- Check deprecated markers, schema shape, and the actual consumer before assuming that a generated operation is ready to use.
-- When a ready generated operation exists for the changed call, migrate deprecated operations and remove the replaced layer instead of adding compatibility wrappers.
-- Normalize only at real boundaries such as user input, search, URL params, filenames, DOM IDs, or a required legacy adapter.
-- Preserve `null`, `undefined`, and intentional empty strings until the final boundary. Do not use `value || undefined` when an empty string means clearing a field.
-- Build required values in the branch that proves them. Do not use truthiness filters, non-null assertions, or placeholders to conceal missing required input or discard valid `0`, `false`, or empty-string values.
-
-## Queries
-
-- Use generated options directly with `useQuery(consoleQuery.xxx.queryOptions(...))`, `marketplaceQuery`, or the equivalent generated client.
-- If query input comes from atom state, keep it in `atomWithQuery`; do not unwrap the atom in a component solely to call `useQuery`.
-- For missing required input, branch the whole generated input with `skipToken`. Add `enabled` only for an independent execution condition; do not put `skipToken` inside a placeholder payload or coerce IDs to empty strings.
-- Return generated `queryOptions()`, `infiniteOptions()`, or `mutationOptions()` directly from TanStack Query atoms. Pass supported options into the generated call instead of spreading into a parallel object.
-- For the same logical request, preserve key, input, operation, and result contracts. Reuse exact options only when
-  transport, context, and cache policy are shared; imperative and observer freshness may differ. Do not extract a helper
-  merely to reuse input construction.
-- Avoid pass-through service hooks that only rename generated options. Keep feature hooks for actual orchestration or shared domain behavior.
-
-## Mutations And Cache
-
-- Use generated `mutationOptions()` directly for owner-local mutations.
-- Do not introduce deprecated `useInvalid` or `useReset` APIs.
-- Put shared invalidation, retries, and cache behavior in `createTanstackQueryUtils(...experimental_defaults...)`. In oRPC v1, caller options override defaults, including callbacks. Local callbacks may own toast, close, and navigation effects but must preserve shared cache behavior.
-- Prefer `mutate(...)`. Use `mutateAsync(...)` only when Promise composition is required, and catch awaited failures.
-- Preserve intentional empty values and current list/detail ownership when updating data. Do not add optimistic updates without a verified owner contract.
-
-## Prefetch And Hidden Surfaces
-
-- Prefetch expensive secondary content from the trigger or menu-open event when it benefits the visible path. Do not mount hidden subscribers solely to warm the cache.
-- Use `query` or `infiniteQuery` for imperative access. `staleTime` defines cache acceptance; `select` projects the return
-  value without replacing cached query-function data. Imperative queries default to no retries when `retry` is not
-  configured, and observer-only `enabled` does not prevent an imperative call.
-- Migrate deprecated `fetchQuery`, `prefetchQuery`, `ensureQueryData`, and their infinite variants when the current `query` or `infiniteQuery` contract applies. A `staleTime` of `0` treats data as stale; a finite value accepts that freshness window; `Infinity` accepts data until invalidation; `'static'` accepts available data even after invalidation.
-- `await` blocks, `return` transfers the Promise, and `void` discards its value without handling rejection. Handle
-  rejection before discarding a potentially rejecting Promise; use `.catch(noop)` only for intentional silence or
-  feedback owned elsewhere. Hard server gates await the query and preserve rejection.
-
-## SSR, Authentication, And Workspace
-
-- Static configuration owns path-invariant routing. Request-dependent authentication, setup, role, and tenant decisions belong to SSR or runtime decision boundaries.
-- Distinguish soft SSR cache warming from authoritative decisions. Prefetched or placeholder data must not grant access or represent successful availability.
-- Treat Server Components as query prefetch-and-dehydrate owners by default. Do not render or pass an imperative query
-  result when a browser observer can revalidate the same data unless ownership and freshness explicitly prevent drift.
-- Non-blocking RSC streaming requires pending-query dehydration without redacting Next.js server errors, a
-  `HydrationBoundary` around the same-key client consumer, and Suspense when that content must be server-rendered.
-- Never reuse tenant-scoped state after switching workspaces. Discard it at the switch boundary or isolate it by workspace identity.
-- Trace the current switch flow before choosing cache handling: server switch plus full reload is a tenant boundary, not ordinary CRUD invalidation. Include workspace identity in varying query keys when no full-reload boundary applies, and trace the backend contract before interchanging `workspace_id` and `tenant_id`.
-- Do not make product or authorization decisions from bootstrap defaults. Wait for authoritative data, or render an explicit loading or error state.
-- Preserve an existing client fallback until server API-unavailable behavior has an explicit owner.
-- Keep loading and Suspense behavior inside the feature that owns the request. Do not add fake global data merely to bypass that boundary.

.agents/skills/how-to-write-component/references/interactions.md

@@ -1,27 +0,0 @@
-# Component Interactions And Overlays
-
-Read this document when a change involves application hotkeys, focus, dialogs, menus, popovers, or other secondary surfaces. Overlay primitive selection and layering are owned by the [overlay contract].
-
-## Focus And Semantics
-
-- Preserve a visible focus indicator on the final focusable element. Styled Dify UI controls usually provide it; headless anatomy parts and direct trigger exports may not.
-- Native buttons, links, custom trigger renderers, clickable rows, icon controls, and menu-like items must retain their correct native semantics and accessible name.
-- Do not hide an outline without an equivalent visible `focus-visible` treatment. Follow an existing Dify UI pattern rather than inventing a call-site style.
-
-## Keyboard Commands
-
-- Keep widget navigation, dialog dismissal, and editor commands in their local primitive or owner.
-- For Web application commands, follow [Keyboard commands] for TanStack registration, typed bindings, targets, event consumption, display, and verification. Do not recreate that policy in a wrapper or a second command framework.
-
-## Secondary Surfaces
-
-- Follow the [overlay contract] for primitive choice and shared mechanics. The nearest consumer `AGENTS.md` owns application-specific composite reuse policy.
-- Separate behavior ownership from placement ownership: the action may own trigger, open state, and menu content while the caller owns slots, offsets, and alignment.
-- Keep menu and dialog surfaces as siblings when a menu command opens a dialog. Mount the dialog outside popup content.
-- Use the [overlay contract] to determine content lifetime and preserve the Root's closing lifecycle. Follow [state ownership] for draft placement and semantic identity; portal placement alone does not locate the state owner.
-- Place query subscriptions and mutation observers at the owner whose lifetime matches when they should run. Mounted-session work may belong inside content; work that must start or stop exactly with `open` needs an explicit open-state condition.
-- Prefer primitive-owned open state unless another owner must observe or coordinate it. Analytics callbacks and local cleanup alone do not require a controlled root.
-
-[overlay contract]: ../../../../packages/dify-ui/docs/overlays.md
-[Keyboard commands]: ../../../../web/docs/hotkeys.md
-[state ownership]: state.md

.agents/skills/how-to-write-component/references/ownership.md

@@ -1,45 +0,0 @@
-# Component Ownership And Modules
-
-Read this document when adding, moving, splitting, or refactoring React components or feature modules.
-
-## Vertical Modules
-
-- Organize code by product workflow, route, or behavior owner. Keep components, hooks, local types, atoms, query helpers, tests, and small utilities beside the code that changes with them.
-- Name page and tab folders after the current route, tab, or user-visible surface. Do not preserve stale parent groupings that no longer own multiple surfaces.
-- Split a growing page or tab by product or visual owners. Keep the feature root for its public entrypoint and genuinely cross-owner coordination.
-- Import other features only through explicit public entrypoints. Avoid barrels that merely re-export secondary owners.
-- Promote code outside a feature only when multiple verticals use the same stable contract. Possible future reuse is not sufficient.
-
-## Component Ownership
-
-- Put state, data access, loading, empty, error, and handlers in the lowest owner that uses them and whose mounted lifetime matches the required persistence.
-- Keep coordination in a parent only when it needs one consistent snapshot, the value must intentionally survive the local owner's unmount, or the parent coordinates submission, shared selection, batch behavior, navigation, or cross-section loading and errors.
-- Repeated TanStack Query hooks for the same key and input in Client Component siblings under one QueryClient are
-  acceptable; shared cache is not a reason to hoist. Separate Server Component QueryClients do not share it, so
-  request-level deduplication needs an identified request-local cache or verified framework or transport owner.
-- Pass stable domain identity across boundaries. Do not pass raw server data together with separately derived flags for the same concept.
-- Revisit prop forwarding when intermediate components obscure the behavior owner; keep clear data flow rather than introducing shared state merely to avoid passing props.
-- Do not replace prop drilling with one large view-model hook. Move each query, derived value, and handler to the concrete owner that consumes it.
-- Keep source selection, defaults, validation, dirty checks, and payload shaping beside the workflow that owns submission.
-
-## Boundaries
-
-- Prefer reusing or extending the component that already owns an interaction over rebuilding that behavior in a parallel component.
-- State-heavy wizards, drawers, modals, and secondary workflows can form a small vertical surface with an entrypoint, optional feature-local state, and shallow owners matching real visual regions.
-- The entrypoint owns route integration, provider wiring, placement, and open-state coordination. A content or session owner keeps state scoped to that mounted surface.
-- Judge hook lifetime by the component that declares the hook and the primitive's mount contract, not only by where its rendered controls appear in JSX.
-- Separate hidden dialogs, dropdowns, and popovers into small local owners when their content obscures the parent flow.
-- Keep cohesive forms, menu bodies, and one-off helpers local unless they have their own state, reuse, or semantic boundary.
-- Extract components or hooks when they clarify ownership or hide a cohesive implementation; keep logic local when extraction only shortens the file or relocates the same coordination.
-- Avoid wrapper components and wrapper DOM that only rename props, pass children through, or hide the real primitive. A wrapper must own behavior, validation, state, accessibility, layout, or library integration.
-- Keep feature workflows out of shared components: do not encode one feature through many boolean props or import its copy, routes, and API contracts into a generic component. Do not pass pre-rendered fragments merely to avoid assigning the behavior to its owner.
-- Loading states for page sections, cards, lists, tables, forms, and drawers should use skeletons scoped to the loaded content. Reserve spinners for small inline busy indicators.
-
-## Components And Types
-
-- Choose component declaration and export forms from the actual component contract, framework requirements, and enforced package rules. Existing style is context, not authority; do not rewrite unaffected code solely to normalize `FC`, `function`, arrow-function, named-export, or default-export forms.
-- Use API-generated or API-returned types at component boundaries. Keep one-off UI refinements and conversions beside their owner.
-- Name props and converted data after their domain/API role, preserving traceability to the original contract.
-- Preserve domain value types for selections. Do not widen enums, unions, booleans, numbers, objects, or nullable values to `string` before a real boundary requires it.
-- Avoid generic `common.tsx` buckets and aliases that only rename another type. Name files, values, and public types after their domain role.
-- Put fallback and invariant checks in the lowest component that already renders that state. Do not extract helpers whose only purpose is hiding missing display data.

.agents/skills/how-to-write-component/references/runtime.md

@@ -1,24 +0,0 @@
-# Component Effects, Navigation, And Runtime Cost
-
-Read this document when a change introduces Effects, navigation side effects, memoization, preloading, or render-cost optimizations.
-
-## Effects
-
-- Keep render pure: do not read or write `ref.current` during render except for predictable null-guarded lazy initialization. Update interaction-owned refs in event handlers, synchronize external-system refs after commit, and use state or derivation for rendered values.
-- Use Effects only to synchronize with a named external system such as a browser API, subscription, timer, analytics integration, non-React widget, or imperative DOM API.
-- Do not use Effects to transform render state, handle user actions, copy query data, reset state from props, or fetch data owned by framework APIs or TanStack Query.
-- Initialize query-backed form sessions after their defaults are available instead of copying data through Effects. Use a stable semantic identity key when the represented identity changes; use the intended surface lifecycle for per-session reset.
-
-## Navigation
-
-- Use `Link` for ordinary navigation.
-- Use router APIs for command-flow side effects such as mutation success, guarded redirects, or form submission.
-- Keep shareable navigation state in the URL rather than hidden component state.
-
-## Runtime Cost
-
-- Move changing state to the smallest consumer before considering memoization. Stable parent content can be lifted and passed as children.
-- Avoid `memo`, `useMemo`, and `useCallback` unless identity or computation has a demonstrated consumer or measurable cost.
-- Start independent remote work together and await it near the branch that consumes it. Avoid introducing request waterfalls.
-- Load heavy optional surfaces on demand when they sit behind a dialog, tab, command, or feature activation.
-- Use narrow selectors or field-level atoms for broad stores and subscriptions. Do not optimize simple primitive expressions merely for stylistic consistency.

.agents/skills/how-to-write-component/references/state.md

@@ -1,44 +0,0 @@
-# Component State And URL Ownership
-
-Read this document when a change involves Jotai, form drafts, route identity, shared client state, or local persistence.
-
-## Choose The Owner
-
-- Keep synchronous state local when one component owns it: dialog and menu state, confirmations, field drafts, and local selections usually belong to the component or DOM.
-- Use feature-scoped Jotai when siblings need one source of truth, values drive other atoms, or a scoped workflow must preserve state across hidden or unmounted steps.
-- Keep server and cache state in TanStack Query. Use existing feature stores for complex, high-frequency interaction state such as workflow canvas drag, resize, and runtime panels.
-- Use feature-owned storage only for low-frequency client preferences, dismissed notices, and UI defaults. Live application state does not belong in local storage.
-
-## Forms And Sessions
-
-- Follow the [form contract] for field controlledness and the [overlay contract] for Root/content mounting and state lifetime. These primitive contracts also apply when reviewing a consumer.
-- Choose the Web draft owner from the required lifetime. Keep mounted-session drafts in the content owner; start with the lowest shared React owner when another component needs the draft or it must survive unmounting. Use feature-scoped atoms only when their coordination or persistence contract is needed.
-- For query-backed defaults, establish the form session after the required defaults are available. `defaultValue` initializes the current mount; a stable semantic identity key may create a fresh snapshot when the represented identity changes. Do not use a generated key as a routine reset command.
-- Keep validation, source priority, fallback behavior, dirty checks, and payload assembly in the workflow that owns submission.
-- Derive booleans, disabled flags, default tabs, and loading labels from current state. Do not mirror one value into competing prop, default, and local sources; controlled state alone is not a competing-source defect.
-- Do not use local state to fake server data or generated contract fields, or connect a feature mock shell to an unrelated API before its actual contract is confirmed.
-
-## Route And URL State
-
-- Treat `useParams`, route arguments, and `nuqs` as the owners of URL identity and updates.
-- Hydrate a primitive atom at the route or surface boundary only when query atoms or shared derived atoms require route identity. Keep URL writes in route and query-state APIs.
-- Within one route-owned feature, choose one route-identity source. Do not hydrate route identity into atoms while also threading the same ID through multiple component layers.
-- Put shareable filters, tabs, selected panels, pagination, and search state in the URL. Keep one-shot navigation signals and transient UI state out of persistent subscriptions.
-
-## Jotai And Query
-
-- A Jotai-backed feature may keep one feature-local state module ordered by dependency: types and constants, primitives, query atoms, query-data derivations, business facts, commands, mutations, submission orchestration, and provider exports.
-- Use `atomWithQuery` or `atomWithMutation` for async work driven by atom state. Do not hand-roll loading, error, or in-flight state for atom-orchestrated work.
-- Use field-specific derived atoms for query results. `jotai-tanstack-query` does not provide TanStack Query tracked properties, so reading a whole query atom subscribes to the entire observer result.
-- Leave query and mutation atoms unscoped so they retain the shared QueryClient cache. Scope resettable primitives and hydration tuples; scope a derived atom only when all dependencies should be private to the surface.
-- Use non-null lazy primitives for values always hydrated by a scope provider. Name derived atoms as business facts and write atoms as user or workflow commands.
-- Keep independent dialog lifecycles separate. A scoped open-state atom is acceptable only when composed sibling surfaces would otherwise pass confusing lifecycle props through unrelated owners.
-
-## Persistence
-
-- Use feature-owned storage modules built on `createLocalStorageState`; callers should not scatter direct storage access or raw keys.
-- Persist high-frequency interaction state only on commit or after updates settle.
-- Do not add ad hoc global event listeners for shared state. Centralize subscriptions through the owning atom, store, or subscription hook.
-
-[form contract]: ../../../../packages/dify-ui/docs/forms.md
-[overlay contract]: ../../../../packages/dify-ui/docs/overlays.md

.agents/skills/karpathy-guidelines/SKILL.md

@@ -0,0 +1,33 @@
+---
+name: karpathy-guidelines
+description: Lightweight coding guardrails for making focused, simple, and verifiable changes in this repo. Use for all coding work.
+---
+
+# Karpathy Guidelines
+
+Use this skill whenever you touch code in this repository.
+
+## Principles
+
+- Keep the change small and directly tied to the user request.
+- Prefer the simplest implementation that fits the existing codebase.
+- Read the nearby code first, then match its patterns.
+- Avoid unrelated refactors, broad rewrites, or style churn.
+- Preserve existing behavior unless the user explicitly asked to change it.
+- Treat regressions as a signal to narrow the change, not to add workaround layers.
+
+## Workflow
+
+1. Inspect the current implementation and tests around the change.
+2. Make the smallest coherent edit.
+3. Add or update focused tests when the behavior changes or the risk is non-trivial.
+4. Run the narrowest relevant verification first.
+5. Report exactly what was verified and anything left unverified.
+
+## Review Checklist
+
+- Does this change solve the stated problem without expanding scope?
+- Did it preserve existing route/component/data-flow semantics?
+- Are new abstractions justified by real complexity?
+- Are tests focused on the behavior that could regress?
+- Are unrelated files and generated artifacts left alone?

.claude/skills/component-refactoring

@@ -0,0 +1 @@
+../../.agents/skills/component-refactoring

.claude/skills/karpathy-guidelines

@@ -0,0 +1 @@
+../../.agents/skills/karpathy-guidelines

.devcontainer/devcontainer.json

@@ -12,7 +12,7 @@
 	"features": {
 		"ghcr.io/devcontainers/features/node:1": {
 			"nodeGypDependencies": true,
-			"version": "24.20.0"
+			"version": "lts"
 		},
 		"ghcr.io/devcontainers-extra/features/npm-package:1": {
 			"package": "typescript",
@@ -46,4 +46,4 @@
 	// Configure tool-specific properties.
 	// "customizations": {},
 	// Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root.
-}
+}

.editorconfig

@@ -37,7 +37,3 @@ indent_size = 2
 [package.json]
 indent_style = space
 indent_size = 2
-
-# Oxlint writes its generated suppression baseline without a final newline.
-[oxlint-suppressions.json]
-insert_final_newline = false

.gemini/config.yaml

@@ -0,0 +1,13 @@
+have_fun: false
+memory_config:
+  disabled: false
+code_review:
+  disable: true
+  comment_severity_threshold: MEDIUM
+  max_review_comments: -1
+  pull_request_opened:
+    help: false
+    summary: false
+    code_review: false
+    include_drafts: false
+ignore_patterns: []

.gitattributes

@@ -9,6 +9,3 @@
 # Codegen output must stay byte-identical across platforms so
 # `pnpm tree:check` in CI does not trip on CRLF rewrites.
 *.generated.ts  text eol=lf
-
-# Skill scripts run on every platform, so keep LF line endings.
-/skills/**      text=auto eol=lf

.github/CODEOWNERS

@@ -26,34 +26,14 @@
 /cli/ @GareArc
 /.github/workflows/cli-tests.yml @GareArc
 
-# Dify Agent
-/dify-agent/ @BeautyyuYanli
-
 # E2E
 /e2e/ @lyzno1
-/.github/workflows/web-e2e.yml @lyzno1
 
 # Backend (default owner, more specific rules below will override)
 /api/ @QuantumGhost
 
-# Backend - Tests (default owners, domain-specific rules below will override)
+# Backend - Tests
 /api/tests/ @laipz8200 @QuantumGhost
-/api/tests/*/core/rag/ @JohnJyong
-/api/tests/*/services/rag_pipeline/ @JohnJyong
-/api/tests/*/services/dataset_service/ @JohnJyong
-/api/tests/*/controllers/console/datasets/ @JohnJyong
-/api/tests/*/controllers/service_api/dataset/ @JohnJyong
-/api/tests/*/vdb/ @JohnJyong
-/api/tests/*/core/plugin/ @WH-2099
-/api/tests/*/services/plugin/ @WH-2099
-/api/tests/*/controllers/inner_api/plugin/ @WH-2099
-/api/tests/*/plugin/ @WH-2099
-/api/tests/*/controllers/trigger/ @CourTeous33
-/api/tests/*/core/trigger/ @CourTeous33
-/api/tests/*/trigger/ @CourTeous33
-/api/tests/*/controllers/console/billing/ @zyssyz123
-/api/tests/*/services/enterprise/ @GareArc
-/api/tests/*/migrations/ @snakevash @laipz8200 @MRZHUH
 
 # Backend - RAG (Retrieval Augmented Generation)
 /api/core/rag/ @JohnJyong
@@ -128,8 +108,8 @@
 /api/tasks/async_workflow_tasks.py @Mairuis
 
 # Backend - Billing
-/api/services/billing_service.py @zyssyz123
-/api/controllers/console/billing/ @zyssyz123
+/api/services/billing_service.py @hj24 @zyssyz123
+/api/controllers/console/billing/ @hj24 @zyssyz123
 
 # Backend - Enterprise
 /api/configs/enterprise/ @GareArc
@@ -147,12 +127,6 @@
 # Frontend
 /web/ @iamjoel
 
-# Frontend - Tooling
-/lint.config.ts @hyoban @lyzno1
-/eslint.config.mjs @hyoban @lyzno1
-/knip.config.ts @hyoban @lyzno1
-/vite.config.ts @hyoban @lyzno1
-
 # Frontend - Platform and Features
 /web/config/ @lyzno1
 /web/env.ts @lyzno1
@@ -271,31 +245,10 @@
 
 # Frontend - Billing and Education
 /web/app/components/billing/ @iamjoel @zxhlyh
-/web/app/education/ @iamjoel @zxhlyh
+/web/app/education-apply/ @iamjoel @zxhlyh
 
 # Frontend - Workspace
 /web/app/components/header/account-dropdown/workplace-selector/ @iamjoel @zxhlyh
 
-# Frontend - App Shell and Console Bootstrap
-/web/app/layout.tsx @iamjoel @lyzno1
-/web/app/error.tsx @iamjoel @lyzno1
-/web/app/(commonLayout)/layout.tsx @iamjoel @lyzno1
-/web/app/(commonLayout)/providers.tsx @iamjoel @lyzno1
-/web/app/(commonLayout)/hydration-boundary.tsx @iamjoel @lyzno1
-/web/app/(commonLayout)/profile-bootstrap-gate.tsx @iamjoel @lyzno1
-/web/app/(commonLayout)/error.tsx @iamjoel @lyzno1
-/web/app/account/(commonLayout)/layout.tsx @iamjoel @lyzno1
-/web/app/components/main-nav/* @iamjoel @lyzno1
-/web/app/components/main-nav/components/* @iamjoel @lyzno1
-/web/context/query-client.tsx @iamjoel @lyzno1
-/web/context/query-client-server.ts @iamjoel @lyzno1
-/web/proxy.ts @iamjoel @lyzno1
-/web/app/auth/refresh/route.ts @iamjoel @lyzno1
-/web/service/server.ts @iamjoel @lyzno1
-
-# Frontend - Browser Mode Tests
-/web/app/**/*.browser.spec.ts @lyzno1
-/web/app/**/*.browser.spec.tsx @lyzno1
-
 # Docker
 /docker/* @laipz8200

.github/DISCUSSION_TEMPLATE/general.yml

@@ -1,17 +1,17 @@
-title: 'General Discussion'
+title: "General Discussion"
 body:
   - type: checkboxes
     attributes:
       label: Self Checks
-      description: 'To make sure we get to you in time, please check the following :)'
+      description: "To make sure we get to you in time, please check the following :)"
       options:
         - label: I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones.
           required: true
         - label: I confirm that I am using English to submit this report (我已阅读并同意 [Language Policy](https://github.com/langgenius/dify/issues/1542)).
           required: true
-        - label: '[FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:)'
+        - label: "[FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:)"
           required: true
-        - label: 'Please do not modify this template :) and fill in all the required fields.'
+        - label: "Please do not modify this template :) and fill in all the required fields."
           required: true
   - type: textarea
     attributes:

.github/DISCUSSION_TEMPLATE/help.yml

@@ -1,17 +1,17 @@
-title: 'Help'
+title: "Help"
 body:
   - type: checkboxes
     attributes:
       label: Self Checks
-      description: 'To make sure we get to you in time, please check the following :)'
+      description: "To make sure we get to you in time, please check the following :)"
       options:
         - label: I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones.
           required: true
         - label: I confirm that I am using English to submit this report (我已阅读并同意 [Language Policy](https://github.com/langgenius/dify/issues/1542)).
           required: true
-        - label: '[FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:)'
+        - label: "[FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:)"
           required: true
-        - label: 'Please do not modify this template :) and fill in all the required fields.'
+        - label: "Please do not modify this template :) and fill in all the required fields."
           required: true
   - type: textarea
     attributes:

.github/DISCUSSION_TEMPLATE/suggestion.yml

@@ -3,15 +3,15 @@ body:
   - type: checkboxes
     attributes:
       label: Self Checks
-      description: 'To make sure we get to you in time, please check the following :)'
+      description: "To make sure we get to you in time, please check the following :)"
       options:
         - label: I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones.
           required: true
         - label: I confirm that I am using English to submit this report (我已阅读并同意 [Language Policy](https://github.com/langgenius/dify/issues/1542)).
           required: true
-        - label: '[FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:)'
+        - label: "[FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:)"
           required: true
-        - label: 'Please do not modify this template :) and fill in all the required fields.'
+        - label: "Please do not modify this template :) and fill in all the required fields."
           required: true
   - type: textarea
     attributes:

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,12 +1,12 @@
-name: '🕷️ Bug report'
+name: "🕷️ Bug report"
 description: Report errors or unexpected behavior
 labels:
-  - 🐞 bug
+  - bug
 body:
   - type: checkboxes
     attributes:
       label: Self Checks
-      description: 'To make sure we get to you in time, please check the following :)'
+      description: "To make sure we get to you in time, please check the following :)"
       options:
         - label: I have read the [Contributing Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) and [Language Policy](https://github.com/langgenius/dify/issues/1542).
           required: true
@@ -18,7 +18,7 @@ body:
           required: true
         - label: 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
           required: true
-        - label: 'Please do not modify this template :) and fill in all the required fields.'
+        - label: "Please do not modify this template :) and fill in all the required fields."
           required: true
 
   - type: input

.github/ISSUE_TEMPLATE/config.yml

@@ -1,13 +1,13 @@
 blank_issues_enabled: false
 contact_links:
   - name: "\U0001F510 Security Vulnerabilities"
-    url: 'https://github.com/langgenius/dify/security/advisories/new'
+    url: "https://github.com/langgenius/dify/security/advisories/new"
     about: Report security vulnerabilities through GitHub Security Advisories to ensure responsible disclosure. 💡 Please do not report security vulnerabilities in public issues.
   - name: "\U0001F4A1 Model Providers & Plugins"
-    url: 'https://github.com/langgenius/dify-official-plugins/issues/new/choose'
+    url: "https://github.com/langgenius/dify-official-plugins/issues/new/choose"
     about: Report issues with official plugins or model providers, you will need to provide the plugin version and other relevant details.
   - name: "\U0001F4AC Documentation Issues"
-    url: 'https://github.com/langgenius/dify-docs/issues/new'
+    url: "https://github.com/langgenius/dify-docs/issues/new"
     about: Report issues with the documentation, such as typos, outdated information, or missing content. Please provide the specific section and details of the issue.
   - name: "\U0001F4E7 Discussions"
     url: https://github.com/langgenius/dify/discussions/categories/general

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,12 +1,12 @@
-name: '⭐ Feature or enhancement request'
+name: "⭐ Feature or enhancement request"
 description: Propose something new.
 labels:
-  - 💪 enhancement
+  - enhancement
 body:
   - type: checkboxes
     attributes:
       label: Self Checks
-      description: 'To make sure we get to you in time, please check the following :)'
+      description: "To make sure we get to you in time, please check the following :)"
       options:
         - label: I have read the [Contributing Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) and [Language Policy](https://github.com/langgenius/dify/issues/1542).
           required: true
@@ -14,7 +14,7 @@ body:
           required: true
         - label: I confirm that I am using English to submit this report, otherwise it will be closed.
           required: true
-        - label: 'Please do not modify this template :) and fill in all the required fields.'
+        - label: "Please do not modify this template :) and fill in all the required fields."
           required: true
   - type: textarea
     attributes:

.github/ISSUE_TEMPLATE/refactor.yml

@@ -1,11 +1,11 @@
-name: '✨ Refactor or Chore'
+name: "✨ Refactor or Chore"
 description: Refactor existing code or perform maintenance chores to improve readability and reliability.
-title: '[Refactor/Chore] '
+title: "[Refactor/Chore] "
 body:
   - type: checkboxes
     attributes:
       label: Self Checks
-      description: 'To make sure we get to you in time, please check the following :)'
+      description: "To make sure we get to you in time, please check the following :)"
       options:
         - label: I have read the [Contributing Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) and [Language Policy](https://github.com/langgenius/dify/issues/1542).
           required: true
@@ -17,26 +17,26 @@ body:
           required: true
         - label: 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
           required: true
-        - label: 'Please do not modify this template :) and fill in all the required fields.'
+        - label: "Please do not modify this template :) and fill in all the required fields."
           required: true
   - type: textarea
     id: description
     attributes:
       label: Description
-      placeholder: 'Describe the refactor or chore you are proposing.'
+      placeholder: "Describe the refactor or chore you are proposing."
     validations:
       required: true
   - type: textarea
     id: motivation
     attributes:
       label: Motivation
-      placeholder: 'Explain why this refactor or chore is necessary.'
+      placeholder: "Explain why this refactor or chore is necessary."
     validations:
       required: false
   - type: textarea
     id: additional-context
     attributes:
       label: Additional Context
-      placeholder: 'Add any other context or screenshots about the request here.'
+      placeholder: "Add any other context or screenshots about the request here."
     validations:
       required: false

.github/actions/setup-core-e2e/action.yml

@@ -1,29 +0,0 @@
-name: Setup Core E2E Dependencies
-description: Install API dependencies alongside web dependencies and the selected browser
-
-inputs:
-  browser:
-    description: Browser to install (chromium or webkit)
-    required: true
-
-runs:
-  using: composite
-  steps:
-    - name: Setup web toolchain
-      uses: ./.github/actions/setup-web
-      with:
-        run-install: 'false'
-
-    - name: Setup UV and Python
-      uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
-      with:
-        enable-cache: true
-        python-version: '3.12'
-        cache-dependency-glob: api/uv.lock
-
-    - name: Install dependencies in parallel
-      shell: bash
-      env:
-        E2E_INSTALL_BROWSER: ${{ inputs.browser }}
-        E2E_SETUP_ACTION_PATH: ${{ github.action_path }}
-      run: bash "$E2E_SETUP_ACTION_PATH/install.sh"

.github/actions/setup-core-e2e/install.sh

@@ -1,56 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-case "${E2E_INSTALL_BROWSER:-}" in
-  chromium|webkit) ;;
-  *) echo "Expected chromium or webkit" >&2; exit 1 ;;
-esac
-
-# Keep both branches in this step so failures are collected before tests start.
-started=$SECONDS
-timing_dir=$(mktemp -d)
-trap 'rm -rf "$timing_dir"' EXIT
-
-(
-  api_started=$SECONDS
-  uv sync --project api --dev
-  echo "$((SECONDS - api_started))" > "$timing_dir/api"
-) &
-api_pid=$!
-
-(
-  web_started=$SECONDS
-  vp install --frozen-lockfile
-  echo "$((SECONDS - web_started))" > "$timing_dir/web"
-  browser_started=$SECONDS
-  cd e2e
-  vp run "e2e:install:ci:$E2E_INSTALL_BROWSER"
-  echo "$((SECONDS - browser_started))" > "$timing_dir/browser"
-) &
-web_pid=$!
-
-api_status=0
-web_status=0
-wait "$api_pid" || api_status=$?
-wait "$web_pid" || web_status=$?
-
-{
-  echo "### E2E dependency preparation ($E2E_INSTALL_BROWSER)"
-  echo ""
-  echo "Parallel install wall time: $((SECONDS - started))s"
-  echo ""
-  echo "| Phase | Seconds |"
-  echo "| --- | ---: |"
-  for phase in api web browser; do
-    if [[ -f "$timing_dir/$phase" ]]; then
-      echo "| $phase | $(cat "$timing_dir/$phase") |"
-    fi
-  done
-  echo ""
-  echo "API exit status: $api_status; Web/browser exit status: $web_status"
-} >> "${GITHUB_STEP_SUMMARY:-/dev/null}"
-
-if (( api_status != 0 || web_status != 0 )); then
-  echo "E2E dependency installation failed (API: $api_status, Web/browser: $web_status)" >&2
-  exit 1
-fi

.github/actions/setup-web/action.yml

@@ -1,29 +1,16 @@
 name: Setup Web Environment
 description: Set up Node.js, Vite+, pnpm, and web dependencies
 
-inputs:
-  run-install:
-    description: Install web dependencies after setting up the toolchain
-    default: 'true'
-  cache-save:
-    description: Save the dependency cache after the job completes
-    default: 'true'
-
 runs:
   using: composite
   steps:
-    - name: Setup pnpm and Node.js
-      uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
+    - name: Setup pnpm
+      uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
       with:
-        install: false
+        run_install: false
     - name: Setup Vite+
-      uses: voidzero-dev/setup-vp@9fd26ff49f9b5e6276c2b493da4454ad4527f7f4 # v1.20.0
+      uses: voidzero-dev/setup-vp@ca1c46663915d6c1042ae23bd39ab85718bfb0fa # v1.10.0
       with:
-        node-manager: false
-        package-manager: |
-          pnpm: false
-          npm: false
+        node-version-file: .nvmrc
         cache: true
-        # Nested composite post actions can evaluate inputs in the outer scope.
-        cache-save: ${{ inputs.cache-save || 'true' }}
-        run-install: ${{ inputs.run-install }}
+        run-install: true

.github/actions/wait-e2e-web-build/action.yml

@@ -1,21 +0,0 @@
-name: Wait for Core E2E Web Build
-description: Wait for the current workflow run's Web build artifact while the producer finishes independently
-
-outputs:
-  artifact-id:
-    description: ID of the ready Web build artifact
-    value: ${{ steps.wait.outputs.result }}
-
-runs:
-  using: composite
-  steps:
-    - name: Wait for build artifact
-      id: wait
-      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-      env:
-        E2E_WAIT_ACTION_PATH: ${{ github.action_path }}
-      with:
-        result-encoding: string
-        script: |
-          const waitForBuild = require(`${process.env.E2E_WAIT_ACTION_PATH}/wait.cjs`)
-          return await waitForBuild({ github, context, core, runAttempt: Number(process.env.GITHUB_RUN_ATTEMPT) })

.github/actions/wait-e2e-web-build/wait.cjs

@@ -1,65 +0,0 @@
-const { setTimeout: delay } = require('node:timers/promises')
-
-module.exports = async function waitForBuild({
-  github,
-  context,
-  core,
-  runAttempt,
-  now = Date.now,
-  sleep = delay,
-  timeoutMs = 30 * 60 * 1000,
-}) {
-  const started = now()
-  const run = { ...context.repo, run_id: context.runId, per_page: 100 }
-  core.info('Waiting for core-e2e-web-build in this workflow run')
-
-  while (now() - started < timeoutMs) {
-    const jobs = await github.paginate(github.rest.actions.listJobsForWorkflowRunAttempt, {
-      ...run,
-      attempt_number: runAttempt,
-    })
-    const producer = jobs.find(
-      (job) =>
-        job.name === 'Prepare Core E2E Web Build' ||
-        job.name.endsWith(' / Prepare Core E2E Web Build'),
-    )
-    if (producer?.status === 'completed' && producer.conclusion !== 'success') {
-      throw new Error(
-        `Web build finished with ${producer.conclusion} before publishing an artifact`,
-      )
-    }
-
-    if (producer && ['in_progress', 'completed'].includes(producer.status)) {
-      const artifacts = await github.paginate(github.rest.actions.listWorkflowRunArtifacts, run)
-      const upload = producer.steps?.find((step) => step.name === 'Upload Web build')
-      const artifact = artifacts.find((item) => {
-        if (item.expired || !/^core-e2e-web-build-[1-9]\d*$/.test(item.name)) return false
-        if (producer.status === 'in_progress') {
-          // A rebuilding producer must publish this attempt's immutable artifact.
-          return item.name === `core-e2e-web-build-${runAttempt}`
-        }
-        // GitHub relabels reused successful jobs with the current run_attempt.
-        // Their upload step keeps its original timestamps, identifying the artifact
-        // to reuse when only consumers are rerun (including across several attempts).
-        return (
-          upload?.conclusion === 'success' &&
-          item.created_at >= upload.started_at &&
-          item.created_at <= upload.completed_at
-        )
-      })
-      if (artifact) {
-        const seconds = Math.round((now() - started) / 1000)
-        core.info(`Web build artifact ${artifact.name} ready after ${seconds}s`)
-        await core.summary
-          .addHeading('E2E Web build wait')
-          .addRaw(`Artifact wait: ${seconds}s`)
-          .write()
-        return String(artifact.id)
-      }
-    }
-
-    await sleep(Math.min(10000, timeoutMs - (now() - started)))
-  }
-
-  throw new Error('Timed out waiting for core-e2e-web-build in this workflow run')
-}

.github/actions/wait-e2e-web-build/wait.test.cjs

@@ -1,164 +0,0 @@
-const assert = require('node:assert/strict')
-const { test } = require('node:test')
-const waitForBuild = require('./wait.cjs')
-
-function fixture({ artifacts = [], jobs = [producer], error, runAttempt = 2 } = {}) {
-  let elapsed = 0
-  const calls = []
-  const summary = {
-    addHeading() {
-      return this
-    },
-    addRaw() {
-      return this
-    },
-    async write() {},
-  }
-  return {
-    calls,
-    options: {
-      context: { repo: { owner: 'owner', repo: 'repo' }, runId: 123 },
-      core: { info() {}, summary },
-      runAttempt,
-      github: {
-        rest: {
-          actions: { listWorkflowRunArtifacts: 'artifacts', listJobsForWorkflowRunAttempt: 'jobs' },
-        },
-        async paginate(endpoint, params) {
-          calls.push({ endpoint, params })
-          if (error) throw error
-          const values = endpoint === 'artifacts' ? artifacts : jobs
-          return typeof values === 'function' ? values(elapsed) : values
-        },
-      },
-      now: () => elapsed,
-      sleep: async (ms) => {
-        elapsed += ms
-      },
-      timeoutMs: 20000,
-    },
-  }
-}
-
-const producer = {
-  name: 'Run Web Full-Stack E2E / Prepare Core E2E Web Build',
-  status: 'in_progress',
-  run_attempt: 2,
-}
-const artifact = {
-  id: 42,
-  name: 'core-e2e-web-build-2',
-  expired: false,
-  created_at: '2026-09-22T04:08:11Z',
-}
-const oldArtifact = {
-  ...artifact,
-  id: 41,
-  name: 'core-e2e-web-build-1',
-  created_at: '2026-09-22T03:08:11Z',
-}
-const successfulProducer = {
-  ...producer,
-  status: 'completed',
-  conclusion: 'success',
-  steps: [
-    {
-      name: 'Upload Web build',
-      conclusion: 'success',
-      started_at: '2026-09-22T04:08:08Z',
-      completed_at: '2026-09-22T04:08:12Z',
-    },
-  ],
-}
-
-test('starts consuming the current artifact without waiting for producer cache saves', async () => {
-  const { options, calls } = fixture({ artifacts: (elapsed) => (elapsed ? [artifact] : []) })
-  assert.equal(await waitForBuild(options), '42')
-  assert.equal(options.now(), 10000)
-  assert.deepEqual(
-    calls.map((call) => call.endpoint),
-    ['jobs', 'artifacts', 'jobs', 'artifacts'],
-  )
-  for (const { endpoint, params } of calls) {
-    assert.equal(params.run_id, 123)
-    assert.equal(params.owner, 'owner')
-    assert.equal(params.repo, 'repo')
-    if (endpoint === 'jobs') assert.equal(params.attempt_number, 2)
-  }
-})
-
-test('full reruns ignore the old artifact until the rebuilding producer publishes this attempt', async () => {
-  const { options } = fixture({
-    artifacts: (elapsed) => (elapsed ? [oldArtifact, artifact] : [oldArtifact]),
-  })
-  assert.equal(await waitForBuild(options), '42')
-  assert.equal(options.now(), 10000)
-})
-
-test('does not use an old artifact before the current producer appears or while it is queued', async () => {
-  const { options } = fixture({
-    artifacts: [oldArtifact],
-    jobs: (elapsed) => (elapsed ? [{ ...producer, status: 'queued' }] : []),
-  })
-  await assert.rejects(waitForBuild(options), /Timed out/)
-})
-
-test('consumer-only reruns reuse the actual successful upload despite a relabeled run_attempt', async () => {
-  const { options } = fixture({
-    runAttempt: 4,
-    artifacts: [oldArtifact, artifact],
-    jobs: [{ ...successfulProducer, run_attempt: 4 }],
-  })
-  assert.equal(await waitForBuild(options), '42')
-  assert.equal(options.now(), 0)
-})
-
-for (const conclusion of ['failure', 'cancelled', 'skipped']) {
-  test(`does not fall back to an old artifact when the producer finishes with ${conclusion}`, async () => {
-    const { options } = fixture({
-      artifacts: [oldArtifact, artifact],
-      jobs: [{ ...producer, status: 'completed', conclusion }],
-    })
-    await assert.rejects(waitForBuild(options), new RegExp(`Web build finished with ${conclusion}`))
-    assert.equal(options.now(), 0)
-  })
-}
-
-test('ignores unrelated and expired artifacts and stops at the deadline', async () => {
-  const { options } = fixture({
-    artifacts: [
-      { ...artifact, expired: true },
-      { ...artifact, name: 'other' },
-    ],
-  })
-  await assert.rejects(waitForBuild(options), /Timed out/)
-  assert.equal(options.now(), 20000)
-})
-
-test('completed rebuilt producers select their upload instead of the old artifact', async () => {
-  const { options } = fixture({ artifacts: [oldArtifact, artifact], jobs: [successfulProducer] })
-  assert.equal(await waitForBuild(options), '42')
-})
-
-test('allows artifact visibility to catch up after a successful producer finishes', async () => {
-  const { options } = fixture({
-    artifacts: (elapsed) => (elapsed ? [oldArtifact, artifact] : [oldArtifact]),
-    jobs: [successfulProducer],
-  })
-  assert.equal(await waitForBuild(options), '42')
-  assert.equal(options.now(), 10000)
-})
-
-test('does not reuse artifacts without a successful matching upload step', async () => {
-  const { options } = fixture({
-    artifacts: [artifact],
-    jobs: [{ ...successfulProducer, steps: [] }],
-  })
-  await assert.rejects(waitForBuild(options), /Timed out/)
-})
-
-test('reports API errors rather than silently waiting until timeout', async () => {
-  const { options } = fixture({ error: new Error('Resource not accessible by integration') })
-  await assert.rejects(waitForBuild(options), /Resource not accessible/)
-  assert.equal(options.now(), 0)
-})

.github/dependabot.yml

@@ -1,223 +1,223 @@
 version: 2
 
 updates:
-  - package-ecosystem: 'uv'
-    directory: '/api'
+  - package-ecosystem: "uv"
+    directory: "/api"
     open-pull-requests-limit: 10
     schedule:
-      interval: 'weekly'
+      interval: "weekly"
     groups:
       flask:
         patterns:
-          - 'flask'
-          - 'flask-*'
-          - 'werkzeug'
-          - 'gunicorn'
+          - "flask"
+          - "flask-*"
+          - "werkzeug"
+          - "gunicorn"
       google:
         patterns:
-          - 'google-*'
-          - 'googleapis-*'
+          - "google-*"
+          - "googleapis-*"
       opentelemetry:
         patterns:
-          - 'opentelemetry-*'
+          - "opentelemetry-*"
       pydantic:
         patterns:
-          - 'pydantic'
-          - 'pydantic-*'
+          - "pydantic"
+          - "pydantic-*"
       llm:
         patterns:
-          - 'langfuse'
-          - 'langsmith'
-          - 'litellm'
-          - 'mlflow*'
-          - 'opik'
-          - 'weave*'
-          - 'arize*'
-          - 'tiktoken'
-          - 'transformers'
+          - "langfuse"
+          - "langsmith"
+          - "litellm"
+          - "mlflow*"
+          - "opik"
+          - "weave*"
+          - "arize*"
+          - "tiktoken"
+          - "transformers"
       database:
         patterns:
-          - 'sqlalchemy'
-          - 'psycopg2*'
-          - 'psycogreen'
-          - 'redis*'
-          - 'alembic*'
+          - "sqlalchemy"
+          - "psycopg2*"
+          - "psycogreen"
+          - "redis*"
+          - "alembic*"
       storage:
         patterns:
-          - 'boto3*'
-          - 'botocore*'
-          - 'azure-*'
-          - 'bce-*'
-          - 'cos-python-*'
-          - 'esdk-obs-*'
-          - 'google-cloud-storage'
-          - 'opendal'
-          - 'oss2'
-          - 'supabase*'
-          - 'tos*'
+          - "boto3*"
+          - "botocore*"
+          - "azure-*"
+          - "bce-*"
+          - "cos-python-*"
+          - "esdk-obs-*"
+          - "google-cloud-storage"
+          - "opendal"
+          - "oss2"
+          - "supabase*"
+          - "tos*"
       vdb:
         patterns:
-          - 'alibabacloud*'
-          - 'chromadb'
-          - 'clickhouse-*'
-          - 'clickzetta-*'
-          - 'couchbase'
-          - 'elasticsearch'
-          - 'opensearch-py'
-          - 'oracledb'
-          - 'pgvect*'
-          - 'pymilvus'
-          - 'pymochow'
-          - 'pyobvector'
-          - 'qdrant-client'
-          - 'intersystems-*'
-          - 'tablestore'
-          - 'tcvectordb'
-          - 'tidb-vector'
-          - 'upstash-*'
-          - 'volcengine-*'
-          - 'weaviate-*'
-          - 'xinference-*'
-          - 'mo-vector'
-          - 'mysql-connector-*'
+          - "alibabacloud*"
+          - "chromadb"
+          - "clickhouse-*"
+          - "clickzetta-*"
+          - "couchbase"
+          - "elasticsearch"
+          - "opensearch-py"
+          - "oracledb"
+          - "pgvect*"
+          - "pymilvus"
+          - "pymochow"
+          - "pyobvector"
+          - "qdrant-client"
+          - "intersystems-*"
+          - "tablestore"
+          - "tcvectordb"
+          - "tidb-vector"
+          - "upstash-*"
+          - "volcengine-*"
+          - "weaviate-*"
+          - "xinference-*"
+          - "mo-vector"
+          - "mysql-connector-*"
       dev:
         patterns:
-          - 'coverage'
-          - 'dotenv-linter'
-          - 'faker'
-          - 'lxml-stubs'
-          - 'basedpyright'
-          - 'ruff'
-          - 'pytest*'
-          - 'types-*'
-          - 'boto3-stubs'
-          - 'hypothesis'
-          - 'pandas-stubs'
-          - 'scipy-stubs'
-          - 'import-linter'
-          - 'celery-types'
-          - 'mypy*'
-          - 'pyrefly'
+          - "coverage"
+          - "dotenv-linter"
+          - "faker"
+          - "lxml-stubs"
+          - "basedpyright"
+          - "ruff"
+          - "pytest*"
+          - "types-*"
+          - "boto3-stubs"
+          - "hypothesis"
+          - "pandas-stubs"
+          - "scipy-stubs"
+          - "import-linter"
+          - "celery-types"
+          - "mypy*"
+          - "pyrefly"
       python-packages:
         patterns:
-          - '*'
-  - package-ecosystem: 'github-actions'
-    directory: '/'
+          - "*"
+  - package-ecosystem: "github-actions"
+    directory: "/"
     open-pull-requests-limit: 5
     schedule:
-      interval: 'weekly'
+      interval: "weekly"
     groups:
       github-actions-dependencies:
         patterns:
-          - '*'
-  - package-ecosystem: 'uv'
-    directory: '/api'
-    target-branch: 'lts/1.13.x'
+          - "*"
+  - package-ecosystem: "uv"
+    directory: "/api"
+    target-branch: "lts/1.13.x"
     open-pull-requests-limit: 10
     schedule:
-      interval: 'weekly'
+      interval: "weekly"
     groups:
       flask:
         patterns:
-          - 'flask'
-          - 'flask-*'
-          - 'werkzeug'
-          - 'gunicorn'
+          - "flask"
+          - "flask-*"
+          - "werkzeug"
+          - "gunicorn"
       google:
         patterns:
-          - 'google-*'
-          - 'googleapis-*'
+          - "google-*"
+          - "googleapis-*"
       opentelemetry:
         patterns:
-          - 'opentelemetry-*'
+          - "opentelemetry-*"
       pydantic:
         patterns:
-          - 'pydantic'
-          - 'pydantic-*'
+          - "pydantic"
+          - "pydantic-*"
       llm:
         patterns:
-          - 'langfuse'
-          - 'langsmith'
-          - 'litellm'
-          - 'mlflow*'
-          - 'opik'
-          - 'weave*'
-          - 'arize*'
-          - 'tiktoken'
-          - 'transformers'
+          - "langfuse"
+          - "langsmith"
+          - "litellm"
+          - "mlflow*"
+          - "opik"
+          - "weave*"
+          - "arize*"
+          - "tiktoken"
+          - "transformers"
       database:
         patterns:
-          - 'sqlalchemy'
-          - 'psycopg2*'
-          - 'psycogreen'
-          - 'redis*'
-          - 'alembic*'
+          - "sqlalchemy"
+          - "psycopg2*"
+          - "psycogreen"
+          - "redis*"
+          - "alembic*"
       storage:
         patterns:
-          - 'boto3*'
-          - 'botocore*'
-          - 'azure-*'
-          - 'bce-*'
-          - 'cos-python-*'
-          - 'esdk-obs-*'
-          - 'google-cloud-storage'
-          - 'opendal'
-          - 'oss2'
-          - 'supabase*'
-          - 'tos*'
+          - "boto3*"
+          - "botocore*"
+          - "azure-*"
+          - "bce-*"
+          - "cos-python-*"
+          - "esdk-obs-*"
+          - "google-cloud-storage"
+          - "opendal"
+          - "oss2"
+          - "supabase*"
+          - "tos*"
       vdb:
         patterns:
-          - 'alibabacloud*'
-          - 'chromadb'
-          - 'clickhouse-*'
-          - 'clickzetta-*'
-          - 'couchbase'
-          - 'elasticsearch'
-          - 'opensearch-py'
-          - 'oracledb'
-          - 'pgvect*'
-          - 'pymilvus'
-          - 'pymochow'
-          - 'pyobvector'
-          - 'qdrant-client'
-          - 'intersystems-*'
-          - 'tablestore'
-          - 'tcvectordb'
-          - 'tidb-vector'
-          - 'upstash-*'
-          - 'volcengine-*'
-          - 'weaviate-*'
-          - 'xinference-*'
-          - 'mo-vector'
-          - 'mysql-connector-*'
+          - "alibabacloud*"
+          - "chromadb"
+          - "clickhouse-*"
+          - "clickzetta-*"
+          - "couchbase"
+          - "elasticsearch"
+          - "opensearch-py"
+          - "oracledb"
+          - "pgvect*"
+          - "pymilvus"
+          - "pymochow"
+          - "pyobvector"
+          - "qdrant-client"
+          - "intersystems-*"
+          - "tablestore"
+          - "tcvectordb"
+          - "tidb-vector"
+          - "upstash-*"
+          - "volcengine-*"
+          - "weaviate-*"
+          - "xinference-*"
+          - "mo-vector"
+          - "mysql-connector-*"
       dev:
         patterns:
-          - 'coverage'
-          - 'dotenv-linter'
-          - 'faker'
-          - 'lxml-stubs'
-          - 'basedpyright'
-          - 'ruff'
-          - 'pytest*'
-          - 'types-*'
-          - 'boto3-stubs'
-          - 'hypothesis'
-          - 'pandas-stubs'
-          - 'scipy-stubs'
-          - 'import-linter'
-          - 'celery-types'
-          - 'mypy*'
-          - 'pyrefly'
+          - "coverage"
+          - "dotenv-linter"
+          - "faker"
+          - "lxml-stubs"
+          - "basedpyright"
+          - "ruff"
+          - "pytest*"
+          - "types-*"
+          - "boto3-stubs"
+          - "hypothesis"
+          - "pandas-stubs"
+          - "scipy-stubs"
+          - "import-linter"
+          - "celery-types"
+          - "mypy*"
+          - "pyrefly"
       python-packages:
         patterns:
-          - '*'
-  - package-ecosystem: 'github-actions'
-    directory: '/'
-    target-branch: 'lts/1.13.x'
+          - "*"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    target-branch: "lts/1.13.x"
     open-pull-requests-limit: 5
     schedule:
-      interval: 'weekly'
+      interval: "weekly"
     groups:
       github-actions-dependencies:
         patterns:
-          - '*'
+          - "*"

.github/labeler.yml

@@ -6,6 +6,7 @@ web:
           - 'package.json'
           - 'pnpm-lock.yaml'
           - 'pnpm-workspace.yaml'
+          - '.nvmrc'
 
 e2e:
   - changed-files:

.github/linters/.hadolint.yaml

@@ -1 +1 @@
-failure-threshold: 'error'
+failure-threshold: "error"

.github/linters/.yaml-lint.yml

@@ -1,11 +1,10 @@
 ---
+
 extends: default
 
 rules:
   brackets:
     max-spaces-inside: 1
-  comments:
-    min-spaces-from-content: 1
   comments-indentation: disable
   document-start: disable
   line-length: disable

.github/linters/editorconfig-checker.json

@@ -1,22 +1,22 @@
 {
-  "Verbose": false,
-  "Debug": false,
-  "IgnoreDefaults": false,
-  "SpacesAfterTabs": false,
-  "NoColor": false,
-  "Exclude": [
-    "^web/public/vs/",
-    "^web/public/pdf.worker.min.mjs$",
-    "web/app/components/base/icons/src/vender/"
-  ],
-  "AllowedContentTypes": [],
-  "PassedFiles": [],
-  "Disable": {
-    "EndOfLine": false,
-    "Indentation": false,
-    "IndentSize": true,
-    "InsertFinalNewline": false,
-    "TrimTrailingWhitespace": false,
-    "MaxLineLength": false
-  }
+    "Verbose": false,
+    "Debug": false,
+    "IgnoreDefaults": false,
+    "SpacesAfterTabs": false,
+    "NoColor": false,
+    "Exclude": [
+        "^web/public/vs/",
+        "^web/public/pdf.worker.min.mjs$",
+        "web/app/components/base/icons/src/vender/"
+    ],
+    "AllowedContentTypes": [],
+    "PassedFiles": [],
+    "Disable": {
+        "EndOfLine": false,
+        "Indentation": false,
+        "IndentSize": true,
+        "InsertFinalNewline": false,
+        "TrimTrailingWhitespace": false,
+        "MaxLineLength": false
+    }
 }

.github/pull_request_template.md

@@ -1,7 +1,7 @@
 > [!IMPORTANT]
 >
 > 1. Make sure you have read our [contribution guidelines](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md)
-> 1. Ensure there is an associated issue
+> 1. Ensure there is an associated issue and you have been assigned to it
 > 1. Use the correct syntax to link this PR: `Fixes #<issue number>`.
 
 ## Summary
@@ -12,13 +12,13 @@
 ## Screenshots
 
 | Before | After |
-| ------ | ----- |
-| ...    | ...   |
+|--------|-------|
+| ... | ... |
 
 ## Checklist
 
 - [ ] This change requires a documentation update, included: [Dify Document](https://github.com/langgenius/dify-docs)
 - [ ] I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!)
-- [ ] I've verified the change and added or updated tests where meaningful regression risk justifies coverage.
+- [ ] I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
 - [ ] I've updated the documentation accordingly.
-- [ ] I ran `make lint && make type-check` (backend) and `vp staged` (frontend) to appease the lint gods
+- [ ] I ran `make lint && make type-check` (backend) and `cd web && pnpm exec vp staged` (frontend) to appease the lint gods

.github/scripts/generate-i18n-changes.mjs

@@ -8,32 +8,31 @@ const headSha = process.env.HEAD_SHA || ''
 const files = (process.env.CHANGED_FILES || '').split(/\s+/).filter(Boolean)
 const outputPath = process.env.I18N_CHANGES_OUTPUT_PATH || '/tmp/i18n-changes.json'
 
-const englishPath = (fileStem) =>
-  path.join(repoRoot, 'web', 'i18n', 'locales', 'en-US', `${fileStem}.json`)
+const englishPath = fileStem => path.join(repoRoot, 'web', 'i18n', 'en-US', `${fileStem}.json`)
 
 const readCurrentJson = (fileStem) => {
   const filePath = englishPath(fileStem)
-  if (!fs.existsSync(filePath)) return null
+  if (!fs.existsSync(filePath))
+    return null
 
   return JSON.parse(fs.readFileSync(filePath, 'utf8'))
 }
 
 const readBaseJson = (fileStem) => {
-  if (!baseSha) return null
+  if (!baseSha)
+    return null
 
   try {
-    const relativePath = `web/i18n/locales/en-US/${fileStem}.json`
-    const content = execFileSync('git', ['show', `${baseSha}:${relativePath}`], {
-      encoding: 'utf8',
-    })
+    const relativePath = `web/i18n/en-US/${fileStem}.json`
+    const content = execFileSync('git', ['show', `${baseSha}:${relativePath}`], { encoding: 'utf8' })
     return JSON.parse(content)
-  } catch {
+  }
+  catch {
     return null
   }
 }
 
-const compareJson = (beforeValue, afterValue) =>
-  JSON.stringify(beforeValue) === JSON.stringify(afterValue)
+const compareJson = (beforeValue, afterValue) => JSON.stringify(beforeValue) === JSON.stringify(afterValue)
 
 const changes = {}
 
@@ -60,7 +59,8 @@ for (const fileStem of files) {
   }
 
   for (const key of Object.keys(beforeJson)) {
-    if (!(key in afterJson)) deleted.push(key)
+    if (!(key in afterJson))
+      deleted.push(key)
   }
 
   changes[fileStem] = {
@@ -78,5 +78,5 @@ fs.writeFileSync(
     headSha,
     files,
     changes,
-  }),
+  })
 )

.github/scripts/size-labeler.test.cjs

@@ -1,94 +0,0 @@
-const fs = require('node:fs')
-const assert = require('node:assert/strict')
-const test = require('node:test')
-const source = fs.readFileSync(
-  require('node:path').join(__dirname, '../workflows/size-labeler.yml'),
-  'utf8',
-)
-const script = source
-  .replace(/\r\n/g, '\n')
-  .split('          script: |\n')[1]
-  .split('\n')
-  .map((l) => l.replace(/^            /, ''))
-  .join('\n')
-const run = new (Object.getPrototypeOf(async function () {}).constructor)(
-  'github',
-  'context',
-  'core',
-  script,
-)
-async function scenario(files, existing = [], changed = files.length) {
-  const calls = []
-  const warnings = []
-  const api = {
-    pulls: {
-      get: async () => ({ data: { changed_files: changed } }),
-      listFiles: 'files',
-    },
-    issues: {
-      listLabelsOnIssue: 'labels',
-      addLabels: async (p) => calls.push(['add', p.labels[0]]),
-      removeLabel: async (p) => calls.push(['remove', p.name]),
-    },
-  }
-  await run(
-    {
-      rest: api,
-      paginate: async (endpoint) =>
-        endpoint === 'files' ? files : existing.map((name) => ({ name })),
-    },
-    {
-      repo: { owner: 'test', repo: 'repo' },
-      payload: { pull_request: { number: 1 } },
-    },
-    { warning: (s) => warnings.push(s) },
-  )
-  return { calls, warnings }
-}
-for (const [n, label] of [
-  [0, 'XS'],
-  [9, 'XS'],
-  [10, 'S'],
-  [29, 'S'],
-  [30, 'M'],
-  [99, 'M'],
-  [100, 'L'],
-  [499, 'L'],
-  [500, 'XL'],
-  [999, 'XL'],
-  [1000, 'XXL'],
-]) {
-  test(`threshold ${n}`, async () =>
-    assert.deepEqual((await scenario([{ filename: 'a.py', additions: n, deletions: 0 }])).calls, [
-      ['add', `size:${label}`],
-    ]))
-}
-test('count deletions', async () =>
-  assert.deepEqual((await scenario([{ filename: 'a.py', additions: 0, deletions: 30 }])).calls, [
-    ['add', 'size:M'],
-  ]))
-test('ignore nested lockfiles', async () =>
-  assert.deepEqual(
-    (
-      await scenario([
-        { filename: 'api/uv.lock', additions: 9000, deletions: 5 },
-        { filename: 'web/pnpm-lock.yaml', additions: 5000, deletions: 0 },
-      ])
-    ).calls,
-    [['add', 'size:XS']],
-  ))
-test('replace stale size only', async () =>
-  assert.deepEqual(
-    (await scenario([{ filename: 'a.py', additions: 10, deletions: 0 }], ['size:L', 'bug', 'web']))
-      .calls,
-    [
-      ['add', 'size:S'],
-      ['remove', 'size:L'],
-    ],
-  ))
-test('idempotent', async () => assert.deepEqual((await scenario([], ['size:XS', 'bug'])).calls, []))
-test('incomplete file list', async () => {
-  const r = await scenario([], ['size:L'], 3001)
-  assert.deepEqual(r.calls, [])
-  assert.equal(r.warnings.length, 1)
-})

.github/workflows/accessibility-e2e.yml

@@ -1,101 +0,0 @@
-name: Manual WCAG Accessibility Audit
-run-name: WCAG ${{ inputs.level }} · ${{ inputs.page }}
-
-on:
-  workflow_dispatch:
-    inputs:
-      page:
-        description: Page to scan
-        required: true
-        default: home
-        type: choice
-        options:
-          - home
-          - sign-in
-          - studio
-          - agents
-          - knowledge
-          - integrations
-          - all
-      level:
-        description: WCAG level to scan
-        required: true
-        default: aa
-        type: choice
-        options:
-          - aa
-          - a
-
-permissions:
-  contents: read
-
-concurrency:
-  group: accessibility-e2e-${{ github.ref }}-${{ inputs.page }}-${{ inputs.level }}
-  cancel-in-progress: true
-
-jobs:
-  accessibility:
-    name: WCAG Level ${{ inputs.level == 'a' && 'A' || 'AA' }} · ${{ inputs.page }}
-    runs-on: ubuntu-24.04
-    timeout-minutes: 120
-    defaults:
-      run:
-        shell: bash
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - name: Setup web dependencies
-        uses: ./.github/actions/setup-web
-
-      - name: Setup UV and Python
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
-        with:
-          enable-cache: true
-          python-version: '3.12'
-          cache-dependency-glob: |
-            api/uv.lock
-
-      - name: Install API dependencies
-        run: uv sync --project api --dev
-
-      - name: Install Chromium for accessibility E2E
-        timeout-minutes: 15
-        working-directory: ./e2e
-        run: vp run e2e:install:ci:chromium
-
-      - name: Run automated WCAG Level ${{ inputs.level == 'a' && 'A' || 'AA' }} checks
-        working-directory: ./e2e
-        env:
-          E2E_ADMIN_EMAIL: e2e-admin@example.com
-          E2E_ADMIN_NAME: E2E Admin
-          E2E_ADMIN_PASSWORD: E2eAdmin12345
-          E2E_FORCE_WEB_BUILD: '1'
-          E2E_INIT_PASSWORD: E2eInit12345
-          WCAG_PAGE: ${{ inputs.page }}
-        run: |
-          if [[ "$WCAG_PAGE" == "all" ]]; then
-            vp run e2e:accessibility:${{ inputs.level }}
-          else
-            pnpm exec node ./scripts/run-cucumber.ts --full -- --tags "@axe and @wcag-${{ inputs.level }} and @wcag-page-$WCAG_PAGE"
-          fi
-
-      - name: Upload accessibility Cucumber report
-        if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: cucumber-report-accessibility-${{ inputs.level }}-${{ inputs.page }}
-          path: e2e/cucumber-report
-          retention-days: 7
-
-      - name: Upload accessibility E2E logs
-        if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: e2e-logs-accessibility-${{ inputs.level }}-${{ inputs.page }}
-          path: e2e/.logs/*.log
-          include-hidden-files: true
-          retention-days: 7

.github/workflows/api-tests.yml

@@ -14,79 +14,28 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  api-unit-plan:
-    name: Plan API unit shards
-    runs-on: depot-ubuntu-24.04
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - name: Setup UV and Python
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
-        with:
-          python-version: '3.12'
-          enable-cache: false
-      - name: Download shared timing baseline
-        # Public statistics are independent of PR refs and require no credentials.
-        run: |
-          if ! curl --fail --silent --show-error --location \
-            --connect-timeout 5 --max-time 15 --retry 2 --retry-max-time 30 \
-            https://raw.githubusercontent.com/langgenius/dify-test-infra/generated-stats/stats/test-times.json \
-            --output unit-test-durations.json; then
-            rm -f unit-test-durations.json
-            echo '::warning::Timing baseline unavailable; using round-robin file allocation.'
-          fi
-      - name: Freeze file assignments for every shard
-        run: |
-          uv run --project api --no-sync python api/dev/pytest_sharding.py \
-            --shard-index 1 --shard-total 2 \
-            --durations unit-test-durations.json \
-            --write-plan unit-test-plan.json \
-            --split-threshold 60 \
-            --ignore api/tests/unit_tests/controllers \
-            api/tests/unit_tests \
-            api/providers/vdb/*/tests/unit_tests \
-            api/providers/trace/*/tests/unit_tests
-      - name: Upload shared plan
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: api-unit-plan
-          path: |
-            unit-test-plan.json
-            unit-test-durations.json
-          retention-days: 7
-          if-no-files-found: error
-
   api-unit:
-    needs: api-unit-plan
-    name: API Unit Tests (${{ matrix.python-version }}, shard ${{ matrix.shardIndex }}/${{ matrix.shardTotal }})
+    name: API Unit Tests
     runs-on: depot-ubuntu-24.04
     env:
-      PYTHONUNBUFFERED: '1'
-      COVERAGE_FILE: coverage-unit-${{ matrix.python-version }}-${{ matrix.shardIndex }}
+      COVERAGE_FILE: coverage-unit
     defaults:
       run:
         shell: bash
     strategy:
-      fail-fast: false
       matrix:
         python-version:
-          - '3.12'
-        shardIndex:
-          - 1
-          - 2
-        shardTotal:
-          - 2
+          - "3.12"
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
+          fetch-depth: 0
           persist-credentials: false
 
       - name: Setup UV and Python
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           enable-cache: true
           python-version: ${{ matrix.python-version }}
@@ -98,116 +47,34 @@ jobs:
       - name: Install dependencies
         run: uv sync --project api --dev
 
-      - name: Download shared plan
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: api-unit-plan
-
       - name: Run Unit Tests
         run: |
-          uv run --project api python api/dev/pytest_sharding.py \
-            --plan unit-test-plan.json \
-            --shard-index "${{ matrix.shardIndex }}" \
-            --shard-total "${{ matrix.shardTotal }}" \
-            --ignore api/tests/unit_tests/controllers \
-            api/tests/unit_tests \
-            api/providers/vdb/*/tests/unit_tests \
-            api/providers/trace/*/tests/unit_tests > "$RUNNER_TEMP/unit-test-files.txt"
           uv run --project api pytest \
             -p no:benchmark \
             --timeout "${PYTEST_TIMEOUT:-20}" \
             -n auto \
-            -o 'addopts=--cov=./api --cov-branch --import-mode=importlib' \
-            --cov-report= \
-            --file-shard-plan unit-test-plan.json \
-            --shard-index "${{ matrix.shardIndex }}" \
-            --shard-total "${{ matrix.shardTotal }}" \
-            --write-test-durations "test-results/durations-${{ matrix.shardIndex }}.json" \
-            --junitxml=test-results/unit.xml \
-            "@$RUNNER_TEMP/unit-test-files.txt"
-
-      - name: Upload unit test reports
-        if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: api-test-results-unit-${{ matrix.python-version }}-${{ matrix.shardIndex }}
-          path: test-results/*.xml
-          if-no-files-found: warn
-          retention-days: 7
-
-      - name: Upload successful timing observations
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: api-unit-durations-${{ matrix.shardIndex }}
-          path: test-results/durations-*.json
-          retention-days: 7
-          if-no-files-found: error
+            api/tests/unit_tests \
+            api/providers/vdb/*/tests/unit_tests \
+            api/providers/trace/*/tests/unit_tests \
+            --ignore=api/tests/unit_tests/controllers
+          # Controller tests register Flask routes at import time, so keep them out of xdist.
+          uv run --project api pytest \
+            --timeout "${PYTEST_TIMEOUT:-20}" \
+            --cov-append \
+            api/tests/unit_tests/controllers
 
       - name: Upload unit coverage data
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: api-coverage-unit-${{ matrix.python-version }}-${{ matrix.shardIndex }}
-          path: ${{ env.COVERAGE_FILE }}
-          if-no-files-found: error
-          retention-days: 1
-
-  api-controllers:
-    name: API Controller Tests (3.12)
-    runs-on: depot-ubuntu-24.04
-    env:
-      PYTHONUNBUFFERED: '1'
-      COVERAGE_FILE: coverage-controllers-3.12
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - name: Setup UV and Python
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
-        with:
-          enable-cache: true
-          python-version: '3.12'
-          cache-dependency-glob: api/uv.lock
-
-      - name: Check UV lockfile
-        run: uv lock --project api --check
-
-      - name: Install dependencies
-        run: uv sync --project api --dev
-
-      - name: Run Controller Tests
-        # Controller tests register Flask routes at import time, so keep them out of xdist.
-        run: |
-          uv run --project api pytest \
-            --timeout "${PYTEST_TIMEOUT:-20}" \
-            -o 'addopts=--cov=./api --cov-branch --import-mode=importlib' \
-            --cov-report= \
-            --junitxml=test-results/controllers.xml \
-            api/tests/unit_tests/controllers
-
-      - name: Upload controller test reports
-        if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: api-test-results-controllers-3.12
-          path: test-results/*.xml
-          if-no-files-found: warn
-          retention-days: 7
-
-      - name: Upload controller coverage data
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: api-coverage-controllers-3.12
-          path: ${{ env.COVERAGE_FILE }}
-          if-no-files-found: error
+          name: api-coverage-unit
+          path: coverage-unit
           retention-days: 1
 
   api-integration:
-    name: API Integration Tests (${{ matrix.python-version }})
-    runs-on: depot-ubuntu-24.04-4
+    name: API Integration Tests
+    runs-on: depot-ubuntu-24.04
     env:
-      COVERAGE_FILE: coverage-integration-${{ matrix.python-version }}
+      COVERAGE_FILE: coverage-integration
       STORAGE_TYPE: opendal
       OPENDAL_SCHEME: fs
       OPENDAL_FS_ROOT: /tmp/dify-storage
@@ -215,19 +82,19 @@ jobs:
       run:
         shell: bash
     strategy:
-      fail-fast: false
       matrix:
         python-version:
-          - '3.12'
+          - "3.12"
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
+          fetch-depth: 0
           persist-credentials: false
 
       - name: Setup UV and Python
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           enable-cache: true
           python-version: ${{ matrix.python-version }}
@@ -244,10 +111,7 @@ jobs:
           uv run --project api pytest \
             -p no:benchmark \
             --start-middleware \
-            --middleware-stop-timeout 2 \
             -n auto \
-            -o 'addopts=--cov=./api --cov-branch --import-mode=importlib' \
-            --cov-report= \
             --timeout "${PYTEST_TIMEOUT:-180}" \
             api/tests/integration_tests/workflow \
             api/tests/integration_tests/tools \
@@ -256,9 +120,8 @@ jobs:
       - name: Upload integration coverage data
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: api-coverage-integration-${{ matrix.python-version }}
-          path: ${{ env.COVERAGE_FILE }}
-          if-no-files-found: error
+          name: api-coverage-integration
+          path: coverage-integration
           retention-days: 1
 
   api-coverage:
@@ -266,7 +129,6 @@ jobs:
     runs-on: depot-ubuntu-24.04
     needs:
       - api-unit
-      - api-controllers
       - api-integration
     env:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
@@ -277,14 +139,20 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
+          fetch-depth: 0
           persist-credentials: false
 
       - name: Setup UV and Python
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
-          python-version: '3.12'
+          enable-cache: true
+          python-version: "3.12"
+          cache-dependency-glob: api/uv.lock
+
+      - name: Install dependencies
+        run: uv sync --project api --dev
 
       - name: Download coverage data
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -296,48 +164,35 @@ jobs:
       - name: Combine coverage
         run: |
           set -euo pipefail
-          coverage_version=$(python3 -c 'import tomllib; print(next(p["version"] for p in tomllib.load(open("api/uv.lock", "rb"))["package"] if p["name"] == "coverage"))')
 
-          mapfile -t unit_coverage < <(find coverage-data -type f -name 'coverage-unit-*' -print | sort)
-          mapfile -t controller_coverage < <(find coverage-data -type f -name 'coverage-controllers-*' -print | sort)
-          mapfile -t integration_coverage < <(find coverage-data -type f -name 'coverage-integration-*' -print | sort)
-          if [[ "${#unit_coverage[@]}" -ne 2 ]]; then
-            echo "expected 2 unit coverage artifacts, found ${#unit_coverage[@]}" >&2
-            exit 1
-          fi
-          if [[ "${#controller_coverage[@]}" -ne 1 ]]; then
-            echo "expected 1 controller coverage artifact, found ${#controller_coverage[@]}" >&2
-            exit 1
-          fi
-          if [[ "${#integration_coverage[@]}" -ne 1 ]]; then
-            echo "expected 1 integration coverage artifact, found ${#integration_coverage[@]}" >&2
-            exit 1
-          fi
+          echo "### API Coverage" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "Merged backend coverage report generated for Codecov project status." >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
 
-          uvx --from "coverage==$coverage_version" coverage combine "${unit_coverage[@]}" "${controller_coverage[@]}" "${integration_coverage[@]}"
-          uvx --from "coverage==$coverage_version" coverage xml -o coverage.xml
+          unit_coverage="$(find coverage-data -type f -name coverage-unit -print -quit)"
+          integration_coverage="$(find coverage-data -type f -name coverage-integration -print -quit)"
+          : "${unit_coverage:?coverage-unit artifact not found}"
+          : "${integration_coverage:?coverage-integration artifact not found}"
 
-          # Reuse the XML totals instead of analyzing every source file again for a text report.
-          python3 - <<'PY'
-          import os
-          import xml.etree.ElementTree as ET
-
-          coverage = ET.parse("coverage.xml").getroot()
-          with open(os.environ["GITHUB_STEP_SUMMARY"], "a") as summary:
-              summary.write("### API Coverage\n\n")
-              summary.write("Merged backend coverage report generated for Codecov project status.\n\n")
-              summary.write("| Metric | Covered | Total | Coverage |\n")
-              summary.write("| --- | ---: | ---: | ---: |\n")
-              for label, metric in (("Lines", "lines"), ("Branches", "branches")):
-                  covered = int(coverage.attrib[f"{metric}-covered"])
-                  total = int(coverage.attrib[f"{metric}-valid"])
-                  percentage = f"{covered / total:.2%}" if total else "N/A"
-                  summary.write(f"| {label} | {covered} | {total} | {percentage} |\n")
-              summary.write("\nSee Codecov for per-file coverage details.\n")
-          PY
+          report_file="$(mktemp)"
+          uv run --project api coverage combine "$unit_coverage" "$integration_coverage"
+          uv run --project api coverage report --show-missing | tee "$report_file"
+          echo "Summary: \`$(tail -n 1 "$report_file")\`" >> "$GITHUB_STEP_SUMMARY"
+          {
+            echo ""
+            echo "<details><summary>Coverage report</summary>"
+            echo ""
+            echo '```'
+            cat "$report_file"
+            echo '```'
+            echo "</details>"
+          } >> "$GITHUB_STEP_SUMMARY"
+          uv run --project api coverage xml -o coverage.xml
 
       - name: Report coverage
-        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
+        if: ${{ env.CODECOV_TOKEN != '' }}
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           files: ./coverage.xml
           disable_search: true

.github/workflows/autofix.yml

@@ -1,10 +1,12 @@
 name: autofix.ci
 on:
   pull_request:
-    branches: ['main']
+    branches: ["main"]
   merge_group:
-    branches: ['main']
+    branches: ["main"]
     types: [checks_requested]
+  push:
+    branches: ["main"]
 permissions:
   contents: read
 
@@ -18,7 +20,7 @@ jobs:
         run: echo "autofix.ci updates pull request branches, not merge group refs."
 
       - if: github.event_name != 'merge_group'
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Check Docker Compose inputs
         if: github.event_name != 'merge_group'
@@ -30,6 +32,29 @@ jobs:
             docker/.env.example
             docker/docker-compose-template.yaml
             docker/docker-compose.yaml
+      - name: Check web inputs
+        if: github.event_name != 'merge_group'
+        id: web-changes
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
+        with:
+          files: |
+            web/**
+            cli/**
+            e2e/**
+            packages/**
+            sdks/nodejs-client/**
+            package.json
+            pnpm-lock.yaml
+            pnpm-workspace.yaml
+            .nvmrc
+            vite.config.ts
+            lint.config.ts
+            eslint.config.mjs
+            oxlint-suppressions.json
+            eslint-suppressions.json
+            .vscode/**
+            .github/workflows/autofix.yml
+            .github/workflows/style.yml
       - name: Check api inputs
         if: github.event_name != 'merge_group'
         id: api-changes
@@ -58,13 +83,13 @@ jobs:
             dify-agent/**/*.py
             dify-agent/pyproject.toml
             dify-agent/uv.lock
-      - if: github.event_name != 'merge_group' && (steps.docker-compose-changes.outputs.any_changed == 'true' || steps.api-changes.outputs.any_changed == 'true' || steps.frontend-contract-changes.outputs.any_changed == 'true' || steps.dify-agent-changes.outputs.any_changed == 'true')
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      - if: github.event_name != 'merge_group'
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
-          python-version: '3.11'
+          python-version: "3.11"
 
-      - if: github.event_name != 'merge_group' && (steps.api-changes.outputs.any_changed == 'true' || steps.frontend-contract-changes.outputs.any_changed == 'true' || steps.dify-agent-changes.outputs.any_changed == 'true')
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - if: github.event_name != 'merge_group'
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
 
       - name: Generate Docker Compose
         if: github.event_name != 'merge_group' && steps.docker-compose-changes.outputs.any_changed == 'true'
@@ -94,6 +119,12 @@ jobs:
           # Format code
           uv run ruff format .
 
+      - name: count migration progress
+        if: github.event_name != 'merge_group' && steps.api-changes.outputs.any_changed == 'true'
+        run: |
+          cd api
+          ./cnt_base.sh
+
       - name: ast-grep
         if: github.event_name != 'merge_group' && steps.api-changes.outputs.any_changed == 'true'
         run: |
@@ -125,7 +156,7 @@ jobs:
           find . -name "*.py.bak" -type f -delete
 
       - name: Setup web environment
-        if: github.event_name != 'merge_group' && steps.frontend-contract-changes.outputs.any_changed == 'true'
+        if: github.event_name != 'merge_group'
         uses: ./.github/actions/setup-web
 
       - name: Generate API docs
@@ -138,5 +169,13 @@ jobs:
         if: github.event_name != 'merge_group' && steps.frontend-contract-changes.outputs.any_changed == 'true'
         run: pnpm --dir packages/contracts gen-api-contract
 
+      - name: ESLint fallback autofix
+        if: github.event_name != 'merge_group' && steps.web-changes.outputs.any_changed == 'true'
+        run: pnpm lint:eslint:fix --quiet || true
+
+      - name: Vite+ static autofix
+        if: github.event_name != 'merge_group' && (steps.web-changes.outputs.any_changed == 'true' || steps.frontend-contract-changes.outputs.any_changed == 'true')
+        run: vp check --fix || true
+
       - if: github.event_name != 'merge_group'
         uses: autofix-ci/action@c5b2d67aa2274e7b5a18224e8171550871fc7e4a # v1.3.4

.github/workflows/build-push.yml

@@ -3,13 +3,13 @@ name: Build and Push API & Web
 on:
   push:
     branches:
-      - 'main'
-      - 'deploy/**'
-      - 'build/**'
-      - 'release/e-*'
-      - 'hotfix/**'
+      - "main"
+      - "deploy/**"
+      - "build/**"
+      - "release/e-*"
+      - "hotfix/**"
     tags:
-      - '*'
+      - "*"
 
 concurrency:
   group: build-push-${{ github.head_ref || github.run_id }}
@@ -33,60 +33,60 @@ jobs:
     strategy:
       matrix:
         include:
-          - service_name: 'build-api-amd64'
-            image_name_env: 'DIFY_API_IMAGE_NAME'
-            artifact_context: 'api'
-            build_context: '{{defaultContext}}'
-            file: 'api/Dockerfile'
+          - service_name: "build-api-amd64"
+            image_name_env: "DIFY_API_IMAGE_NAME"
+            artifact_context: "api"
+            build_context: "{{defaultContext}}"
+            file: "api/Dockerfile"
             platform: linux/amd64
             runs_on: depot-ubuntu-24.04-4
-          - service_name: 'build-api-arm64'
-            image_name_env: 'DIFY_API_IMAGE_NAME'
-            artifact_context: 'api'
-            build_context: '{{defaultContext}}'
-            file: 'api/Dockerfile'
+          - service_name: "build-api-arm64"
+            image_name_env: "DIFY_API_IMAGE_NAME"
+            artifact_context: "api"
+            build_context: "{{defaultContext}}"
+            file: "api/Dockerfile"
             platform: linux/arm64
             runs_on: depot-ubuntu-24.04-4
-          - service_name: 'build-web-amd64'
-            image_name_env: 'DIFY_WEB_IMAGE_NAME'
-            artifact_context: 'web'
-            build_context: '{{defaultContext}}'
-            file: 'web/Dockerfile'
+          - service_name: "build-web-amd64"
+            image_name_env: "DIFY_WEB_IMAGE_NAME"
+            artifact_context: "web"
+            build_context: "{{defaultContext}}"
+            file: "web/Dockerfile"
             platform: linux/amd64
             runs_on: depot-ubuntu-24.04-4
-          - service_name: 'build-web-arm64'
-            image_name_env: 'DIFY_WEB_IMAGE_NAME'
-            artifact_context: 'web'
-            build_context: '{{defaultContext}}'
-            file: 'web/Dockerfile'
+          - service_name: "build-web-arm64"
+            image_name_env: "DIFY_WEB_IMAGE_NAME"
+            artifact_context: "web"
+            build_context: "{{defaultContext}}"
+            file: "web/Dockerfile"
             platform: linux/arm64
             runs_on: depot-ubuntu-24.04-4
-          - service_name: 'build-agent-amd64'
-            image_name_env: 'DIFY_AGENT_IMAGE_NAME'
-            artifact_context: 'agent'
-            build_context: '{{defaultContext}}'
-            file: 'dify-agent/Dockerfile'
+          - service_name: "build-agent-amd64"
+            image_name_env: "DIFY_AGENT_IMAGE_NAME"
+            artifact_context: "agent"
+            build_context: "{{defaultContext}}"
+            file: "dify-agent/Dockerfile"
             platform: linux/amd64
             runs_on: depot-ubuntu-24.04-4
-          - service_name: 'build-agent-arm64'
-            image_name_env: 'DIFY_AGENT_IMAGE_NAME'
-            artifact_context: 'agent'
-            build_context: '{{defaultContext}}'
-            file: 'dify-agent/Dockerfile'
+          - service_name: "build-agent-arm64"
+            image_name_env: "DIFY_AGENT_IMAGE_NAME"
+            artifact_context: "agent"
+            build_context: "{{defaultContext}}"
+            file: "dify-agent/Dockerfile"
             platform: linux/arm64
             runs_on: depot-ubuntu-24.04-4
-          - service_name: 'build-agent-local-sandbox-amd64'
-            image_name_env: 'DIFY_AGENT_LOCAL_SANDBOX_IMAGE_NAME'
-            artifact_context: 'local-sandbox'
-            build_context: '{{defaultContext}}:dify-agent-runtime'
-            file: 'docker/Dockerfile'
+          - service_name: "build-agent-local-sandbox-amd64"
+            image_name_env: "DIFY_AGENT_LOCAL_SANDBOX_IMAGE_NAME"
+            artifact_context: "local-sandbox"
+            build_context: "{{defaultContext}}:dify-agent-runtime"
+            file: "docker/Dockerfile"
             platform: linux/amd64
             runs_on: depot-ubuntu-24.04-4
-          - service_name: 'build-agent-local-sandbox-arm64'
-            image_name_env: 'DIFY_AGENT_LOCAL_SANDBOX_IMAGE_NAME'
-            artifact_context: 'local-sandbox'
-            build_context: '{{defaultContext}}:dify-agent-runtime'
-            file: 'docker/Dockerfile'
+          - service_name: "build-agent-local-sandbox-arm64"
+            image_name_env: "DIFY_AGENT_LOCAL_SANDBOX_IMAGE_NAME"
+            artifact_context: "local-sandbox"
+            build_context: "{{defaultContext}}:dify-agent-runtime"
+            file: "docker/Dockerfile"
             platform: linux/arm64
             runs_on: depot-ubuntu-24.04-4
 
@@ -97,13 +97,13 @@ jobs:
           echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
 
       - name: Login to Docker Hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           username: ${{ env.DOCKERHUB_USER }}
           password: ${{ env.DOCKERHUB_TOKEN }}
 
       - name: Set up Depot CLI
-        uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1.7.2
+        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.7.1
 
       - name: Extract metadata for Docker
         id: meta
@@ -146,24 +146,24 @@ jobs:
     strategy:
       matrix:
         include:
-          - service_name: 'validate-api-amd64'
-            build_context: '{{defaultContext}}'
-            file: 'api/Dockerfile'
-          - service_name: 'validate-web-amd64'
-            build_context: '{{defaultContext}}'
-            file: 'web/Dockerfile'
-          - service_name: 'validate-agent-amd64'
-            build_context: '{{defaultContext}}'
-            file: 'dify-agent/Dockerfile'
-          - service_name: 'validate-agent-local-sandbox-amd64'
-            build_context: '{{defaultContext}}:dify-agent-runtime'
-            file: 'docker/Dockerfile'
+          - service_name: "validate-api-amd64"
+            build_context: "{{defaultContext}}"
+            file: "api/Dockerfile"
+          - service_name: "validate-web-amd64"
+            build_context: "{{defaultContext}}"
+            file: "web/Dockerfile"
+          - service_name: "validate-agent-amd64"
+            build_context: "{{defaultContext}}"
+            file: "dify-agent/Dockerfile"
+          - service_name: "validate-agent-local-sandbox-amd64"
+            build_context: "{{defaultContext}}:dify-agent-runtime"
+            file: "docker/Dockerfile"
     steps:
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Validate Docker image
-        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           push: false
           context: ${{ matrix.build_context }}
@@ -178,18 +178,18 @@ jobs:
     strategy:
       matrix:
         include:
-          - service_name: 'merge-api-images'
-            image_name_env: 'DIFY_API_IMAGE_NAME'
-            context: 'api'
-          - service_name: 'merge-web-images'
-            image_name_env: 'DIFY_WEB_IMAGE_NAME'
-            context: 'web'
-          - service_name: 'merge-agent-images'
-            image_name_env: 'DIFY_AGENT_IMAGE_NAME'
-            context: 'agent'
-          - service_name: 'merge-agent-local-sandbox-images'
-            image_name_env: 'DIFY_AGENT_LOCAL_SANDBOX_IMAGE_NAME'
-            context: 'local-sandbox'
+          - service_name: "merge-api-images"
+            image_name_env: "DIFY_API_IMAGE_NAME"
+            context: "api"
+          - service_name: "merge-web-images"
+            image_name_env: "DIFY_WEB_IMAGE_NAME"
+            context: "web"
+          - service_name: "merge-agent-images"
+            image_name_env: "DIFY_AGENT_IMAGE_NAME"
+            context: "agent"
+          - service_name: "merge-agent-local-sandbox-images"
+            image_name_env: "DIFY_AGENT_LOCAL_SANDBOX_IMAGE_NAME"
+            context: "local-sandbox"
     steps:
       - name: Download digests
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -199,7 +199,7 @@ jobs:
           merge-multiple: true
 
       - name: Login to Docker Hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           username: ${{ env.DOCKERHUB_USER }}
           password: ${{ env.DOCKERHUB_TOKEN }}
@@ -229,38 +229,3 @@ jobs:
           IMAGE_VERSION: ${{ steps.meta.outputs.version }}
         run: |
           docker buildx imagetools inspect "$IMAGE_NAME:$IMAGE_VERSION"
-
-  sync-e2b-template:
-    needs: create-manifest
-    runs-on: ubuntu-24.04
-    if: github.repository == 'langgenius/dify' && startsWith(github.ref, 'refs/tags/')
-    strategy:
-      matrix:
-        include:
-          - project: dev
-            api_key_secret: E2B_API_KEY_DEV
-          - project: prod
-            api_key_secret: E2B_API_KEY_PROD
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Use Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version-file: package.json
-          cache: ''
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-        with:
-          username: ${{ env.DOCKERHUB_USER }}
-          password: ${{ env.DOCKERHUB_TOKEN }}
-
-      - name: Sync E2B Template (${{ matrix.project }})
-        env:
-          E2B_API_KEY: ${{ secrets[matrix.api_key_secret] }}
-        run: ./dify-agent-runtime/docker/sync-e2b-template.sh

.github/workflows/cli-e2e.yml

@@ -4,19 +4,19 @@ on:
   workflow_dispatch:
     inputs:
       cli_ref:
-        description: 'Git ref (default: current branch)'
+        description: "Git ref (default: current branch)"
         type: string
         required: false
 
       edition:
-        description: 'Dify edition'
+        description: "Dify edition"
         type: choice
         required: false
         default: ee
         options: [ee, ce]
 
       test_scope:
-        description: 'smoke = [P0] only  /  full = all cases'
+        description: "smoke = [P0] only  /  full = all cases"
         type: choice
         required: false
         default: full
@@ -24,23 +24,23 @@ on:
 
       # ── Suite on/off ────────────────────────────────────────────────────────
       suite_framework_output_error:
-        description: 'framework + output + error-handling suites'
+        description: "framework + output + error-handling suites"
         type: boolean
         default: true
       suite_discovery:
-        description: 'discovery suite (get app / describe app)'
+        description: "discovery suite (get app / describe app)"
         type: boolean
         default: true
       suite_run:
-        description: 'run suite (basic / streaming / conversation / file / hitl)'
+        description: "run suite (basic / streaming / conversation / file / hitl)"
         type: boolean
         default: true
       suite_auth:
-        description: 'auth suite (login / status / whoami / use / devices / logout)'
+        description: "auth suite (login / status / whoami / use / devices / logout)"
         type: boolean
         default: true
       suite_agent:
-        description: 'agent suite'
+        description: "agent suite"
         type: boolean
         default: true
 
@@ -51,34 +51,35 @@ permissions:
 # Each job reads DIFY_E2E_TOKEN + app IDs from the provision job outputs,
 # so global-setup skips minting and finds existing apps in < 10 s.
 env:
-  DIFY_E2E_NO_KEYRING: '1' # Linux CI has no keychain; skip probe
-  VITEST_RETRY: '2' # Retry flaky staging responses
+  DIFY_E2E_NO_KEYRING: "1"   # Linux CI has no keychain; skip probe
+  VITEST_RETRY:        "2"    # Retry flaky staging responses
 
 jobs:
-  # ════════════════════════════════════════════════════════════════════════════
-  # 0. PROVISION — mint token + import DSL fixtures (runs once, outputs IDs)
-  # ════════════════════════════════════════════════════════════════════════════
+
+# ════════════════════════════════════════════════════════════════════════════
+# 0. PROVISION — mint token + import DSL fixtures (runs once, outputs IDs)
+# ════════════════════════════════════════════════════════════════════════════
   provision:
-    name: 'Provision: mint token + DSL apps'
+    name: "Provision: mint token + DSL apps"
     runs-on: ubuntu-latest
     timeout-minutes: 10
     outputs:
-      token: ${{ steps.out.outputs.DIFY_E2E_TOKEN }}
-      workspace_id: ${{ steps.out.outputs.DIFY_E2E_WORKSPACE_ID }}
-      workspace_name: ${{ steps.out.outputs.DIFY_E2E_WORKSPACE_NAME }}
-      ws2_id: ${{ steps.out.outputs.DIFY_E2E_WS2_ID }}
-      chat_app_id: ${{ steps.out.outputs.DIFY_E2E_CHAT_APP_ID }}
-      workflow_app_id: ${{ steps.out.outputs.DIFY_E2E_WORKFLOW_APP_ID }}
-      file_app_id: ${{ steps.out.outputs.DIFY_E2E_FILE_APP_ID }}
-      file_chat_app_id: ${{ steps.out.outputs.DIFY_E2E_FILE_CHAT_APP_ID }}
-      hitl_app_id: ${{ steps.out.outputs.DIFY_E2E_HITL_APP_ID }}
-      hitl_external_app_id: ${{ steps.out.outputs.DIFY_E2E_HITL_EXTERNAL_APP_ID }}
-      hitl_single_action_app_id: ${{ steps.out.outputs.DIFY_E2E_HITL_SINGLE_ACTION_APP_ID }}
-      hitl_multi_node_app_id: ${{ steps.out.outputs.DIFY_E2E_HITL_MULTI_NODE_APP_ID }}
-      ws2_app_id: ${{ steps.out.outputs.DIFY_E2E_WS2_APP_ID }}
+      token:                      ${{ steps.out.outputs.DIFY_E2E_TOKEN }}
+      workspace_id:               ${{ steps.out.outputs.DIFY_E2E_WORKSPACE_ID }}
+      workspace_name:             ${{ steps.out.outputs.DIFY_E2E_WORKSPACE_NAME }}
+      ws2_id:                     ${{ steps.out.outputs.DIFY_E2E_WS2_ID }}
+      chat_app_id:                ${{ steps.out.outputs.DIFY_E2E_CHAT_APP_ID }}
+      workflow_app_id:            ${{ steps.out.outputs.DIFY_E2E_WORKFLOW_APP_ID }}
+      file_app_id:                ${{ steps.out.outputs.DIFY_E2E_FILE_APP_ID }}
+      file_chat_app_id:           ${{ steps.out.outputs.DIFY_E2E_FILE_CHAT_APP_ID }}
+      hitl_app_id:                ${{ steps.out.outputs.DIFY_E2E_HITL_APP_ID }}
+      hitl_external_app_id:       ${{ steps.out.outputs.DIFY_E2E_HITL_EXTERNAL_APP_ID }}
+      hitl_single_action_app_id:  ${{ steps.out.outputs.DIFY_E2E_HITL_SINGLE_ACTION_APP_ID }}
+      hitl_multi_node_app_id:     ${{ steps.out.outputs.DIFY_E2E_HITL_MULTI_NODE_APP_ID }}
+      ws2_app_id:                 ${{ steps.out.outputs.DIFY_E2E_WS2_APP_ID }}
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
         with:
           ref: ${{ inputs.cli_ref || github.ref }}
           persist-credentials: false
@@ -87,9 +88,10 @@ jobs:
         with:
           bun-version: latest
 
-      - uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
-          install: false
+          package_json_field: packageManager
+          run_install: false
 
       - name: Install CLI dependencies
         working-directory: cli
@@ -99,19 +101,19 @@ jobs:
         id: out
         working-directory: cli
         env:
-          DIFY_E2E_HOST: ${{ secrets.DIFY_E2E_HOST }}
-          DIFY_E2E_EMAIL: ${{ secrets.DIFY_E2E_EMAIL }}
+          DIFY_E2E_HOST:     ${{ secrets.DIFY_E2E_HOST }}
+          DIFY_E2E_EMAIL:    ${{ secrets.DIFY_E2E_EMAIL }}
           DIFY_E2E_PASSWORD: ${{ secrets.DIFY_E2E_PASSWORD }}
-          DIFY_E2E_TOKEN: ${{ secrets.DIFY_E2E_TOKEN }}
-          DIFY_E2E_EDITION: ${{ inputs.edition || 'ee' }}
+          DIFY_E2E_TOKEN:    ${{ secrets.DIFY_E2E_TOKEN }}
+          DIFY_E2E_EDITION:  ${{ inputs.edition || 'ee' }}
         run: bun scripts/e2e-provision.ts
 
-  # ════════════════════════════════════════════════════════════════════════════
-  # 1-B. framework + output + error-handling (parallel with run/discovery)
-  # ════════════════════════════════════════════════════════════════════════════
+# ════════════════════════════════════════════════════════════════════════════
+# 1-B. framework + output + error-handling (parallel with run/discovery)
+# ════════════════════════════════════════════════════════════════════════════
   suite-framework-output-error:
-    name: 'Suite: framework + output + error-handling'
-    if: ${{ inputs.suite_framework_output_error }}
+    name: "Suite: framework + output + error-handling"
+    if: ${{ inputs.suite_framework_output_error != 'false' }}
     needs: provision
     runs-on: ubuntu-latest
     timeout-minutes: 20
@@ -121,29 +123,31 @@ jobs:
         shell: bash
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
         with:
           ref: ${{ inputs.cli_ref || github.ref }}
           persist-credentials: false
 
       - uses: ./.github/actions/setup-web
       - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: latest
+        with: { bun-version: latest }
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        with: { package_json_field: packageManager, run_install: false }
+      - run: pnpm install --frozen-lockfile
       - run: pnpm tree:gen
 
       - name: Run framework + output + error-handling
         env:
-          DIFY_E2E_HOST: ${{ secrets.DIFY_E2E_HOST }}
-          DIFY_E2E_EMAIL: ${{ secrets.DIFY_E2E_EMAIL }}
-          DIFY_E2E_PASSWORD: ${{ secrets.DIFY_E2E_PASSWORD }}
-          DIFY_E2E_EDITION: ${{ inputs.edition || 'ee' }}
-          DIFY_E2E_TOKEN: ${{ needs.provision.outputs.token }}
-          DIFY_E2E_WORKSPACE_ID: ${{ needs.provision.outputs.workspace_id }}
+          DIFY_E2E_HOST:           ${{ secrets.DIFY_E2E_HOST }}
+          DIFY_E2E_EMAIL:          ${{ secrets.DIFY_E2E_EMAIL }}
+          DIFY_E2E_PASSWORD:       ${{ secrets.DIFY_E2E_PASSWORD }}
+          DIFY_E2E_EDITION:        ${{ inputs.edition || 'ee' }}
+          DIFY_E2E_TOKEN:          ${{ needs.provision.outputs.token }}
+          DIFY_E2E_WORKSPACE_ID:   ${{ needs.provision.outputs.workspace_id }}
           DIFY_E2E_WORKSPACE_NAME: ${{ needs.provision.outputs.workspace_name }}
-          DIFY_E2E_CHAT_APP_ID: ${{ needs.provision.outputs.chat_app_id }}
+          DIFY_E2E_CHAT_APP_ID:    ${{ needs.provision.outputs.chat_app_id }}
           DIFY_E2E_WORKFLOW_APP_ID: ${{ needs.provision.outputs.workflow_app_id }}
-          DIFY_E2E_INCLUDE: 'test/e2e/suites/framework/**/*.e2e.ts,test/e2e/suites/output/**/*.e2e.ts,test/e2e/suites/error-handling/**/*.e2e.ts'
+          DIFY_E2E_INCLUDE: "test/e2e/suites/framework/**/*.e2e.ts,test/e2e/suites/output/**/*.e2e.ts,test/e2e/suites/error-handling/**/*.e2e.ts"
         run: |
           if [ "${{ inputs.test_scope }}" = "smoke" ]; then
             pnpm test:e2e -- -t "\[P0\]"
@@ -151,12 +155,12 @@ jobs:
             pnpm test:e2e
           fi
 
-  # ════════════════════════════════════════════════════════════════════════════
-  # 1-C. Discovery (parallel)
-  # ════════════════════════════════════════════════════════════════════════════
+# ════════════════════════════════════════════════════════════════════════════
+# 1-C. Discovery (parallel)
+# ════════════════════════════════════════════════════════════════════════════
   suite-discovery:
-    name: 'Suite: discovery'
-    if: ${{ inputs.suite_discovery }}
+    name: "Suite: discovery"
+    if: ${{ inputs.suite_discovery != 'false' }}
     needs: provision
     runs-on: ubuntu-latest
     timeout-minutes: 20
@@ -166,30 +170,32 @@ jobs:
         shell: bash
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
         with:
           ref: ${{ inputs.cli_ref || github.ref }}
           persist-credentials: false
 
       - uses: ./.github/actions/setup-web
       - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: latest
+        with: { bun-version: latest }
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        with: { package_json_field: packageManager, run_install: false }
+      - run: pnpm install --frozen-lockfile
       - run: pnpm tree:gen
 
       - name: Run discovery suite
         env:
-          DIFY_E2E_HOST: ${{ secrets.DIFY_E2E_HOST }}
-          DIFY_E2E_EMAIL: ${{ secrets.DIFY_E2E_EMAIL }}
-          DIFY_E2E_PASSWORD: ${{ secrets.DIFY_E2E_PASSWORD }}
-          DIFY_E2E_EDITION: ${{ inputs.edition || 'ee' }}
-          DIFY_E2E_TOKEN: ${{ needs.provision.outputs.token }}
-          DIFY_E2E_WORKSPACE_ID: ${{ needs.provision.outputs.workspace_id }}
+          DIFY_E2E_HOST:           ${{ secrets.DIFY_E2E_HOST }}
+          DIFY_E2E_EMAIL:          ${{ secrets.DIFY_E2E_EMAIL }}
+          DIFY_E2E_PASSWORD:       ${{ secrets.DIFY_E2E_PASSWORD }}
+          DIFY_E2E_EDITION:        ${{ inputs.edition || 'ee' }}
+          DIFY_E2E_TOKEN:          ${{ needs.provision.outputs.token }}
+          DIFY_E2E_WORKSPACE_ID:   ${{ needs.provision.outputs.workspace_id }}
           DIFY_E2E_WORKSPACE_NAME: ${{ needs.provision.outputs.workspace_name }}
-          DIFY_E2E_WS2_ID: ${{ needs.provision.outputs.ws2_id }}
-          DIFY_E2E_CHAT_APP_ID: ${{ needs.provision.outputs.chat_app_id }}
+          DIFY_E2E_WS2_ID:         ${{ needs.provision.outputs.ws2_id }}
+          DIFY_E2E_CHAT_APP_ID:    ${{ needs.provision.outputs.chat_app_id }}
           DIFY_E2E_WORKFLOW_APP_ID: ${{ needs.provision.outputs.workflow_app_id }}
-          DIFY_E2E_INCLUDE: 'test/e2e/suites/discovery/**/*.e2e.ts'
+          DIFY_E2E_INCLUDE: "test/e2e/suites/discovery/**/*.e2e.ts"
         run: |
           if [ "${{ inputs.test_scope }}" = "smoke" ]; then
             pnpm test:e2e -- -t "\[P0\]"
@@ -197,12 +203,12 @@ jobs:
             pnpm test:e2e
           fi
 
-  # ════════════════════════════════════════════════════════════════════════════
-  # 1-D. Run suite — 5 files in matrix (parallel)
-  # ════════════════════════════════════════════════════════════════════════════
+# ════════════════════════════════════════════════════════════════════════════
+# 1-D. Run suite — 5 files in matrix (parallel)
+# ════════════════════════════════════════════════════════════════════════════
   suite-run:
-    name: 'Suite: run / ${{ matrix.name }}'
-    if: ${{ inputs.suite_run }}
+    name: "Suite: run / ${{ matrix.name }}"
+    if: ${{ inputs.suite_run != 'false' }}
     needs: provision
     runs-on: ubuntu-latest
     timeout-minutes: 20
@@ -227,36 +233,38 @@ jobs:
         shell: bash
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
         with:
           ref: ${{ inputs.cli_ref || github.ref }}
           persist-credentials: false
 
       - uses: ./.github/actions/setup-web
       - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: latest
+        with: { bun-version: latest }
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        with: { package_json_field: packageManager, run_install: false }
+      - run: pnpm install --frozen-lockfile
       - run: pnpm tree:gen
 
-      - name: 'Run run/${{ matrix.name }}'
+      - name: "Run run/${{ matrix.name }}"
         env:
-          DIFY_E2E_HOST: ${{ secrets.DIFY_E2E_HOST }}
-          DIFY_E2E_EMAIL: ${{ secrets.DIFY_E2E_EMAIL }}
-          DIFY_E2E_PASSWORD: ${{ secrets.DIFY_E2E_PASSWORD }}
-          DIFY_E2E_EDITION: ${{ inputs.edition || 'ee' }}
-          DIFY_E2E_SSO_TOKEN: ${{ secrets.DIFY_E2E_SSO_TOKEN }}
-          DIFY_E2E_TOKEN: ${{ needs.provision.outputs.token }}
-          DIFY_E2E_WORKSPACE_ID: ${{ needs.provision.outputs.workspace_id }}
-          DIFY_E2E_WORKSPACE_NAME: ${{ needs.provision.outputs.workspace_name }}
-          DIFY_E2E_CHAT_APP_ID: ${{ needs.provision.outputs.chat_app_id }}
-          DIFY_E2E_WORKFLOW_APP_ID: ${{ needs.provision.outputs.workflow_app_id }}
-          DIFY_E2E_FILE_APP_ID: ${{ needs.provision.outputs.file_app_id }}
-          DIFY_E2E_FILE_CHAT_APP_ID: ${{ needs.provision.outputs.file_chat_app_id }}
-          DIFY_E2E_HITL_APP_ID: ${{ needs.provision.outputs.hitl_app_id }}
-          DIFY_E2E_HITL_EXTERNAL_APP_ID: ${{ needs.provision.outputs.hitl_external_app_id }}
+          DIFY_E2E_HOST:                      ${{ secrets.DIFY_E2E_HOST }}
+          DIFY_E2E_EMAIL:                     ${{ secrets.DIFY_E2E_EMAIL }}
+          DIFY_E2E_PASSWORD:                  ${{ secrets.DIFY_E2E_PASSWORD }}
+          DIFY_E2E_EDITION:                   ${{ inputs.edition || 'ee' }}
+          DIFY_E2E_SSO_TOKEN:                 ${{ secrets.DIFY_E2E_SSO_TOKEN }}
+          DIFY_E2E_TOKEN:                     ${{ needs.provision.outputs.token }}
+          DIFY_E2E_WORKSPACE_ID:              ${{ needs.provision.outputs.workspace_id }}
+          DIFY_E2E_WORKSPACE_NAME:            ${{ needs.provision.outputs.workspace_name }}
+          DIFY_E2E_CHAT_APP_ID:               ${{ needs.provision.outputs.chat_app_id }}
+          DIFY_E2E_WORKFLOW_APP_ID:           ${{ needs.provision.outputs.workflow_app_id }}
+          DIFY_E2E_FILE_APP_ID:               ${{ needs.provision.outputs.file_app_id }}
+          DIFY_E2E_FILE_CHAT_APP_ID:          ${{ needs.provision.outputs.file_chat_app_id }}
+          DIFY_E2E_HITL_APP_ID:               ${{ needs.provision.outputs.hitl_app_id }}
+          DIFY_E2E_HITL_EXTERNAL_APP_ID:      ${{ needs.provision.outputs.hitl_external_app_id }}
           DIFY_E2E_HITL_SINGLE_ACTION_APP_ID: ${{ needs.provision.outputs.hitl_single_action_app_id }}
-          DIFY_E2E_HITL_MULTI_NODE_APP_ID: ${{ needs.provision.outputs.hitl_multi_node_app_id }}
-          DIFY_E2E_INCLUDE: 'test/e2e/suites/run/${{ matrix.file }}'
+          DIFY_E2E_HITL_MULTI_NODE_APP_ID:    ${{ needs.provision.outputs.hitl_multi_node_app_id }}
+          DIFY_E2E_INCLUDE: "test/e2e/suites/run/${{ matrix.file }}"
         run: |
           if [ "${{ inputs.test_scope }}" = "smoke" ]; then
             pnpm test:e2e -- -t "\[P0\]"
@@ -272,12 +280,12 @@ jobs:
           path: cli/test-results/
           retention-days: 3
 
-  # ════════════════════════════════════════════════════════════════════════════
-  # 1-E. auth/login + status + whoami (parallel, read-only, safe)
-  # ════════════════════════════════════════════════════════════════════════════
+# ════════════════════════════════════════════════════════════════════════════
+# 1-E. auth/login + status + whoami (parallel, read-only, safe)
+# ════════════════════════════════════════════════════════════════════════════
   suite-auth-safe:
-    name: 'Suite: auth (login / status / whoami)'
-    if: ${{ inputs.suite_auth }}
+    name: "Suite: auth (login / status / whoami)"
+    if: ${{ inputs.suite_auth != 'false' }}
     needs: provision
     runs-on: ubuntu-latest
     timeout-minutes: 15
@@ -287,28 +295,30 @@ jobs:
         shell: bash
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
         with:
           ref: ${{ inputs.cli_ref || github.ref }}
           persist-credentials: false
 
       - uses: ./.github/actions/setup-web
       - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: latest
+        with: { bun-version: latest }
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        with: { package_json_field: packageManager, run_install: false }
+      - run: pnpm install --frozen-lockfile
       - run: pnpm tree:gen
 
       - name: Run auth/login + status + whoami
         env:
-          DIFY_E2E_HOST: ${{ secrets.DIFY_E2E_HOST }}
-          DIFY_E2E_EMAIL: ${{ secrets.DIFY_E2E_EMAIL }}
-          DIFY_E2E_PASSWORD: ${{ secrets.DIFY_E2E_PASSWORD }}
-          DIFY_E2E_EDITION: ${{ inputs.edition || 'ee' }}
-          DIFY_E2E_TOKEN: ${{ needs.provision.outputs.token }}
-          DIFY_E2E_WORKSPACE_ID: ${{ needs.provision.outputs.workspace_id }}
+          DIFY_E2E_HOST:           ${{ secrets.DIFY_E2E_HOST }}
+          DIFY_E2E_EMAIL:          ${{ secrets.DIFY_E2E_EMAIL }}
+          DIFY_E2E_PASSWORD:       ${{ secrets.DIFY_E2E_PASSWORD }}
+          DIFY_E2E_EDITION:        ${{ inputs.edition || 'ee' }}
+          DIFY_E2E_TOKEN:          ${{ needs.provision.outputs.token }}
+          DIFY_E2E_WORKSPACE_ID:   ${{ needs.provision.outputs.workspace_id }}
           DIFY_E2E_WORKSPACE_NAME: ${{ needs.provision.outputs.workspace_name }}
-          DIFY_E2E_WS2_ID: ${{ needs.provision.outputs.ws2_id }}
-          DIFY_E2E_INCLUDE: 'test/e2e/suites/auth/login.e2e.ts,test/e2e/suites/auth/status.e2e.ts,test/e2e/suites/auth/whoami.e2e.ts'
+          DIFY_E2E_WS2_ID:         ${{ needs.provision.outputs.ws2_id }}
+          DIFY_E2E_INCLUDE: "test/e2e/suites/auth/login.e2e.ts,test/e2e/suites/auth/status.e2e.ts,test/e2e/suites/auth/whoami.e2e.ts"
         run: |
           if [ "${{ inputs.test_scope }}" = "smoke" ]; then
             pnpm test:e2e -- -t "\[P0\]"
@@ -316,15 +326,15 @@ jobs:
             pnpm test:e2e
           fi
 
-  # ════════════════════════════════════════════════════════════════════════════
-  # 2. DESTRUCTIVE — auth/use + devices + logout + agent (serial, runs LAST)
-  #    Must wait for ALL parallel suites to finish to avoid token revocation
-  #    invalidating other in-flight requests.
-  # ════════════════════════════════════════════════════════════════════════════
+# ════════════════════════════════════════════════════════════════════════════
+# 2. DESTRUCTIVE — auth/use + devices + logout + agent (serial, runs LAST)
+#    Must wait for ALL parallel suites to finish to avoid token revocation
+#    invalidating other in-flight requests.
+# ════════════════════════════════════════════════════════════════════════════
   suite-last:
-    name: 'Suite: auth-use + devices + logout + agent (last, serial)'
+    name: "Suite: auth-use + devices + logout + agent (last, serial)"
     # Runs when auth is selected; also runs after all parallel jobs finish
-    if: ${{ inputs.suite_auth || inputs.suite_agent }}
+    if: ${{ inputs.suite_auth != 'false' || inputs.suite_agent != 'false' }}
     needs:
       - provision
       - suite-framework-output-error
@@ -341,33 +351,35 @@ jobs:
         shell: bash
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
         with:
           ref: ${{ inputs.cli_ref || github.ref }}
           persist-credentials: false
 
       - uses: ./.github/actions/setup-web
       - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: latest
+        with: { bun-version: latest }
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        with: { package_json_field: packageManager, run_install: false }
+      - run: pnpm install --frozen-lockfile
       - run: pnpm tree:gen
 
       - name: Run use / devices / logout / agent (serial)
         env:
-          DIFY_E2E_HOST: ${{ secrets.DIFY_E2E_HOST }}
-          DIFY_E2E_EMAIL: ${{ secrets.DIFY_E2E_EMAIL }}
-          DIFY_E2E_PASSWORD: ${{ secrets.DIFY_E2E_PASSWORD }}
-          DIFY_E2E_EDITION: ${{ inputs.edition || 'ee' }}
-          DIFY_E2E_TOKEN: ${{ needs.provision.outputs.token }}
-          DIFY_E2E_WORKSPACE_ID: ${{ needs.provision.outputs.workspace_id }}
-          DIFY_E2E_WORKSPACE_NAME: ${{ needs.provision.outputs.workspace_name }}
-          DIFY_E2E_WS2_ID: ${{ needs.provision.outputs.ws2_id }}
-          DIFY_E2E_CHAT_APP_ID: ${{ needs.provision.outputs.chat_app_id }}
-          DIFY_E2E_WORKFLOW_APP_ID: ${{ needs.provision.outputs.workflow_app_id }}
-          DIFY_E2E_HITL_APP_ID: ${{ needs.provision.outputs.hitl_app_id }}
-          DIFY_E2E_HITL_EXTERNAL_APP_ID: ${{ needs.provision.outputs.hitl_external_app_id }}
+          DIFY_E2E_HOST:                      ${{ secrets.DIFY_E2E_HOST }}
+          DIFY_E2E_EMAIL:                     ${{ secrets.DIFY_E2E_EMAIL }}
+          DIFY_E2E_PASSWORD:                  ${{ secrets.DIFY_E2E_PASSWORD }}
+          DIFY_E2E_EDITION:                   ${{ inputs.edition || 'ee' }}
+          DIFY_E2E_TOKEN:                     ${{ needs.provision.outputs.token }}
+          DIFY_E2E_WORKSPACE_ID:              ${{ needs.provision.outputs.workspace_id }}
+          DIFY_E2E_WORKSPACE_NAME:            ${{ needs.provision.outputs.workspace_name }}
+          DIFY_E2E_WS2_ID:                    ${{ needs.provision.outputs.ws2_id }}
+          DIFY_E2E_CHAT_APP_ID:               ${{ needs.provision.outputs.chat_app_id }}
+          DIFY_E2E_WORKFLOW_APP_ID:           ${{ needs.provision.outputs.workflow_app_id }}
+          DIFY_E2E_HITL_APP_ID:               ${{ needs.provision.outputs.hitl_app_id }}
+          DIFY_E2E_HITL_EXTERNAL_APP_ID:      ${{ needs.provision.outputs.hitl_external_app_id }}
           DIFY_E2E_HITL_SINGLE_ACTION_APP_ID: ${{ needs.provision.outputs.hitl_single_action_app_id }}
-          DIFY_E2E_HITL_MULTI_NODE_APP_ID: ${{ needs.provision.outputs.hitl_multi_node_app_id }}
+          DIFY_E2E_HITL_MULTI_NODE_APP_ID:    ${{ needs.provision.outputs.hitl_multi_node_app_id }}
         run: |
           # Collect files in safe order: use → devices → logout (revokes last) → agent
           FILES=()

.github/workflows/cli-edge.yml

@@ -5,7 +5,6 @@ on:
     branches: [main]
     paths:
       - 'cli/**'
-      - 'skills/**'
       - 'packages/contracts/generated/api/openapi/**'
   workflow_dispatch:
 
@@ -24,7 +23,7 @@ jobs:
         working-directory: ./cli
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           fetch-depth: 0
@@ -37,7 +36,7 @@ jobs:
         uses: ./.github/actions/setup-web
 
       - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        uses: oven-sh/setup-bun@4bc047ad259df6fc24a6c9b0f9a0cb08cf17fbe5 # v2.0.2
         with:
           bun-version-file: cli/.bun-version
 

.github/workflows/cli-release.yml

@@ -7,22 +7,12 @@ on:
         description: Dify release tag to attach difyctl assets to (blank = latest stable)
         required: false
         type: string
-      dry_run:
-        description: Build and checksum only — skip asset upload and stale-asset prune
-        required: false
-        type: boolean
-        default: false
   workflow_call:
     inputs:
       release_tag:
         description: Dify release tag to attach difyctl assets to (blank = latest stable)
         required: false
         type: string
-      dry_run:
-        description: Build and checksum only — skip asset upload and stale-asset prune
-        required: false
-        type: boolean
-        default: false
   release:
     types: [released]
 
@@ -45,12 +35,15 @@ jobs:
       dify_tag: ${{ steps.resolve.outputs.dify_tag }}
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
+      - name: Export manifest to env
+        run: node scripts/release-naming.mjs github-env >> "$GITHUB_ENV"
+
       - name: Validate manifest
-        run: node scripts/release-naming.mjs validate
+        run: scripts/release-validate-manifest.sh
 
       - name: Resolve target Dify release
         id: resolve
@@ -77,6 +70,20 @@ jobs:
           echo "dify_tag=${tag}" >> "$GITHUB_OUTPUT"
           echo "::notice::target Dify release ${tag}"
 
+      - name: Compatibility check
+        env:
+          DIFY_TAG: ${{ steps.resolve.outputs.dify_tag }}
+        run: node scripts/release-naming.mjs compat-check "$DIFY_TAG"
+
+      - name: Reject duplicate difyctl version
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if gh api "repos/${GITHUB_REPOSITORY}/git/ref/tags/${difyctlTag}" >/dev/null 2>&1; then
+              echo "::error::difyctl ${version} already released (tag ${difyctlTag} exists); bump cli/package.json version"
+              exit 1
+          fi
+
   release:
     name: build + attach standalone binaries (all targets)
     needs: validate
@@ -91,7 +98,7 @@ jobs:
       DIFY_TAG: ${{ needs.validate.outputs.dify_tag }}
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           fetch-depth: 1
@@ -107,13 +114,12 @@ jobs:
         run: node scripts/release-naming.mjs github-env >> "$GITHUB_ENV"
 
       - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        uses: oven-sh/setup-bun@4bc047ad259df6fc24a6c9b0f9a0cb08cf17fbe5 # v2.0.2
         with:
           bun-version-file: cli/.bun-version
 
       - name: Compile standalone binaries (all targets)
         run: |
-          CLI_VERSION="$version" \
           DIFYCTL_COMMIT="$(git rev-parse HEAD)" \
           DIFYCTL_BUILD_DATE="$(git log -1 --format=%cI HEAD)" \
             pnpm build:bin
@@ -122,7 +128,6 @@ jobs:
         run: scripts/release-write-checksums.sh
 
       - name: Attach difyctl assets to Dify release
-        if: ${{ !inputs.dry_run }}
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
@@ -130,7 +135,6 @@ jobs:
               --repo "$GITHUB_REPOSITORY" --clobber
 
       - name: Prune stale difyctl assets
-        if: ${{ !inputs.dry_run }}
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
@@ -145,3 +149,18 @@ jobs:
                         --repo "$GITHUB_REPOSITORY" --yes
                 fi
               done
+
+      - name: Create provenance tag
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          ref="refs/tags/${difyctlTag}"
+          sha="$(git rev-parse HEAD)"
+          status="$(gh api -X POST "repos/${GITHUB_REPOSITORY}/git/refs" \
+                -f ref="$ref" -f sha="$sha" --silent --include 2>/dev/null \
+                | awk 'NR==1 {print $2; exit}' || true)"
+          case "$status" in
+              201) echo "::notice::created ${ref}" ;;
+              422) echo "::notice::tag ${ref} already exists; skipping (immutable)" ;;
+              *)   echo "::error::provenance tag ${ref} not created (HTTP ${status:-unknown})"; exit 1 ;;
+          esac

.github/workflows/cli-smoke.yml

@@ -4,11 +4,11 @@ on:
   workflow_dispatch:
     inputs:
       dify_version:
-        description: 'Dify image tag to test against (e.g. 1.7.0)'
+        description: "Dify image tag to test against (e.g. 1.7.0)"
         type: string
         required: true
       cli_ref:
-        description: 'Git ref to build the cli from (default: current branch)'
+        description: "Git ref to build the cli from (default: current branch)"
         type: string
         required: false
 
@@ -24,7 +24,7 @@ jobs:
         shell: bash
     steps:
       - name: Checkout cli ref
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ inputs.cli_ref || github.ref }}
           persist-credentials: false
@@ -51,7 +51,7 @@ jobs:
 
       - name: Run smoke against live dify
         working-directory: ./cli
-        run: DIFY_SERVER=http://localhost:5001 bun scripts/run-smoke.ts
+        run: pnpm exec tsx scripts/run-smoke.ts --base-url http://localhost:5001
 
       - name: Dump dify logs on failure
         if: failure()

.github/workflows/cli-tests.yml

@@ -30,7 +30,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -44,14 +44,14 @@ jobs:
 
       - name: Validate release manifest
         if: matrix.os == 'depot-ubuntu-24.04'
-        run: node scripts/release-naming.mjs validate
+        run: scripts/release-validate-manifest.sh
 
       - name: CI pipeline (tree, coverage, build)
         run: pnpm run ci
 
       - name: Report coverage
         if: ${{ env.CODECOV_TOKEN != '' && matrix.os == 'depot-ubuntu-24.04' }}
-        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           directory: cli/coverage
           flags: cli

.github/workflows/db-migration-test.yml

@@ -13,16 +13,16 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Setup UV and Python
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           enable-cache: true
-          python-version: '3.12'
+          python-version: "3.12"
           cache-dependency-glob: api/uv.lock
 
       - name: Install dependencies
@@ -40,7 +40,7 @@ jobs:
           cp envs/middleware.env.example middleware.env
 
       - name: Set up Middlewares
-        uses: hoverkraft-tech/compose-action@b659c744ee9bed25aea2307c017ad849bd104433 # v3.2.0
+        uses: hoverkraft-tech/compose-action@11beaa1c2dae4e8ed7b1665aa074723b6cecb0e4 # v3.0.0
         with:
           compose-file: |
             docker/docker-compose.middleware.yaml
@@ -63,16 +63,16 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Setup UV and Python
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           enable-cache: true
-          python-version: '3.12'
+          python-version: "3.12"
           cache-dependency-glob: api/uv.lock
 
       - name: Install dependencies
@@ -94,7 +94,7 @@ jobs:
           sed -i 's/DB_USERNAME=postgres/DB_USERNAME=mysql/' middleware.env
 
       - name: Set up Middlewares
-        uses: hoverkraft-tech/compose-action@b659c744ee9bed25aea2307c017ad849bd104433 # v3.2.0
+        uses: hoverkraft-tech/compose-action@11beaa1c2dae4e8ed7b1665aa074723b6cecb0e4 # v3.0.0
         with:
           compose-file: |
             docker/docker-compose.middleware.yaml

.github/workflows/deploy-agent.yml

@@ -5,9 +5,9 @@ permissions:
 
 on:
   workflow_run:
-    workflows: ['Build and Push API & Web']
+    workflows: ["Build and Push API & Web"]
     branches:
-      - 'deploy/agent'
+      - "deploy/agent"
     types:
       - completed
 

.github/workflows/deploy-dev.yml

@@ -2,9 +2,9 @@ name: Deploy Dev
 
 on:
   workflow_run:
-    workflows: ['Build and Push API & Web']
+    workflows: ["Build and Push API & Web"]
     branches:
-      - 'deploy/dev'
+      - "deploy/dev"
     types:
       - completed
 

.github/workflows/deploy-enterprise.yml

@@ -5,9 +5,9 @@ permissions:
 
 on:
   workflow_run:
-    workflows: ['Build and Push API & Web']
+    workflows: ["Build and Push API & Web"]
     branches:
-      - 'deploy/enterprise'
+      - "deploy/enterprise"
     types:
       - completed
 

.github/workflows/deploy-hitl-im-dev.yml

@@ -1,25 +0,0 @@
-name: Deploy HITL IM Dev
-
-on:
-  workflow_run:
-    workflows: ['Build and Push API & Web']
-    branches:
-      - 'build/feat/hitl-im-dev'
-    types:
-      - completed
-
-jobs:
-  deploy:
-    runs-on: depot-ubuntu-24.04
-    if: |
-      github.event.workflow_run.conclusion == 'success' &&
-      github.event.workflow_run.head_branch == 'build/feat/hitl-im-dev'
-    steps:
-      - name: Deploy to server
-        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
-        with:
-          host: ${{ secrets.HITL_SSH_HOST }}
-          username: ${{ secrets.SSH_USER }}
-          key: ${{ secrets.SSH_PRIVATE_KEY }}
-          script: |
-            ${{ vars.SSH_SCRIPT || secrets.SSH_SCRIPT }}

.github/workflows/deploy-knowledge.yml

@@ -1,73 +0,0 @@
-name: Deploy Knowledge
-
-permissions:
-  actions: read
-  contents: read
-
-on:
-  workflow_run:
-    workflows: ['Build and Push API & Web']
-    branches:
-      - 'deploy/konwledge'
-    types:
-      - completed
-
-jobs:
-  deploy:
-    runs-on: depot-ubuntu-24.04
-    if: |
-      github.event.workflow_run.conclusion == 'success' &&
-      github.event.workflow_run.head_branch == 'deploy/konwledge'
-    steps:
-      - name: Wait for KnowledgeFS CI
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        timeout-minutes: 35
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const workflowId = "knowledge-fs-ci.yml";
-            const headBranch = context.payload.workflow_run.head_branch;
-            const headSha = context.payload.workflow_run.head_sha;
-            const deadline = Date.now() + 30 * 60 * 1000;
-            const pollIntervalMs = 15 * 1000;
-
-            while (Date.now() < deadline) {
-              const { data } = await github.rest.actions.listWorkflowRuns({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                workflow_id: workflowId,
-                branch: headBranch,
-                event: "push",
-                head_sha: headSha,
-                per_page: 10,
-              });
-              const run = data.workflow_runs[0];
-
-              if (!run) {
-                core.info(`Waiting for ${workflowId} to start for ${headSha}.`);
-              } else if (run.status !== "completed") {
-                core.info(`Waiting for ${run.html_url}; current status is ${run.status}.`);
-              } else if (run.conclusion !== "success") {
-                throw new Error(
-                  `${workflowId} did not succeed for ${headSha}: ${run.conclusion} (${run.html_url})`,
-                );
-              } else {
-                core.info(`KnowledgeFS CI succeeded for ${headSha}: ${run.html_url}`);
-                return;
-              }
-
-              await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
-            }
-
-            throw new Error(`Timed out waiting for ${workflowId} to succeed for ${headSha}.`);
-
-      - name: Deploy to server
-        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
-        with:
-          host: ${{ secrets.SSH_NEW_RAG_HOST }}
-          username: ${{ secrets.SSH_USER }}
-          key: ${{ secrets.SSH_PRIVATE_KEY }}
-          # Allow the shared deployment lock and Celery warm shutdown to finish.
-          command_timeout: 300m
-          script: |
-            ${{ vars.SSH_SCRIPT || secrets.SSH_SCRIPT }}

.github/workflows/deploy-saas.yml

@@ -5,9 +5,9 @@ permissions:
 
 on:
   workflow_run:
-    workflows: ['Build and Push API & Web']
+    workflows: ["Build and Push API & Web"]
     branches:
-      - 'deploy/saas'
+      - "deploy/saas"
     types:
       - completed
 

.github/workflows/dify-agent-tests.yml

@@ -1,47 +0,0 @@
-name: Dify Agent Tests
-
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: dify-agent-tests-${{ github.head_ref || github.run_id }}
-  cancel-in-progress: true
-
-jobs:
-  dify-agent-unit:
-    name: Dify Agent Unit Tests
-    runs-on: depot-ubuntu-24.04
-    defaults:
-      run:
-        shell: bash
-        working-directory: dify-agent
-    strategy:
-      matrix:
-        python-version:
-          - '3.12'
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Setup UV and Python
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
-        with:
-          enable-cache: true
-          python-version: ${{ matrix.python-version }}
-          cache-dependency-glob: dify-agent/uv.lock
-
-      - name: Check UV lockfile
-        run: uv lock --check
-
-      - name: Install dependencies
-        run: uv sync --extra server --dev
-
-      - name: Run unit tests
-        run: uv run pytest

.github/workflows/docker-build.yml

@@ -3,7 +3,7 @@ name: Build docker image
 on:
   pull_request:
     branches:
-      - 'main'
+      - "main"
     paths:
       - api/Dockerfile
       - api/Dockerfile.dockerignore
@@ -33,39 +33,39 @@ jobs:
     strategy:
       matrix:
         include:
-          - service_name: 'api-amd64'
+          - service_name: "api-amd64"
             platform: linux/amd64
             runs_on: depot-ubuntu-24.04-4
-            context: '{{defaultContext}}'
-            file: 'api/Dockerfile'
-          - service_name: 'api-arm64'
+            context: "{{defaultContext}}"
+            file: "api/Dockerfile"
+          - service_name: "api-arm64"
             platform: linux/arm64
             runs_on: depot-ubuntu-24.04-4
-            context: '{{defaultContext}}'
-            file: 'api/Dockerfile'
-          - service_name: 'web-amd64'
+            context: "{{defaultContext}}"
+            file: "api/Dockerfile"
+          - service_name: "web-amd64"
             platform: linux/amd64
             runs_on: depot-ubuntu-24.04-4
-            context: '{{defaultContext}}'
-            file: 'web/Dockerfile'
-          - service_name: 'web-arm64'
+            context: "{{defaultContext}}"
+            file: "web/Dockerfile"
+          - service_name: "web-arm64"
             platform: linux/arm64
             runs_on: depot-ubuntu-24.04-4
-            context: '{{defaultContext}}'
-            file: 'web/Dockerfile'
-          - service_name: 'local-sandbox-amd64'
+            context: "{{defaultContext}}"
+            file: "web/Dockerfile"
+          - service_name: "local-sandbox-amd64"
             platform: linux/amd64
             runs_on: depot-ubuntu-24.04-4
-            context: '{{defaultContext}}:dify-agent-runtime'
-            file: 'docker/Dockerfile'
-          - service_name: 'local-sandbox-arm64'
+            context: "{{defaultContext}}:dify-agent-runtime"
+            file: "docker/Dockerfile"
+          - service_name: "local-sandbox-arm64"
             platform: linux/arm64
             runs_on: depot-ubuntu-24.04-4
-            context: '{{defaultContext}}:dify-agent-runtime'
-            file: 'docker/Dockerfile'
+            context: "{{defaultContext}}:dify-agent-runtime"
+            file: "docker/Dockerfile"
     steps:
       - name: Set up Depot CLI
-        uses: depot/setup-action@91bc8495a33ebfc504ffc89e5674379ccf23c29c # v1.7.2
+        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.7.1
 
       - name: Build Docker Image
         uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0
@@ -85,21 +85,21 @@ jobs:
     strategy:
       matrix:
         include:
-          - service_name: 'api-amd64'
-            context: '{{defaultContext}}'
-            file: 'api/Dockerfile'
-          - service_name: 'web-amd64'
-            context: '{{defaultContext}}'
-            file: 'web/Dockerfile'
-          - service_name: 'local-sandbox-amd64'
-            context: '{{defaultContext}}:dify-agent-runtime'
-            file: 'docker/Dockerfile'
+          - service_name: "api-amd64"
+            context: "{{defaultContext}}"
+            file: "api/Dockerfile"
+          - service_name: "web-amd64"
+            context: "{{defaultContext}}"
+            file: "web/Dockerfile"
+          - service_name: "local-sandbox-amd64"
+            context: "{{defaultContext}}:dify-agent-runtime"
+            file: "docker/Dockerfile"
     steps:
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Build Docker Image
-        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           push: false
           context: ${{ matrix.context }}

.github/workflows/hotfix-cherry-pick.yml

@@ -24,7 +24,7 @@ jobs:
     name: Require cherry-pick provenance
     runs-on: depot-ubuntu-24.04
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 

.github/workflows/image-resources.yml

@@ -1,39 +0,0 @@
-name: Image optimization
-
-on:
-  pull_request:
-
-permissions:
-  contents: read
-
-jobs:
-  image-resources:
-    name: Image optimization
-    runs-on: depot-ubuntu-24.04
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          persist-credentials: false
-          fetch-depth: 0
-
-      - name: Set up workspace toolchain
-        uses: ./.github/actions/setup-web
-        with:
-          run-install: 'false'
-
-      - name: Install image checker dependencies
-        run: pnpm --filter @dify/image-resources... install --frozen-lockfile --ignore-scripts
-
-      - name: Type-check image checker
-        run: pnpm --filter @dify/image-resources type-check
-
-      - name: Test image checker
-        run: pnpm --filter @dify/image-resources test
-
-      - name: Check image optimization
-        env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-        run: |
-          pnpm --filter @dify/image-resources check:images --base "$BASE_SHA"

.github/workflows/labeler.yml

@@ -1,4 +1,4 @@
-name: 'Pull Request Labeler'
+name: "Pull Request Labeler"
 on:
   pull_request_target:
 
@@ -9,6 +9,6 @@ jobs:
       pull-requests: write
     runs-on: depot-ubuntu-24.04
     steps:
-      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
+      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
         with:
           sync-labels: true

.github/workflows/main-ci.yml

@@ -2,9 +2,9 @@ name: Main CI Pipeline
 
 on:
   pull_request:
-    branches: ['main']
+    branches: ["main"]
   merge_group:
-    branches: ['main']
+    branches: ["main"]
     types: [checks_requested]
 
 permissions:
@@ -15,10 +15,8 @@ permissions:
   statuses: write
 
 concurrency:
-  # Pull request deduplication is owned by skip-duplicate-actions so pre_job can
-  # publish should_skip before required status finalizers run.
-  group: main-ci-${{ github.event.merge_group.head_sha || github.run_id }}
-  cancel-in-progress: ${{ github.event_name == 'merge_group' }}
+  group: main-ci-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
 
 jobs:
   pre_job:
@@ -37,6 +35,8 @@ jobs:
   # Check which paths were changed to determine which tests to run
   check-changes:
     name: Check Changed Files
+    needs: pre_job
+    if: needs.pre_job.outputs.should_skip != 'true'
     runs-on: depot-ubuntu-24.04
     outputs:
       api-changed: ${{ steps.changes.outputs.api }}
@@ -46,15 +46,9 @@ jobs:
       vdb-changed: ${{ steps.changes.outputs.vdb }}
       migration-changed: ${{ steps.changes.outputs.migration }}
       sandbox-runtime-changed: ${{ steps.changes.outputs.sandbox-runtime }}
-      dify-agent-changed: ${{ steps.changes.outputs.dify-agent }}
-      python-style-changed: ${{ steps.changes.outputs.python-style }}
-      dify-agent-style-changed: ${{ steps.changes.outputs.dify-agent-style }}
-      web-style-changed: ${{ steps.changes.outputs.web-style }}
-      ts-common-style-changed: ${{ steps.changes.outputs.ts-common-style }}
-      superlinter-changed: ${{ steps.changes.outputs.superlinter }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
         id: changes
         with:
           filters: |
@@ -78,7 +72,6 @@ jobs:
               - 'docker/volumes/sandbox/conf/**'
             cli:
               - 'cli/**'
-              - 'skills/**'
               - 'packages/contracts/**'
               - 'packages/tsconfig/**'
               - 'package.json'
@@ -86,6 +79,7 @@ jobs:
               - 'pnpm-workspace.yaml'
               - 'lint.config.ts'
               - '.npmrc'
+              - '.nvmrc'
               - '.github/workflows/cli-tests.yml'
               - '.github/actions/setup-web/**'
             web:
@@ -94,26 +88,25 @@ jobs:
               - 'package.json'
               - 'pnpm-lock.yaml'
               - 'pnpm-workspace.yaml'
-              - '.github/workflows/main-ci.yml'
+              - '.nvmrc'
               - '.github/workflows/web-tests.yml'
               - '.github/actions/setup-web/**'
             e2e:
               - 'api/**'
+              - 'api/pyproject.toml'
+              - 'api/uv.lock'
               - 'e2e/**'
               - 'web/**'
               - 'packages/**'
               - 'package.json'
               - 'pnpm-lock.yaml'
               - 'pnpm-workspace.yaml'
+              - '.nvmrc'
               - 'docker/docker-compose.middleware.yaml'
               - 'docker/envs/middleware.env.example'
-              - 'docker/ssrf_proxy/**'
-              - 'docker/volumes/sandbox/conf/**'
               - '.github/workflows/web-e2e.yml'
               - '.github/workflows/main-ci.yml'
               - '.github/actions/setup-web/**'
-              - '.github/actions/setup-core-e2e/**'
-              - '.github/actions/wait-e2e-web-build/**'
             vdb:
               - 'api/core/rag/datasource/**'
               - 'api/tests/integration_tests/vdb/**'
@@ -142,9 +135,6 @@ jobs:
             sandbox-runtime:
               - 'dify-agent-runtime/**'
               - '.github/workflows/sandbox-runtime-tests.yml'
-            dify-agent:
-              - 'dify-agent/**'
-              - '.github/workflows/dify-agent-tests.yml'
             migration:
               - 'api/migrations/**'
               - 'api/.env.example'
@@ -156,63 +146,6 @@ jobs:
               - 'docker/generate_docker_compose'
               - 'docker/ssrf_proxy/**'
               - 'docker/volumes/sandbox/conf/**'
-            python-style:
-              - 'api/**'
-              - 'scripts/ast_grep_guard.py'
-              - 'scripts/check_no_new_getattr.py'
-              - 'scripts/check_no_new_controller_sqlalchemy.py'
-              - 'scripts/lint_controller_sqlalchemy.py'
-              - 'scripts/ast_grep_rules/no_new_getattr.yml'
-              - 'scripts/ast_grep_rules/no_new_controller_sqlalchemy.yml'
-              - '.github/workflows/style.yml'
-              - '.github/workflows/main-ci.yml'
-            dify-agent-style:
-              - 'dify-agent/**'
-              - '.github/workflows/style.yml'
-              - '.github/workflows/main-ci.yml'
-            web-style:
-              - 'web/**'
-              - 'e2e/**'
-              - 'sdks/nodejs-client/**'
-              - 'packages/**'
-              - 'package.json'
-              - 'pnpm-lock.yaml'
-              - 'pnpm-workspace.yaml'
-              - 'knip.config.ts'
-              - 'scripts/check-web-production-unused-after-knip-fix.mjs'
-              - '.npmrc'
-              - '.github/workflows/main-ci.yml'
-              - '.github/workflows/web-bundle-size.yml'
-              - '.github/workflows/style.yml'
-              - '.github/actions/setup-web/**'
-            ts-common-style:
-              - 'web/**'
-              - 'cli/**'
-              - 'skills/**'
-              - 'e2e/**'
-              - 'sdks/nodejs-client/**'
-              - 'packages/**'
-              - 'package.json'
-              - 'pnpm-lock.yaml'
-              - 'pnpm-workspace.yaml'
-              - 'tsconfig.json'
-              - 'vite.config.ts'
-              - 'lint.config.ts'
-              - 'eslint.config.mjs'
-              - 'knip.config.ts'
-              - 'scripts/check-web-production-unused-after-knip-fix.mjs'
-              - 'oxlint-suppressions.json'
-              - 'eslint-suppressions.json'
-              - '.vscode/**'
-              - '.github/**'
-            superlinter:
-              - '**.sh'
-              - '**.yaml'
-              - '**.yml'
-              - '**Dockerfile'
-              - 'dev/**'
-              - '.editorconfig'
-              - '.vite-hooks/**'
 
   # Run tests in parallel while always emitting stable required checks.
   api-tests-run:
@@ -459,20 +392,11 @@ jobs:
 
   style-check:
     name: Style Check
-    if: ${{ always() }}
-    needs:
-      - pre_job
-      - check-changes
+    needs: pre_job
+    if: needs.pre_job.outputs.should_skip != 'true'
     uses: ./.github/workflows/style.yml
     with:
       base-rev: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha }}
-      classification-succeeded: ${{ needs.check-changes.result == 'success' }}
-      run-python-style: ${{ needs.check-changes.outputs.python-style-changed == 'true' }}
-      run-dify-agent-style: ${{ needs.check-changes.outputs.dify-agent-style-changed == 'true' }}
-      run-web-style: ${{ needs.check-changes.outputs.web-style-changed == 'true' }}
-      run-ts-common-style: ${{ needs.check-changes.outputs.ts-common-style-changed == 'true' }}
-      run-superlinter: ${{ needs.check-changes.outputs.superlinter-changed == 'true' }}
-      skip-checks: ${{ needs.pre_job.outputs.should_skip == 'true' }}
 
   vdb-tests-run:
     name: Run VDB Tests
@@ -651,63 +575,3 @@ jobs:
 
           echo "Sandbox runtime tests were not required, but the skip job finished with result: $SKIP_RESULT" >&2
           exit 1
-
-  dify-agent-tests-run:
-    name: Run Dify Agent Tests
-    needs:
-      - pre_job
-      - check-changes
-    if: needs.pre_job.outputs.should_skip != 'true' && needs.check-changes.outputs.dify-agent-changed == 'true'
-    uses: ./.github/workflows/dify-agent-tests.yml
-    secrets: inherit
-
-  dify-agent-tests-skip:
-    name: Skip Dify Agent Tests
-    needs:
-      - pre_job
-      - check-changes
-    if: needs.pre_job.outputs.should_skip != 'true' && needs.check-changes.outputs.dify-agent-changed != 'true'
-    runs-on: depot-ubuntu-24.04
-    steps:
-      - name: Report skipped dify agent tests
-        run: echo "No dify-agent-related changes detected; skipping dify agent tests."
-
-  dify-agent-tests:
-    name: Dify Agent Tests
-    if: ${{ always() }}
-    needs:
-      - pre_job
-      - check-changes
-      - dify-agent-tests-run
-      - dify-agent-tests-skip
-    runs-on: depot-ubuntu-24.04
-    steps:
-      - name: Finalize Dify Agent Tests status
-        env:
-          SHOULD_SKIP_WORKFLOW: ${{ needs.pre_job.outputs.should_skip }}
-          TESTS_CHANGED: ${{ needs.check-changes.outputs.dify-agent-changed }}
-          RUN_RESULT: ${{ needs.dify-agent-tests-run.result }}
-          SKIP_RESULT: ${{ needs.dify-agent-tests-skip.result }}
-        run: |
-          if [[ "$SHOULD_SKIP_WORKFLOW" == 'true' ]]; then
-            echo "Dify agent tests were skipped because this workflow run duplicated a successful or newer run."
-            exit 0
-          fi
-
-          if [[ "$TESTS_CHANGED" == 'true' ]]; then
-            if [[ "$RUN_RESULT" == 'success' ]]; then
-              echo "Dify agent tests ran successfully."
-              exit 0
-            fi
-
-            echo "Dify agent tests were required but finished with result: $RUN_RESULT" >&2
-            exit 1
-          fi
-
-          if [[ "$SKIP_RESULT" == 'success' ]]; then
-            echo "Dify agent tests were skipped because no dify-agent-related files changed."
-            exit 0
-          fi
-
-          echo "Dify agent tests were not required, but the skip job finished with result: $SKIP_RESULT" >&2
-          exit 1

.github/workflows/post-merge.yml

@@ -2,7 +2,7 @@ name: Post-Merge Checks
 
 on:
   push:
-    branches: ['main']
+    branches: ["main"]
 
 permissions:
   contents: read
@@ -18,8 +18,8 @@ jobs:
     outputs:
       external-e2e-changed: ${{ steps.changes.outputs.external_e2e }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
         id: changes
         with:
           filters: |
@@ -36,15 +36,15 @@ jobs:
               - 'e2e/package.json'
               - 'e2e/test-env.ts'
               - 'e2e/tsconfig.json'
+              - 'e2e/tsx-register.js'
               - 'package.json'
               - 'pnpm-lock.yaml'
+              - '.nvmrc'
               - '.github/workflows/post-merge.yml'
               - '.github/workflows/web-e2e.yml'
               - '.github/actions/setup-web/**'
               - 'docker/docker-compose.middleware.yaml'
               - 'docker/envs/middleware.env.example'
-              - 'docker/ssrf_proxy/**'
-              - 'docker/volumes/sandbox/conf/**'
               - 'dify-agent/**'
               - 'dify-agent-runtime/**'
               - 'api/pyproject.toml'
@@ -54,30 +54,12 @@ jobs:
               - 'api/core/app/apps/agent_app/**'
               - 'api/core/workflow/nodes/agent_v2/**'
               - 'api/controllers/console/agent/**'
-              - 'api/controllers/console/app/agent*.py'
-              - 'api/controllers/console/app/audio.py'
-              - 'api/controllers/common/agent_access.py'
-              - 'api/controllers/inner_api/agent/**'
-              - 'api/controllers/inner_api/wraps.py'
-              - 'api/controllers/service_api/app/completion.py'
-              - 'api/controllers/service_api/wraps.py'
-              - 'api/controllers/web/completion.py'
-              - 'api/controllers/web/wraps.py'
-              - 'api/services/agent_llm_inner_service.py'
-              - 'api/services/agent_tool_inner_service.py'
-              - 'api/services/audio_service.py'
-              - 'api/services/entities/agent_llm_inner.py'
-              - 'api/services/entities/agent_tool_inner.py'
-              - 'api/services/errors/agent_tool_inner.py'
               - 'api/services/agent/**'
               - 'api/core/plugin/**'
               - 'api/services/plugin/**'
               - 'api/core/tools/**'
               - 'api/services/tools/**'
               - 'packages/contracts/package.json'
-              - 'packages/contracts/console.ts'
-              - 'packages/contracts/generated/api/console/router.gen.ts'
-              - 'packages/contracts/generated/api/web/**'
               - 'packages/contracts/generated/api/console/agent/**'
               - 'packages/contracts/generated/api/console/apps/**'
               - 'packages/contracts/generated/api/console/datasets/**'
@@ -85,27 +67,20 @@ jobs:
               - 'packages/contracts/generated/api/console/workspaces/**'
               - 'packages/contracts/generated/api/service/**'
               - 'web/features/agent-v2/**'
-              - 'web/app/\(commonLayout\)/agents/**'
-              - 'web/app/\(commonLayout\)/@detailSidebar/agents/**'
-              - 'web/app/\(shareLayout\)/chat/**'
-              - 'web/app/\(shareLayout\)/components/**'
-              - 'web/app/components/base/chat/chat-with-history/**'
+              - 'web/app/(commonLayout)/agents/**'
+              - 'web/app/(commonLayout)/@detailSidebar/agents/**'
+              - 'web/app/(commonLayout)/roster/**'
               - 'web/app/components/base/chat/chat/**'
               - 'web/app/components/base/voice-input/**'
-              - 'web/app/components/workflow/index.tsx'
-              - 'web/app/components/workflow/block-selector/**'
-              - 'web/app/components/workflow/hooks/use-node-keyboard-interactions.ts'
-              - 'web/app/components/workflow/hooks/use-nodes-interactions.ts'
-              - 'web/app/components/workflow/hooks/use-nodes-sync-draft.ts'
-              - 'web/app/components/workflow/nodes/_base/**'
               - 'web/app/components/workflow/nodes/agent-v2/**'
-              - 'web/i18n/locales/en-US/agent-v-2.json'
-              - 'web/i18n/locales/en-US/common.json'
+              - 'web/i18n/en-US/agent-v-2.json'
+              - 'web/i18n/en-US/common.json'
               - 'web/service/base.ts'
-              - 'web/service/console/**'
+              - 'web/service/client.ts'
+              - 'web/service/console-link.ts'
+              - 'web/service/console-openapi-url.ts'
+              - 'web/service/console-router-loader.ts'
               - 'web/service/share.ts'
-              - 'web/service/use-share.ts'
-              - 'web/service/webapp-address.ts'
               - 'web/package.json'
               - 'pnpm-workspace.yaml'
 
@@ -113,9 +88,6 @@ jobs:
     name: External Runtime E2E
     needs: check-changes
     if: needs.check-changes.outputs.external-e2e-changed == 'true'
-    permissions:
-      actions: read
-      contents: read
     uses: ./.github/workflows/web-e2e.yml
     with:
       run-external-runtime: true

.github/workflows/pyrefly-diff.yml

@@ -17,12 +17,12 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout PR branch
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 
       - name: Setup Python & UV
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           enable-cache: true
 

.github/workflows/pyrefly-type-coverage-comment.yml

@@ -21,10 +21,10 @@ jobs:
     if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.pull_requests[0].head.repo.full_name != github.repository }}
     steps:
       - name: Checkout default branch (trusted code)
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup Python & UV
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           enable-cache: true
 

.github/workflows/pyrefly-type-coverage.yml

@@ -17,12 +17,12 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout PR branch
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 
       - name: Setup Python & UV
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           enable-cache: true
 

.github/workflows/sandbox-runtime-tests.yml

@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -45,7 +45,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -57,7 +57,7 @@ jobs:
           cache-dependency-path: dify-agent-runtime/go.sum
 
       - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v6.5.0
         with:
           working-directory: dify-agent-runtime
           version: latest
@@ -72,7 +72,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false

.github/workflows/semantic-pull-request.yml

@@ -8,7 +8,7 @@ on:
       - reopened
       - synchronize
   merge_group:
-    branches: ['main']
+    branches: ["main"]
     types: [checks_requested]
 
 jobs:

.github/workflows/size-labeler.yml

@@ -1,55 +0,0 @@
-name: Pull Request Size Labeler
-
-on:
-  pull_request_target:
-    types: [opened, reopened, synchronize, ready_for_review, edited]
-
-permissions:
-  pull-requests: write
-
-concurrency:
-  group: size-labeler-${{ github.event.pull_request.number }}
-  cancel-in-progress: false
-
-jobs:
-  label:
-    runs-on: depot-ubuntu-24.04
-    steps:
-      # Only read PR metadata. Never check out or execute the PR's code here.
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const { owner, repo } = context.repo
-            const issue_number = context.payload.pull_request.number
-            const { data: pr } = await github.rest.pulls.get({ owner, repo, pull_number: issue_number })
-            const files = await github.paginate(github.rest.pulls.listFiles, {
-              owner, repo, pull_number: issue_number, per_page: 100,
-            })
-            // GitHub caps this endpoint at 3,000 files; avoid labeling a partial count.
-            if (files.length !== pr.changed_files) {
-              core.warning('Skipping size label because the changed-file list is incomplete')
-              return
-            }
-            const ignoredNames = new Set(['uv.lock', 'pnpm-lock.yaml', 'package-lock.json', 'yarn.lock'])
-            const changes = files
-              .filter(file => !ignoredNames.has(file.filename.split('/').pop()))
-              .reduce((total, file) => total + file.additions + file.deletions, 0)
-            // Match the descriptions of the repository's existing size labels.
-            const buckets = [
-              [10, 'size:XS'], [30, 'size:S'], [100, 'size:M'],
-              [500, 'size:L'], [1000, 'size:XL'], [Infinity, 'size:XXL'],
-            ]
-            const label = buckets.find(([limit]) => changes < limit)[1]
-            const sizeLabels = new Set(buckets.map(([, name]) => name))
-            const labels = await github.paginate(github.rest.issues.listLabelsOnIssue, {
-              owner, repo, issue_number, per_page: 100,
-            })
-            // Add first so an API error cannot leave the PR without a size label.
-            if (!labels.some(item => item.name === label)) {
-              await github.rest.issues.addLabels({ owner, repo, issue_number, labels: [label] })
-            }
-            for (const item of labels) {
-              if (sizeLabels.has(item.name) && item.name !== label) {
-                await github.rest.issues.removeLabel({ owner, repo, issue_number, name: item.name })
-              }
-            }

.github/workflows/stale.yml

@@ -11,19 +11,20 @@ on:
 
 jobs:
   stale:
+
     runs-on: depot-ubuntu-24.04
     permissions:
       issues: write
       pull-requests: write
 
     steps:
-      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
+      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
         with:
           days-before-issue-stale: 15
           days-before-issue-close: 3
           repo-token: ${{ secrets.GITHUB_TOKEN }}
-          stale-issue-message: 'Closed due to inactivity. If you have any questions, you can reopen it.'
-          stale-pr-message: 'Closed due to inactivity. If you have any questions, you can reopen it.'
+          stale-issue-message: "Closed due to inactivity. If you have any questions, you can reopen it."
+          stale-pr-message: "Closed due to inactivity. If you have any questions, you can reopen it."
           stale-issue-label: 'no-issue-activity'
           stale-pr-label: 'no-pr-activity'
           any-of-labels: '🌚 invalid,🙋‍♂️ question,wont-fix,no-issue-activity,no-pr-activity,💪 enhancement,🤔 cant-reproduce,🙏 help wanted'

.github/workflows/style.yml

@@ -6,35 +6,10 @@ on:
       base-rev:
         required: true
         type: string
-      classification-succeeded:
-        description: Whether the caller successfully classified the changed files.
-        required: true
-        type: boolean
-      run-python-style:
-        description: Run Python style checks for the changed files.
-        required: true
-        type: boolean
-      run-dify-agent-style:
-        description: Run Dify Agent style checks for the changed files.
-        required: true
-        type: boolean
-      run-web-style:
-        description: Run Web style checks for the changed files.
-        required: true
-        type: boolean
-      run-ts-common-style:
-        description: Run shared TypeScript style checks for the changed files.
-        required: true
-        type: boolean
-      run-superlinter:
-        description: Run SuperLinter for the changed files.
-        required: true
-        type: boolean
-      skip-checks:
-        description: Create the required check runs without repeating previously successful work.
-        required: false
-        type: boolean
-        default: false
+
+concurrency:
+  group: style-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
 
 permissions:
   checks: write
@@ -44,82 +19,70 @@ permissions:
 jobs:
   python-style:
     name: Python Style
-    if: ${{ !inputs.skip-checks && (!inputs.classification-succeeded || inputs.run-python-style || inputs.run-dify-agent-style) }}
     runs-on: depot-ubuntu-24.04
 
     steps:
-      - name: Verify changed-file classification
-        if: ${{ !inputs.classification-succeeded }}
-        run: |
-          echo "Changed-file classification failed; refusing to skip Python style checks." >&2
-          exit 1
-
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           fetch-depth: 0
 
+      - name: Check changed files
+        id: changed-files
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
+        with:
+          files: |
+            api/**
+            scripts/ast_grep_guard.py
+            scripts/check_no_new_getattr.py
+            scripts/check_no_new_controller_sqlalchemy.py
+            scripts/lint_controller_sqlalchemy.py
+            scripts/ast_grep_rules/no_new_getattr.yml
+            scripts/ast_grep_rules/no_new_controller_sqlalchemy.yml
+            .github/workflows/style.yml
+            .github/workflows/main-ci.yml
+
       - name: Setup UV and Python
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        if: steps.changed-files.outputs.any_changed == 'true'
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           enable-cache: false
-          python-version: '3.12'
-          cache-dependency-glob: |
-            api/uv.lock
-            dify-agent/uv.lock
+          python-version: "3.12"
+          cache-dependency-glob: api/uv.lock
 
       - name: Install dependencies
-        if: inputs.run-python-style
+        if: steps.changed-files.outputs.any_changed == 'true'
         run: uv sync --project api --dev
 
       - name: Run Import Linter
-        if: inputs.run-python-style
+        if: steps.changed-files.outputs.any_changed == 'true'
         run: uv run --directory api --dev lint-imports
 
       - name: Run Response Contract Linter
-        if: inputs.run-python-style
+        if: steps.changed-files.outputs.any_changed == 'true'
         run: uv run --project api --dev python api/dev/lint_response_contracts.py --fail-on-mismatch
 
       - name: Run No New Getattr Guard
-        if: inputs.run-python-style
+        if: steps.changed-files.outputs.any_changed == 'true'
         run: uv run --project api python scripts/check_no_new_getattr.py --base-rev "${{ inputs.base-rev }}"
 
       - name: Run No New Controller SQLAlchemy Guard
-        if: inputs.run-python-style
+        if: steps.changed-files.outputs.any_changed == 'true'
         run: uv run --project api python scripts/check_no_new_controller_sqlalchemy.py --base-rev "${{ inputs.base-rev }}"
 
       - name: Run Type Checks
-        if: inputs.run-python-style
+        if: steps.changed-files.outputs.any_changed == 'true'
         env:
           PYREFLY_OUTPUT_FORMAT: github
         run: make type-check-core
 
-      - name: Run Dify Agent Ruff
-        if: inputs.run-dify-agent-style
-        run: make -C dify-agent check
-
-      - name: Run Dify Agent Type Checks
-        if: inputs.run-dify-agent-style
-        run: make -C dify-agent typecheck
-
       - name: Dotenv check
-        if: inputs.run-python-style
+        if: steps.changed-files.outputs.any_changed == 'true'
         run: uv run --project api dotenv-linter ./api/.env.example ./web/.env.example
 
-  web-build:
-    name: Web Build and Bundle Analysis
-    if: ${{ !inputs.skip-checks && inputs.classification-succeeded && inputs.run-web-style }}
-    permissions:
-      contents: read
-      pull-requests: write
-    uses: ./.github/workflows/web-bundle-size.yml
-    with:
-      base-rev: ${{ inputs.base-rev }}
-
-  web-style-checks:
-    name: Web Static Checks
-    if: ${{ !inputs.skip-checks && (!inputs.classification-succeeded || inputs.run-web-style) }}
+  web-style:
+    name: Web Style
     runs-on: depot-ubuntu-24.04
     defaults:
       run:
@@ -129,130 +92,128 @@ jobs:
       pull-requests: read
 
     steps:
-      - name: Verify changed-file classification
-        if: ${{ !inputs.classification-succeeded }}
-        working-directory: .
-        run: |
-          echo "Changed-file classification failed; refusing to skip Web style checks." >&2
-          exit 1
-
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
+      - name: Check changed files
+        id: changed-files
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
+        with:
+          files: |
+            web/**
+            e2e/**
+            sdks/nodejs-client/**
+            packages/**
+            package.json
+            pnpm-lock.yaml
+            pnpm-workspace.yaml
+            .nvmrc
+            .github/workflows/style.yml
+            .github/actions/setup-web/**
+
       - name: Setup web environment
+        if: steps.changed-files.outputs.any_changed == 'true'
         uses: ./.github/actions/setup-web
 
-      - name: Check generated i18n types
-        run: vp run i18n:check-types
-
       - name: Web tsslint
+        if: steps.changed-files.outputs.any_changed == 'true'
         env:
           NODE_OPTIONS: --max-old-space-size=4096
         run: vp run lint:tss
 
       - name: Web dead code check
-        working-directory: .
+        if: steps.changed-files.outputs.any_changed == 'true'
         run: vp run knip
 
       - name: Web dead code check production
-        working-directory: .
+        if: steps.changed-files.outputs.any_changed == 'true'
         run: vp run knip:production
 
       - name: Web production unused declarations check
-        working-directory: .
+        if: steps.changed-files.outputs.any_changed == 'true'
         run: vp run knip:production-unused-check
 
-  # Preserve the existing required check while build and static checks run in parallel.
-  web-style:
-    name: Web Style
-    if: ${{ always() && !inputs.skip-checks && (!inputs.classification-succeeded || inputs.run-web-style) }}
-    needs: [web-build, web-style-checks]
-    runs-on: ubuntu-24.04
-    permissions: {}
-    steps:
-      - name: Verify web checks
-        env:
-          BUILD_RESULT: ${{ needs.web-build.result }}
-          STYLE_RESULT: ${{ needs.web-style-checks.result }}
-        run: |
-          if [[ "$BUILD_RESULT" != 'success' || "$STYLE_RESULT" != 'success' ]]; then
-            echo "Web checks failed: build=$BUILD_RESULT, static checks=$STYLE_RESULT" >&2
-            exit 1
-          fi
-
   ts-common-style:
     name: TS Common
-    if: ${{ !inputs.skip-checks && (!inputs.classification-succeeded || inputs.run-ts-common-style) }}
     runs-on: depot-ubuntu-24.04-4
     permissions:
       checks: write
       pull-requests: read
 
     steps:
-      - name: Verify changed-file classification
-        if: ${{ !inputs.classification-succeeded }}
-        run: |
-          echo "Changed-file classification failed; refusing to skip TypeScript style checks." >&2
-          exit 1
-
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
+      - name: Check changed files
+        id: changed-files
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
+        with:
+          files: |
+            web/**
+            cli/**
+            e2e/**
+            sdks/nodejs-client/**
+            packages/**
+            package.json
+            pnpm-lock.yaml
+            pnpm-workspace.yaml
+            .nvmrc
+            vite.config.ts
+            lint.config.ts
+            eslint.config.mjs
+            oxlint-suppressions.json
+            eslint-suppressions.json
+            .vscode/**
+            .github/workflows/autofix.yml
+            .github/workflows/style.yml
+            .github/actions/setup-web/**
+
       - name: Setup web environment
+        if: steps.changed-files.outputs.any_changed == 'true'
         uses: ./.github/actions/setup-web
 
-      - name: Restore static check task cache
-        id: static-check-cache
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: node_modules/.vite/task-cache
-          key: vite-task-static-v1-${{ runner.os }}-${{ runner.arch }}-${{ github.run_id }}-${{ github.run_attempt }}
-          restore-keys: |
-            vite-task-static-v1-${{ runner.os }}-${{ runner.arch }}-
-
       - name: Static check
-        run: vp run -w check
-
-      - name: Save static check task cache
-        if: success() && github.event_name != 'merge_group'
-        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: node_modules/.vite/task-cache
-          key: ${{ steps.static-check-cache.outputs.cache-primary-key }}
+        if: steps.changed-files.outputs.any_changed == 'true'
+        run: pnpm -w check
 
   superlinter:
     name: SuperLinter
-    if: ${{ !inputs.skip-checks && (!inputs.classification-succeeded || inputs.run-superlinter) }}
     runs-on: depot-ubuntu-24.04
 
     steps:
-      - name: Verify changed-file classification
-        if: ${{ !inputs.classification-succeeded }}
-        run: |
-          echo "Changed-file classification failed; refusing to skip SuperLinter." >&2
-          exit 1
-
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
 
+      - name: Check changed files
+        id: changed-files
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
+        with:
+          files: |
+            **.sh
+            **.yaml
+            **.yml
+            **Dockerfile
+            dev/**
+            .editorconfig
+
       - name: Super-linter
         uses: super-linter/super-linter/slim@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8.7.0
+        if: steps.changed-files.outputs.any_changed == 'true'
         env:
           BASH_SEVERITY: warning
           DEFAULT_BRANCH: origin/main
           EDITORCONFIG_FILE_NAME: editorconfig-checker.json
-          ENABLE_GITHUB_PULL_REQUEST_SUMMARY_COMMENT: false
+          FILTER_REGEX_INCLUDE: pnpm-lock.yaml
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           IGNORE_GENERATED_FILES: true
           IGNORE_GITIGNORED_FILES: true
-          VALIDATE_ALL_CODEBASE: false
           VALIDATE_BASH: true
           VALIDATE_BASH_EXEC: true
           # FIXME: temporarily disabled until api-docker.yaml's run script is fixed for shellcheck

.github/workflows/tool-test-sdks.yaml

@@ -9,8 +9,6 @@ on:
       - package.json
       - pnpm-lock.yaml
       - pnpm-workspace.yaml
-      - .github/actions/setup-web/**
-      - .github/workflows/tool-test-sdks.yaml
 
 concurrency:
   group: sdk-tests-${{ github.head_ref || github.run_id }}
@@ -26,17 +24,19 @@ jobs:
         working-directory: sdks/nodejs-client
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
-      - name: Setup web environment
-        uses: ./.github/actions/setup-web
+      - name: Use Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          cache: ''
+          cache-dependency-path: 'pnpm-lock.yaml'
+
+      - name: Install Dependencies
+        run: pnpm install --frozen-lockfile
 
       - name: Test
         run: pnpm test
-
-      - name: Build and verify package entry points
-        run: |
-          pnpm build
-          node --input-type=module -e "import { access } from 'node:fs/promises'; import 'dify-client'; await access('dist/index.d.ts')"

.github/workflows/translate-i18n-claude.yml

@@ -8,19 +8,15 @@ on:
   workflow_dispatch:
     inputs:
       files:
-        description: 'Specific files to translate (space-separated, e.g., "app common").
-          Required for full mode; leave empty in incremental mode to use en-US
-          files changed since HEAD~1.'
+        description: 'Specific files to translate (space-separated, e.g., "app common"). Required for full mode; leave empty in incremental mode to use en-US files changed since HEAD~1.'
         required: false
         type: string
       languages:
-        description: 'Specific languages to translate (space-separated, e.g., "zh-Hans
-          ja-JP"). Leave empty for all supported target languages except en-US.'
+        description: 'Specific languages to translate (space-separated, e.g., "zh-Hans ja-JP"). Leave empty for all supported target languages except en-US.'
         required: false
         type: string
       mode:
-        description: 'Sync mode: incremental (compare with previous en-US revision) or
-          full (sync all keys in scope)'
+        description: 'Sync mode: incremental (compare with previous en-US revision) or full (sync all keys in scope)'
         required: false
         default: incremental
         type: choice
@@ -44,10 +40,9 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
-          ref: ${{ github.event.client_payload.head_sha || github.sha }}
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Configure Git
@@ -70,7 +65,7 @@ jobs:
             /supported: true/ && value != \"en-US\" {
               printf \"%s \", value
             }
-          " web/i18n/languages.ts | sed 's/[[:space:]]*$//')
+          " web/i18n-config/languages.ts | sed 's/[[:space:]]*$//')
 
           generate_changes_json() {
             node .github/scripts/generate-i18n-changes.mjs
@@ -111,9 +106,9 @@ jobs:
             elif [ "$SYNC_MODE" = "incremental" ]; then
               BASE_SHA=$(git rev-parse HEAD~1 2>/dev/null || true)
               if [ -n "$BASE_SHA" ]; then
-                CHANGED_FILES=$(git diff --name-only --find-renames=100% --diff-filter=AMDT "$BASE_SHA" "$HEAD_SHA" -- 'web/i18n/' 2>/dev/null | sed -n '\@^web/i18n/locales/en-US/[^/]*\.json$@p' | sed -n 's@^.*/@@p' | sed 's/\.json$//' | tr '\n' ' ' | sed 's/[[:space:]]*$//')
+                CHANGED_FILES=$(git diff --name-only "$BASE_SHA" "$HEAD_SHA" -- 'web/i18n/en-US/*.json' 2>/dev/null | sed -n 's@^.*/@@p' | sed 's/\.json$//' | tr '\n' ' ' | sed 's/[[:space:]]*$//')
               else
-                CHANGED_FILES=$(find web/i18n/locales/en-US -maxdepth 1 -type f -name '*.json' -print | sed -n 's@^.*/@@p' | sed 's/\.json$//' | sort | tr '\n' ' ' | sed 's/[[:space:]]*$//')
+                CHANGED_FILES=$(find web/i18n/en-US -maxdepth 1 -type f -name '*.json' -print | sed -n 's@^.*/@@p' | sed 's/\.json$//' | sort | tr '\n' ' ' | sed 's/[[:space:]]*$//')
               fi
             elif [ "$SYNC_MODE" = "full" ]; then
               echo "workflow_dispatch full mode requires the files input to stay within CI limits." >&2
@@ -163,7 +158,7 @@ jobs:
 
       - name: Run Claude Code for Translation Sync
         if: steps.context.outputs.CHANGED_FILES != ''
-        uses: anthropics/claude-code-action@756cc22e19660d20e8cc9496b4f242475a7f7790 # v1.0.235
+        uses: anthropics/claude-code-action@af0559ee4f514d1ef21826982bed13f7edc3c35e # v1.0.178
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -171,12 +166,12 @@ jobs:
           show_full_output: ${{ github.event_name == 'workflow_dispatch' }}
           prompt: |
             You are the i18n sync agent for the Dify repository.
-            Your job is to keep translations synchronized with the English source files under `${{ github.workspace }}/web/i18n/locales/en-US/`.
+            Your job is to keep translations synchronized with the English source files under `${{ github.workspace }}/web/i18n/en-US/`.
 
             Use absolute paths at all times:
             - Repo root: `${{ github.workspace }}`
             - Web directory: `${{ github.workspace }}/web`
-            - Language config: `${{ github.workspace }}/web/i18n/languages.ts`
+            - Language config: `${{ github.workspace }}/web/i18n-config/languages.ts`
 
             Inputs:
             - Files in scope: `${{ steps.context.outputs.CHANGED_FILES }}`
@@ -199,12 +194,12 @@ jobs:
             Required execution plan:
             1. Resolve target languages.
                - Use the provided `Target languages` value as the source of truth.
-               - If it is unexpectedly empty, read `${{ github.workspace }}/web/i18n/languages.ts` and use every language with `supported: true` except `en-US`.
+               - If it is unexpectedly empty, read `${{ github.workspace }}/web/i18n-config/languages.ts` and use every language with `supported: true` except `en-US`.
             2. Stay strictly in scope.
                - Only process the files listed in `Files in scope`.
                - Only process the resolved target languages, never `en-US`.
                - Do not touch unrelated i18n files.
-               - Do not modify `${{ github.workspace }}/web/i18n/locales/en-US/`.
+               - Do not modify `${{ github.workspace }}/web/i18n/en-US/`.
             3. Resolve source changes.
                - If `Structured change set available` is `true`, read `/tmp/i18n-changes.json` and use it as the source of truth for file-level and key-level changes.
                - For each file entry:
@@ -228,7 +223,7 @@ jobs:
                - Match the existing terminology and register used by each locale.
                - Prefer one Edit per file when stable, but prioritize correctness over batching.
             6. Verify only the edited files.
-               - Run `vp fmt <repo-relative edited paths such as web/i18n/locales/...>`
+               - Run `vp fmt <repo-relative edited paths such as web/i18n/...>`
                - Run `vp run dify-web#i18n:check ${{ steps.context.outputs.FILE_ARGS }} ${{ steps.context.outputs.LANG_ARGS }}`
                - If verification fails, fix the remaining problems before continuing.
             7. Stop after the scoped locale files are updated and verification passes.
@@ -242,7 +237,7 @@ jobs:
         if: steps.context.outputs.CHANGED_FILES != ''
         shell: bash
         run: |
-          if [ -z "$(git -C "${{ github.workspace }}" status --porcelain -- web/i18n/locales/)" ]; then
+          if [ -z "$(git -C "${{ github.workspace }}" status --porcelain -- web/i18n/)" ]; then
             echo "has_changes=false" >> "$GITHUB_OUTPUT"
             exit 0
           fi
@@ -261,7 +256,7 @@ jobs:
         shell: bash
         run: |
           git -C "${{ github.workspace }}" checkout -B "${{ steps.pr_meta.outputs.branch_name }}"
-          git -C "${{ github.workspace }}" add web/i18n/locales/
+          git -C "${{ github.workspace }}" add web/i18n/
           git -C "${{ github.workspace }}" commit -m "chore(i18n): sync translations with en-US"
 
       - name: Push translation branch
@@ -286,7 +281,6 @@ jobs:
           BASE_SHA: ${{ steps.context.outputs.BASE_SHA }}
           HEAD_SHA: ${{ steps.context.outputs.HEAD_SHA }}
           REPO_NAME: ${{ github.repository }}
-          EVENT_NAME: ${{ github.event_name }}
         shell: bash
         run: |
           PR_BODY_FILE=/tmp/i18n-pr-body.md
@@ -297,7 +291,6 @@ jobs:
           export LANG_COUNT
 
           node <<'NODE' > "$PR_BODY_FILE"
-          const { execFileSync } = require('node:child_process')
           const fs = require('node:fs')
 
           const changesPath = '/tmp/i18n-changes.json'
@@ -306,25 +299,7 @@ jobs:
             : { changes: {} }
 
           const filesInScope = (process.env.FILES_IN_SCOPE || '').split(/\s+/).filter(Boolean)
-          const sourceCommit = process.env.HEAD_SHA
-          let sourcePr
-          if (process.env.EVENT_NAME === 'repository_dispatch') {
-            try {
-              const pulls = JSON.parse(execFileSync('gh', [
-                'api', `repos/${process.env.REPO_NAME}/commits/${sourceCommit}/pulls`,
-              ], { encoding: 'utf8' }))
-              sourcePr = pulls.find(pr => pr.merged_at && pr.merge_commit_sha === sourceCommit)
-            } catch (error) {
-              console.error(`Could not resolve source PR: ${error.message}`)
-            }
-          }
-
           const lines = [
-            '## Source',
-            '',
-            ...(sourcePr ? [`- **PR**: [#${sourcePr.number}](${sourcePr.html_url})`] : []),
-            `- **Commit**: [\`${sourceCommit.slice(0, 12)}\`](https://github.com/${process.env.REPO_NAME}/commit/${sourceCommit})`,
-            '',
             '## Summary',
             '',
             `- **Files synced**: \`${process.env.FILES_IN_SCOPE || '<none>'}\``,
@@ -347,7 +322,7 @@ jobs:
             '## Verification',
             '',
             `- \`vp run dify-web#i18n:check --file ${process.env.FILES_IN_SCOPE} --lang ${process.env.TARGET_LANGS}\``,
-            `- \`vp fmt <repo-relative edited paths such as web/i18n/locales/...>\``,
+            `- \`vp fmt <repo-relative edited paths such as web/i18n/...>\``,
             '',
             '## Notes',
             '',

.github/workflows/trigger-i18n-sync.yml

@@ -4,7 +4,7 @@ on:
   push:
     branches: [main]
     paths:
-      - 'web/i18n/locales/en-US/*.json'
+      - 'web/i18n/en-US/*.json'
 
 permissions:
   contents: write
@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 
@@ -36,9 +36,9 @@ jobs:
           HEAD_SHA="${{ github.sha }}"
 
           if [ -n "$BASE_SHA" ]; then
-            CHANGED_FILES=$(git diff --name-only --find-renames=100% --diff-filter=AMDT "$BASE_SHA" "$HEAD_SHA" -- 'web/i18n/' 2>/dev/null | sed -n '\@^web/i18n/locales/en-US/[^/]*\.json$@p' | sed -n 's@^.*/@@p' | sed 's/\.json$//' | tr '\n' ' ' | sed 's/[[:space:]]*$//')
+            CHANGED_FILES=$(git diff --name-only "$BASE_SHA" "$HEAD_SHA" -- 'web/i18n/en-US/*.json' 2>/dev/null | sed -n 's@^.*/@@p' | sed 's/\.json$//' | tr '\n' ' ' | sed 's/[[:space:]]*$//')
           else
-            CHANGED_FILES=$(find web/i18n/locales/en-US -maxdepth 1 -type f -name '*.json' -print | sed -n 's@^.*/@@p' | sed 's/\.json$//' | sort | tr '\n' ' ' | sed 's/[[:space:]]*$//')
+            CHANGED_FILES=$(find web/i18n/en-US -maxdepth 1 -type f -name '*.json' -print | sed -n 's@^.*/@@p' | sed 's/\.json$//' | sort | tr '\n' ' ' | sed 's/[[:space:]]*$//')
           fi
 
           export BASE_SHA HEAD_SHA CHANGED_FILES

.github/workflows/vdb-tests-full.yml

@@ -20,23 +20,23 @@ jobs:
     strategy:
       matrix:
         python-version:
-          - '3.12'
+          - "3.12"
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
       - name: Free Disk Space
-        uses: endersonmenezes/free-disk-space@2a22f8c59cae9cddae7194b33e6b92d023b2b4b8 # v4.0.0
+        uses: endersonmenezes/free-disk-space@7901478139cff6e9d44df5972fd8ab8fcade4db1 # v3.2.2
         with:
           remove_dotnet: true
           remove_haskell: true
           remove_tool_cache: true
 
       - name: Setup UV and Python
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           enable-cache: true
           python-version: ${{ matrix.python-version }}
@@ -48,16 +48,16 @@ jobs:
       - name: Install dependencies
         run: uv sync --project api --dev
 
-      #      - name: Set up Vector Store (TiDB)
-      #        uses: hoverkraft-tech/compose-action@v2.0.2
-      #        with:
-      #          compose-file: docker/tidb/docker-compose.yaml
-      #          services: |
-      #            tidb
-      #            tiflash
+#      - name: Set up Vector Store (TiDB)
+#        uses: hoverkraft-tech/compose-action@v2.0.2
+#        with:
+#          compose-file: docker/tidb/docker-compose.yaml
+#          services: |
+#            tidb
+#            tiflash
 
-      #      - name: Check VDB Ready (TiDB)
-      #        run: uv run --project api python api/providers/vdb/tidb-vector/tests/integration_tests/check_tiflash_ready.py
+#      - name: Check VDB Ready (TiDB)
+#        run: uv run --project api python api/providers/vdb/tidb-vector/tests/integration_tests/check_tiflash_ready.py
 
       - name: Test Vector Stores
         run: |

.github/workflows/vdb-tests.yml

@@ -17,23 +17,23 @@ jobs:
     strategy:
       matrix:
         python-version:
-          - '3.12'
+          - "3.12"
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
       - name: Free Disk Space
-        uses: endersonmenezes/free-disk-space@2a22f8c59cae9cddae7194b33e6b92d023b2b4b8 # v4.0.0
+        uses: endersonmenezes/free-disk-space@7901478139cff6e9d44df5972fd8ab8fcade4db1 # v3.2.2
         with:
           remove_dotnet: true
           remove_haskell: true
           remove_tool_cache: true
 
       - name: Setup UV and Python
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           enable-cache: true
           python-version: ${{ matrix.python-version }}
@@ -45,16 +45,16 @@ jobs:
       - name: Install dependencies
         run: uv sync --project api --dev
 
-      #      - name: Set up Vector Store (TiDB)
-      #        uses: hoverkraft-tech/compose-action@v2.0.2
-      #        with:
-      #          compose-file: docker/tidb/docker-compose.yaml
-      #          services: |
-      #            tidb
-      #            tiflash
+#      - name: Set up Vector Store (TiDB)
+#        uses: hoverkraft-tech/compose-action@v2.0.2
+#        with:
+#          compose-file: docker/tidb/docker-compose.yaml
+#          services: |
+#            tidb
+#            tiflash
 
-      #      - name: Check VDB Ready (TiDB)
-      #        run: uv run --project api python api/providers/vdb/tidb-vector/tests/integration_tests/check_tiflash_ready.py
+#      - name: Check VDB Ready (TiDB)
+#        run: uv run --project api python api/providers/vdb/tidb-vector/tests/integration_tests/check_tiflash_ready.py
 
       - name: Test Vector Stores
         run: |

.github/workflows/web-bundle-size.yml

@@ -1,162 +0,0 @@
-name: Web Bundle Analysis
-
-on:
-  workflow_call:
-    inputs:
-      base-rev:
-        description: Exact base revision selected by the main CI event.
-        required: true
-        type: string
-
-permissions:
-  contents: read
-  pull-requests: write
-
-jobs:
-  measure:
-    name: Measure ${{ matrix.revision }}
-    runs-on: ubuntu-24.04
-    timeout-minutes: 30
-    permissions:
-      contents: read
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - revision: base
-            sha: ${{ inputs.base-rev }}
-          - revision: merge
-            sha: ${{ github.sha }}
-    env:
-      NEXT_TELEMETRY_DISABLED: '1'
-      NODE_OPTIONS: --max-old-space-size=6144
-    steps:
-      # Keep one collector for both revisions, including when it does not exist on base yet.
-      - name: Checkout reporting tools
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - name: Preserve collector
-        run: cp web/scripts/bundle-analysis.ts "$RUNNER_TEMP/bundle-analysis.ts"
-
-      - name: Checkout measured revision
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ matrix.sha }}
-          persist-credentials: false
-
-      - name: Setup web environment
-        uses: ./.github/actions/setup-web
-
-      - name: Instrument selected revision
-        run: node "$RUNNER_TEMP/bundle-analysis.ts" instrument web
-
-      - name: Full Vinext build with official Rolldown analysis
-        working-directory: web
-        shell: bash
-        run: |
-          set -o pipefail
-          started=$SECONDS
-          pnpm run build:vinext 2>&1 | tee "$RUNNER_TEMP/vinext-build.log"
-          printf 'Full Vinext build: **%s seconds**.\n' "$((SECONDS - started))" >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Collect sizes
-        env:
-          COMMIT_SHA: ${{ matrix.sha }}
-        run: node "$RUNNER_TEMP/bundle-analysis.ts" collect web "$COMMIT_SHA" "$RUNNER_TEMP/bundle-size/summary.json"
-
-      - name: Upload size snapshot
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: web-bundle-summary-${{ matrix.revision }}
-          path: ${{ runner.temp }}/bundle-size/summary.json
-          if-no-files-found: error
-          retention-days: 14
-
-      - name: Upload official Rolldown analysis
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: web-bundle-analyzer-${{ matrix.revision }}
-          path: |
-            web/dist/client/bundle-analysis.json
-            web/dist/client/bundle-analysis.md
-            ${{ runner.temp }}/vinext-build.log
-          include-hidden-files: true
-          if-no-files-found: error
-          retention-days: 14
-
-  report:
-    name: Compare bundle sizes
-    needs: measure
-    runs-on: ubuntu-24.04
-    timeout-minutes: 5
-    permissions:
-      contents: read
-      pull-requests: write
-    steps:
-      - name: Checkout reporting tools
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - name: Setup Node.js
-        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
-        with:
-          install: false
-
-      - name: Download size snapshots
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          pattern: web-bundle-summary-*
-          path: bundle-results
-
-      - name: Compare and summarize
-        id: compare
-        env:
-          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-        run: |
-          node web/scripts/bundle-analysis.ts compare \
-            bundle-results/web-bundle-summary-base/summary.json \
-            bundle-results/web-bundle-summary-merge/summary.json \
-            bundle-report.md
-          printf '\n[Download base/merge snapshots and official Rolldown analysis reports](%s#artifacts).\n' "$RUN_URL" >> bundle-report.md
-          printf '\nComparison: event base SHA vs the tested merge commit at GITHUB_SHA (PR or merge queue).\n' >> bundle-report.md
-          cat bundle-report.md >> "$GITHUB_STEP_SUMMARY"
-
-      # Forks still receive the job summary and artifacts, without a privileged PR build.
-      - name: Update PR report
-        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        env:
-          SHOULD_COMMENT: ${{ steps.compare.outputs.should-comment }}
-        with:
-          script: |
-            const fs = require('node:fs');
-            const { owner, repo } = context.repo;
-            const pull_number = context.payload.pull_request.number;
-            const { data: pr } = await github.rest.pulls.get({ owner, repo, pull_number });
-            if (pr.state !== 'open' || pr.head.sha !== context.payload.pull_request.head.sha ||
-                pr.base.sha !== context.payload.pull_request.base.sha) {
-              core.info('Skipping a superseded bundle report.');
-              return;
-            }
-            const body = fs.readFileSync('bundle-report.md', 'utf8');
-            const comments = await github.paginate(github.rest.issues.listComments, {
-              owner, repo, issue_number: pull_number, per_page: 100,
-            });
-            const existing = comments.find(comment =>
-              comment.user?.login === 'github-actions[bot]' &&
-              comment.body?.startsWith('<!-- dify-vinext-bundle-size -->'));
-            if (process.env.SHOULD_COMMENT !== 'true') {
-              if (existing) {
-                await github.rest.issues.deleteComment({ owner, repo, comment_id: existing.id });
-              }
-              core.info('Bundle changes are below the PR comment thresholds. See the job summary.');
-              return;
-            }
-            if (existing) {
-              await github.rest.issues.updateComment({ owner, repo, comment_id: existing.id, body });
-            } else {
-              await github.rest.issues.createComment({ owner, repo, issue_number: pull_number, body });
-            }

.github/workflows/web-e2e.yml

@@ -9,229 +9,24 @@ on:
         type: boolean
 
 permissions:
-  actions: read
   contents: read
 
+concurrency:
+  group: web-e2e-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
-  core-build:
-    name: Prepare Core E2E Web Build
-    if: ${{ !inputs.run-external-runtime }}
-    runs-on: depot-ubuntu-24.04-4
-    timeout-minutes: 30
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - name: Test Web build synchronization
-        run: node --test .github/actions/wait-e2e-web-build/wait.test.cjs
-
-      - name: Compute build source hash
-        id: build-source
-        shell: bash
-        run: |
-          # Hash tracked build inputs, excluding generated files and backend-only changes.
-          source_hash=$(git ls-tree -r HEAD -- web packages e2e/scripts e2e/package.json e2e/test-env.ts package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc .github/actions/setup-web .github/workflows/web-e2e.yml | sha256sum | cut -d ' ' -f 1)
-          echo "hash=$source_hash" >> "$GITHUB_OUTPUT"
-
-      - name: Setup web dependencies
-        uses: ./.github/actions/setup-web
-        with:
-          # Browser jobs already save this dependency cache; avoid duplicate uploads.
-          cache-save: 'false'
-
-      - name: Restore Next.js build cache
-        id: next-cache
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: web/.next/cache
-          key: e2e-next-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml') }}-${{ steps.build-source.outputs.hash }}
-          restore-keys: |
-            e2e-next-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml') }}-
-
-      - name: Run E2E support unit tests
-        working-directory: ./e2e
-        run: vp run test:unit
-
-      - name: Build production Web app
-        working-directory: ./e2e
-        env:
-          E2E_FORCE_WEB_BUILD: '1'
-          CACHE_HIT: ${{ steps.next-cache.outputs.cache-hit || 'false' }}
-        run: |
-          started=$SECONDS
-          vp run e2e:web:build
-          {
-            echo "### E2E Web build"
-            echo "Build: $((SECONDS - started))s"
-            echo "Exact cache hit: $CACHE_HIT (false can include a compatible fallback)"
-          } >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Package Web build
-        run: >-
-          tar -cf e2e-web-build.tar -C web
-          .next/BUILD_ID
-          .next/e2e-web-build.sha256
-          .next/standalone
-          .next/static
-
-      - name: Upload Web build
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: core-e2e-web-build-${{ github.run_attempt }}
-          path: e2e-web-build.tar
-          if-no-files-found: error
-          retention-days: 7
-
-      - name: Save Next.js build cache
-        if: github.event_name != 'merge_group' && steps.next-cache.outputs.cache-hit != 'true'
-        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: web/.next/cache
-          key: ${{ steps.next-cache.outputs.cache-primary-key }}
-
-  chromium-full:
-    name: Chromium Full (${{ matrix.shard }}/3)
-    if: ${{ !inputs.run-external-runtime }}
-    runs-on: ubuntu-24.04
-    timeout-minutes: 45
-    strategy:
-      fail-fast: false
-      matrix:
-        shard: [1, 2, 3]
-    env:
-      E2E_ADMIN_EMAIL: e2e-admin@example.com
-      E2E_ADMIN_NAME: E2E Admin
-      E2E_ADMIN_PASSWORD: E2eAdmin12345
-      E2E_INIT_PASSWORD: E2eInit12345
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - name: Prepare Chromium E2E dependencies
-        timeout-minutes: 15
-        uses: ./.github/actions/setup-core-e2e
-        with:
-          browser: chromium
-
-      # Install dependencies while core-build runs, then wait only for its artifact.
-      - name: Wait for Web build
-        id: web-build
-        timeout-minutes: 35
-        uses: ./.github/actions/wait-e2e-web-build
-
-      - name: Download Web build
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          artifact-ids: ${{ steps.web-build.outputs.artifact-id }}
-          github-token: ${{ github.token }}
-
-      - name: Extract Web build
-        run: tar -xf e2e-web-build.tar -C web
-
-      - name: Run Chromium full shard
-        working-directory: ./e2e
-        run: vp run e2e:full -- --shard ${{ matrix.shard }}/3
-
-      - name: Upload Cucumber report
-        if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: cucumber-report-chromium-${{ matrix.shard }}
-          path: e2e/cucumber-report
-          if-no-files-found: ignore
-          overwrite: true
-          retention-days: 7
-
-      - name: Upload E2E logs
-        if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: e2e-logs-chromium-${{ matrix.shard }}
-          path: e2e/.logs/*.log
-          if-no-files-found: ignore
-          include-hidden-files: true
-          overwrite: true
-          retention-days: 7
-
-  webkit-smoke:
-    name: WebKit Browser Smoke
-    if: ${{ !inputs.run-external-runtime }}
-    runs-on: ubuntu-24.04
-    timeout-minutes: 45
-    env:
-      E2E_ADMIN_EMAIL: e2e-admin@example.com
-      E2E_ADMIN_NAME: E2E Admin
-      E2E_ADMIN_PASSWORD: E2eAdmin12345
-      E2E_BROWSER: webkit
-      E2E_INIT_PASSWORD: E2eInit12345
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - name: Prepare WebKit E2E dependencies
-        timeout-minutes: 15
-        uses: ./.github/actions/setup-core-e2e
-        with:
-          browser: webkit
-
-      # Install dependencies while core-build runs, then wait only for its artifact.
-      - name: Wait for Web build
-        id: web-build
-        timeout-minutes: 35
-        uses: ./.github/actions/wait-e2e-web-build
-
-      - name: Download Web build
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          artifact-ids: ${{ steps.web-build.outputs.artifact-id }}
-          github-token: ${{ github.token }}
-
-      - name: Extract Web build
-        run: tar -xf e2e-web-build.tar -C web
-
-      - name: Run WebKit browser smoke
-        working-directory: ./e2e
-        run: vp run e2e:full -- --tags '@browser-smoke'
-
-      - name: Upload Cucumber report
-        if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: cucumber-report-webkit
-          path: e2e/cucumber-report
-          if-no-files-found: ignore
-          overwrite: true
-          retention-days: 7
-
-      - name: Upload E2E logs
-        if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: e2e-logs-webkit
-          path: e2e/.logs/*.log
-          if-no-files-found: ignore
-          include-hidden-files: true
-          overwrite: true
-          retention-days: 7
-
-  external-runtime:
+  test:
     name: Web Full-Stack E2E
-    if: ${{ inputs.run-external-runtime }}
-    runs-on: ubuntu-24.04
+    runs-on: depot-ubuntu-24.04-4
     timeout-minutes: 120
+    defaults:
+      run:
+        shell: bash
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -239,10 +34,10 @@ jobs:
         uses: ./.github/actions/setup-web
 
       - name: Setup UV and Python
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           enable-cache: true
-          python-version: '3.12'
+          python-version: "3.12"
           cache-dependency-glob: |
             api/uv.lock
             dify-agent/uv.lock
@@ -250,12 +45,74 @@ jobs:
       - name: Install API dependencies
         run: uv sync --project api --dev
 
-      - name: Install Chromium
-        timeout-minutes: 15
+      - name: Run E2E support unit tests
+        if: ${{ !inputs.run-external-runtime }}
         working-directory: ./e2e
-        run: vp run e2e:install:ci:chromium
+        run: vp run test:unit
+
+      - name: Install Playwright browser
+        working-directory: ./e2e
+        run: vp run e2e:install
+
+      - name: Run isolated source-api and built-web Cucumber E2E tests
+        if: ${{ !inputs.run-external-runtime }}
+        working-directory: ./e2e
+        env:
+          E2E_ADMIN_EMAIL: e2e-admin@example.com
+          E2E_ADMIN_NAME: E2E Admin
+          E2E_ADMIN_PASSWORD: E2eAdmin12345
+          E2E_FORCE_WEB_BUILD: "1"
+          E2E_INIT_PASSWORD: E2eInit12345
+        run: vp run e2e:full
+
+      - name: Preserve Chromium E2E report and logs
+        if: ${{ !cancelled() && !inputs.run-external-runtime }}
+        run: |
+          if [[ -d e2e/cucumber-report ]]; then
+            mv e2e/cucumber-report e2e/cucumber-report-non-external
+          fi
+          if [[ -d e2e/.logs ]]; then
+            mv e2e/.logs e2e/.logs-non-external
+          fi
+
+      - name: Run WebKit keyboard and browser smoke tests
+        if: ${{ !inputs.run-external-runtime }}
+        working-directory: ./e2e
+        env:
+          E2E_ADMIN_EMAIL: e2e-admin@example.com
+          E2E_ADMIN_NAME: E2E Admin
+          E2E_ADMIN_PASSWORD: E2eAdmin12345
+          E2E_BROWSER: webkit
+          E2E_INIT_PASSWORD: E2eInit12345
+        run: |
+          teardown_webkit_smoke() {
+            local run_status=$?
+            trap - EXIT
+            if ! vp run e2e:middleware:down; then
+              echo "::error title=E2E teardown failed::WebKit smoke middleware did not shut down cleanly."
+              if [[ "$run_status" -eq 0 ]]; then
+                run_status=1
+              fi
+            fi
+            exit "$run_status"
+          }
+
+          trap teardown_webkit_smoke EXIT
+          vp run e2e:middleware:up
+          vp run e2e -- --tags '@browser-smoke'
+
+      - name: Preserve WebKit E2E report and logs
+        if: ${{ !cancelled() && !inputs.run-external-runtime }}
+        run: |
+          if [[ -d e2e/cucumber-report ]]; then
+            mv e2e/cucumber-report e2e/cucumber-report-webkit
+          fi
+          if [[ -d e2e/.logs ]]; then
+            mv e2e/.logs e2e/.logs-webkit
+          fi
 
       - name: Run prepared and external runtime E2E tests
+        if: ${{ inputs.run-external-runtime }}
         working-directory: ./e2e
         env:
           E2E_ADMIN_EMAIL: e2e-admin@example.com
@@ -264,7 +121,7 @@ jobs:
           E2E_AGENT_DECISION_MODEL_NAME: ${{ vars.E2E_AGENT_DECISION_MODEL_NAME || 'gpt-5.5' }}
           E2E_AGENT_DECISION_MODEL_PROVIDER: ${{ vars.E2E_AGENT_DECISION_MODEL_PROVIDER || 'openai' }}
           E2E_AGENT_DECISION_MODEL_TYPE: ${{ vars.E2E_AGENT_DECISION_MODEL_TYPE || 'llm' }}
-          E2E_FORCE_WEB_BUILD: '1'
+          E2E_FORCE_WEB_BUILD: "1"
           E2E_INIT_PASSWORD: E2eInit12345
           E2E_MARKETPLACE_API_URL: ${{ vars.E2E_MARKETPLACE_API_URL }}
           E2E_MARKETPLACE_PLUGIN_IDS: ${{ vars.E2E_MARKETPLACE_PLUGIN_IDS }}
@@ -281,6 +138,21 @@ jobs:
             exit 1
           fi
 
+          teardown_external_runtime() {
+            local run_status=$?
+            trap - EXIT
+            if ! vp run e2e:middleware:down; then
+              echo "::error title=E2E teardown failed::External runtime middleware did not shut down cleanly."
+              if [[ "$run_status" -eq 0 ]]; then
+                run_status=1
+              fi
+            fi
+            exit "$run_status"
+          }
+
+          trap teardown_external_runtime EXIT
+          vp run e2e:middleware:up
+          vp run e2e:post-merge:prepare
           vp run e2e:post-merge
 
       - name: Upload Cucumber report
@@ -288,8 +160,10 @@ jobs:
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: cucumber-report
-          path: e2e/cucumber-report
-          overwrite: true
+          path: |
+            e2e/cucumber-report
+            e2e/cucumber-report-non-external
+            e2e/cucumber-report-webkit
           retention-days: 7
 
       - name: Upload E2E logs
@@ -297,17 +171,18 @@ jobs:
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: e2e-logs
-          path: e2e/.logs/*.log
+          path: |
+            e2e/.logs/*.log
+            e2e/.logs-non-external/*.log
+            e2e/.logs-webkit/*.log
           include-hidden-files: true
-          overwrite: true
           retention-days: 7
 
       - name: Upload E2E seed report
-        if: ${{ !cancelled() }}
+        if: ${{ !cancelled() && inputs.run-external-runtime }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: e2e-seed-report
           path: e2e/seed-report
           if-no-files-found: ignore
-          overwrite: true
           retention-days: 7

.github/workflows/web-tests.yml

@@ -9,6 +9,10 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: web-tests-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   test:
     name: Web Tests (${{ matrix.shardIndex }}/${{ matrix.shardTotal }})
@@ -25,7 +29,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -33,52 +37,17 @@ jobs:
         uses: ./.github/actions/setup-web
 
       - name: Run tests
-        run: vp test run --project unit --reporter=blob --reporter=minimal --shard=${{ matrix.shardIndex }}/${{ matrix.shardTotal }} --coverage
+        run: vp test run --reporter=blob --reporter=minimal --shard=${{ matrix.shardIndex }}/${{ matrix.shardTotal }} --coverage
 
       - name: Upload blob report
         if: ${{ !cancelled() }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: blob-report-${{ matrix.shardIndex }}
-          path: web/.vitest/blob/*
+          path: web/.vitest-reports/*
           include-hidden-files: true
           retention-days: 1
 
-  browser-test:
-    name: Web Browser Tests
-    runs-on: ubuntu-24.04
-    timeout-minutes: 20
-    defaults:
-      run:
-        shell: bash
-        working-directory: ./web
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - name: Setup web environment
-        uses: ./.github/actions/setup-web
-
-      - name: Install Chromium for Browser Mode
-        timeout-minutes: 15
-        run: vp exec playwright install --with-deps --only-shell chromium
-
-      - name: Run browser tests
-        run: vp test run --project browser --silent=passed-only
-
-      - name: Upload browser failure artifacts
-        if: ${{ failure() && !cancelled() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: browser-test-failures
-          path: web/.vitest-browser/
-          if-no-files-found: ignore
-          include-hidden-files: true
-          retention-days: 7
-
   merge-reports:
     name: Merge Test Reports
     if: ${{ !cancelled() }}
@@ -93,7 +62,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -103,7 +72,7 @@ jobs:
       - name: Download blob reports
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          path: web/.vitest/blob
+          path: web/.vitest-reports
           pattern: blob-report-*
           merge-multiple: true
 
@@ -111,7 +80,8 @@ jobs:
         run: vp test --merge-reports --coverage --silent=passed-only
 
       - name: Report coverage
-        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
+        if: ${{ env.CODECOV_TOKEN != '' }}
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           directory: web/coverage
           flags: web
@@ -120,8 +90,7 @@ jobs:
 
   dify-ui-test:
     name: dify-ui Tests
-    runs-on: ubuntu-24.04
-    timeout-minutes: 20
+    runs-on: depot-ubuntu-24.04-4
     env:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
     defaults:
@@ -131,7 +100,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -139,24 +108,14 @@ jobs:
         uses: ./.github/actions/setup-web
 
       - name: Install Chromium for Browser Mode
-        timeout-minutes: 15
-        run: vp exec playwright install --with-deps --only-shell chromium
+        run: vp exec playwright install --with-deps chromium
 
       - name: Run dify-ui tests
         run: vp test run --project unit --coverage --silent=passed-only
 
-      - name: Upload dify-ui test failure artifacts
-        if: ${{ failure() && !cancelled() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: dify-ui-test-failures
-          path: packages/dify-ui/.vitest-browser/
-          if-no-files-found: ignore
-          include-hidden-files: true
-          retention-days: 7
-
       - name: Report coverage
-        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
+        if: ${{ env.CODECOV_TOKEN != '' }}
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           directory: packages/dify-ui/coverage
           flags: dify-ui
@@ -165,8 +124,7 @@ jobs:
 
   dify-ui-storybook-test:
     name: dify-ui Storybook Tests
-    runs-on: ubuntu-24.04
-    timeout-minutes: 20
+    runs-on: depot-ubuntu-24.04-4
     defaults:
       run:
         shell: bash
@@ -174,7 +132,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -182,18 +140,7 @@ jobs:
         uses: ./.github/actions/setup-web
 
       - name: Install Chromium for Browser Mode
-        timeout-minutes: 15
-        run: vp exec playwright install --with-deps --only-shell chromium
+        run: vp exec playwright install --with-deps chromium
 
       - name: Run dify-ui Storybook tests
         run: vp run test:storybook
-
-      - name: Upload dify-ui Storybook test failure artifacts
-        if: ${{ failure() && !cancelled() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: dify-ui-storybook-test-failures
-          path: packages/dify-ui/.vitest-browser/
-          if-no-files-found: ignore
-          include-hidden-files: true
-          retention-days: 7

.gitignore

@@ -140,9 +140,6 @@ dmypy.json
 pyrightconfig.json
 !api/pyrightconfig.json
 
-# import-linter
-.import_linter_cache/
-
 # Pyre type checker
 .pyre/
 .idea/'
@@ -185,7 +182,6 @@ docker/volumes/minio/*
 docker/volumes/milvus/*
 docker/volumes/chroma/*
 docker/volumes/opensearch/data/*
-docker/volumes/openshell-mtls/*
 docker/volumes/myscale/data/*
 docker/volumes/myscale/log/*
 docker/volumes/unstructured/*
@@ -264,7 +260,6 @@ scripts/stress-test/reports/
 .qoder/*
 .context/
 # Vitest local reports
-web/.vitest-browser/
 web/.vitest-reports/
 
 # dify-agent-runtime

.nvmrc

@@ -0,0 +1 @@
+22

.vite-hooks/pre-commit

@@ -1,5 +1,12 @@
 #!/bin/sh
-set -eu
+# get the list of modified files
+files=$(git diff --cached --name-only)
+
+# check if api or web directory is modified
+
+api_modified=false
+web_modified=false
+skip_web_checks=false
 
 git_path() {
     git rev-parse --git-path "$1"
@@ -11,7 +18,46 @@ if [ -f "$(git_path MERGE_HEAD)" ] || \
    [ -f "$(git_path SQUASH_MSG)" ] || \
    [ -d "$(git_path rebase-merge)" ] || \
    [ -d "$(git_path rebase-apply)" ]; then
-    echo "Git operation in progress, skipping staged checks; CI validates the result."
+    skip_web_checks=true
+fi
+
+for file in $files
+do
+    # Use POSIX compliant pattern matching
+    case "$file" in
+        api/*.py)
+            # set api_modified flag to true
+            api_modified=true
+            ;;
+        web/*)
+            # set web_modified flag to true
+            web_modified=true
+            ;;
+    esac
+done
+
+# run linters based on the modified modules
+
+if $api_modified; then
+    echo "Running Ruff linter on api module"
+
+    # run Ruff linter auto-fixing
+    uv run --project api --dev ruff check --fix ./api
+
+    # run Ruff linter checks
+    uv run --project api --dev ruff check  ./api || status=$?
+
+    status=${status:-0}
+
+    if [ $status -ne 0 ]; then
+      echo "Ruff linter on api module error, exit code: $status"
+      echo "Please run 'dev/reformat' to fix the fixable linting errors."
+      exit 1
+    fi
+fi
+
+if $skip_web_checks; then
+    echo "Git operation in progress, skipping web checks"
     exit 0
 fi
 

.vscode/settings.example.json

@@ -4,6 +4,7 @@
 
   "tailwindCSS.experimental.configFile": "web/app/styles/globals.css",
 
+  // Format
   "[javascript]": { "editor.defaultFormatter": "oxc.oxc-vscode" },
   "[javascriptreact]": { "editor.defaultFormatter": "oxc.oxc-vscode" },
   "[typescript]": { "editor.defaultFormatter": "oxc.oxc-vscode" },
@@ -24,9 +25,9 @@
   "[handlebars]": { "editor.defaultFormatter": "oxc.oxc-vscode" },
   "editor.formatOnSave": true,
   "editor.formatOnSaveMode": "file",
-  "oxc.disableNestedConfig": true,
-  "oxc.fmt.disableNestedConfig": true,
+  "oxc.fmt.configPath": "./vite.config.ts",
 
+  // Lint fix
   "eslint.useFlatConfig": true,
   "eslint.validate": ["json", "jsonc", "markdown", "yaml", "toml"],
   "editor.codeActionsOnSave": {

AGENTS.md

@@ -1,9 +1,46 @@
 # AGENTS.md
 
-Dify is an open-source platform for building LLM applications, agentic workflows, and RAG pipelines. This monorepo contains the backend API (`api/`), frontend application (`web/`), deployment assets (`docker/`), standalone agent backend (`dify-agent/`), CLI (`cli/`), and end-to-end suite (`e2e/`). Follow the nearest scoped `AGENTS.md` for the files being changed. Apply its guidance within the user's requested scope; explicit user instructions take precedence over workflow defaults.
+## Project Overview
 
-## Repository Gotchas
+Dify is an open-source platform for developing LLM applications with an intuitive interface combining agentic AI workflows, RAG pipelines, agent capabilities, and model management.
 
-- Run backend commands through `uv run --project api <command>`.
-- Backend integration tests are CI-only and are not expected to run locally.
-- Keep `docker/.env.example` limited to variables required for a default Docker Compose deployment to start. Put optional and provider-specific settings in the matching `docker/envs/*.env.example` file; `docker/.env` overrides those service-specific env files.
+The codebase is split into:
+
+- **Backend API** (`/api`): Python Flask application organized with Domain-Driven Design
+- **Frontend Web** (`/web`): Next.js application using TypeScript and React
+- **Docker deployment** (`/docker`): Containerized deployment configurations
+- **Dify Agent Backend** (`/dify-agent`): Backend services for managing and executing agent
+
+## Backend Workflow
+
+- Read `api/AGENTS.md` for details
+- Run backend CLI commands through `uv run --project api <command>`.
+- Integration tests are CI-only and are not expected to run in the local environment.
+
+## Frontend Workflow
+
+- Read `web/AGENTS.md` for details
+
+## Testing & Quality Practices
+
+- Follow TDD: red → green → refactor.
+- Use `pytest` for backend tests with Arrange-Act-Assert structure.
+- Enforce strong typing; avoid `Any` and prefer explicit type annotations.
+- Write self-documenting code; only add comments that explain intent.
+
+## Language Style
+
+- **Python**: Keep type hints on functions and attributes, and implement relevant special methods (e.g., `__repr__`, `__str__`). Prefer `TypedDict` over `dict` or `Mapping` for type safety and better code documentation.
+- **TypeScript**: Use the strict config, run `pnpm check` for formatting, Oxlint, ESLint non-code checks, and type checking, and avoid `any` types.
+
+## General Practices
+
+- Prefer editing existing files; add new documentation only when requested.
+- Inject dependencies through constructors and preserve clean architecture boundaries.
+- Handle errors with domain-specific exceptions at the correct layer.
+
+## Project Conventions
+
+- Backend architecture adheres to DDD and Clean Architecture principles.
+- Async work runs through Celery with Redis as the broker.
+- Frontend user-facing strings must use `web/i18n/en-US/`; avoid hardcoded text.

CLAUDE.md

@@ -0,0 +1 @@
+AGENTS.md

CONTRIBUTING.md

@@ -22,8 +22,6 @@ Don't forget to link an existing issue or open a new issue in the PR's descripti
 
 ### Bug reports
 
-For security vulnerabilities, follow our [security policy](./SECURITY.md) and report privately instead of opening a public issue.
-
 > [!IMPORTANT]
 > Please make sure to include the following information when submitting a bug report:
 
@@ -38,7 +36,7 @@ How we prioritize:
 
 | Issue Type | Priority |
 | ------------------------------------------------------------ | --------------- |
-| Bugs in core functions (cloud service, cannot login, applications not working) | Critical |
+| Bugs in core functions (cloud service, cannot login, applications not working, security loopholes) | Critical |
 | Non-critical bugs, performance boosts | Medium Priority |
 | Minor fixes (typos, confusing but working UI) | Low Priority |
 
@@ -73,10 +71,6 @@ How we prioritize:
 1. Please link the issue in the PR description, `fixes #<issue_number>`
 1. Get merged!
 
-### AI-assisted contributions
-
-AI tools are welcome, but you are responsible for understanding and verifying every change you submit. Describe the problem, your solution, and actual test results in your own words. Unreviewed or repetitive low-quality submissions may be closed.
-
 ### Setup the project
 
 #### Frontend

Makefile

@@ -90,13 +90,15 @@ api-contract-lint:
 	@echo "✅ Response contract lint complete"
 
 type-check:
-	@echo "📝 Running type checks (pyrefly)..."
+	@echo "📝 Running type checks (pyrefly + mypy)..."
 	@./dev/pyrefly-check-local $(PATH_TO_CHECK)
+	@uv --directory api run mypy --exclude-gitignore --exclude '(^|/)conftest\.py$$' --exclude 'tests/' --exclude 'migrations/' --exclude 'dev/generate_swagger_specs.py' --exclude 'dev/generate_fastopenapi_specs.py' --check-untyped-defs --disable-error-code=import-untyped .
 	@echo "✅ Type checks complete"
 
 type-check-core:
-	@echo "📝 Running core type checks (pyrefly)..."
+	@echo "📝 Running core type checks (pyrefly + mypy)..."
 	@./dev/pyrefly-check-local $(PATH_TO_CHECK)
+	@uv --directory api run mypy --exclude-gitignore --exclude '(^|/)conftest\.py$$' --exclude 'tests/' --exclude 'migrations/' --exclude 'dev/generate_swagger_specs.py' --exclude 'dev/generate_fastopenapi_specs.py' --check-untyped-defs --disable-error-code=import-untyped .
 	@echo "✅ Core type checks complete"
 
 test:
@@ -212,8 +214,8 @@ help:
 	@echo "  make check          - Check code with ruff"
 	@echo "  make lint           - Format, fix, and lint code (ruff, imports, dotenv)"
 	@echo "  make api-contract-lint - Check Flask response docs against returned schemas"
-	@echo "  make type-check     - Run type checks (pyrefly)"
-	@echo "  make type-check-core - Run core type checks (pyrefly)"
+	@echo "  make type-check     - Run type checks (pyrefly, mypy)"
+	@echo "  make type-check-core - Run core type checks (pyrefly, mypy)"
 	@echo "  make test           - Run backend unit tests (or TARGET_TESTS=./api/tests/<target_tests>)"
 	@echo "  make test-all       - Run full backend tests, including Docker-backed suites"
 	@echo ""

README.md

@@ -58,7 +58,6 @@
   <a href="./docs/sl-SI/README.md"><img alt="README Slovenščina" src="https://img.shields.io/badge/Sloven%C5%A1%C4%8Dina-d9d9d9"></a>
   <a href="./docs/bn-BD/README.md"><img alt="README in বাংলা" src="https://img.shields.io/badge/বাংলা-d9d9d9"></a>
   <a href="./docs/hi-IN/README.md"><img alt="README in हिन्दी" src="https://img.shields.io/badge/Hindi-d9d9d9"></a>
-  <a href="./docs/id-ID/README.md"><img alt="README dalam Bahasa Indonesia" src="https://img.shields.io/badge/Bahasa%20Indonesia-d9d9d9"></a>
 </p>
 
 Dify is an open-source LLM app development platform. Its intuitive interface combines AI workflow, RAG pipeline, agent capabilities, model management, observability features (including [Opik](https://www.comet.com/docs/opik/integrations/dify), [Langfuse](https://docs.langfuse.com), and [Arize Phoenix](https://docs.arize.com/phoenix)) and more, letting you quickly go from prototype to production. Here's a list of the core features:
@@ -105,7 +104,8 @@ Intuitive interface for crafting prompts, comparing model performance, and addin
 **4. RAG Pipeline**:
 Extensive RAG capabilities that cover everything from document ingestion to retrieval, with out-of-box support for text extraction from PDFs, PPTs, and other common document formats.
 
-**5. Agent**: Autonomous agents with a sandbox of their own: they run commands, install software, and handle files to get open-ended tasks done. Describe the agent you want and it builds itself. Give it skills, connect tools from [Dify Marketplace](https://marketplace.dify.ai/?category=tool), MCP servers, or your own APIs, and put it to work as a chat app or as a step in any workflow.
+**5. Agent capabilities**:
+You can define agents based on LLM Function Calling or ReAct, and add pre-built or custom tools for the agent. Dify provides 50+ built-in tools for AI agents, such as Google Search, DALL·E, Stable Diffusion and WolframAlpha.
 
 **6. LLMOps**:
 Monitor and analyze application logs and performance over time. You could continuously improve prompts, datasets, and models based on production data and annotations.
@@ -122,50 +122,99 @@ All of Dify's offerings come with corresponding APIs, so you could effortlessly
   Quickly get Dify running in your environment with this [starter guide](#quick-start).
   Use our [documentation](https://docs.dify.ai) for further references and more in-depth instructions.
 
-- **[Dify Enterprise](https://dify.ai/dify-enterprise)<br/>**
-  For organizations requiring self-hosting, SSO, RBAC Security and Enterprise Support SLAs, please fill out [this form](https://share-na2.hsforms.com/14-09ff5HS92Sh4m3f4yrcw40s9fk) to speak to a solution representative. <br/>
+- **Dify for enterprise / organizations<br/>**
+  We provide additional enterprise-centric features. [Send us an email](mailto:business@dify.ai?subject=%5BGitHub%5DBusiness%20License%20Inquiry) to discuss your enterprise needs. <br/>
 
 ## Staying ahead
 
 Star Dify on GitHub and be instantly notified of new releases.
 
-<img width="1344" height="720" alt="star" src="https://github.com/user-attachments/assets/dcd086d1-af0f-471b-ae52-1ad2fa040595" />
+![star-us](https://github.com/langgenius/dify/assets/13230914/b823edc1-6388-4e25-ad45-2f6b187adbb4)
 
 ## Advanced Setup
 
-For custom configuration, observability, and deployment options, see [Advanced Setup](docs/ADVANCED_SETUP.md).
+### Custom configurations
+
+If you need to customize the configuration, edit `docker/.env`. The essential startup defaults live in [`docker/.env.example`](docker/.env.example), and optional advanced variables are split under `docker/envs/` by theme. After making any changes, re-run `docker compose up -d` from the `docker` directory. You can find the full list of available environment variables [here](https://docs.dify.ai/getting-started/install-self-hosted/environments).
+
+### Metrics Monitoring with Grafana
+
+Import the dashboard to Grafana, using Dify's PostgreSQL database as data source, to monitor metrics in granularity of apps, tenants, messages, and more.
+
+- [Grafana Dashboard by @bowenliang123](https://github.com/bowenliang123/dify-grafana-dashboard)
+
+### Deployment with Kubernetes
+
+If you'd like to configure a highly available setup, there are community-contributed [Helm Charts](https://helm.sh/) and YAML files which allow Dify to be deployed on Kubernetes.
+
+- [Helm Chart by @LeoQuote](https://github.com/douban/charts/tree/master/charts/dify)
+- [Helm Chart by @BorisPolonsky](https://github.com/BorisPolonsky/dify-helm)
+- [Helm Chart by @magicsong](https://github.com/magicsong/ai-charts)
+- [YAML file by @Winson-030](https://github.com/Winson-030/dify-kubernetes)
+- [YAML file by @wyy-holding](https://github.com/wyy-holding/dify-k8s)
+- [🚀 NEW! YAML files (Supports Dify v1.6.0) by @Zhoneym](https://github.com/Zhoneym/DifyAI-Kubernetes)
+
+#### Using Terraform for Deployment
+
+Deploy Dify to Cloud Platform with a single click using [terraform](https://www.terraform.io/)
+
+##### Azure Global
+
+- [Azure Terraform by @nikawang](https://github.com/nikawang/dify-azure-terraform)
+
+##### Google Cloud
+
+- [Google Cloud Terraform by @sotazum](https://github.com/DeNA/dify-google-cloud-terraform)
+
+#### Using AWS CDK for Deployment
+
+Deploy Dify to AWS with [CDK](https://aws.amazon.com/cdk/)
+
+##### AWS
+
+- [AWS CDK by @KevinZhao (EKS based)](https://github.com/aws-samples/solution-for-deploying-dify-on-aws)
+- [AWS CDK by @tmokmss (ECS based)](https://github.com/aws-samples/dify-self-hosted-on-aws)
+
+#### Using Alibaba Cloud Computing Nest
+
+Quickly deploy Dify to Alibaba cloud with [Alibaba Cloud Computing Nest](https://computenest.console.aliyun.com/service/instance/create/default?type=user&ServiceName=Dify%E7%A4%BE%E5%8C%BA%E7%89%88)
+
+#### Using Alibaba Cloud Data Management
+
+One-Click deploy Dify to Alibaba Cloud with [Alibaba Cloud Data Management](https://www.alibabacloud.com/help/en/dms/dify-in-invitational-preview/)
+
+#### Deploy to AKS with Azure Devops Pipeline
+
+One-Click deploy Dify to AKS with [Azure Devops Pipeline Helm Chart by @LeoZhang](https://github.com/Ruiruiz30/Dify-helm-chart-AKS)
 
 ## Contributing
 
-Dify welcomes contributions of all kinds:
+For those who'd like to contribute code, see our [Contribution Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md).
+At the same time, please consider supporting Dify by sharing it on social media and at events and conferences.
 
-- **Code**: Read the [Contribution Guide](CONTRIBUTING.md), then browse [good first issues](https://github.com/langgenius/dify/issues?q=is%3Aissue%20state%3Aopen%20label%3A%22good%20first%20issue%22).
-- **Ideas and feedback**: Start or join a [GitHub Discussion](https://github.com/langgenius/dify/discussions).
-- **Translations**: Follow the [internationalization guide](web/i18n/README.md) to add or update a locale.
-- **Community**: Share the apps you build, help other users, and spread the word about Dify.
-
-### Contributors
-
-<a href="https://github.com/langgenius/dify/graphs/contributors">
-  <img alt="Dify contributors" src="https://contrib.rocks/image?repo=langgenius/dify" />
-</a>
+> We are looking for contributors to help translate Dify into languages other than Mandarin or English. If you are interested in helping, please see the [i18n README](https://github.com/langgenius/dify/blob/main/web/i18n-config/README.md) for more information, and leave us a comment in the `global-users` channel of our [Discord Community Server](https://discord.gg/8Tpq4AcN9c).
 
 ## Community & contact
 
-Choose the channel that best fits your question:
+- [GitHub Discussion](https://github.com/langgenius/dify/discussions). Best for: sharing feedback and asking questions.
+- [GitHub Issues](https://github.com/langgenius/dify/issues). Best for: bugs you encounter using Dify.AI, and feature proposals. See our [Contribution Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md).
+- [Discord](https://discord.gg/FngNHpbcY7). Best for: sharing your applications and hanging out with the community.
+- [X(Twitter)](https://twitter.com/dify_ai). Best for: sharing your applications and hanging out with the community.
 
-- [GitHub Discussions](https://github.com/langgenius/dify/discussions): Get help, share feedback, and propose ideas.
-- [GitHub Issues](https://github.com/langgenius/dify/issues): Report reproducible bugs and track engineering work. Read the [Contribution Guide](CONTRIBUTING.md) before opening one.
-- [Discord](https://discord.gg/FngNHpbcY7): Chat in real time, share your apps, and connect with other Dify users.
-- [X](https://x.com/dify_ai): Follow Dify for release news and project updates.
+**Contributors**
+
+<a href="https://github.com/langgenius/dify/graphs/contributors">
+  <img src="https://contrib.rocks/image?repo=langgenius/dify" />
+</a>
 
 ## Star History
 
-<a href="https://star-history.dera.page/#langgenius/dify&type=date&legend=top-left">
+<!-- GitHub token name: star-history -->
+<a href="https://www.star-history.com/?repos=langgenius%2Fdify&type=date&legend=top-left">
  <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://star-history.dera.page/svg?repos=langgenius/dify&type=date&theme=dark&legend=top-left" />
-   <source media="(prefers-color-scheme: light)" srcset="https://star-history.dera.page/svg?repos=langgenius/dify&type=date&legend=top-left" />
-   <img alt="Star History Chart" src="https://star-history.dera.page/svg?repos=langgenius/dify&type=date&legend=top-left" />
+   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=langgenius/dify&type=date&theme=dark&legend=top-left&sealed_token=p-SWD-UXZEDc5a2d0EMfgMmyCwVyRlSof0Qox68v7k4PvQPKRlCx0jDIlNztw7mbA6DEn96R50DojO9pCi5LQUlDBAoIhRswt8-GuC8K3rZQ3naJUXbuHqR_oItIW2F0NNM-7npevzw5SXp7L5mwixgqJncAvAGzuGq5zmhQfiDRSW_Jd6y8TQCZMJbt" />
+   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=langgenius/dify&type=date&legend=top-left&sealed_token=p-SWD-UXZEDc5a2d0EMfgMmyCwVyRlSof0Qox68v7k4PvQPKRlCx0jDIlNztw7mbA6DEn96R50DojO9pCi5LQUlDBAoIhRswt8-GuC8K3rZQ3naJUXbuHqR_oItIW2F0NNM-7npevzw5SXp7L5mwixgqJncAvAGzuGq5zmhQfiDRSW_Jd6y8TQCZMJbt" />
+   <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=langgenius/dify&type=date&legend=top-left&sealed_token=p-SWD-UXZEDc5a2d0EMfgMmyCwVyRlSof0Qox68v7k4PvQPKRlCx0jDIlNztw7mbA6DEn96R50DojO9pCi5LQUlDBAoIhRswt8-GuC8K3rZQ3naJUXbuHqR_oItIW2F0NNM-7npevzw5SXp7L5mwixgqJncAvAGzuGq5zmhQfiDRSW_Jd6y8TQCZMJbt" />
  </picture>
 </a>