diff --git a/.agents/skills/how-to-write-component/SKILL.md b/.agents/skills/how-to-write-component/SKILL.md
index 738ec9de95a..8a480c8fd09 100644
--- a/.agents/skills/how-to-write-component/SKILL.md
+++ b/.agents/skills/how-to-write-component/SKILL.md
@@ -36,19 +36,30 @@ Use this as the decision guide for React/TypeScript component structure. Existin
 - Avoid prop drilling. One pass-through layer is acceptable; repeated forwarding means ownership should move down or into feature-scoped Jotai UI state. Keep server/cache state in query and API data flow.
 - Do not replace prop drilling with one top-level hook that returns a large view model and then thread that object through section props. Move each hook, query, derived value, and handler to the concrete section that consumes it, or use feature-scoped Jotai atoms for simple shared form/UI state when siblings need the same source of truth.
 - When using feature-scoped Jotai state for a form, drawer, or other secondary surface, scope the store to that surface instance when stale cross-instance state is possible. Initialize stable config at the owning boundary, then let descendants read only the atoms or purpose-named hooks they actually need.
+- For Jotai-backed surfaces, put shared query atoms, mutation atoms, derived state, and write actions in the feature state file when they coordinate multiple descendants. The lowest-owner rule still applies to independent visual surfaces that do not participate in shared state.
+- For repeated row/menu action surfaces that need reset, hydrate the stable identity at the surface entry and scope only the primitives that truly need per-instance reset, such as open flags, drafts, or selected local options.
 - Keep callbacks in a parent only for workflow coordination such as form submission, shared selection, batch behavior, or navigation. Otherwise let the child or row own its action.
 - Prefer uncontrolled DOM state and CSS variables before adding controlled props.
 
 ## Feature-Scoped Jotai State
 
 - A module's feature-local state lives in one state file for Jotai-backed features: primitive atoms, query atoms, derived atoms, write-only action atoms, mutation atoms, submission orchestration, provider exports, and optional scope configuration.
+- Keep state local when one component owns it, even inside Jotai-backed features. Dialog open flags, menu/popover visibility, confirmation visibility, form/input drafts, row-local pending flags, and in-flight refs usually belong in component state.
+- Promote UI state to an atom only when siblings need the same source of truth, the value drives a query or mutation atom, a parent workflow coordinates the state, or the state intentionally persists across hidden or unmounted descendants within a scoped surface.
+- Reflect atom-backed surface-wide locks or invariants in every affected trigger. If only one row, menu, or dialog should be disabled, keep the pending or lock state local to that row, menu, or dialog.
 - Atom order in the state file follows the dependency graph: types/constants, editable primitives, query atoms, query-data derived atoms, readiness/business derived atoms, write actions, mutation atoms, submission orchestration, provider exports.
 - Derived atom names read as business facts. Write atom names read as user or workflow commands.
 - UI components read and write the exact atom they use with `useAtomValue` or `useSetAtom`. Repeated workflow semantics live in named derived atoms or write atoms.
-- Non-query derived atoms return a narrow value with a clear domain name. Query atoms expose the TanStack Query result object so loading, error, fetch, and pagination state stay attached to the query contract.
-- Write-only atoms own state transitions that update multiple primitives, reset dependent state, guard stale async work, or advance the workflow.
+- Non-query derived atoms return a narrow value with a clear domain name; avoid pass-through aliases or bundling unrelated UI facts. Query atoms expose the TanStack Query result object so loading, error, fetch, and pagination state stay attached to the query contract.
+- Write-only atoms own synchronous state transitions that update multiple primitives, reset dependent state, or advance the workflow. Async work with loading, error, caching, retry, or stale-result concerns should be modeled as query or mutation atoms, with write atoms only changing the inputs that drive them.
+- Avoid feature hooks that aggregate form values, query results, derived state, and commands for sibling components. Prefer named derived atoms and write atoms so UI components read the exact shared fact or command they need.
+- When a form library owns validation, keep submit orchestration in feature state when post-submit result or error state is shared by the surface. Avoid duplicating validation gates or request shaping in UI hooks.
 - `jotai-tanstack-query` atoms use the same QueryClient as the React Query provider. Query atoms belong in feature state when atoms are the feature's local state surface.
-- Jotai scope is an optional instance-isolation tool for secondary surfaces with independent local state. Query atoms keep shared cache behavior through the shared QueryClient.
+- Jotai scope is an optional instance-isolation tool for secondary surfaces with independent local state. Query and mutation atoms keep shared cache behavior through the shared QueryClient.
+- Do not put `atomWithQuery`, `atomWithInfiniteQuery`, `atomWithMutation`, or broad derived orchestration atoms in a `ScopeProvider` just to reset a surface. Scoped derived atoms implicitly scope their dependencies, which can duplicate query client access and break shared invalidation. Leave query/mutation atoms unscoped; let them read scoped primitive inputs.
+- Scope providers should list resettable primitive atoms and explicit hydration tuples. If a derived atom must be scoped, confirm that every dependency it implicitly scopes is meant to be private to that surface.
+- Keep independent dialog lifecycles separate. Avoid a single discriminated "current action dialog" atom when edit, delete, and other dialogs have their own open state, loading guard, or reset behavior.
+- Route-derived stable identities that do not need instance reset or scoped isolation can be hydrated at the route or layout boundary into a feature route atom. Use scoped atoms only when stale cross-instance state or per-surface reset semantics are needed.
 
 ## Components, Props, And Types
 
@@ -71,6 +82,7 @@ Use this as the decision guide for React/TypeScript component structure. Existin
 - Use generated enum objects and union types directly in props, comparisons, status logic, and i18n keys. Do not add local enum constants or parallel frontend enum/status layers unless they model real product state not represented by the API. Presentation-only tone maps should be keyed by the generated enum.
 - Normalize or coerce only at a real boundary, such as user-entered forms, search, URL/query params, file names, DOM IDs, or legacy adapters. Preserve user-entered values when whitespace or formatting can be meaningful.
 - Do not coerce nullable or optional API strings to `''` in query, derived model, or payload-building code. Keep `undefined` or `null` until the final boundary that requires a string.
+- Do not use `value || undefined` for mutation payload fields where an empty string means "clear this value". Trim or normalize at the form boundary, then preserve `''` when the API contract treats it as an intentional update.
 - Local UI models are fine for presentation, form state, select options, or guarded required-field refinements. Name them as UI concepts, not generated DTO mirrors.
 - Required-value refinements are allowed only after same-branch filtering or early return. Prefer nullable-tolerant props for render-only data.
 - When a component needs a stricter shape than a generated DTO, refine once at the API/query-to-UI boundary into a purpose-named UI type instead of hiding missing fields with generic fallback or coercion helpers.
@@ -90,12 +102,17 @@ Use this as the decision guide for React/TypeScript component structure. Existin
 
 - Keep `web/contract/*` as the single source of truth for API shape; follow existing domain/router patterns and the `{ params, query?, body? }` input shape.
 - Consume queries directly with `useQuery(consoleQuery.xxx.queryOptions(...))` or `useQuery(marketplaceQuery.xxx.queryOptions(...))`.
+- In `atomWithQuery` and `atomWithInfiniteQuery`, return generated `queryOptions()` or `infiniteOptions()` directly. Pass `enabled`, `retry`, `placeholderData`, `select`, and pagination options into that call instead of spreading generated options into a hand-built object.
+- In `atomWithMutation`, return generated `mutationOptions()` directly when using generated clients. Put request shaping and submit orchestration in write atoms; do not rebuild mutation option objects just to pass through the generated mutation function.
+- For custom query functions that do not come from generated clients, wrap the options object with TanStack `queryOptions(...)` so query atoms still return a query options contract.
 - Avoid pass-through hooks and thin `web/service/use-*` wrappers that only rename `queryOptions()` or `mutationOptions()`. Extract a small `queryOptions` helper only when repeated call-site options justify it.
 - Keep feature hooks for real orchestration, workflow state, or shared domain behavior.
 - For TanStack cache data, use generated or query-derived types; do not create local wrappers for `getQueryData` or `getQueriesData`.
-- For generated oRPC `queryOptions()` / `infiniteOptions()`, do not pass `skipToken` as `input`; keep a valid placeholder input shape and use `enabled` to gate missing required params because the OpenAPI codec encodes input eagerly.
+- For generated oRPC `queryOptions()` / `infiniteOptions()`, keep returning the generated options directly. When required input is missing, use a whole-input branch such as `input: condition ? validInput : skipToken` together with `enabled: Boolean(condition)` so no request runs and no fake payload is built.
+- Do not put `skipToken` inside a nested placeholder payload, such as `{ params: { appInstanceId: skipToken } }`. Do not create hand-written "missing queryOptions" objects or coerce required IDs to `''`.
 - Consume mutations directly with `useMutation(consoleQuery.xxx.mutationOptions(...))` or `useMutation(marketplaceQuery.xxx.mutationOptions(...))`; use oRPC clients as `mutationFn` only for custom flows.
 - Put shared cache behavior in `createTanstackQueryUtils(...experimental_defaults...)`; components may add UI feedback callbacks, but should not own shared invalidation rules.
+- Component or atom mutation callbacks can handle local UI feedback such as toasts, closing dialogs, or navigation. They should not replace shared invalidation or add local cache patches for shared server state.
 - Do not use deprecated `useInvalid` or `useReset`.
 - Prefer `mutate(...)`; use `mutateAsync(...)` only when Promise semantics are required, and wrap awaited calls in `try/catch`.
 
@@ -107,8 +124,9 @@ Use this as the decision guide for React/TypeScript component structure. Existin
 - Keep cohesive forms, menu bodies, and one-off helpers local unless they need their own state, reuse, or semantic boundary.
 - Separate hidden secondary surfaces from the trigger's main flow. For dialogs, dropdowns, popovers, and similar branches, extract a small local component that owns the trigger, open state, and hidden content when it would obscure the parent flow.
 - Preserve composability by separating behavior ownership from layout ownership. A dropdown action may own its trigger, open state, and menu content; the caller owns placement such as slots, offsets, and alignment.
+- When a dialog, dropdown, or popover component already accepts controlled `open` state, mount the surface unconditionally unless unmounting is required for performance or reset semantics. Use keyed scope or local state reset for reset behavior instead of `{open && <Surface />}` wrappers.
 - Avoid unnecessary DOM hierarchy. Do not add wrapper elements unless they provide layout, semantics, accessibility, state ownership, or integration with a library API; prefer fragments or styling an existing element when possible.
-- Avoid shallow wrappers, hook-to-props adapter components, layout-only render-prop wrappers, and prop renaming unless the wrapper adds validation, orchestration, error handling, state ownership, or a real semantic boundary. If a component only calls a hook and forwards every returned field to one child, move the hook into that child or make the wrapper own a real surface.
+- Avoid shallow wrappers, hook-to-props adapter components, layout-only render-prop wrappers, children-as-pass-through composition, and prop renaming unless the wrapper adds validation, orchestration, error handling, state ownership, or a real semantic boundary. If a component only calls a hook, forwards props, or passes trigger/content through to one child, move the logic into that child or make the wrapper own a real surface.
 
 ## You Might Not Need An Effect
 
@@ -117,6 +135,7 @@ Use this as the decision guide for React/TypeScript component structure. Existin
 - Do not use Effects to handle user actions. Put action-specific logic in the event handler where the cause is known.
 - Do not use Effects to copy one state value into another state value representing the same concept. Pick one source of truth and derive the rest during render.
 - Do not reset or adjust state from props with an Effect. Prefer a `key` reset, storing a stable ID and deriving the selected object, or guarded same-component render-time adjustment when truly necessary.
+- For forms initialized from query data, prefer keyed remounts or surface-entry hydration of form/field atoms over an Effect that copies query data into form state.
 - Prefer framework data APIs or TanStack Query for data fetching instead of writing request Effects in components.
 - If an Effect still seems necessary, first name the external system it synchronizes with. If there is no external system, remove the Effect and restructure the state or event flow.
 
diff --git a/.github/workflows/build-push.yml b/.github/workflows/build-push.yml
index 2ff4e8c2123..63ce63cad42 100644
--- a/.github/workflows/build-push.yml
+++ b/.github/workflows/build-push.yml
@@ -8,8 +8,6 @@ on:
       - "build/**"
       - "release/e-*"
       - "hotfix/**"
-      - "feat/hitl-backend"
-      - "feat/rbac"
     tags:
       - "*"
 
@@ -23,6 +21,7 @@ env:
   DIFY_WEB_IMAGE_NAME: ${{ vars.DIFY_WEB_IMAGE_NAME || 'langgenius/dify-web' }}
   DIFY_API_IMAGE_NAME: ${{ vars.DIFY_API_IMAGE_NAME || 'langgenius/dify-api' }}
   DIFY_AGENT_IMAGE_NAME: ${{ vars.DIFY_AGENT_IMAGE_NAME || 'langgenius/dify-agent-backend' }}
+  DIFY_AGENT_LOCAL_SANDBOX_IMAGE_NAME: ${{ vars.DIFY_AGENT_LOCAL_SANDBOX_IMAGE_NAME || 'langgenius/dify-agent-local-sandbox' }}
 
 jobs:
   build:
@@ -76,6 +75,20 @@ jobs:
             file: "dify-agent/Dockerfile"
             platform: linux/arm64
             runs_on: depot-ubuntu-24.04-4
+          - service_name: "build-agent-local-sandbox-amd64"
+            image_name_env: "DIFY_AGENT_LOCAL_SANDBOX_IMAGE_NAME"
+            artifact_context: "local-sandbox"
+            build_context: "{{defaultContext}}:dify-agent"
+            file: "docker/local-sandbox/Dockerfile"
+            platform: linux/amd64
+            runs_on: depot-ubuntu-24.04-4
+          - service_name: "build-agent-local-sandbox-arm64"
+            image_name_env: "DIFY_AGENT_LOCAL_SANDBOX_IMAGE_NAME"
+            artifact_context: "local-sandbox"
+            build_context: "{{defaultContext}}:dify-agent"
+            file: "docker/local-sandbox/Dockerfile"
+            platform: linux/arm64
+            runs_on: depot-ubuntu-24.04-4
 
     steps:
       - name: Prepare
@@ -141,6 +154,9 @@ jobs:
           - service_name: "validate-agent-amd64"
             build_context: "{{defaultContext}}"
             file: "dify-agent/Dockerfile"
+          - service_name: "validate-agent-local-sandbox-amd64"
+            build_context: "{{defaultContext}}:dify-agent"
+            file: "docker/local-sandbox/Dockerfile"
     steps:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
@@ -169,6 +185,9 @@ jobs:
           - service_name: "merge-agent-images"
             image_name_env: "DIFY_AGENT_IMAGE_NAME"
             context: "agent"
+          - service_name: "merge-agent-local-sandbox-images"
+            image_name_env: "DIFY_AGENT_LOCAL_SANDBOX_IMAGE_NAME"
+            context: "local-sandbox"
     steps:
       - name: Download digests
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
diff --git a/.github/workflows/deploy-hitl.yml b/.github/workflows/deploy-hitl.yml
deleted file mode 100644
index 0da241cf959..00000000000
--- a/.github/workflows/deploy-hitl.yml
+++ /dev/null
@@ -1,25 +0,0 @@
-name: Deploy HITL
-
-on:
-  workflow_run:
-    workflows: ["Build and Push API & Web"]
-    branches:
-      - "build/feat/hitl"
-    types:
-      - completed
-
-jobs:
-  deploy:
-    runs-on: depot-ubuntu-24.04
-    if: |
-      github.event.workflow_run.conclusion == 'success' &&
-      github.event.workflow_run.head_branch == 'build/feat/hitl'
-    steps:
-      - name: Deploy to server
-        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
-        with:
-          host: ${{ secrets.HITL_SSH_HOST }}
-          username: ${{ secrets.SSH_USER }}
-          key: ${{ secrets.SSH_PRIVATE_KEY }}
-          script: |
-            ${{ vars.SSH_SCRIPT || secrets.SSH_SCRIPT }}
diff --git a/api/.env.example b/api/.env.example
index 8a2af53c6e7..3aa107130f9 100644
--- a/api/.env.example
+++ b/api/.env.example
@@ -768,7 +768,6 @@ EVENT_BUS_REDIS_CHANNEL_TYPE=pubsub
 # Whether to use Redis cluster mode while use redis as event bus.
 #  It's highly recommended to enable this for large deployments.
 EVENT_BUS_REDIS_USE_CLUSTERS=false
-EVENT_BUS_LISTENER_JOIN_TIMEOUT_MS=2000
 
 # Whether to Enable human input timeout check task
 ENABLE_HUMAN_INPUT_TIMEOUT_TASK=true
diff --git a/api/clients/agent_backend/request_builder.py b/api/clients/agent_backend/request_builder.py
index c245a09e970..6eadd4ce3d8 100644
--- a/api/clients/agent_backend/request_builder.py
+++ b/api/clients/agent_backend/request_builder.py
@@ -78,6 +78,13 @@ def _filter_snapshot_to_specs(
     return CompositorSessionSnapshot(schema_version=snapshot.schema_version, layers=filtered_layers)
 
 
+def _shell_layer_deps(*, include_drive: bool) -> dict[str, str]:
+    deps = {"execution_context": DIFY_EXECUTION_CONTEXT_LAYER_ID}
+    if include_drive:
+        deps["drive"] = DIFY_DRIVE_LAYER_ID
+    return deps
+
+
 class AgentBackendModelConfig(BaseModel):
     """API-side model/plugin selection before it is converted to Dify Agent layers."""
 
@@ -263,6 +270,7 @@ class AgentBackendRunRequestBuilder:
                 RunLayerSpec(
                     name=DIFY_DRIVE_LAYER_ID,
                     type=DIFY_DRIVE_LAYER_TYPE_ID,
+                    deps={"execution_context": DIFY_EXECUTION_CONTEXT_LAYER_ID},
                     metadata=run_input.metadata,
                     config=run_input.drive_config,
                 )
@@ -329,14 +337,15 @@ class AgentBackendRunRequestBuilder:
             )
 
         if run_input.include_shell:
-            # Sandboxed bash workspace (dify.shell). Depends on execution_context so
-            # the agent server can mint per-command Agent Stub env (back proxy);
+            # Sandboxed bash workspace (dify.shell). Depends on execution_context
+            # so the agent server can mint per-command Agent Stub env, and on
+            # drive when present so that env points at /mnt/drive/<drive_ref>.
             # shellctl connection itself is server-injected.
             layers.append(
                 RunLayerSpec(
                     name=DIFY_SHELL_LAYER_ID,
                     type=DIFY_SHELL_LAYER_TYPE_ID,
-                    deps={"execution_context": DIFY_EXECUTION_CONTEXT_LAYER_ID},
+                    deps=_shell_layer_deps(include_drive=run_input.drive_config is not None),
                     metadata=run_input.metadata,
                     config=run_input.shell_config or DifyShellLayerConfig(),
                 )
@@ -460,6 +469,7 @@ class AgentBackendRunRequestBuilder:
                 RunLayerSpec(
                     name=DIFY_DRIVE_LAYER_ID,
                     type=DIFY_DRIVE_LAYER_TYPE_ID,
+                    deps={"execution_context": DIFY_EXECUTION_CONTEXT_LAYER_ID},
                     metadata=run_input.metadata,
                     config=run_input.drive_config,
                 )
@@ -528,14 +538,15 @@ class AgentBackendRunRequestBuilder:
             )
 
         if run_input.include_shell:
-            # Sandboxed bash workspace (dify.shell). Depends on execution_context so
-            # the agent server can mint per-command Agent Stub env (back proxy);
+            # Sandboxed bash workspace (dify.shell). Depends on execution_context
+            # so the agent server can mint per-command Agent Stub env, and on
+            # drive when present so that env points at /mnt/drive/<drive_ref>.
             # shellctl connection itself is server-injected.
             layers.append(
                 RunLayerSpec(
                     name=DIFY_SHELL_LAYER_ID,
                     type=DIFY_SHELL_LAYER_TYPE_ID,
-                    deps={"execution_context": DIFY_EXECUTION_CONTEXT_LAYER_ID},
+                    deps=_shell_layer_deps(include_drive=run_input.drive_config is not None),
                     metadata=run_input.metadata,
                     config=run_input.shell_config or DifyShellLayerConfig(),
                 )
diff --git a/api/commands/__init__.py b/api/commands/__init__.py
index 94321ed1e49..e4207bea74e 100644
--- a/api/commands/__init__.py
+++ b/api/commands/__init__.py
@@ -25,6 +25,7 @@ from .plugin import (
 from .rbac import migrate_member_roles_to_rbac
 from .retention import (
     archive_workflow_runs,
+    archive_workflow_runs_plan,
     clean_expired_messages,
     clean_workflow_runs,
     cleanup_orphaned_draft_variables,
@@ -51,6 +52,7 @@ from .vector import (
 __all__ = [
     "add_qdrant_index",
     "archive_workflow_runs",
+    "archive_workflow_runs_plan",
     "backfill_plugin_auto_upgrade",
     "clean_expired_messages",
     "clean_workflow_runs",
diff --git a/api/commands/retention.py b/api/commands/retention.py
index 657a2a2e839..1386e367aff 100644
--- a/api/commands/retention.py
+++ b/api/commands/retention.py
@@ -12,10 +12,160 @@ from services.clear_free_plan_tenant_expired_logs import ClearFreePlanTenantExpi
 from services.retention.conversation.messages_clean_policy import create_message_clean_policy
 from services.retention.conversation.messages_clean_service import MessagesCleanService
 from services.retention.workflow_run.clear_free_plan_expired_workflow_run_logs import WorkflowRunCleanup
+from services.retention.workflow_run.tenant_prefix import tenant_prefix_condition
 from tasks.remove_app_and_related_data_task import delete_draft_variables_batch
 
 logger = logging.getLogger(__name__)
 
+_HEX_PREFIXES = tuple("0123456789abcdef")
+
+
+class WorkflowRunArchivePlanRow(TypedDict):
+    tenant_prefix: str
+    total_tenants: int
+    workflow_runs: int
+    workflow_node_executions: int
+    paid_tenants: int
+    unpaid_tenants: int
+
+
+class WorkflowRunArchiveTenantPlan(TypedDict):
+    archive_tenant_ids: list[str] | None
+    paid_tenant_ids: list[str]
+    unpaid_tenant_ids: list[str]
+
+
+def _parse_tenant_prefixes(prefixes: str | None) -> list[str]:
+    if not prefixes:
+        return []
+
+    parsed = []
+    for raw_prefix in prefixes.split(","):
+        prefix = raw_prefix.strip().lower()
+        if not prefix:
+            continue
+        if len(prefix) != 1 or prefix not in _HEX_PREFIXES:
+            raise click.UsageError("--tenant-prefixes must be a comma-separated list of hex digits, e.g. 0,1,a,f.")
+        parsed.append(prefix)
+    return sorted(set(parsed))
+
+
+def _get_archive_candidate_tenant_ids_by_prefix(
+    prefix: str,
+    *,
+    start_from: datetime.datetime | None,
+    end_before: datetime.datetime,
+) -> list[str]:
+    from graphon.enums import WorkflowExecutionStatus
+    from models.workflow import WorkflowRun
+    from services.retention.workflow_run.archive_paid_plan_workflow_run import WorkflowRunArchiver
+
+    conditions = [
+        WorkflowRun.created_at < end_before,
+        WorkflowRun.status.in_(WorkflowExecutionStatus.ended_values()),
+        WorkflowRun.type.in_(WorkflowRunArchiver.ARCHIVED_TYPE),
+        tenant_prefix_condition(WorkflowRun.tenant_id, prefix),
+    ]
+    if start_from is not None:
+        conditions.append(WorkflowRun.created_at >= start_from)
+
+    tenant_ids = db.session.scalars(
+        sa.select(WorkflowRun.tenant_id).where(*conditions).distinct().order_by(WorkflowRun.tenant_id)
+    ).all()
+    return list(tenant_ids)
+
+
+def _filter_paid_workflow_archive_tenant_ids(tenant_ids: list[str]) -> tuple[list[str], list[str]]:
+    from configs import dify_config
+    from enums.cloud_plan import CloudPlan
+    from services.billing_service import BillingService
+
+    tenant_ids = sorted(set(tenant_ids))
+    if not tenant_ids:
+        return [], []
+    if not dify_config.BILLING_ENABLED:
+        return tenant_ids, []
+
+    plans = BillingService.get_plan_bulk_with_cache(tenant_ids)
+    paid_tenant_ids = [
+        tenant_id
+        for tenant_id in tenant_ids
+        if plans.get(tenant_id) and plans[tenant_id].get("plan") in (CloudPlan.PROFESSIONAL, CloudPlan.TEAM)
+    ]
+    unpaid_tenant_ids = sorted(set(tenant_ids) - set(paid_tenant_ids))
+    return paid_tenant_ids, unpaid_tenant_ids
+
+
+def _resolve_archive_tenant_ids_from_plan(
+    *,
+    tenant_ids: str | None,
+    tenant_prefixes: list[str],
+    start_from: datetime.datetime | None,
+    end_before: datetime.datetime,
+) -> WorkflowRunArchiveTenantPlan:
+    """
+    Resolve the archive tenant scope once before scanning workflow_runs.
+
+    Prefix rollout should use the tenant list collected by the same planning path, then archive by
+    tenant_id IN (...). Scanning workflow_runs with a tenant prefix range in every archive run is too expensive on
+    the large production table this command is meant to shrink.
+    """
+    if tenant_ids:
+        requested_tenant_ids = [tid.strip() for tid in tenant_ids.split(",") if tid.strip()]
+    elif tenant_prefixes:
+        requested_tenant_ids = []
+        for prefix in tenant_prefixes:
+            requested_tenant_ids.extend(
+                _get_archive_candidate_tenant_ids_by_prefix(
+                    prefix,
+                    start_from=start_from,
+                    end_before=end_before,
+                )
+            )
+    else:
+        return WorkflowRunArchiveTenantPlan(
+            archive_tenant_ids=None,
+            paid_tenant_ids=[],
+            unpaid_tenant_ids=[],
+        )
+
+    paid_tenant_ids, unpaid_tenant_ids = _filter_paid_workflow_archive_tenant_ids(requested_tenant_ids)
+    return WorkflowRunArchiveTenantPlan(
+        archive_tenant_ids=paid_tenant_ids,
+        paid_tenant_ids=paid_tenant_ids,
+        unpaid_tenant_ids=unpaid_tenant_ids,
+    )
+
+
+def _resolve_archive_time_range(
+    *,
+    before_days: int,
+    from_days_ago: int | None,
+    to_days_ago: int | None,
+    start_from: datetime.datetime | None,
+    end_before: datetime.datetime | None,
+) -> tuple[int, datetime.datetime | None, datetime.datetime | None]:
+    if (start_from is None) ^ (end_before is None):
+        raise click.UsageError("--start-from and --end-before must be provided together.")
+
+    if (from_days_ago is None) ^ (to_days_ago is None):
+        raise click.UsageError("--from-days-ago and --to-days-ago must be provided together.")
+
+    if from_days_ago is not None and to_days_ago is not None:
+        if start_from or end_before:
+            raise click.UsageError("Choose either day offsets or explicit dates, not both.")
+        if from_days_ago <= to_days_ago:
+            raise click.UsageError("--from-days-ago must be greater than --to-days-ago.")
+        now = datetime.datetime.now()
+        start_from = now - datetime.timedelta(days=from_days_ago)
+        end_before = now - datetime.timedelta(days=to_days_ago)
+        before_days = 0
+
+    if start_from and end_before and start_from >= end_before:
+        raise click.UsageError("--start-from must be earlier than --end-before.")
+
+    return before_days, start_from, end_before
+
 
 @click.command("clear-free-plan-tenant-expired-logs", help="Clear free plan tenant expired logs.")
 @click.option("--days", prompt=True, help="The days to clear free plan tenant expired logs.", default=30)
@@ -139,11 +289,143 @@ def clean_workflow_runs(
     )
 
 
+@click.command(
+    "archive-workflow-runs-plan",
+    help="Plan workflow run archive rollout by tenant ID first hex digit.",
+)
+@click.option("--before-days", default=90, show_default=True, help="Plan runs older than N days.")
+@click.option(
+    "--from-days-ago",
+    default=None,
+    type=click.IntRange(min=0),
+    help="Lower bound in days ago (older). Must be paired with --to-days-ago.",
+)
+@click.option(
+    "--to-days-ago",
+    default=None,
+    type=click.IntRange(min=0),
+    help="Upper bound in days ago (newer). Must be paired with --from-days-ago.",
+)
+@click.option(
+    "--start-from",
+    type=click.DateTime(formats=["%Y-%m-%d", "%Y-%m-%dT%H:%M:%S"]),
+    default=None,
+    help="Plan runs created at or after this timestamp (UTC if no timezone).",
+)
+@click.option(
+    "--end-before",
+    type=click.DateTime(formats=["%Y-%m-%d", "%Y-%m-%dT%H:%M:%S"]),
+    default=None,
+    help="Plan runs created before this timestamp (UTC if no timezone).",
+)
+@click.option(
+    "--include-archived",
+    is_flag=True,
+    help="Compatibility no-op for V2 bundle archive; plan counts source rows in the requested window.",
+)
+def archive_workflow_runs_plan(
+    before_days: int,
+    from_days_ago: int | None,
+    to_days_ago: int | None,
+    start_from: datetime.datetime | None,
+    end_before: datetime.datetime | None,
+    include_archived: bool,
+):
+    """
+    Print the 16 tenant-prefix rollout rows used to choose archive execution order.
+
+    Counts use the same workflow run eligibility as archive-workflow-runs: ended runs,
+    supported workflow types, and the requested created_at window. V2 bundle archive
+    does not maintain per-run archive logs, so this plan reports source-table volume.
+    """
+    from graphon.enums import WorkflowExecutionStatus
+    from models.workflow import WorkflowNodeExecutionModel, WorkflowRun
+    from services.retention.workflow_run.archive_paid_plan_workflow_run import WorkflowRunArchiver
+
+    before_days, start_from, end_before = _resolve_archive_time_range(
+        before_days=before_days,
+        from_days_ago=from_days_ago,
+        to_days_ago=to_days_ago,
+        start_from=start_from,
+        end_before=end_before,
+    )
+    plan_end_before = end_before or datetime.datetime.now(datetime.UTC) - datetime.timedelta(days=before_days)
+    if include_archived:
+        click.echo(click.style("--include-archived is a no-op for V2 bundle archive plans.", fg="yellow"))
+
+    rows: list[WorkflowRunArchivePlanRow] = []
+    for prefix in _HEX_PREFIXES:
+        tenant_ids = _get_archive_candidate_tenant_ids_by_prefix(
+            prefix,
+            start_from=start_from,
+            end_before=plan_end_before,
+        )
+        total_tenants = len(tenant_ids)
+        paid_tenant_ids, unpaid_tenant_ids = _filter_paid_workflow_archive_tenant_ids(tenant_ids)
+
+        run_conditions = [
+            WorkflowRun.created_at < plan_end_before,
+            WorkflowRun.status.in_(WorkflowExecutionStatus.ended_values()),
+            WorkflowRun.type.in_(WorkflowRunArchiver.ARCHIVED_TYPE),
+            tenant_prefix_condition(WorkflowRun.tenant_id, prefix),
+        ]
+        if start_from is not None:
+            run_conditions.append(WorkflowRun.created_at >= start_from)
+        workflow_runs = (
+            db.session.scalar(sa.select(sa.func.count()).select_from(WorkflowRun).where(*run_conditions)) or 0
+        )
+        candidate_runs = sa.select(WorkflowRun.id).where(*run_conditions).subquery()
+        workflow_node_executions = (
+            db.session.scalar(
+                sa.select(sa.func.count())
+                .select_from(WorkflowNodeExecutionModel)
+                .join(candidate_runs, WorkflowNodeExecutionModel.workflow_run_id == candidate_runs.c.id)
+            )
+            or 0
+        )
+
+        rows.append(
+            WorkflowRunArchivePlanRow(
+                tenant_prefix=prefix,
+                total_tenants=total_tenants,
+                workflow_runs=workflow_runs,
+                workflow_node_executions=workflow_node_executions,
+                paid_tenants=len(paid_tenant_ids),
+                unpaid_tenants=len(unpaid_tenant_ids),
+            )
+        )
+
+    click.echo(
+        click.style(
+            f"Workflow archive plan for runs before {plan_end_before.isoformat()}"
+            f"{f' and at/after {start_from.isoformat()}' if start_from else ''}.",
+            fg="white",
+        )
+    )
+    click.echo("tenant_prefix,total_tenants,workflow_runs,workflow_node_executions,paid_tenants,unpaid_tenants")
+    for row in rows:
+        click.echo(
+            f"{row['tenant_prefix']},{row['total_tenants']},{row['workflow_runs']},"
+            f"{row['workflow_node_executions']},{row['paid_tenants']},{row['unpaid_tenants']}"
+        )
+
+    ordered_rows = sorted(
+        rows,
+        key=lambda row: (row["workflow_runs"] + row["workflow_node_executions"], row["tenant_prefix"]),
+    )
+    click.echo("suggested_execution_order=" + ",".join(row["tenant_prefix"] for row in ordered_rows))
+
+
 @click.command(
     "archive-workflow-runs",
     help="Archive workflow runs for paid plan tenants to S3-compatible storage.",
 )
 @click.option("--tenant-ids", default=None, help="Optional comma-separated tenant IDs for grayscale rollout.")
+@click.option(
+    "--tenant-prefixes",
+    default=None,
+    help="Optional comma-separated tenant ID first hex digits for rollout waves, e.g. 0,1,a,f.",
+)
 @click.option("--before-days", default=90, show_default=True, help="Archive runs older than N days.")
 @click.option(
     "--from-days-ago",
@@ -169,13 +451,36 @@ def clean_workflow_runs(
     default=None,
     help="Archive runs created before this timestamp (UTC if no timezone).",
 )
-@click.option("--batch-size", default=100, show_default=True, help="Batch size for processing.")
-@click.option("--workers", default=1, show_default=True, type=int, help="Concurrent workflow runs to archive.")
+@click.option("--batch-size", default=100, show_default=True, help="Maximum workflow runs per archive bundle.")
+@click.option(
+    "--workers",
+    default=1,
+    show_default=True,
+    type=int,
+    help="Reserved; bundle archive currently runs serially.",
+)
+@click.option(
+    "--run-shard-index",
+    default=None,
+    type=click.IntRange(min=0),
+    help="Zero-based workflow run shard index for parallel cron jobs. Must be paired with --run-shard-total.",
+)
+@click.option(
+    "--run-shard-total",
+    default=None,
+    type=click.IntRange(min=1, max=16),
+    help="Total workflow run shard count for parallel cron jobs. Must be paired with --run-shard-index.",
+)
 @click.option("--limit", default=None, type=int, help="Maximum number of runs to archive.")
 @click.option("--dry-run", is_flag=True, help="Preview without archiving.")
-@click.option("--delete-after-archive", is_flag=True, help="Delete runs and related data after archiving.")
+@click.option(
+    "--delete-after-archive",
+    is_flag=True,
+    help="Not supported by bundle archive; use a separate bundle delete workflow after validation.",
+)
 def archive_workflow_runs(
     tenant_ids: str | None,
+    tenant_prefixes: str | None,
     before_days: int,
     from_days_ago: int | None,
     to_days_ago: int | None,
@@ -183,6 +488,8 @@ def archive_workflow_runs(
     end_before: datetime.datetime | None,
     batch_size: int,
     workers: int,
+    run_shard_index: int | None,
+    run_shard_total: int | None,
     limit: int | None,
     dry_run: bool,
     delete_after_archive: bool,
@@ -190,14 +497,19 @@ def archive_workflow_runs(
     """
     Archive workflow runs for paid plan tenants older than the specified days.
 
-    This command archives the following tables to storage:
+    This command writes V2 tenant/month/shard archive bundles. Each bundle contains Parquet snapshots from:
+    - workflow_runs
+    - workflow_app_logs
     - workflow_node_executions
     - workflow_node_execution_offload
     - workflow_pauses
     - workflow_pause_reasons
     - workflow_trigger_logs
 
-    The workflow_runs and workflow_app_logs tables are preserved for UI listing.
+    Source database rows are always preserved by archive. Deletion must be handled by
+    a separate bundle-level delete workflow after manifest, checksum, row-count, and
+    restore-sampling validation. In --dry-run mode, no storage or database writes
+    happen; the command estimates per-table Parquet bytes and object size instead.
     """
     from services.retention.workflow_run.archive_paid_plan_workflow_run import WorkflowRunArchiver
 
@@ -209,32 +521,58 @@ def archive_workflow_runs(
         )
     )
 
-    if (start_from is None) ^ (end_before is None):
-        click.echo(click.style("start-from and end-before must be provided together.", fg="red"))
-        return
-
-    if (from_days_ago is None) ^ (to_days_ago is None):
-        click.echo(click.style("from-days-ago and to-days-ago must be provided together.", fg="red"))
-        return
-
-    if from_days_ago is not None and to_days_ago is not None:
-        if start_from or end_before:
-            click.echo(click.style("Choose either day offsets or explicit dates, not both.", fg="red"))
-            return
-        if from_days_ago <= to_days_ago:
-            click.echo(click.style("from-days-ago must be greater than to-days-ago.", fg="red"))
-            return
-        now = datetime.datetime.now()
-        start_from = now - datetime.timedelta(days=from_days_ago)
-        end_before = now - datetime.timedelta(days=to_days_ago)
-        before_days = 0
-
-    if start_from and end_before and start_from >= end_before:
-        click.echo(click.style("start-from must be earlier than end-before.", fg="red"))
+    try:
+        before_days, start_from, end_before = _resolve_archive_time_range(
+            before_days=before_days,
+            from_days_ago=from_days_ago,
+            to_days_ago=to_days_ago,
+            start_from=start_from,
+            end_before=end_before,
+        )
+        parsed_tenant_prefixes = _parse_tenant_prefixes(tenant_prefixes)
+    except click.UsageError as e:
+        click.echo(click.style(e.message, fg="red"))
         return
+    plan_end_before = end_before or datetime.datetime.now(datetime.UTC) - datetime.timedelta(days=before_days)
     if workers < 1:
         click.echo(click.style("workers must be at least 1.", fg="red"))
         return
+    if (run_shard_index is None) ^ (run_shard_total is None):
+        click.echo(click.style("run-shard-index and run-shard-total must be provided together.", fg="red"))
+        return
+    if run_shard_index is not None and run_shard_total is not None and run_shard_index >= run_shard_total:
+        click.echo(click.style("run-shard-index must be less than run-shard-total.", fg="red"))
+        return
+    if delete_after_archive:
+        click.echo(click.style("delete-after-archive is not supported by bundle archive.", fg="red"))
+        return
+
+    try:
+        tenant_plan = _resolve_archive_tenant_ids_from_plan(
+            tenant_ids=tenant_ids,
+            tenant_prefixes=parsed_tenant_prefixes,
+            start_from=start_from,
+            end_before=plan_end_before,
+        )
+    except Exception:
+        logger.exception("Failed to resolve workflow archive tenant plan")
+        click.echo(click.style("Failed to resolve workflow archive tenant plan.", fg="red"))
+        return
+
+    planned_tenant_ids = tenant_plan["archive_tenant_ids"]
+    planned_paid_tenant_ids = tenant_plan["paid_tenant_ids"] if planned_tenant_ids is not None else None
+    paid_tenants = len(tenant_plan["paid_tenant_ids"])
+    unpaid_tenants = len(tenant_plan["unpaid_tenant_ids"])
+    if planned_tenant_ids is not None:
+        click.echo(
+            click.style(
+                f"Resolved archive tenant plan: paid_tenants={paid_tenants}, unpaid_tenants={unpaid_tenants}.",
+                fg="white",
+            )
+        )
+        if not planned_tenant_ids:
+            click.echo(click.style("No paid tenants matched the archive plan; nothing to archive.", fg="yellow"))
+            return
 
     archiver = WorkflowRunArchiver(
         days=before_days,
@@ -242,7 +580,11 @@ def archive_workflow_runs(
         start_from=start_from,
         end_before=end_before,
         workers=workers,
-        tenant_ids=[tid.strip() for tid in tenant_ids.split(",")] if tenant_ids else None,
+        tenant_ids=planned_tenant_ids,
+        tenant_prefixes=parsed_tenant_prefixes,
+        paid_tenant_ids=planned_paid_tenant_ids,
+        run_shard_index=run_shard_index,
+        run_shard_total=run_shard_total,
         limit=limit,
         dry_run=dry_run,
         delete_after_archive=delete_after_archive,
@@ -252,7 +594,9 @@ def archive_workflow_runs(
         click.style(
             f"Summary: processed={summary.total_runs_processed}, archived={summary.runs_archived}, "
             f"skipped={summary.runs_skipped}, failed={summary.runs_failed}, "
-            f"time={summary.total_elapsed_time:.2f}s",
+            f"bundles_archived={summary.bundles_archived}, bundles_skipped={summary.bundles_skipped}, "
+            f"bundles_failed={summary.bundles_failed}, "
+            f"object_size_bytes={summary.total_object_size_bytes}, time={summary.total_elapsed_time:.2f}s",
             fg="cyan",
         )
     )
@@ -268,6 +612,52 @@ def archive_workflow_runs(
     )
 
 
+def _echo_bundle_archive_operation_summary(summary) -> None:
+    status = "completed successfully" if summary.bundles_failed == 0 else "completed with failures"
+    fg = "green" if summary.bundles_failed == 0 else "red"
+    click.echo(
+        click.style(
+            f"{summary.operation} {status}. "
+            f"bundles_success={summary.bundles_succeeded} bundles_failed={summary.bundles_failed} "
+            f"runs={summary.runs_processed} rows={summary.rows_processed} "
+            f"archive_bytes={summary.archive_bytes} duration={summary.elapsed_time:.2f}s "
+            f"validation_time={summary.validation_time:.2f}s "
+            f"runs_per_second={summary.runs_per_second:.2f} rows_per_second={summary.rows_per_second:.2f} "
+            f"bytes_per_second={summary.bytes_per_second:.2f}",
+            fg=fg,
+        )
+    )
+    click.echo(click.style("table,row_count", fg="white"))
+    for table_name in [
+        "workflow_runs",
+        "workflow_app_logs",
+        "workflow_node_executions",
+        "workflow_node_execution_offload",
+        "workflow_pauses",
+        "workflow_pause_reasons",
+        "workflow_trigger_logs",
+    ]:
+        click.echo(f"{table_name},{summary.table_counts.get(table_name, 0)}")
+    for result in summary.results:
+        if result.success:
+            click.echo(
+                click.style(
+                    f"  bundle={result.bundle_id} tenant={result.tenant_id} runs={result.run_count} "
+                    f"rows={result.row_count} archive_bytes={result.archive_bytes} "
+                    f"time={result.elapsed_time:.2f}s validation={result.validation_time:.2f}s",
+                    fg="white",
+                )
+            )
+        else:
+            click.echo(
+                click.style(
+                    f"  failed bundle={result.bundle_id} tenant={result.tenant_id} "
+                    f"object_prefix={result.object_prefix} error={result.error}",
+                    fg="red",
+                )
+            )
+
+
 @click.command(
     "restore-workflow-runs",
     help="Restore archived workflow runs from S3-compatible storage.",
@@ -290,8 +680,8 @@ def archive_workflow_runs(
     default=None,
     help="Optional upper bound (exclusive) for created_at; must be paired with --start-from.",
 )
-@click.option("--workers", default=1, show_default=True, type=int, help="Concurrent workflow runs to restore.")
-@click.option("--limit", type=int, default=100, show_default=True, help="Maximum number of runs to restore.")
+@click.option("--workers", default=1, show_default=True, type=int, help="V1 --run-id compatibility only.")
+@click.option("--limit", type=int, default=100, show_default=True, help="Maximum number of V2 bundles to restore.")
 @click.option("--dry-run", is_flag=True, help="Preview without restoring.")
 def restore_workflow_runs(
     tenant_ids: str | None,
@@ -303,15 +693,18 @@ def restore_workflow_runs(
     dry_run: bool,
 ):
     """
-    Restore an archived workflow run from storage to the database.
+    Restore archived workflow runs from storage to the database.
 
-    This restores the following tables:
+    Batch restore uses V2 bundle metadata and validates archive objects before writing source rows. This restores:
+    - workflow_runs
+    - workflow_app_logs
     - workflow_node_executions
     - workflow_node_execution_offload
     - workflow_pauses
     - workflow_pause_reasons
     - workflow_trigger_logs
     """
+    from services.retention.workflow_run.bundle_archive_maintenance import WorkflowRunBundleArchiveMaintenance
     from services.retention.workflow_run.restore_archived_workflow_run import WorkflowRunRestore
 
     parsed_tenant_ids = None
@@ -335,39 +728,46 @@ def restore_workflow_runs(
         )
     )
 
-    restorer = WorkflowRunRestore(dry_run=dry_run, workers=workers)
     if run_id:
+        restorer = WorkflowRunRestore(dry_run=dry_run, workers=workers)
         results = [restorer.restore_by_run_id(run_id)]
-    else:
-        assert start_from is not None
-        assert end_before is not None
-        results = restorer.restore_batch(
-            parsed_tenant_ids,
-            start_date=start_from,
-            end_date=end_before,
-            limit=limit,
-        )
+        end_time = datetime.datetime.now(datetime.UTC)
+        elapsed = end_time - start_time
 
-    end_time = datetime.datetime.now(datetime.UTC)
-    elapsed = end_time - start_time
+        successes = sum(1 for result in results if result.success)
+        failures = len(results) - successes
 
-    successes = sum(1 for result in results if result.success)
-    failures = len(results) - successes
-
-    if failures == 0:
-        click.echo(
-            click.style(
-                f"Restore completed successfully. success={successes} duration={elapsed}",
-                fg="green",
+        if failures == 0:
+            click.echo(
+                click.style(
+                    f"Restore completed successfully. success={successes} duration={elapsed}",
+                    fg="green",
+                )
             )
-        )
-    else:
-        click.echo(
-            click.style(
-                f"Restore completed with failures. success={successes} failed={failures} duration={elapsed}",
-                fg="red",
+        else:
+            click.echo(
+                click.style(
+                    f"Restore completed with failures. success={successes} failed={failures} duration={elapsed}",
+                    fg="red",
+                )
             )
+        return
+
+    if workers != 1:
+        click.echo(
+            click.style("--workers is ignored for V2 bundle restore; bundles are processed serially.", fg="yellow")
         )
+    assert start_from is not None
+    assert end_before is not None
+    bundle_restorer = WorkflowRunBundleArchiveMaintenance(dry_run=dry_run, strict_content_validation=True)
+    summary = bundle_restorer.restore_batch(
+        tenant_ids=parsed_tenant_ids,
+        start_date=start_from,
+        end_date=end_before,
+        limit=limit,
+    )
+    _echo_bundle_archive_operation_summary(summary)
+    return
 
 
 @click.command(
@@ -392,8 +792,20 @@ def restore_workflow_runs(
     default=None,
     help="Optional upper bound (exclusive) for created_at; must be paired with --start-from.",
 )
-@click.option("--limit", type=int, default=100, show_default=True, help="Maximum number of runs to delete.")
+@click.option("--limit", type=int, default=100, show_default=True, help="Maximum number of V2 bundles to delete.")
 @click.option("--dry-run", is_flag=True, help="Preview without deleting.")
+@click.option(
+    "--skip-bad-archives",
+    is_flag=True,
+    help="Continue batch deletion when one archive object fails validation.",
+)
+@click.option(
+    "--restore-sample-interval",
+    type=int,
+    default=0,
+    show_default=True,
+    help="Run restore dry-run after every N successful deletes; 0 disables restore sampling.",
+)
 def delete_archived_workflow_runs(
     tenant_ids: str | None,
     run_id: str | None,
@@ -401,10 +813,16 @@ def delete_archived_workflow_runs(
     end_before: datetime.datetime | None,
     limit: int,
     dry_run: bool,
+    skip_bad_archives: bool,
+    restore_sample_interval: int,
 ):
     """
     Delete archived workflow runs from the database.
+
+    Batch delete uses V2 bundle metadata and validates object existence, manifest schema, object size, checksum, row
+    counts, and source/archive content checksums before deleting source rows. `--run-id` keeps the V1 per-run path.
     """
+    from services.retention.workflow_run.bundle_archive_maintenance import WorkflowRunBundleArchiveMaintenance
     from services.retention.workflow_run.delete_archived_workflow_run import ArchivedWorkflowRunDeletion
 
     parsed_tenant_ids = None
@@ -417,6 +835,8 @@ def delete_archived_workflow_runs(
         raise click.UsageError("--start-from and --end-before must be provided together.")
     if run_id is None and (start_from is None or end_before is None):
         raise click.UsageError("--start-from and --end-before are required for batch delete.")
+    if restore_sample_interval < 0:
+        raise click.BadParameter("restore-sample-interval must be >= 0")
 
     start_time = datetime.datetime.now(datetime.UTC)
     target_desc = f"workflow run {run_id}" if run_id else "workflow runs"
@@ -427,56 +847,85 @@ def delete_archived_workflow_runs(
         )
     )
 
-    deleter = ArchivedWorkflowRunDeletion(dry_run=dry_run)
     if run_id:
-        results = [deleter.delete_by_run_id(run_id)]
-    else:
-        assert start_from is not None
-        assert end_before is not None
-        results = deleter.delete_batch(
-            parsed_tenant_ids,
-            start_date=start_from,
-            end_date=end_before,
-            limit=limit,
+        deleter = ArchivedWorkflowRunDeletion(
+            dry_run=dry_run,
+            skip_bad_archives=skip_bad_archives,
+            restore_sample_interval=restore_sample_interval,
         )
+        results = [deleter.delete_by_run_id(run_id)]
+        for result in results:
+            if result.success:
+                click.echo(
+                    click.style(
+                        f"{'[DRY RUN] Would delete' if dry_run else 'Deleted'} "
+                        f"workflow run {result.run_id} (tenant={result.tenant_id}, "
+                        f"archive_key={result.archive_key}, counts={result.validated_counts})",
+                        fg="green",
+                    )
+                )
+                if result.restore_sampled:
+                    sample_status = "passed" if result.restore_sample_success else "failed"
+                    click.echo(
+                        click.style(
+                            f"  restore dry-run sample {sample_status} for workflow run {result.run_id}",
+                            fg="green" if result.restore_sample_success else "red",
+                        )
+                    )
+            else:
+                click.echo(
+                    click.style(
+                        f"Failed to delete workflow run {result.run_id}: {result.error}",
+                        fg="red",
+                    )
+                )
+                click.echo(
+                    click.style(
+                        "  runbook: pause this delete window, verify archive storage object and manifest/checksum, "
+                        "retry the same run after fixing storage or DB drift, or rerun with --skip-bad-archives "
+                        "to quarantine this run and continue the batch.",
+                        fg="yellow",
+                    )
+                )
 
-    for result in results:
-        if result.success:
+        end_time = datetime.datetime.now(datetime.UTC)
+        elapsed = end_time - start_time
+
+        successes = sum(1 for result in results if result.success)
+        failures = len(results) - successes
+
+        if failures == 0:
             click.echo(
                 click.style(
-                    f"{'[DRY RUN] Would delete' if dry_run else 'Deleted'} "
-                    f"workflow run {result.run_id} (tenant={result.tenant_id})",
+                    f"Delete completed successfully. success={successes} duration={elapsed}",
                     fg="green",
                 )
             )
         else:
             click.echo(
                 click.style(
-                    f"Failed to delete workflow run {result.run_id}: {result.error}",
+                    f"Delete completed with failures. success={successes} failed={failures} duration={elapsed}",
                     fg="red",
                 )
             )
+        return
 
-    end_time = datetime.datetime.now(datetime.UTC)
-    elapsed = end_time - start_time
-
-    successes = sum(1 for result in results if result.success)
-    failures = len(results) - successes
-
-    if failures == 0:
-        click.echo(
-            click.style(
-                f"Delete completed successfully. success={successes} duration={elapsed}",
-                fg="green",
-            )
-        )
-    else:
-        click.echo(
-            click.style(
-                f"Delete completed with failures. success={successes} failed={failures} duration={elapsed}",
-                fg="red",
-            )
-        )
+    if restore_sample_interval:
+        click.echo(click.style("--restore-sample-interval is ignored for V2 bundle delete.", fg="yellow"))
+    assert start_from is not None
+    assert end_before is not None
+    bundle_deleter = WorkflowRunBundleArchiveMaintenance(
+        dry_run=dry_run,
+        strict_content_validation=True,
+        stop_on_error=not skip_bad_archives,
+    )
+    summary = bundle_deleter.delete_batch(
+        tenant_ids=parsed_tenant_ids,
+        start_date=start_from,
+        end_date=end_before,
+        limit=limit,
+    )
+    _echo_bundle_archive_operation_summary(summary)
 
 
 def _find_orphaned_draft_variables(batch_size: int = 1000) -> list[str]:
diff --git a/api/configs/middleware/cache/redis_pubsub_config.py b/api/configs/middleware/cache/redis_pubsub_config.py
index d465f2e93c3..0a166818b36 100644
--- a/api/configs/middleware/cache/redis_pubsub_config.py
+++ b/api/configs/middleware/cache/redis_pubsub_config.py
@@ -2,7 +2,6 @@ from typing import Literal, Protocol, cast
 from urllib.parse import quote_plus, urlunparse
 
 from pydantic import AliasChoices, Field
-from pydantic.types import NonNegativeInt
 from pydantic_settings import BaseSettings
 
 
@@ -71,24 +70,6 @@ class RedisPubSubConfig(BaseSettings):
         default=600,
     )
 
-    PUBSUB_LISTENER_JOIN_TIMEOUT_MS: NonNegativeInt = Field(
-        validation_alias=AliasChoices("EVENT_BUS_LISTENER_JOIN_TIMEOUT_MS", "PUBSUB_LISTENER_JOIN_TIMEOUT_MS"),
-        description=(
-            "Maximum time (milliseconds) that ``Subscription.close()`` waits for its listener thread to "
-            "finish before returning. Bounds the tail latency between a terminal event being delivered to "
-            "an SSE client and the response stream actually closing.\n\n"
-            "The listener thread blocks on a polling read (XREAD BLOCK for streams, get_message timeout "
-            "for pubsub/sharded) with a fixed 1s window, so close() naturally has to wait up to ~1s for "
-            "the thread to notice the subscription was closed. Setting this lower (e.g. 100) lets close() "
-            "return promptly while the daemon listener thread cleans itself up on the next poll "
-            "boundary - safe because the listener holds no critical state and exits within one poll "
-            "window. Setting it higher (e.g. 5000) gives the listener more grace before close() gives up "
-            "and logs a warning. Default 2000ms preserves the pre-change behaviour.\n\n"
-            "Also accepts ENV: EVENT_BUS_LISTENER_JOIN_TIMEOUT_MS."
-        ),
-        default=2000,
-    )
-
     def _build_default_pubsub_url(self) -> str:
         defaults = _redis_defaults(self)
         if not defaults.REDIS_HOST or not defaults.REDIS_PORT:
diff --git a/api/controllers/common/app_access.py b/api/controllers/common/app_access.py
new file mode 100644
index 00000000000..863b69d2339
--- /dev/null
+++ b/api/controllers/common/app_access.py
@@ -0,0 +1,107 @@
+from __future__ import annotations
+
+from collections.abc import Sequence
+from dataclasses import dataclass
+from typing import TYPE_CHECKING
+
+from services.enterprise import rbac_service as enterprise_rbac_service
+
+if TYPE_CHECKING:
+    from services.app_service import AppListBaseParams
+    from services.enterprise.rbac_service import MyPermissionsResponse
+
+# Permission keys (dot-notation, from MyPermissionsResponse) that grant
+# list/preview access to an app. Keep this the single source of truth for both
+# the console and OpenAPI app-list endpoints.
+APP_LIST_PERMISSION_KEYS: frozenset[str] = frozenset({"app.preview", "app.acl.preview", "app.full_access"})
+
+# Workspace permission key that lets a caller see apps they maintain even when
+# those apps are not in their preview whitelist.
+_MANAGE_OWN_APPS_PERMISSION_KEY = "app.create_and_management"
+
+
+def has_app_list_permission(permission_keys: Sequence[str]) -> bool:
+    """Return True if any of ``permission_keys`` grants app list/preview access."""
+    return any(permission_key in APP_LIST_PERMISSION_KEYS for permission_key in permission_keys)
+
+
+@dataclass(frozen=True)
+class AppAccessFilter:
+    """Resolved RBAC visibility for app list/read endpoints.
+
+    ``accessible_app_ids`` of ``None`` means the caller can see every app in the
+    workspace (unrestricted). Otherwise it is the exact set of app ids the
+    caller may preview; combined with ``can_manage_own_apps`` it also covers
+    apps the caller maintains.
+    """
+
+    accessible_app_ids: set[str] | None
+    can_manage_own_apps: bool
+
+    @classmethod
+    def unrestricted(cls) -> AppAccessFilter:
+        """Filter that imposes no restriction (RBAC disabled / not applicable)."""
+        return cls(accessible_app_ids=None, can_manage_own_apps=False)
+
+    def is_app_accessible(self, app_id: str, maintainer: str | None, account_id: str) -> bool:
+        """Whether a single app is visible to the caller under this filter.
+
+        Mirrors the service-layer query gate: an app is visible when the filter
+        is unrestricted, the app id is whitelisted, or the caller maintains it
+        and holds ``app.create_and_management``.
+        """
+        if self.accessible_app_ids is None:
+            return True
+        if app_id in self.accessible_app_ids:
+            return True
+        return self.can_manage_own_apps and maintainer is not None and maintainer == account_id
+
+    def apply_to_params(self, params: AppListBaseParams) -> None:
+        if self.accessible_app_ids is None:
+            return
+        params.accessible_app_ids = sorted(self.accessible_app_ids)
+        params.include_own_apps = self.can_manage_own_apps
+
+
+def resolve_app_access_filter(
+    tenant_id: str,
+    account_id: str,
+    *,
+    permissions: MyPermissionsResponse | None = None,
+) -> AppAccessFilter:
+    """Compute the RBAC app-access filter for ``account_id`` in ``tenant_id``.
+
+    Pass ``permissions`` when the caller has already fetched the snapshot (the
+    console controller reuses it for per-app permission keys) to avoid a second
+    inner-API round trip; otherwise it is fetched here.
+    """
+    if permissions is None:
+        permissions = enterprise_rbac_service.RBACService.MyPermissions.get(tenant_id, account_id)
+    whitelist_scope = enterprise_rbac_service.RBACService.AppAccess.whitelist_resources(tenant_id, account_id)
+
+    can_manage_own_apps = _MANAGE_OWN_APPS_PERMISSION_KEY in permissions.workspace.permission_keys
+    has_default_preview = has_app_list_permission(permissions.app.default_permission_keys) or has_app_list_permission(
+        permissions.workspace.permission_keys
+    )
+
+    permission_app_ids: set[str] | None = None
+    if not has_default_preview:
+        # Collect apps the caller can preview via per-app permission overrides.
+        permission_app_ids = {
+            override.resource_id
+            for override in permissions.app.overrides
+            if has_app_list_permission(override.permission_keys)
+        }
+
+    accessible_app_ids: set[str] | None
+    if getattr(whitelist_scope, "unrestricted", False):
+        accessible_app_ids = permission_app_ids
+    else:
+        accessible_app_ids = set(whitelist_scope.resource_ids)
+        if permission_app_ids is not None:
+            accessible_app_ids |= permission_app_ids
+        elif has_default_preview:
+            # Default preview overrides the whitelist restriction.
+            accessible_app_ids = None
+
+    return AppAccessFilter(accessible_app_ids=accessible_app_ids, can_manage_own_apps=can_manage_own_apps)
diff --git a/api/controllers/common/wraps.py b/api/controllers/common/wraps.py
index 7e39b4f37cd..29b1fc44e5d 100644
--- a/api/controllers/common/wraps.py
+++ b/api/controllers/common/wraps.py
@@ -1,23 +1,3 @@
-"""Shared decorator utilities for Dify controller layers.
-
-This module provides decorators that are not tied to any single API group (e.g.
-console, inner, service).  Currently it exposes the RBAC permission gate, which
-can be applied to any blueprint.
-
-Key exports
------------
-``rbac_permission_required`` – decorator that enforces enterprise RBAC access
-    control.  When ``RBAC_ENABLED`` is ``False`` it is a no-op.
-
-``RBACPermission``, ``RBACResourceScope`` – re-exported from ``core.rbac`` so
-    callers only need a single import site.
-
-Private helpers
----------------
-``_extract_resource_id``, ``_is_resource_owned_by_current_user`` – kept module-
-    private but accessible via the module namespace for unit-test patching.
-"""
-
 from collections.abc import Callable
 from functools import wraps
 
@@ -32,7 +12,57 @@ from models.dataset import Dataset
 from models.model import App
 from services.enterprise.rbac_service import RBACService
 
-__all__ = ["RBACPermission", "RBACResourceScope", "rbac_permission_required"]
+__all__ = ["RBACPermission", "RBACResourceScope", "enforce_rbac_access", "rbac_permission_required"]
+
+
+def enforce_rbac_access(
+    *,
+    tenant_id: str,
+    account_id: str,
+    resource_type: RBACResourceScope,
+    scene: RBACPermission,
+    resource_required: bool = True,
+    path_args: dict[str, object] | None = None,
+) -> None:
+    """Enforce enterprise RBAC for an explicit account/tenant pair.
+
+    This is the flask-login-independent core of the RBAC gate so it can run
+    inside request-handling layers that resolve the caller themselves (e.g. the
+    openapi auth pipeline, which has the account on ``AuthData`` before
+    flask-login is mounted).
+
+    No-op when ``RBAC_ENABLED`` is ``False``. For resource-scoped checks the
+    resource ID is taken from ``path_args`` merged with ``request.view_args``;
+    resource ownership short-circuits the check. Raises ``Forbidden`` when
+    access is denied. For workspace-level checks pass ``resource_required=False``
+    so the RBAC request omits ``resource_id``.
+
+    Args:
+        tenant_id: The tenant the access is evaluated against.
+        account_id: The account requesting access.
+        resource_type: The :class:`RBACResourceScope` member (app/dataset/workspace).
+        scene: The :class:`RBACPermission` permission point, e.g. ``RBACPermission.APP_DELETE``.
+        resource_required: Whether a concrete resource ID is required.
+        path_args: Extra path arguments to merge with ``request.view_args``.
+    """
+    if not dify_config.RBAC_ENABLED:
+        return
+
+    check_resource_type = None if resource_type == RBACResourceScope.WORKSPACE else resource_type
+    resource_id = None
+    if resource_required and check_resource_type:
+        resource_id = _extract_resource_id(resource_type, path_args)
+        if _is_resource_owned_by_current_user(tenant_id, account_id, resource_type, resource_id):
+            return
+    allowed = RBACService.CheckAccess.check(
+        tenant_id,
+        account_id,
+        scene=scene,
+        resource_type=check_resource_type,
+        resource_id=resource_id,
+    )
+    if not allowed:
+        raise Forbidden()
 
 
 def rbac_permission_required[**P, R](
@@ -41,14 +71,12 @@ def rbac_permission_required[**P, R](
     *,
     resource_required: bool = True,
 ) -> Callable[[Callable[P, R]], Callable[P, R]]:
-    """Check enterprise RBAC permissions for the current user.
+    """Check enterprise RBAC permissions for the current flask-login user.
 
     When ``RBAC_ENABLED`` is ``False`` the decorator is a no-op and the
-    request passes through unchanged. When enabled it extracts the resource ID
-    from ``request.view_args`` for resource-scoped checks, calls the RBAC
-    service ``check-access`` endpoint, and raises ``Forbidden`` if the access
-    is denied. For workspace-level checks, set ``resource_required=False`` so
-    the RBAC request omits ``resource_id``.
+    request passes through unchanged. When enabled it resolves the current
+    account/tenant and delegates to :func:`enforce_rbac_access`, raising
+    ``Forbidden`` if access is denied.
 
     Args:
         resource_type: The :class:`RBACResourceScope` member (app/dataset/workspace).
@@ -63,23 +91,14 @@ def rbac_permission_required[**P, R](
                 return view(*args, **kwargs)
 
             current_user, current_tenant_id = current_account_with_tenant()
-            check_resource_type = None if resource_type == RBACResourceScope.WORKSPACE else resource_type
-            resource_id = None
-            if resource_required and check_resource_type:
-                resource_id = _extract_resource_id(resource_type, kwargs)
-                if _is_resource_owned_by_current_user(current_tenant_id, current_user.id, resource_type, resource_id):
-                    return view(*args, **kwargs)
-            allowed = RBACService.CheckAccess.check(
-                current_tenant_id,
-                current_user.id,
+            enforce_rbac_access(
+                tenant_id=current_tenant_id,
+                account_id=current_user.id,
+                resource_type=resource_type,
                 scene=scene,
-                resource_type=check_resource_type,
-                resource_id=resource_id,
+                resource_required=resource_required,
+                path_args=kwargs,
             )
-
-            if not allowed:
-                raise Forbidden()
-
             return view(*args, **kwargs)
 
         return decorated
diff --git a/api/controllers/console/agent/composer.py b/api/controllers/console/agent/composer.py
index 2cd01e427f7..975586c635c 100644
--- a/api/controllers/console/agent/composer.py
+++ b/api/controllers/console/agent/composer.py
@@ -104,7 +104,7 @@ class WorkflowAgentComposerValidateApi(Resource):
     @with_current_tenant_id
     def post(self, tenant_id: str, app_model: App, node_id: str):
         payload = ComposerSavePayload.model_validate(console_ns.payload or {})
-        ComposerConfigValidator.validate_save_payload(payload)
+        ComposerConfigValidator.validate_publish_payload(payload)
         findings = AgentComposerService.collect_validation_findings(
             tenant_id=tenant_id,
             payload=payload,
@@ -238,7 +238,7 @@ class AgentComposerValidateApi(Resource):
     def post(self, tenant_id: str, agent_id: UUID):
         _resolve_agent_app_id(tenant_id=tenant_id, agent_id=agent_id)
         payload = ComposerSavePayload.model_validate(console_ns.payload or {})
-        ComposerConfigValidator.validate_save_payload(payload)
+        ComposerConfigValidator.validate_publish_payload(payload)
         findings = AgentComposerService.collect_validation_findings(
             tenant_id=tenant_id,
             payload=payload,
diff --git a/api/controllers/console/agent/roster.py b/api/controllers/console/agent/roster.py
index d4546ac88bf..ac3f7ef4824 100644
--- a/api/controllers/console/agent/roster.py
+++ b/api/controllers/console/agent/roster.py
@@ -3,16 +3,17 @@ from uuid import UUID
 from flask import abort, request
 from flask_restx import Resource
 from pydantic import AliasChoices, BaseModel, Field, field_validator
+from sqlalchemy import func, select
 
 from controllers.common.schema import query_params_from_model, register_response_schema_models, register_schema_models
 from controllers.console import console_ns
 from controllers.console.agent.app_helpers import resolve_agent_app_model
+from controllers.console.apikey import ApiKeyItem, ApiKeyList, BaseApiKeyListResource, BaseApiKeyResource
 from controllers.console.app.app import (
     AppDetailWithSite as GenericAppDetailWithSite,
 )
 from controllers.console.app.app import (
     AppListQuery,
-    CopyAppPayload,
     _normalize_app_list_query_args,
 )
 from controllers.console.app.app import (
@@ -25,9 +26,13 @@ from controllers.console.app.app import (
     UpdateAppPayload as GenericUpdateAppPayload,
 )
 from controllers.console.wraps import (
+    RBACPermission,
+    RBACResourceScope,
     account_initialization_required,
     edit_permission_required,
     enterprise_license_required,
+    is_admin_or_owner_required,
+    rbac_permission_required,
     setup_required,
     with_current_tenant_id,
     with_current_user,
@@ -36,6 +41,7 @@ from extensions.ext_database import db
 from fields.agent_fields import (
     AgentConfigSnapshotDetailResponse,
     AgentConfigSnapshotListResponse,
+    AgentConfigSnapshotRestoreResponse,
     AgentInviteOptionsResponse,
     AgentLogListResponse,
     AgentLogMessageListResponse,
@@ -48,7 +54,8 @@ from libs.datetime_utils import parse_time_range
 from libs.helper import dump_response
 from libs.login import login_required
 from models import Account
-from models.model import IconType
+from models.enums import ApiTokenType
+from models.model import ApiToken, App, IconType
 from services.agent.errors import AgentNotFoundError
 from services.agent.observability_service import (
     AgentLogQueryParams,
@@ -102,6 +109,46 @@ class AgentAppUpdatePayload(GenericUpdateAppPayload):
         return role
 
 
+class AgentAppCopyPayload(BaseModel):
+    name: str | None = Field(default=None, description="Name for the copied agent")
+    description: str | None = Field(default=None, description="Description for the copied agent", max_length=400)
+    role: str | None = Field(default=None, description="Role for the copied agent", max_length=255)
+    icon_type: IconType | None = Field(default=None, description="Icon type")
+    icon: str | None = Field(default=None, description="Icon")
+    icon_background: str | None = Field(default=None, description="Icon background color")
+
+    @field_validator("role")
+    @classmethod
+    def validate_role(cls, value: str | None) -> str | None:
+        if value is None:
+            return None
+        role = value.strip()
+        if not role:
+            raise ValueError("Agent role is required when provided.")
+        return role
+
+
+class AgentApiStatusPayload(BaseModel):
+    enable_api: bool = Field(..., description="Enable or disable Agent service API")
+
+
+class AgentApiAccessResponse(BaseModel):
+    enabled: bool
+    service_api_base_url: str
+    streaming_only: bool = True
+    chat_endpoint: str
+    stop_endpoint: str
+    conversations_endpoint: str
+    messages_endpoint: str
+    files_upload_endpoint: str
+    parameters_endpoint: str
+    info_endpoint: str
+    meta_endpoint: str
+    api_rpm: int
+    api_rph: int
+    api_key_count: int
+
+
 class AgentAppPublishedReferenceResponse(BaseModel):
     app_id: str
     app_name: str
@@ -185,6 +232,7 @@ class AgentStatisticsQuery(BaseModel):
 
 class AgentAppPartial(GenericAppPartial):
     app_id: str | None = None
+    debug_conversation_id: str | None = None
     role: str | None = None
     active_config_is_published: bool = False
     published_reference_count: int = 0
@@ -193,10 +241,15 @@ class AgentAppPartial(GenericAppPartial):
 
 class AgentAppDetailWithSite(GenericAppDetailWithSite):
     app_id: str | None = None
+    debug_conversation_id: str | None = None
     role: str | None = None
     active_config_is_published: bool = False
 
 
+class AgentDebugConversationRefreshResponse(BaseModel):
+    debug_conversation_id: str
+
+
 class AgentAppPagination(GenericAppPagination):
     data: list[AgentAppPartial] = Field(  # type: ignore[assignment]  # pyrefly: ignore[bad-override-mutable-attribute]
         validation_alias=AliasChoices("items", "data")
@@ -207,7 +260,8 @@ register_schema_models(
     console_ns,
     AgentAppCreatePayload,
     AgentAppUpdatePayload,
-    CopyAppPayload,
+    AgentAppCopyPayload,
+    AgentApiStatusPayload,
     AgentInviteOptionsQuery,
     AgentLogsQuery,
     AgentStatisticsQuery,
@@ -218,11 +272,14 @@ register_schema_models(
 register_response_schema_models(
     console_ns,
     AgentAppPagination,
+    AgentApiAccessResponse,
     AgentAppPublishedReferenceResponse,
     AgentAppDetailWithSite,
     AgentAppPartial,
+    AgentDebugConversationRefreshResponse,
     AgentConfigSnapshotDetailResponse,
     AgentConfigSnapshotListResponse,
+    AgentConfigSnapshotRestoreResponse,
     AgentInviteOptionsResponse,
     AgentLogListResponse,
     AgentLogMessageListResponse,
@@ -237,7 +294,7 @@ def _agent_roster_service() -> AgentRosterService:
     return AgentRosterService(db.session)
 
 
-def _serialize_agent_app_detail(app_model) -> dict:
+def _serialize_agent_app_detail(app_model, *, current_user: Account) -> dict:
     """Serialize an Agent App detail using roster-only DTOs.
 
     `/agent` responses are roster-shaped rather than raw app-shaped: `id`
@@ -260,6 +317,11 @@ def _serialize_agent_app_detail(app_model) -> dict:
     payload.pop("bound_agent_id", None)
     payload["app_id"] = str(app_model.id)
     payload["id"] = agent.id
+    payload["debug_conversation_id"] = roster_service.get_or_create_agent_app_debug_conversation_id(
+        tenant_id=app_model.tenant_id,
+        agent_id=agent.id,
+        account_id=current_user.id,
+    )
     payload["role"] = agent.role or ""
     payload["active_config_is_published"] = roster_service.active_config_is_published(
         tenant_id=app_model.tenant_id,
@@ -268,7 +330,7 @@ def _serialize_agent_app_detail(app_model) -> dict:
     return payload
 
 
-def _serialize_agent_app_pagination(app_pagination, *, tenant_id: str) -> dict:
+def _serialize_agent_app_pagination(app_pagination, *, tenant_id: str, current_user: Account) -> dict:
     """Serialize Agent App lists with roster-shaped items.
 
     Each item starts from the shared App list shape, then drops
@@ -291,6 +353,11 @@ def _serialize_agent_app_pagination(app_pagination, *, tenant_id: str) -> dict:
         tenant_id=tenant_id,
         agent_ids=[agent.id for agent in agents_by_app_id.values()],
     )
+    debug_conversation_ids_by_agent_id = roster_service.load_or_create_agent_app_debug_conversation_ids_by_agent_id(
+        tenant_id=tenant_id,
+        agents=list(agents_by_app_id.values()),
+        account_id=current_user.id,
+    )
     payload = AgentAppPagination.model_validate(app_pagination, from_attributes=True).model_dump(mode="json")
     for item in payload["data"]:
         app_id = item["id"]
@@ -299,6 +366,7 @@ def _serialize_agent_app_pagination(app_pagination, *, tenant_id: str) -> dict:
         if agent:
             item["app_id"] = app_id
             item["id"] = agent.id
+            item["debug_conversation_id"] = debug_conversation_ids_by_agent_id.get(agent.id)
             item["role"] = agent.role or ""
             item["active_config_is_published"] = active_config_is_published_by_agent_id.get(agent.id, False)
             published_references = published_references_by_agent_id.get(agent.id, [])
@@ -323,6 +391,38 @@ def _resolve_agent_app_model(*, tenant_id: str, agent_id: UUID):
     return resolve_agent_app_model(tenant_id=tenant_id, agent_id=agent_id)
 
 
+def _agent_api_key_count(app_id: str) -> int:
+    return (
+        db.session.scalar(
+            select(func.count(ApiToken.id)).where(
+                ApiToken.type == ApiTokenType.APP,
+                ApiToken.app_id == app_id,
+            )
+        )
+        or 0
+    )
+
+
+def _serialize_agent_api_access(app_model: App) -> dict:
+    base_url = app_model.api_base_url
+    response = AgentApiAccessResponse(
+        enabled=bool(app_model.enable_api),
+        service_api_base_url=base_url,
+        chat_endpoint=f"{base_url}/chat-messages",
+        stop_endpoint=f"{base_url}/chat-messages/{{task_id}}/stop",
+        conversations_endpoint=f"{base_url}/conversations",
+        messages_endpoint=f"{base_url}/messages",
+        files_upload_endpoint=f"{base_url}/files/upload",
+        parameters_endpoint=f"{base_url}/parameters",
+        info_endpoint=f"{base_url}/info",
+        meta_endpoint=f"{base_url}/meta",
+        api_rpm=app_model.api_rpm or 0,
+        api_rph=app_model.api_rph or 0,
+        api_key_count=_agent_api_key_count(str(app_model.id)),
+    )
+    return response.model_dump(mode="json")
+
+
 def _agent_observability_service() -> AgentObservabilityService:
     return AgentObservabilityService(db.session)
 
@@ -374,7 +474,11 @@ class AgentAppListApi(Resource):
             empty = AgentAppPagination(page=args.page, limit=args.limit, total=0, has_more=False, data=[])
             return empty.model_dump(mode="json")
 
-        return _serialize_agent_app_pagination(app_pagination, tenant_id=current_tenant_id)
+        return _serialize_agent_app_pagination(
+            app_pagination,
+            tenant_id=current_tenant_id,
+            current_user=current_user,
+        )
 
     @console_ns.expect(console_ns.models[AgentAppCreatePayload.__name__])
     @console_ns.response(201, "Agent app created successfully", console_ns.models[AgentAppDetailWithSite.__name__])
@@ -399,7 +503,7 @@ class AgentAppListApi(Resource):
         )
 
         app = AppService().create_app(current_tenant_id, params, current_user)
-        return _serialize_agent_app_detail(app), 201
+        return _serialize_agent_app_detail(app, current_user=current_user), 201
 
 
 @console_ns.route("/agent/<uuid:agent_id>")
@@ -409,10 +513,11 @@ class AgentAppApi(Resource):
     @login_required
     @account_initialization_required
     @enterprise_license_required
+    @with_current_user
     @with_current_tenant_id
-    def get(self, tenant_id: str, agent_id: UUID):
+    def get(self, tenant_id: str, current_user: Account, agent_id: UUID):
         app_model = _resolve_agent_app_model(tenant_id=tenant_id, agent_id=agent_id)
-        return _serialize_agent_app_detail(app_model)
+        return _serialize_agent_app_detail(app_model, current_user=current_user)
 
     @console_ns.expect(console_ns.models[AgentAppUpdatePayload.__name__])
     @console_ns.response(200, "Agent app updated successfully", console_ns.models[AgentAppDetailWithSite.__name__])
@@ -422,8 +527,9 @@ class AgentAppApi(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
+    @with_current_user
     @with_current_tenant_id
-    def put(self, tenant_id: str, agent_id: UUID):
+    def put(self, tenant_id: str, current_user: Account, agent_id: UUID):
         app_model = _resolve_agent_app_model(tenant_id=tenant_id, agent_id=agent_id)
         args = AgentAppUpdatePayload.model_validate(console_ns.payload)
         args_dict: AppService.ArgsDict = {
@@ -437,7 +543,7 @@ class AgentAppApi(Resource):
             "role": args.role,
         }
         updated = AppService().update_app(app_model, args_dict)
-        return _serialize_agent_app_detail(updated)
+        return _serialize_agent_app_detail(updated, current_user=current_user)
 
     @console_ns.response(204, "Agent app deleted successfully")
     @console_ns.response(403, "Insufficient permissions")
@@ -452,9 +558,34 @@ class AgentAppApi(Resource):
         return "", 204
 
 
+@console_ns.route("/agent/<uuid:agent_id>/debug-conversation/refresh")
+class AgentDebugConversationRefreshApi(Resource):
+    @console_ns.response(
+        200,
+        "Agent debug conversation refreshed",
+        console_ns.models[AgentDebugConversationRefreshResponse.__name__],
+    )
+    @console_ns.response(403, "Insufficient permissions")
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def post(self, tenant_id: str, current_user: Account, agent_id: UUID):
+        debug_conversation_id = _agent_roster_service().refresh_agent_app_debug_conversation_id(
+            tenant_id=tenant_id,
+            agent_id=str(agent_id),
+            account_id=current_user.id,
+        )
+        return AgentDebugConversationRefreshResponse(debug_conversation_id=debug_conversation_id).model_dump(
+            mode="json"
+        )
+
+
 @console_ns.route("/agent/<uuid:agent_id>/copy")
 class AgentAppCopyApi(Resource):
-    @console_ns.expect(console_ns.models[CopyAppPayload.__name__])
+    @console_ns.expect(console_ns.models[AgentAppCopyPayload.__name__])
     @console_ns.response(201, "Agent app copied successfully", console_ns.models[AgentAppDetailWithSite.__name__])
     @console_ns.response(403, "Insufficient permissions")
     @console_ns.response(400, "Invalid request parameters")
@@ -465,18 +596,88 @@ class AgentAppCopyApi(Resource):
     @with_current_user
     @with_current_tenant_id
     def post(self, tenant_id: str, current_user: Account, agent_id: UUID):
-        args = CopyAppPayload.model_validate(console_ns.payload or {})
+        args = AgentAppCopyPayload.model_validate(console_ns.payload or {})
         copied_app = _agent_roster_service().duplicate_agent_app(
             tenant_id=tenant_id,
             agent_id=str(agent_id),
             account=current_user,
             name=args.name,
             description=args.description,
+            role=args.role,
             icon_type=args.icon_type,
             icon=args.icon,
             icon_background=args.icon_background,
         )
-        return _serialize_agent_app_detail(copied_app), 201
+        return _serialize_agent_app_detail(copied_app, current_user=current_user), 201
+
+
+@console_ns.route("/agent/<uuid:agent_id>/api-access")
+class AgentApiAccessApi(Resource):
+    @console_ns.response(200, "Agent service API access", console_ns.models[AgentApiAccessResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_tenant_id
+    def get(self, tenant_id: str, agent_id: UUID):
+        app_model = _resolve_agent_app_model(tenant_id=tenant_id, agent_id=agent_id)
+        return _serialize_agent_api_access(app_model)
+
+
+@console_ns.route("/agent/<uuid:agent_id>/api-enable")
+class AgentApiStatusApi(Resource):
+    @console_ns.expect(console_ns.models[AgentApiStatusPayload.__name__])
+    @console_ns.response(200, "Agent service API status updated", console_ns.models[AgentApiAccessResponse.__name__])
+    @console_ns.response(403, "Insufficient permissions")
+    @setup_required
+    @login_required
+    @is_admin_or_owner_required
+    @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_RELEASE_AND_VERSION)
+    @with_current_tenant_id
+    def post(self, tenant_id: str, agent_id: UUID):
+        app_model = _resolve_agent_app_model(tenant_id=tenant_id, agent_id=agent_id)
+        args = AgentApiStatusPayload.model_validate(console_ns.payload)
+        app_model = AppService().update_app_api_status(app_model, args.enable_api)
+        return _serialize_agent_api_access(app_model)
+
+
+@console_ns.route("/agent/<uuid:agent_id>/api-keys")
+class AgentApiKeyListApi(BaseApiKeyListResource):
+    resource_type = ApiTokenType.APP
+    resource_model = App
+    resource_id_field = "app_id"
+    token_prefix = "app-"
+
+    @console_ns.response(200, "Agent service API keys", console_ns.models[ApiKeyList.__name__])
+    @with_current_tenant_id
+    def get(self, tenant_id: str, agent_id: UUID) -> dict[str, object]:
+        app_model = _resolve_agent_app_model(tenant_id=tenant_id, agent_id=agent_id)
+        return dump_response(ApiKeyList, self._get_api_key_list(str(app_model.id), tenant_id))
+
+    @console_ns.response(201, "Agent service API key created", console_ns.models[ApiKeyItem.__name__])
+    @console_ns.response(400, "Maximum keys exceeded")
+    @with_current_tenant_id
+    @edit_permission_required
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_RELEASE_AND_VERSION)
+    def post(self, tenant_id: str, agent_id: UUID) -> tuple[dict[str, object], int]:
+        app_model = _resolve_agent_app_model(tenant_id=tenant_id, agent_id=agent_id)
+        return dump_response(ApiKeyItem, self._create_api_key(str(app_model.id), tenant_id)), 201
+
+
+@console_ns.route("/agent/<uuid:agent_id>/api-keys/<uuid:api_key_id>")
+class AgentApiKeyApi(BaseApiKeyResource):
+    resource_type = ApiTokenType.APP
+    resource_model = App
+    resource_id_field = "app_id"
+
+    @console_ns.response(204, "Agent service API key deleted")
+    @with_current_user
+    @with_current_tenant_id
+    @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_RELEASE_AND_VERSION)
+    def delete(self, tenant_id: str, current_user: Account, agent_id: UUID, api_key_id: UUID) -> tuple[str, int]:
+        app_model = _resolve_agent_app_model(tenant_id=tenant_id, agent_id=agent_id)
+        self._delete_api_key(str(app_model.id), str(api_key_id), tenant_id, current_user)
+        return "", 204
 
 
 @console_ns.route("/agent/invite-options")
@@ -649,3 +850,24 @@ class AgentRosterVersionDetailApi(Resource):
                 version_id=str(version_id),
             ),
         )
+
+
+@console_ns.route("/agent/<uuid:agent_id>/versions/<uuid:version_id>/restore")
+class AgentRosterVersionRestoreApi(Resource):
+    @console_ns.response(200, "Agent version restored", console_ns.models[AgentConfigSnapshotRestoreResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @edit_permission_required
+    @with_current_user
+    @with_current_tenant_id
+    def post(self, tenant_id: str, current_user: Account, agent_id: UUID, version_id: UUID):
+        return dump_response(
+            AgentConfigSnapshotRestoreResponse,
+            _agent_roster_service().restore_agent_version(
+                tenant_id=tenant_id,
+                agent_id=str(agent_id),
+                version_id=str(version_id),
+                account_id=current_user.id,
+            ),
+        )
diff --git a/api/controllers/console/app/agent.py b/api/controllers/console/app/agent.py
index a53a174da42..86a3c473547 100644
--- a/api/controllers/console/app/agent.py
+++ b/api/controllers/console/app/agent.py
@@ -1,4 +1,3 @@
-import logging
 from typing import Any
 from uuid import UUID
 
@@ -30,7 +29,6 @@ from fields.base import ResponseModel
 from libs.helper import uuid_value
 from libs.login import login_required
 from models import Account
-from models.agent_config_entities import AgentFileRefConfig, AgentSkillRefConfig
 from models.model import App, AppMode, UploadFile
 from services.agent.composer_service import AgentComposerService
 from services.agent.skill_package_service import SkillManifest, SkillPackageError
@@ -49,8 +47,6 @@ from services.agent_drive_service import (
 )
 from services.agent_service import AgentService
 
-logger = logging.getLogger(__name__)
-
 _WORKFLOW_AGENT_DRIVE_APP_MODES = [AppMode.WORKFLOW, AppMode.ADVANCED_CHAT]
 _AGENT_SKILL_UPLOAD_PARAMS = {
     "file": {
@@ -130,8 +126,16 @@ class AgentLogResponse(ResponseModel):
     files: list[Any] = Field(default_factory=list)
 
 
+class AgentUploadedSkillResponse(ResponseModel):
+    name: str
+    description: str
+    path: str
+    skill_md_key: str
+    archive_key: str | None = None
+
+
 class AgentSkillUploadResponse(ResponseModel):
-    skill: AgentSkillRefConfig
+    skill: AgentUploadedSkillResponse
     manifest: SkillManifest
 
 
@@ -145,13 +149,11 @@ class AgentDriveFileResponse(ResponseModel):
 
 class AgentDriveFileCommitResponse(ResponseModel):
     file: AgentDriveFileResponse
-    config_version_id: str | None = None
 
 
 class AgentDriveDeleteResponse(ResponseModel):
     result: str
     removed_keys: list[str] = Field(default_factory=list)
-    config_version_id: str | None = None
 
 
 register_schema_models(console_ns, AgentLogQuery, AgentDriveFilePayload, AgentDriveDeleteFileByAgentQuery)
@@ -161,6 +163,7 @@ register_response_schema_models(
     AgentDriveFileCommitResponse,
     AgentDriveFileResponse,
     AgentLogResponse,
+    AgentUploadedSkillResponse,
     AgentSkillUploadResponse,
     SkillToolInferenceResult,
 )
@@ -242,24 +245,6 @@ def _commit_drive_file_for_app(*, current_user: Account, app_model: App, allow_n
         return {"code": exc.code, "message": exc.message}, exc.status_code
 
     row = committed[0]
-    file_ref = AgentFileRefConfig.model_validate(
-        {
-            "id": row["key"],
-            "name": upload_file.name,
-            "file_id": upload_file.id,
-            "drive_key": row["key"],
-            "type": row.get("mime_type"),
-            "size": row.get("size"),
-        }
-    )
-    config_version_id = AgentComposerService.add_drive_file_ref(
-        tenant_id=app_model.tenant_id,
-        agent_id=agent_id,
-        account_id=current_user.id,
-        file_ref=file_ref,
-        app_id=app_model.id,
-        node_id=node_id,
-    )
     return {
         "file": {
             "name": upload_file.name,
@@ -268,7 +253,6 @@ def _commit_drive_file_for_app(*, current_user: Account, app_model: App, allow_n
             "size": row.get("size"),
             "mime_type": row.get("mime_type"),
         },
-        "config_version_id": config_version_id,
     }, 201
 
 
@@ -283,24 +267,17 @@ def _delete_drive_file_for_app(*, current_user: Account, app_model: App, allow_n
     except AgentDriveError as exc:
         return {"code": exc.code, "message": exc.message}, exc.status_code
 
-    config_version_id = AgentComposerService.remove_drive_refs(
-        tenant_id=app_model.tenant_id,
-        agent_id=agent_id,
-        account_id=current_user.id,
-        file_key=key,
-        app_id=app_model.id,
-        node_id=node_id,
-    )
-    removed_keys: list[str] = []
     try:
-        removed_keys = AgentDriveService().delete(tenant_id=app_model.tenant_id, agent_id=agent_id, key=key)
+        result = AgentDriveService().commit(
+            tenant_id=app_model.tenant_id,
+            user_id=current_user.id,
+            agent_id=agent_id,
+            items=[DriveCommitItem(key=key, file_ref=None)],
+        )
     except AgentDriveError as exc:
         return {"code": exc.code, "message": exc.message}, exc.status_code
-    except Exception:
-        # Soul-first ordering: the ref is already gone; orphan KV rows are
-        # harmless and an idempotent DELETE retry cleans them.
-        logger.exception("agent drive delete failed for key %s (soul already updated)", key)
-    return {"result": "success", "removed_keys": removed_keys, "config_version_id": config_version_id}
+    removed_keys = [item["key"] for item in result if item.get("removed")]
+    return {"result": "success", "removed_keys": removed_keys}
 
 
 def _delete_skill_for_app(*, current_user: Account, app_model: App, slug: str, allow_node_id: bool = True):
@@ -312,22 +289,20 @@ def _delete_skill_for_app(*, current_user: Account, app_model: App, slug: str, a
     if "/" in slug or not slug.strip():
         return {"code": "drive_key_invalid", "message": "skill slug must be a single path segment"}, 400
 
-    config_version_id = AgentComposerService.remove_drive_refs(
-        tenant_id=app_model.tenant_id,
-        agent_id=agent_id,
-        account_id=current_user.id,
-        skill_slug=slug,
-        app_id=app_model.id,
-        node_id=node_id,
-    )
-    removed_keys: list[str] = []
     try:
-        removed_keys = AgentDriveService().delete(tenant_id=app_model.tenant_id, agent_id=agent_id, prefix=f"{slug}/")
+        result = AgentDriveService().commit(
+            tenant_id=app_model.tenant_id,
+            user_id=current_user.id,
+            agent_id=agent_id,
+            items=[
+                DriveCommitItem(key=f"{slug}/SKILL.md", file_ref=None),
+                DriveCommitItem(key=f"{slug}/.DIFY-SKILL-FULL.zip", file_ref=None),
+            ],
+        )
     except AgentDriveError as exc:
         return {"code": exc.code, "message": exc.message}, exc.status_code
-    except Exception:
-        logger.exception("agent drive delete failed for skill %s (soul already updated)", slug)
-    return {"result": "success", "removed_keys": removed_keys, "config_version_id": config_version_id}
+    removed_keys = [item["key"] for item in result if item.get("removed")]
+    return {"result": "success", "removed_keys": removed_keys}
 
 
 def _infer_skill_tools_for_app(*, app_model: App, slug: str):
@@ -455,7 +430,7 @@ class AgentDriveFilesApi(Resource):
         return _commit_drive_file_for_app(current_user=current_user, app_model=app_model)
 
     @console_ns.doc("delete_agent_drive_file")
-    @console_ns.doc(description="Delete one drive file by key; soul ref first, then the KV row (ENG-625 D5)")
+    @console_ns.doc(description="Delete one drive file by key via drive commit-null semantics")
     @console_ns.doc(params={"app_id": "Application ID", **query_params_from_model(AgentDriveDeleteFileQuery)})
     @console_ns.response(200, "File removed", console_ns.models[AgentDriveDeleteResponse.__name__])
     @setup_required
@@ -486,9 +461,7 @@ class AgentSkillByAgentApi(Resource):
 @console_ns.route("/apps/<uuid:app_id>/agent/skills/<string:slug>")
 class AgentSkillApi(Resource):
     @console_ns.doc("delete_agent_skill")
-    @console_ns.doc(
-        description="Delete a standardized skill: soul ref first, then the <slug>/ drive prefix (ENG-625 D5)"
-    )
+    @console_ns.doc(description="Delete a standardized skill by removing its known drive keys via commit-null")
     @console_ns.doc(
         params={
             "app_id": "Application ID",
diff --git a/api/controllers/console/app/agent_app_feature.py b/api/controllers/console/app/agent_app_feature.py
index 5d2b77c97f1..d155dae6ac3 100644
--- a/api/controllers/console/app/agent_app_feature.py
+++ b/api/controllers/console/app/agent_app_feature.py
@@ -29,6 +29,7 @@ from controllers.console.wraps import (
     with_current_user,
 )
 from events.app_event import app_model_config_was_updated
+from extensions.ext_database import db
 from libs.helper import dump_response
 from libs.login import login_required
 from models import Account
@@ -90,9 +91,7 @@ class AgentAppFeatureConfigResource(Resource):
         args = AgentAppFeaturesPayload.model_validate(console_ns.payload or {})
 
         new_app_model_config = AgentAppFeatureConfigService.update_features(
-            app_model=app_model,
-            account=current_user,
-            config=args.model_dump(exclude_none=True),
+            app_model=app_model, account=current_user, config=args.model_dump(exclude_none=True), session=db.session
         )
 
         app_model_config_was_updated.send(app_model, app_model_config=new_app_model_config)
diff --git a/api/controllers/console/app/agent_drive_inspector.py b/api/controllers/console/app/agent_drive_inspector.py
index b8d1d487808..bd639955d9c 100644
--- a/api/controllers/console/app/agent_drive_inspector.py
+++ b/api/controllers/console/app/agent_drive_inspector.py
@@ -10,8 +10,12 @@ backend — drive data lives in the API's own DB/storage, served straight from
 
 from __future__ import annotations
 
+import json
+from collections.abc import Mapping
+from typing import Any
 from uuid import UUID
 
+from flask import Response
 from flask_restx import Resource
 from pydantic import BaseModel, Field
 
@@ -49,6 +53,10 @@ class AgentDriveFileByAgentQuery(BaseModel):
     key: str = Field(min_length=1, description="Drive key, e.g. tender-analyzer/SKILL.md")
 
 
+class AgentDriveSkillInspectQuery(BaseModel):
+    node_id: str | None = Field(default=None, description="Workflow node ID (workflow composer variant)")
+
+
 class AgentDriveItemResponse(ResponseModel):
     key: str
     size: int | None = None
@@ -56,12 +64,63 @@ class AgentDriveItemResponse(ResponseModel):
     hash: str | None = None
     file_kind: str
     created_at: int | None = None
+    is_skill: bool | None = None
+    skill_metadata: str | None = None
 
 
 class AgentDriveListResponse(ResponseModel):
     items: list[AgentDriveItemResponse] = Field(default_factory=list)
 
 
+class AgentDriveSkillItemResponse(ResponseModel):
+    path: str
+    skill_md_key: str
+    archive_key: str | None = None
+    name: str
+    description: str
+    size: int | None = None
+    mime_type: str | None = None
+    hash: str | None = None
+    created_at: int | None = None
+
+
+class AgentDriveSkillListResponse(ResponseModel):
+    items: list[AgentDriveSkillItemResponse] = Field(default_factory=list)
+
+
+class AgentDriveSkillFileResponse(ResponseModel):
+    path: str
+    name: str
+    type: str
+    drive_key: str | None = None
+    available_in_drive: bool
+
+
+class AgentDriveSkillMarkdownResponse(ResponseModel):
+    key: str
+    size: int | None = None
+    truncated: bool
+    binary: bool
+    text: str | None = None
+
+
+class AgentDriveSkillInspectResponse(ResponseModel):
+    path: str
+    skill_md_key: str
+    archive_key: str | None = None
+    name: str
+    description: str
+    size: int | None = None
+    mime_type: str | None = None
+    hash: str | None = None
+    created_at: int | None = None
+    source: str
+    files: list[AgentDriveSkillFileResponse] = Field(default_factory=list)
+    file_tree: list[dict[str, Any]] = Field(default_factory=list)
+    skill_md: AgentDriveSkillMarkdownResponse
+    warnings: list[str] = Field(default_factory=list)
+
+
 class AgentDrivePreviewResponse(ResponseModel):
     key: str
     size: int | None = None
@@ -75,7 +134,12 @@ class AgentDriveDownloadResponse(ResponseModel):
 
 
 register_response_schema_models(
-    console_ns, AgentDriveListResponse, AgentDrivePreviewResponse, AgentDriveDownloadResponse
+    console_ns,
+    AgentDriveDownloadResponse,
+    AgentDriveListResponse,
+    AgentDrivePreviewResponse,
+    AgentDriveSkillInspectResponse,
+    AgentDriveSkillListResponse,
 )
 
 
@@ -96,6 +160,13 @@ def _handle(exc: AgentDriveError) -> tuple[dict[str, object], int]:
     return {"code": exc.code, "message": exc.message}, exc.status_code
 
 
+def _json_response(data: Mapping[str, Any]):
+    return Response(
+        response=json.dumps(data, ensure_ascii=False, separators=(",", ":")),
+        content_type="application/json; charset=utf-8",
+    )
+
+
 _WORKFLOW_APP_MODES = [AppMode.WORKFLOW, AppMode.ADVANCED_CHAT]
 
 
@@ -119,6 +190,49 @@ class AgentDriveListByAgentApi(Resource):
         return {"items": [{k: v for k, v in item.items() if k != "file_id"} for item in items]}
 
 
+@console_ns.route("/agent/<uuid:agent_id>/drive/skills")
+class AgentDriveSkillListByAgentApi(Resource):
+    @console_ns.doc("list_agent_drive_skills_by_agent")
+    @console_ns.doc(description="List drive-backed skills for an Agent App")
+    @console_ns.doc(params={"agent_id": "Agent ID"})
+    @console_ns.response(200, "Drive skills", console_ns.models[AgentDriveSkillListResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_tenant_id
+    def get(self, tenant_id: str, agent_id: UUID):
+        resolve_agent_app_model(tenant_id=tenant_id, agent_id=agent_id)
+        try:
+            items = AgentDriveService().list_skills(tenant_id=tenant_id, agent_id=str(agent_id))
+        except AgentDriveError as exc:
+            return _handle(exc)
+        return {"items": items}
+
+
+@console_ns.route("/agent/<uuid:agent_id>/drive/skills/<path:skill_path>/inspect")
+class AgentDriveSkillInspectByAgentApi(Resource):
+    @console_ns.doc("inspect_agent_drive_skill_by_agent")
+    @console_ns.doc(description="Inspect one drive-backed skill for slash-menu hover/detail UI")
+    @console_ns.doc(params={"agent_id": "Agent ID", "skill_path": "Skill path/slug, e.g. tender-analyzer"})
+    @console_ns.response(200, "Drive skill inspect view", console_ns.models[AgentDriveSkillInspectResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @with_current_tenant_id
+    def get(self, tenant_id: str, agent_id: UUID, skill_path: str):
+        resolve_agent_app_model(tenant_id=tenant_id, agent_id=agent_id)
+        try:
+            return _json_response(
+                AgentDriveService().inspect_skill(
+                    tenant_id=tenant_id,
+                    agent_id=str(agent_id),
+                    skill_path=skill_path,
+                )
+            )
+        except AgentDriveError as exc:
+            return _handle(exc)
+
+
 @console_ns.route("/agent/<uuid:agent_id>/drive/files/preview")
 class AgentDrivePreviewByAgentApi(Resource):
     @console_ns.doc("preview_agent_drive_file_by_agent")
@@ -182,6 +296,61 @@ class AgentDriveListApi(Resource):
         return {"items": [{k: v for k, v in item.items() if k != "file_id"} for item in items]}
 
 
+@console_ns.route("/apps/<uuid:app_id>/agent/drive/skills")
+class AgentDriveSkillListApi(Resource):
+    @console_ns.doc("list_agent_drive_skills")
+    @console_ns.doc(description="List drive-backed skills for the bound agent")
+    @console_ns.doc(params={"app_id": "Application ID", **query_params_from_model(AgentDriveListQuery)})
+    @console_ns.response(200, "Drive skills", console_ns.models[AgentDriveSkillListResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @get_app_model(mode=_WORKFLOW_APP_MODES)
+    def get(self, app_model: App):
+        query = query_params_from_request(AgentDriveListQuery)
+        agent_id = _resolve_agent_id(app_model, query.node_id)
+        if not agent_id:
+            return _agent_not_bound()
+        try:
+            items = AgentDriveService().list_skills(tenant_id=app_model.tenant_id, agent_id=agent_id)
+        except AgentDriveError as exc:
+            return _handle(exc)
+        return {"items": items}
+
+
+@console_ns.route("/apps/<uuid:app_id>/agent/drive/skills/<path:skill_path>/inspect")
+class AgentDriveSkillInspectApi(Resource):
+    @console_ns.doc("inspect_agent_drive_skill")
+    @console_ns.doc(description="Inspect one drive-backed skill for slash-menu hover/detail UI")
+    @console_ns.doc(
+        params={
+            "app_id": "Application ID",
+            "skill_path": "Skill path/slug, e.g. tender-analyzer",
+            **query_params_from_model(AgentDriveSkillInspectQuery),
+        }
+    )
+    @console_ns.response(200, "Drive skill inspect view", console_ns.models[AgentDriveSkillInspectResponse.__name__])
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @get_app_model(mode=_WORKFLOW_APP_MODES)
+    def get(self, app_model: App, skill_path: str):
+        query = query_params_from_request(AgentDriveSkillInspectQuery)
+        agent_id = _resolve_agent_id(app_model, query.node_id)
+        if not agent_id:
+            return _agent_not_bound()
+        try:
+            return _json_response(
+                AgentDriveService().inspect_skill(
+                    tenant_id=app_model.tenant_id,
+                    agent_id=agent_id,
+                    skill_path=skill_path,
+                )
+            )
+        except AgentDriveError as exc:
+            return _handle(exc)
+
+
 @console_ns.route("/apps/<uuid:app_id>/agent/drive/files/preview")
 class AgentDrivePreviewApi(Resource):
     @console_ns.doc("preview_agent_drive_file")
@@ -232,4 +401,8 @@ __all__ = [
     "AgentDriveListByAgentApi",
     "AgentDrivePreviewApi",
     "AgentDrivePreviewByAgentApi",
+    "AgentDriveSkillInspectApi",
+    "AgentDriveSkillInspectByAgentApi",
+    "AgentDriveSkillListApi",
+    "AgentDriveSkillListByAgentApi",
 ]
diff --git a/api/controllers/console/app/app.py b/api/controllers/console/app/app.py
index cd8d9ff3785..07d71d4225a 100644
--- a/api/controllers/console/app/app.py
+++ b/api/controllers/console/app/app.py
@@ -14,6 +14,7 @@ from werkzeug.datastructures import MultiDict
 from werkzeug.exceptions import BadRequest, NotFound
 
 from configs import dify_config
+from controllers.common.app_access import resolve_app_access_filter
 from controllers.common.fields import RedirectUrlResponse, SimpleResultResponse
 from controllers.common.helpers import FileInfo
 from controllers.common.schema import (
@@ -78,7 +79,6 @@ _TAG_IDS_BRACKET_PATTERN = re.compile(r"^tag_ids\[(\d+)\]$")
 _CREATOR_IDS_BRACKET_PATTERN = re.compile(r"^creator_ids\[(\d+)\]$")
 AppListMode = Literal["completion", "chat", "advanced-chat", "workflow", "agent-chat", "agent", "channel", "all"]
 DEFAULT_APP_LIST_MODE: AppListMode = "all"
-APP_LIST_PERMISSION_KEYS = frozenset({"app.preview", "app.acl.preview", "app.full_access"})
 
 
 class AppListBaseQuery(BaseModel):
@@ -167,10 +167,6 @@ def _normalize_app_list_query_args(query_args: MultiDict[str, str]) -> dict[str,
     return normalized
 
 
-def _has_app_list_permission(permission_keys: Sequence[str]) -> bool:
-    return any(permission_key in APP_LIST_PERMISSION_KEYS for permission_key in permission_keys)
-
-
 class CreateAppPayload(BaseModel):
     name: str = Field(..., min_length=1, description="App name")
     description: str | None = Field(default=None, description="App description (max 400 chars)", max_length=400)
@@ -612,38 +608,12 @@ class AppListApi(Resource):
             current_user_id,
         )
         if dify_config.RBAC_ENABLED:
-            whitelist_scope = enterprise_rbac_service.RBACService.AppAccess.whitelist_resources(
+            access_filter = resolve_app_access_filter(
                 str(current_tenant_id),
                 current_user_id,
+                permissions=permissions,
             )
-            can_manage_own_apps = "app.create_and_management" in permissions.workspace.permission_keys
-            has_default_preview = _has_app_list_permission(
-                permissions.app.default_permission_keys
-            ) or _has_app_list_permission(permissions.workspace.permission_keys)
-            permission_app_ids: set[str] | None = None
-            if not has_default_preview:
-                permission_app_ids = {
-                    override.resource_id
-                    for override in permissions.app.overrides
-                    if _has_app_list_permission(override.permission_keys)
-                }
-
-            if getattr(whitelist_scope, "unrestricted", False):
-                accessible_app_ids = permission_app_ids
-            else:
-                accessible_app_ids = set(whitelist_scope.resource_ids)
-                if permission_app_ids is not None:
-                    accessible_app_ids |= permission_app_ids
-                elif has_default_preview:
-                    accessible_app_ids = None
-
-            if accessible_app_ids:
-                params.accessible_app_ids = sorted(accessible_app_ids)
-                params.include_own_apps = can_manage_own_apps
-            elif accessible_app_ids is not None and can_manage_own_apps:
-                params.is_created_by_me = True
-            elif accessible_app_ids is not None:
-                params.accessible_app_ids = []
+            access_filter.apply_to_params(params)
 
         # get app list
         app_service = AppService()
diff --git a/api/controllers/console/app/completion.py b/api/controllers/console/app/completion.py
index 62b95ad22e4..545fad34cde 100644
--- a/api/controllers/console/app/completion.py
+++ b/api/controllers/console/app/completion.py
@@ -40,12 +40,15 @@ from core.errors.error import (
     QuotaExceededError,
 )
 from core.helper.trace_id_helper import get_external_trace_id
+from extensions.ext_database import db
 from graphon.model_runtime.errors.invoke import InvokeError
 from libs import helper
 from libs.helper import uuid_value
 from libs.login import login_required
 from models import Account
 from models.model import App, AppMode
+from services.agent.errors import AgentNotFoundError
+from services.agent.roster_service import AgentRosterService
 from services.app_generate_service import AppGenerateService
 from services.app_task_service import AppTaskService
 from services.errors.llm import InvokeRateLimitError
@@ -191,10 +194,11 @@ class ChatMessageApi(Resource):
     @account_initialization_required
     @edit_permission_required
     @with_current_user
+    @with_current_tenant_id
     @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_TEST_AND_RUN)
     @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.AGENT])
-    def post(self, current_user: Account, app_model: App):
-        return _create_chat_message(current_user=current_user, app_model=app_model)
+    def post(self, current_tenant_id: str, current_user: Account, app_model: App):
+        return _create_chat_message(current_tenant_id=current_tenant_id, current_user=current_user, app_model=app_model)
 
 
 @console_ns.route("/agent/<uuid:agent_id>/chat-messages")
@@ -215,7 +219,12 @@ class AgentChatMessageApi(Resource):
     @with_current_tenant_id
     def post(self, current_tenant_id: str, current_user: Account, agent_id: UUID):
         app_model = resolve_agent_app_model(tenant_id=current_tenant_id, agent_id=agent_id)
-        return _create_chat_message(current_user=current_user, app_model=app_model)
+        return _create_chat_message(
+            current_tenant_id=current_tenant_id,
+            current_user=current_user,
+            app_model=app_model,
+            agent_id=str(agent_id),
+        )
 
 
 @console_ns.route("/apps/<uuid:app_id>/chat-messages/<string:task_id>/stop")
@@ -249,11 +258,45 @@ class AgentChatMessageStopApi(Resource):
         return _stop_chat_message(current_user_id=current_user_id, app_model=app_model, task_id=task_id)
 
 
-def _create_chat_message(*, current_user: Account, app_model: App):
+def _resolve_current_user_agent_debug_conversation_id(
+    *, current_tenant_id: str, current_user: Account, app_model: App, agent_id: str | None
+) -> str:
+    roster_service = AgentRosterService(db.session)
+    if agent_id:
+        return roster_service.get_or_create_agent_app_debug_conversation_id(
+            tenant_id=current_tenant_id,
+            agent_id=agent_id,
+            account_id=current_user.id,
+        )
+
+    agent = roster_service.get_app_backing_agent(tenant_id=current_tenant_id, app_id=str(app_model.id))
+    if agent is None:
+        raise AgentNotFoundError()
+    return roster_service.get_or_create_agent_app_debug_conversation_id(
+        tenant_id=current_tenant_id,
+        agent_id=agent.id,
+        account_id=current_user.id,
+    )
+
+
+def _create_chat_message(
+    *, current_user: Account, app_model: App, current_tenant_id: str | None = None, agent_id: str | None = None
+):
     raw_payload = console_ns.payload or {}
     args_model = ChatMessagePayload.model_validate(raw_payload)
     args = args_model.model_dump(exclude_none=True, by_alias=True)
 
+    if AppMode.value_of(app_model.mode) == AppMode.AGENT:
+        debug_conversation_id = _resolve_current_user_agent_debug_conversation_id(
+            current_tenant_id=current_tenant_id or app_model.tenant_id,
+            current_user=current_user,
+            app_model=app_model,
+            agent_id=agent_id,
+        )
+        if args_model.conversation_id and args_model.conversation_id != debug_conversation_id:
+            raise NotFound("Conversation Not Exists.")
+        args["conversation_id"] = debug_conversation_id
+
     streaming = _resolve_debugger_chat_streaming(
         app_mode=AppMode.value_of(app_model.mode),
         response_mode=args_model.response_mode,
diff --git a/api/controllers/console/app/message.py b/api/controllers/console/app/message.py
index 1406fbc634b..726bd94cd7e 100644
--- a/api/controllers/console/app/message.py
+++ b/api/controllers/console/app/message.py
@@ -53,6 +53,7 @@ from libs.login import login_required
 from models.account import Account
 from models.enums import FeedbackFromSource, FeedbackRating
 from models.model import App, AppMode, Conversation, Message, MessageAnnotation, MessageFeedback
+from services.conversation_service import ConversationService
 from services.errors.conversation import ConversationNotExistsError
 from services.errors.message import MessageNotExistsError, SuggestedQuestionsAfterAnswerDisabledError
 from services.message_service import MessageService, attach_message_extra_contents
@@ -186,10 +187,11 @@ class ChatMessageListApi(Resource):
     @account_initialization_required
     @setup_required
     @edit_permission_required
+    @with_current_user
     @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
     @get_app_model(mode=[AppMode.CHAT, AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT, AppMode.AGENT])
-    def get(self, app_model: App):
-        return _list_chat_messages(app_model=app_model)
+    def get(self, current_user: Account, app_model: App):
+        return _list_chat_messages(app_model=app_model, current_user=current_user)
 
 
 @console_ns.route("/agent/<uuid:agent_id>/chat-messages")
@@ -205,10 +207,11 @@ class AgentChatMessageListApi(Resource):
     @setup_required
     @edit_permission_required
     @rbac_permission_required(RBACResourceScope.APP, RBACPermission.APP_VIEW_LAYOUT)
+    @with_current_user
     @with_current_tenant_id
-    def get(self, current_tenant_id: str, agent_id: UUID):
+    def get(self, current_tenant_id: str, current_user: Account, agent_id: UUID):
         app_model = resolve_agent_app_model(tenant_id=current_tenant_id, agent_id=agent_id)
-        return _list_chat_messages(app_model=app_model)
+        return _list_chat_messages(app_model=app_model, current_user=current_user)
 
 
 @console_ns.route("/apps/<uuid:app_id>/feedbacks")
@@ -338,6 +341,7 @@ class MessageFeedbackExportApi(Resource):
 
         try:
             export_data = FeedbackService.export_feedbacks(
+                db.session(),
                 app_id=app_model.id,
                 from_source=args.from_source,
                 rating=args.rating,
@@ -389,14 +393,24 @@ class AgentMessageApi(Resource):
         return _get_message_detail(app_model=app_model, message_id=message_id)
 
 
-def _list_chat_messages(*, app_model: App):
+def _list_chat_messages(*, app_model: App, current_user: Account | None = None):
     args = ChatMessagesQuery.model_validate(request.args.to_dict())
 
-    conversation = db.session.scalar(
-        select(Conversation)
-        .where(Conversation.id == args.conversation_id, Conversation.app_id == app_model.id)
-        .limit(1)
-    )
+    if AppMode.value_of(app_model.mode) == AppMode.AGENT and current_user is not None:
+        try:
+            conversation = ConversationService.get_conversation(
+                app_model=app_model,
+                conversation_id=args.conversation_id,
+                user=current_user,
+            )
+        except ConversationNotExistsError:
+            raise NotFound("Conversation Not Exists.")
+    else:
+        conversation = db.session.scalar(
+            select(Conversation)
+            .where(Conversation.id == args.conversation_id, Conversation.app_id == app_model.id)
+            .limit(1)
+        )
 
     if not conversation:
         raise NotFound("Conversation Not Exists.")
diff --git a/api/controllers/console/auth/activate.py b/api/controllers/console/auth/activate.py
index f61bb8f6802..c9142d85ede 100644
--- a/api/controllers/console/auth/activate.py
+++ b/api/controllers/console/auth/activate.py
@@ -174,7 +174,7 @@ class ActivateApi(Resource):
         RegisterService.revoke_token(args.workspace_id, normalized_request_email, args.token)
 
         if membership_id is None:
-            TenantService.create_tenant_member(tenant, account, str(role))
+            TenantService.create_tenant_member(tenant, account, db.session, role=role)
 
         if setup_fields:
             account.name = setup_fields[0]
diff --git a/api/controllers/console/auth/data_source_bearer_auth.py b/api/controllers/console/auth/data_source_bearer_auth.py
index a9c97401105..1de206c73db 100644
--- a/api/controllers/console/auth/data_source_bearer_auth.py
+++ b/api/controllers/console/auth/data_source_bearer_auth.py
@@ -83,7 +83,7 @@ class ApiKeyAuthDataSourceBinding(Resource):
     @login_required
     @account_initialization_required
     @is_admin_or_owner_required
-    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_CREATE, resource_required=False)
     @console_ns.expect(console_ns.models[ApiKeyAuthBindingPayload.__name__])
     @with_current_tenant_id
     def post(self, current_tenant_id: str):
diff --git a/api/controllers/console/auth/forgot_password.py b/api/controllers/console/auth/forgot_password.py
index c34dd1ac859..d82f63c11db 100644
--- a/api/controllers/console/auth/forgot_password.py
+++ b/api/controllers/console/auth/forgot_password.py
@@ -202,6 +202,6 @@ class ForgotPasswordResetApi(Resource):
             and FeatureService.get_system_features().is_allow_create_workspace
         ):
             tenant = TenantService.create_tenant(f"{account.name}'s Workspace")
-            TenantService.create_tenant_member(tenant, account, role="owner")
+            TenantService.create_tenant_member(tenant, account, db.session, role="owner")
             account.current_tenant = tenant
             tenant_was_created.send(tenant)
diff --git a/api/controllers/console/auth/login.py b/api/controllers/console/auth/login.py
index 6a1b4c6769e..053f313ba53 100644
--- a/api/controllers/console/auth/login.py
+++ b/api/controllers/console/auth/login.py
@@ -35,6 +35,7 @@ from controllers.console.wraps import (
     with_current_user,
 )
 from events.tenant_event import tenant_was_created
+from extensions.ext_database import db
 from libs.helper import EmailStr, extract_remote_ip
 from libs.helper import timezone as validate_timezone_string
 from libs.token import (
@@ -299,7 +300,7 @@ class EmailCodeLoginApi(Resource):
                     raise NotAllowedCreateWorkspace()
                 else:
                     new_tenant = TenantService.create_tenant(f"{account.name}'s Workspace")
-                    TenantService.create_tenant_member(new_tenant, account, role="owner")
+                    TenantService.create_tenant_member(new_tenant, account, db.session, role="owner")
                     account.current_tenant = new_tenant
                     tenant_was_created.send(new_tenant)
 
diff --git a/api/controllers/console/auth/oauth.py b/api/controllers/console/auth/oauth.py
index 31649812fe8..78d1583fde9 100644
--- a/api/controllers/console/auth/oauth.py
+++ b/api/controllers/console/auth/oauth.py
@@ -246,7 +246,7 @@ def _generate_account(
                 raise WorkSpaceNotAllowedCreateError()
             else:
                 new_tenant = TenantService.create_tenant(f"{account.name}'s Workspace")
-                TenantService.create_tenant_member(new_tenant, account, role="owner")
+                TenantService.create_tenant_member(new_tenant, account, db.session, role="owner")
                 account.current_tenant = new_tenant
                 tenant_was_created.send(new_tenant)
 
diff --git a/api/controllers/console/datasets/external.py b/api/controllers/console/datasets/external.py
index 033c9a69af6..eb7b9aa84f8 100644
--- a/api/controllers/console/datasets/external.py
+++ b/api/controllers/console/datasets/external.py
@@ -26,6 +26,7 @@ from controllers.console.wraps import (
     with_current_tenant_id,
     with_current_user,
 )
+from extensions.ext_database import db
 from fields.base import ResponseModel
 from fields.dataset_fields import (
     dataset_detail_fields,
@@ -390,6 +391,7 @@ class ExternalKnowledgeHitTestingApi(Resource):
 
         try:
             response = HitTestingService.external_retrieve(
+                session=db.session,
                 dataset=dataset,
                 query=payload.query,
                 account=current_user,
diff --git a/api/controllers/console/datasets/hit_testing_base.py b/api/controllers/console/datasets/hit_testing_base.py
index 4e90e66eb25..c343effa9a1 100644
--- a/api/controllers/console/datasets/hit_testing_base.py
+++ b/api/controllers/console/datasets/hit_testing_base.py
@@ -18,6 +18,7 @@ from core.errors.error import (
     ProviderTokenNotInitError,
     QuotaExceededError,
 )
+from extensions.ext_database import db
 from graphon.model_runtime.errors.invoke import InvokeError
 from libs.login import resolve_account_fallback
 from models.account import Account
@@ -115,6 +116,7 @@ class DatasetsHitTestingBase:
         try:
             current_user, _ = resolve_account_fallback(current_user, current_tenant_id)
             response = HitTestingService.retrieve(
+                session=db.session,
                 dataset=dataset,
                 query=cast(str, args.get("query")),
                 account=current_user,
diff --git a/api/controllers/console/datasets/rag_pipeline/datasource_auth.py b/api/controllers/console/datasets/rag_pipeline/datasource_auth.py
index c5ca1d155de..a575760ee19 100644
--- a/api/controllers/console/datasets/rag_pipeline/datasource_auth.py
+++ b/api/controllers/console/datasets/rag_pipeline/datasource_auth.py
@@ -222,7 +222,7 @@ class DatasourceAuth(Resource):
     @login_required
     @account_initialization_required
     @edit_permission_required
-    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
+    @rbac_permission_required(RBACResourceScope.DATASET, RBACPermission.CREDENTIAL_CREATE, resource_required=False)
     @with_current_tenant_id
     def post(self, current_tenant_id: str, provider_id: str):
         payload = DatasourceCredentialPayload.model_validate(console_ns.payload or {})
diff --git a/api/controllers/console/explore/saved_message.py b/api/controllers/console/explore/saved_message.py
index 3e8f1ce9083..ce43ff18c93 100644
--- a/api/controllers/console/explore/saved_message.py
+++ b/api/controllers/console/explore/saved_message.py
@@ -11,6 +11,7 @@ from controllers.console.app.error import AppUnavailableError
 from controllers.console.explore.error import NotCompletionAppError
 from controllers.console.explore.wraps import InstalledAppResource
 from controllers.console.wraps import with_current_user
+from extensions.ext_database import db
 from fields.conversation_fields import ResultResponse
 from fields.message_fields import SavedMessageInfiniteScrollPagination, SavedMessageItem
 from models import Account
@@ -37,6 +38,7 @@ class SavedMessageListApi(InstalledAppResource):
         args = SavedMessageListQuery.model_validate(request.args.to_dict())
 
         pagination = SavedMessageService.pagination_by_last_id(
+            db.session(),
             app_model,
             current_user,
             str(args.last_id) if args.last_id else None,
@@ -63,7 +65,7 @@ class SavedMessageListApi(InstalledAppResource):
         payload = SavedMessageCreatePayload.model_validate(console_ns.payload or {})
 
         try:
-            SavedMessageService.save(app_model, current_user, str(payload.message_id))
+            SavedMessageService.save(db.session(), app_model, current_user, str(payload.message_id))
         except MessageNotExistsError:
             raise NotFound("Message Not Exists.")
 
@@ -86,6 +88,6 @@ class SavedMessageApi(InstalledAppResource):
         if app_model.mode != "completion":
             raise NotCompletionAppError()
 
-        SavedMessageService.delete(app_model, current_user, message_id_str)
+        SavedMessageService.delete(db.session(), app_model, current_user, message_id_str)
 
         return "", 204
diff --git a/api/controllers/console/extension.py b/api/controllers/console/extension.py
index 6d9362ae0b1..ec1e01dc460 100644
--- a/api/controllers/console/extension.py
+++ b/api/controllers/console/extension.py
@@ -7,6 +7,7 @@ from flask_restx import Resource
 from pydantic import BaseModel, Field, TypeAdapter, field_validator
 
 from constants import HIDDEN_VALUE
+from extensions.ext_database import db
 from fields.base import ResponseModel
 from libs.helper import to_timestamp
 from libs.login import login_required
@@ -126,7 +127,7 @@ class APIBasedExtensionAPI(Resource):
     def get(self, current_tenant_id: str):
         return [
             _serialize_api_based_extension(extension)
-            for extension in APIBasedExtensionService.get_all_by_tenant_id(current_tenant_id)
+            for extension in APIBasedExtensionService.get_all_by_tenant_id(db.session(), current_tenant_id)
         ]
 
     @console_ns.doc("create_api_based_extension")
@@ -147,7 +148,12 @@ class APIBasedExtensionAPI(Resource):
             api_key=payload.api_key,
         )
 
-        return _serialize_saved_api_based_extension(APIBasedExtensionService.save(extension_data), payload.api_key), 201
+        return (
+            _serialize_saved_api_based_extension(
+                APIBasedExtensionService.save(db.session(), extension_data), payload.api_key
+            ),
+            201,
+        )
 
 
 @console_ns.route("/api-based-extension/<uuid:id>")
@@ -164,7 +170,7 @@ class APIBasedExtensionDetailAPI(Resource):
         api_based_extension_id = str(id)
 
         return _serialize_api_based_extension(
-            APIBasedExtensionService.get_with_tenant_id(current_tenant_id, api_based_extension_id)
+            APIBasedExtensionService.get_with_tenant_id(db.session(), current_tenant_id, api_based_extension_id)
         )
 
     @console_ns.doc("update_api_based_extension")
@@ -179,7 +185,9 @@ class APIBasedExtensionDetailAPI(Resource):
     def post(self, current_tenant_id: str, id: UUID):
         api_based_extension_id = str(id)
 
-        extension_data_from_db = APIBasedExtensionService.get_with_tenant_id(current_tenant_id, api_based_extension_id)
+        extension_data_from_db = APIBasedExtensionService.get_with_tenant_id(
+            db.session(), current_tenant_id, api_based_extension_id
+        )
 
         payload = APIBasedExtensionPayload.model_validate(console_ns.payload or {})
         api_key_for_response = extension_data_from_db.api_key
@@ -192,7 +200,7 @@ class APIBasedExtensionDetailAPI(Resource):
             api_key_for_response = payload.api_key
 
         return _serialize_saved_api_based_extension(
-            APIBasedExtensionService.save(extension_data_from_db),
+            APIBasedExtensionService.save(db.session(), extension_data_from_db),
             api_key_for_response,
         )
 
@@ -207,8 +215,10 @@ class APIBasedExtensionDetailAPI(Resource):
     def delete(self, current_tenant_id: str, id: UUID):
         api_based_extension_id = str(id)
 
-        extension_data_from_db = APIBasedExtensionService.get_with_tenant_id(current_tenant_id, api_based_extension_id)
+        extension_data_from_db = APIBasedExtensionService.get_with_tenant_id(
+            db.session(), current_tenant_id, api_based_extension_id
+        )
 
-        APIBasedExtensionService.delete(extension_data_from_db)
+        APIBasedExtensionService.delete(db.session(), extension_data_from_db)
 
         return "", 204
diff --git a/api/controllers/console/snippets/snippet_workflow.py b/api/controllers/console/snippets/snippet_workflow.py
index 5af885ab91b..0b8dc264a68 100644
--- a/api/controllers/console/snippets/snippet_workflow.py
+++ b/api/controllers/console/snippets/snippet_workflow.py
@@ -80,6 +80,13 @@ class SnippetDraftConfigResponse(BaseModel):
     parallel_depth_limit: int
 
 
+class SnippetWorkflowPaginationResponse(BaseModel):
+    items: list[SnippetWorkflowResponse]
+    page: int
+    limit: int
+    has_more: bool
+
+
 register_schema_models(
     console_ns,
     SnippetDraftSyncPayload,
@@ -98,6 +105,7 @@ register_response_schema_models(
     SimpleResultResponse,
     SnippetDraftConfigResponse,
     SnippetWorkflowResponse,
+    SnippetWorkflowPaginationResponse,
     WorkflowPublishResponse,
     WorkflowPaginationResponse,
     WorkflowRestoreResponse,
@@ -329,7 +337,7 @@ class SnippetPublishedAllWorkflowApi(Resource):
     @console_ns.response(
         200,
         "Published workflows retrieved successfully",
-        console_ns.models[WorkflowPaginationResponse.__name__],
+        console_ns.models[SnippetWorkflowPaginationResponse.__name__],
     )
     @setup_required
     @login_required
@@ -350,7 +358,7 @@ class SnippetPublishedAllWorkflowApi(Resource):
                 limit=args.limit,
             )
 
-        return WorkflowPaginationResponse.model_validate(
+        response = SnippetWorkflowPaginationResponse.model_validate(
             {
                 "items": workflows,
                 "page": args.page,
@@ -359,6 +367,9 @@ class SnippetPublishedAllWorkflowApi(Resource):
             },
             from_attributes=True,
         ).model_dump(mode="json")
+        for item in response["items"]:
+            item["input_fields"] = snippet.input_fields_list
+        return response
 
 
 @console_ns.route("/snippets/<uuid:snippet_id>/workflows/<string:workflow_id>/restore")
diff --git a/api/controllers/console/workspace/__init__.py b/api/controllers/console/workspace/__init__.py
index 59dd29fdace..13bc98c8047 100644
--- a/api/controllers/console/workspace/__init__.py
+++ b/api/controllers/console/workspace/__init__.py
@@ -5,6 +5,7 @@ from sqlalchemy import select
 from sqlalchemy.orm import sessionmaker
 from werkzeug.exceptions import Forbidden
 
+from configs import dify_config
 from extensions.ext_database import db
 from libs.login import current_account_with_tenant
 from models.account import TenantPluginPermission
@@ -17,6 +18,9 @@ def plugin_permission_required(
     def interceptor[**P, R](view: Callable[P, R]) -> Callable[P, R]:
         @wraps(view)
         def decorated(*args: P.args, **kwargs: P.kwargs) -> R:
+            if dify_config.RBAC_ENABLED:
+                return view(*args, **kwargs)
+
             current_user, current_tenant_id = current_account_with_tenant()
             user = current_user
             tenant_id = current_tenant_id
diff --git a/api/controllers/console/workspace/model_providers.py b/api/controllers/console/workspace/model_providers.py
index 8fda67f4ef8..3ce7211703e 100644
--- a/api/controllers/console/workspace/model_providers.py
+++ b/api/controllers/console/workspace/model_providers.py
@@ -169,7 +169,7 @@ class ModelProviderCredentialApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
-    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_CREATE, resource_required=False)
     @account_initialization_required
     @with_current_tenant_id
     def post(self, current_tenant_id: str, provider: str):
@@ -244,7 +244,7 @@ class ModelProviderCredentialSwitchApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
-    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_USE, resource_required=False)
     @account_initialization_required
     @with_current_tenant_id
     def post(self, current_tenant_id: str, provider: str):
@@ -326,7 +326,7 @@ class PreferredProviderTypeUpdateApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
-    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_USE, resource_required=False)
     @account_initialization_required
     @with_current_tenant_id
     def post(self, tenant_id: str, provider: str):
diff --git a/api/controllers/console/workspace/models.py b/api/controllers/console/workspace/models.py
index e82c0fbc2db..1da72ef4362 100644
--- a/api/controllers/console/workspace/models.py
+++ b/api/controllers/console/workspace/models.py
@@ -395,7 +395,7 @@ class ModelProviderModelCredentialApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
-    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_CREATE, resource_required=False)
     @account_initialization_required
     @with_current_tenant_id
     def post(self, tenant_id: str, provider: str):
@@ -481,7 +481,7 @@ class ModelProviderModelCredentialSwitchApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
-    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_USE, resource_required=False)
     @account_initialization_required
     @with_current_tenant_id
     def post(self, current_tenant_id: str, provider: str):
diff --git a/api/controllers/console/workspace/plugin.py b/api/controllers/console/workspace/plugin.py
index d599466002d..e768bb5acde 100644
--- a/api/controllers/console/workspace/plugin.py
+++ b/api/controllers/console/workspace/plugin.py
@@ -469,6 +469,7 @@ class PluginDebuggingKeyApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_DEBUG, resource_required=False)
     @plugin_permission_required(debug_required=True)
     @with_current_tenant_id
     def get(self, tenant_id: str):
@@ -614,6 +615,7 @@ class PluginUploadFromPkgApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_INSTALL, resource_required=False)
     @plugin_permission_required(install_required=True)
     @with_current_tenant_id
     def post(self, tenant_id: str):
@@ -634,6 +636,7 @@ class PluginUploadFromGithubApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_INSTALL, resource_required=False)
     @plugin_permission_required(install_required=True)
     @with_current_tenant_id
     def post(self, tenant_id: str):
@@ -653,6 +656,7 @@ class PluginUploadFromBundleApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_INSTALL, resource_required=False)
     @plugin_permission_required(install_required=True)
     @with_current_tenant_id
     def post(self, tenant_id: str):
@@ -673,6 +677,7 @@ class PluginInstallFromPkgApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_INSTALL, resource_required=False)
     @plugin_permission_required(install_required=True)
     @with_current_tenant_id
     def post(self, tenant_id: str):
@@ -693,6 +698,7 @@ class PluginInstallFromGithubApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_INSTALL, resource_required=False)
     @plugin_permission_required(install_required=True)
     @with_current_tenant_id
     def post(self, tenant_id: str):
@@ -719,6 +725,7 @@ class PluginInstallFromMarketplaceApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_INSTALL, resource_required=False)
     @plugin_permission_required(install_required=True)
     @with_current_tenant_id
     def post(self, tenant_id: str):
@@ -739,6 +746,7 @@ class PluginFetchMarketplacePkgApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_INSTALL, resource_required=False)
     @plugin_permission_required(install_required=True)
     @with_current_tenant_id
     def get(self, tenant_id: str):
@@ -764,6 +772,7 @@ class PluginFetchManifestApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_INSTALL, resource_required=False)
     @plugin_permission_required(install_required=True)
     @with_current_tenant_id
     def get(self, tenant_id: str):
@@ -784,6 +793,7 @@ class PluginFetchInstallTasksApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_INSTALL, resource_required=False)
     @plugin_permission_required(install_required=True)
     @with_current_tenant_id
     def get(self, tenant_id: str):
@@ -801,6 +811,7 @@ class PluginFetchInstallTaskApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_INSTALL, resource_required=False)
     @plugin_permission_required(install_required=True)
     @with_current_tenant_id
     def get(self, tenant_id: str, task_id: str):
@@ -816,6 +827,7 @@ class PluginDeleteInstallTaskApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_INSTALL, resource_required=False)
     @plugin_permission_required(install_required=True)
     @with_current_tenant_id
     def post(self, tenant_id: str, task_id: str):
@@ -831,6 +843,7 @@ class PluginDeleteAllInstallTaskItemsApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_INSTALL, resource_required=False)
     @plugin_permission_required(install_required=True)
     @with_current_tenant_id
     def post(self, tenant_id: str):
@@ -846,6 +859,7 @@ class PluginDeleteInstallTaskItemApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_INSTALL, resource_required=False)
     @plugin_permission_required(install_required=True)
     @with_current_tenant_id
     def post(self, tenant_id: str, task_id: str, identifier: str):
@@ -862,6 +876,7 @@ class PluginUpgradeFromMarketplaceApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_INSTALL, resource_required=False)
     @plugin_permission_required(install_required=True)
     @with_current_tenant_id
     def post(self, tenant_id: str):
@@ -884,6 +899,7 @@ class PluginUpgradeFromGithubApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_INSTALL, resource_required=False)
     @plugin_permission_required(install_required=True)
     @with_current_tenant_id
     def post(self, tenant_id: str):
@@ -911,6 +927,7 @@ class PluginUninstallApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_INSTALL, resource_required=False)
     @plugin_permission_required(install_required=True)
     @with_current_tenant_id
     def post(self, tenant_id: str):
@@ -1041,10 +1058,11 @@ class PluginChangeAutoUpgradeApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_PREFERENCES, resource_required=False)
     @with_current_user
     @with_current_tenant_id
     def post(self, tenant_id: str, user: Account):
-        if not user.is_admin_or_owner:
+        if not dify_config.RBAC_ENABLED and not user.is_admin_or_owner:
             raise Forbidden()
 
         args = ParserAutoUpgradeChange.model_validate(console_ns.payload)
@@ -1097,6 +1115,7 @@ class PluginAutoUpgradeExcludePluginApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.PLUGIN_PREFERENCES, resource_required=False)
     @with_current_tenant_id
     def post(self, tenant_id: str):
         # exclude one single plugin
diff --git a/api/controllers/console/workspace/rbac.py b/api/controllers/console/workspace/rbac.py
index 1b213a4f741..f672833061a 100644
--- a/api/controllers/console/workspace/rbac.py
+++ b/api/controllers/console/workspace/rbac.py
@@ -211,7 +211,7 @@ def _legacy_workspace_roles(
             name=role_name,
             description="",
             is_builtin=True,
-            permission_keys=list(_LEGACY_ROLE_PERMISSION_KEYS[role_name]),
+            permission_keys=list(dict.fromkeys(_LEGACY_ROLE_PERMISSION_KEYS[role_name])),
             role_tag="owner" if role_name == "owner" else "",
         )
         for role_name in ("owner", "admin", "editor", "normal", "dataset_operator")
@@ -244,11 +244,6 @@ def _legacy_workspace_roles(
     )
 
 
-# ---------------------------------------------------------------------------
-# Permission catalogs.
-# ---------------------------------------------------------------------------
-
-
 @console_ns.route("/workspaces/current/rbac/role-permissions/catalog")
 class RBACWorkspaceCatalogApi(Resource):
     @login_required
@@ -375,30 +370,6 @@ class RBACRoleCopyApi(Resource):
         return _dump(role), 201
 
 
-@console_ns.route("/workspaces/current/rbac/roles/<uuid:role_id>/members")
-class RBACRoleMembersApi(Resource):
-    @login_required
-    @rbac_permission_required(
-        RBACResourceScope.WORKSPACE, RBACPermission.WORKSPACE_ROLE_MANAGE, resource_required=False
-    )
-    @console_ns.response(200, "Success", console_ns.models[_RBACRoleAccountList.__name__])
-    def get(self, role_id):
-        tenant_id, account_id = _current_ids()
-        return _dump(
-            svc.RBACService.Roles.members(
-                tenant_id,
-                account_id,
-                str(role_id),
-                options=_pagination_options(),
-            )
-        )
-
-
-# ---------------------------------------------------------------------------
-# Access policies (tenant-level permission sets).
-# ---------------------------------------------------------------------------
-
-
 class _AccessPolicyCreateRequest(BaseModel):
     name: str
     resource_type: svc.RBACResourceType
@@ -788,11 +759,6 @@ class RBACDatasetMemberBindingsApi(Resource):
         return {"result": "success"}
 
 
-# ---------------------------------------------------------------------------
-# Workspace-level access (Settings > Access Rules).
-# ---------------------------------------------------------------------------
-
-
 @console_ns.route("/workspaces/current/rbac/workspace/apps/access-policy")
 class RBACWorkspaceAppMatrixApi(Resource):
     @login_required
diff --git a/api/controllers/console/workspace/tool_providers.py b/api/controllers/console/workspace/tool_providers.py
index 9a92571594c..4125e7d8de8 100644
--- a/api/controllers/console/workspace/tool_providers.py
+++ b/api/controllers/console/workspace/tool_providers.py
@@ -971,7 +971,7 @@ class ToolBuiltinProviderSetDefaultApi(Resource):
     @setup_required
     @login_required
     @is_admin_or_owner_required
-    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_MANAGE, resource_required=False)
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.CREDENTIAL_USE, resource_required=False)
     @account_initialization_required
     @with_current_tenant_id
     def post(self, current_tenant_id: str, provider: str):
@@ -1070,6 +1070,7 @@ class ToolProviderMCPApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.MCP_MANAGE, resource_required=False)
     @with_current_user
     @with_current_tenant_id
     def post(self, tenant_id: str, user: Account):
@@ -1125,6 +1126,7 @@ class ToolProviderMCPApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.MCP_MANAGE, resource_required=False)
     @with_current_tenant_id
     def put(self, current_tenant_id: str):
         payload = MCPProviderUpdatePayload.model_validate(console_ns.payload or {})
@@ -1178,6 +1180,7 @@ class ToolProviderMCPApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.MCP_MANAGE, resource_required=False)
     @with_current_tenant_id
     def delete(self, current_tenant_id: str):
         payload = MCPProviderDeletePayload.model_validate(console_ns.payload or {})
@@ -1196,6 +1199,7 @@ class ToolMCPAuthApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.MCP_MANAGE, resource_required=False)
     @with_current_tenant_id
     def post(self, tenant_id: str):
         payload = MCPAuthPayload.model_validate(console_ns.payload or {})
@@ -1300,6 +1304,7 @@ class ToolMCPUpdateApi(Resource):
     @setup_required
     @login_required
     @account_initialization_required
+    @rbac_permission_required(RBACResourceScope.WORKSPACE, RBACPermission.MCP_MANAGE, resource_required=False)
     @with_current_tenant_id
     def get(self, tenant_id: str, provider_id: str):
         with sessionmaker(db.engine).begin() as session:
diff --git a/api/controllers/inner_api/knowledge/retrieval.py b/api/controllers/inner_api/knowledge/retrieval.py
index ef33fbda518..1c1320fde42 100644
--- a/api/controllers/inner_api/knowledge/retrieval.py
+++ b/api/controllers/inner_api/knowledge/retrieval.py
@@ -1,9 +1,10 @@
-"""Inner API endpoint for tenant-scoped knowledge retrieval.
+"""Plugin inner API endpoint for tenant-scoped knowledge retrieval.
 
 This controller is a thin HTTP wrapper around
 ``services.knowledge_retrieval_inner_service.InnerKnowledgeRetrievalService``.
-It intentionally keeps authorization simple: shared inner API key plus
-tenant-scoped app/dataset validation in the service layer.
+It uses the plugin inner API key because dify-agent calls this endpoint through
+the same trusted Dify API bridge as other agent/plugin inner calls; tenant-scoped
+app/dataset validation remains in the service layer.
 """
 
 from flask_restx import Resource
@@ -11,7 +12,7 @@ from pydantic import ValidationError
 
 from controllers.common.schema import register_response_schema_models, register_schema_models
 from controllers.inner_api import inner_api_ns
-from controllers.inner_api.wraps import inner_api_only
+from controllers.inner_api.wraps import plugin_inner_api_only
 from core.workflow.nodes.knowledge_retrieval import exc as retrieval_exc
 from libs.exception import BaseHTTPException
 from services.entities.knowledge_retrieval_inner import InnerKnowledgeRetrieveRequest, InnerKnowledgeRetrieveResponse
@@ -48,7 +49,7 @@ register_response_schema_models(inner_api_ns, InnerKnowledgeRetrieveResponse)
 class InnerKnowledgeRetrieveApi(Resource):
     """Retrieve knowledge from one or more datasets within the caller tenant."""
 
-    @inner_api_only
+    @plugin_inner_api_only
     @inner_api_ns.doc("inner_knowledge_retrieve")
     @inner_api_ns.doc(description="Retrieve knowledge for trusted internal callers")
     @inner_api_ns.expect(inner_api_ns.models[InnerKnowledgeRetrieveRequest.__name__])
@@ -60,9 +61,8 @@ class InnerKnowledgeRetrieveApi(Resource):
     @inner_api_ns.doc(
         responses={
             400: "Invalid request body",
-            401: "Unauthorized - invalid inner API key",
             403: "Caller tenant does not own the requested resource",
-            404: "App or dataset not found",
+            404: "Invalid plugin inner API key, app not found, or dataset not found",
             422: "Invalid retrieval configuration",
             429: "Knowledge retrieval rate limited",
             502: "External knowledge retrieval failed",
diff --git a/api/controllers/inner_api/plugin/agent_drive.py b/api/controllers/inner_api/plugin/agent_drive.py
index a80caea3c55..0cdb9dab35f 100644
--- a/api/controllers/inner_api/plugin/agent_drive.py
+++ b/api/controllers/inner_api/plugin/agent_drive.py
@@ -1,10 +1,12 @@
-"""Inner API for the agent drive (agent 网盘) control plane — ENG-591.
+"""Inner API for the agent drive (agent 网盘) control plane.
 
-Two endpoints, called by the dify-agent server (not the sandbox) with the inner
-API key. The drive ref is the URL segment ``agent-<agent_id>``; the path-like
-file key travels in the query/body, never as a URL path segment (so its ``/``
-characters do not collide with routing). Drive-owned semantics: tenant scoped,
-no user-level FileAccessScope.
+These endpoints are called by the dify-agent server (not the sandbox) with the
+inner API key. The drive ref is the URL segment ``agent-<agent_id>``; the
+path-like file key travels in the query/body, never as a URL path segment (so
+its ``/`` characters do not collide with routing). Drive-owned semantics:
+tenant scoped, no user-level FileAccessScope. Commit still canonicalizes the
+trusted execution-context user through the same EndUser lookup as plugin file
+upload before validating ToolFile ownership.
 """
 
 from flask import request
@@ -13,6 +15,7 @@ from pydantic import BaseModel, ValidationError
 
 from controllers.console.wraps import setup_required
 from controllers.inner_api import inner_api_ns
+from controllers.inner_api.plugin.wraps import get_user
 from controllers.inner_api.wraps import plugin_inner_api_only
 from services.agent_drive_service import (
     AgentDriveError,
@@ -56,6 +59,24 @@ class AgentDriveManifestApi(Resource):
         return {"items": items}
 
 
+@inner_api_ns.route("/drive/<string:drive_ref>/skills")
+class AgentDriveSkillsApi(Resource):
+    @setup_required
+    @plugin_inner_api_only
+    @inner_api_ns.doc("agent_drive_skills")
+    @inner_api_ns.doc(description="List the skill catalog of an agent drive")
+    def get(self, drive_ref: str):
+        try:
+            agent_id = parse_agent_drive_ref(drive_ref)
+            tenant_id = (request.args.get("tenant_id") or "").strip()
+            if not tenant_id:
+                raise AgentDriveError("missing_tenant_id", "tenant_id is required", status_code=400)
+            items = AgentDriveService().list_skills(tenant_id=tenant_id, agent_id=agent_id)
+        except AgentDriveError as exc:
+            return _error_response(exc)
+        return {"items": items}
+
+
 @inner_api_ns.route("/drive/<string:drive_ref>/commit")
 class AgentDriveCommitApi(Resource):
     @setup_required
@@ -69,9 +90,10 @@ class AgentDriveCommitApi(Resource):
                 body = _CommitRequest.model_validate(request.get_json(silent=True) or {})
             except ValidationError as exc:
                 raise AgentDriveError("invalid_request", str(exc), status_code=400) from exc
+            user = get_user(body.tenant_id, body.user_id)
             items = AgentDriveService().commit(
                 tenant_id=body.tenant_id,
-                user_id=body.user_id,
+                user_id=user.id,
                 agent_id=agent_id,
                 items=body.items,
             )
diff --git a/api/controllers/inner_api/workspace/workspace.py b/api/controllers/inner_api/workspace/workspace.py
index ef0a46db63a..dd93616e6b1 100644
--- a/api/controllers/inner_api/workspace/workspace.py
+++ b/api/controllers/inner_api/workspace/workspace.py
@@ -48,7 +48,7 @@ class EnterpriseWorkspace(Resource):
             return {"message": "owner account not found."}, 404
 
         tenant = TenantService.create_tenant(args.name, is_from_dashboard=True)
-        TenantService.create_tenant_member(tenant, account, role="owner")
+        TenantService.create_tenant_member(tenant, account, db.session, role="owner")
 
         tenant_was_created.send(tenant)
 
diff --git a/api/controllers/openapi/__init__.py b/api/controllers/openapi/__init__.py
index e8406ea00cb..c11019cf627 100644
--- a/api/controllers/openapi/__init__.py
+++ b/api/controllers/openapi/__init__.py
@@ -31,7 +31,7 @@ from controllers.openapi._models import (
     AppDslExportQuery,
     AppDslExportResponse,
     AppDslImportPayload,
-    AppInfoResponse,
+    AppInfo,
     AppListQuery,
     AppListResponse,
     AppListRow,
@@ -62,7 +62,6 @@ from controllers.openapi._models import (
     SessionListQuery,
     SessionListResponse,
     SessionRow,
-    TagItem,
     TaskStopResponse,
     UsageInfo,
     WorkflowRunData,
@@ -96,12 +95,11 @@ register_response_schema_models(
     openapi_ns,
     ErrorBody,
     EventStreamResponse,
-    TagItem,
     UsageInfo,
     MessageMetadata,
     AppListRow,
     AppListResponse,
-    AppInfoResponse,
+    AppInfo,
     AppDescribeInfo,
     AppDescribeResponse,
     AppDslExportResponse,
diff --git a/api/controllers/openapi/_errors.py b/api/controllers/openapi/_errors.py
index 38c068bd354..5e82c2614de 100644
--- a/api/controllers/openapi/_errors.py
+++ b/api/controllers/openapi/_errors.py
@@ -63,6 +63,8 @@ class OpenApiErrorCode(StrEnum):
     FILE_EXTENSION_BLOCKED = "file_extension_blocked"
     MEMBER_LIMIT_EXCEEDED = "member_limit_exceeded"
     MEMBER_LICENSE_EXCEEDED = "member_license_exceeded"
+    HUMAN_INPUT_FORM_NOT_FOUND = "form_not_found"
+    RECIPIENT_SURFACE_MISMATCH = "recipient_surface_mismatch"
 
 
 class ErrorDetail(BaseModel):
@@ -239,3 +241,16 @@ class MemberLicenseExceeded(OpenApiError):  # noqa: N818
     error_code = OpenApiErrorCode.MEMBER_LICENSE_EXCEEDED
     description = "Workspace member license capacity reached."
     hint = "Contact your workspace administrator to expand the license seat count."
+
+
+class HumanInputFormNotFound(OpenApiError):  # noqa: N818
+    code = 404
+    error_code = OpenApiErrorCode.HUMAN_INPUT_FORM_NOT_FOUND
+    description = "No human-input form matches this token. It may be wrong, expired, or already submitted."
+
+
+class RecipientSurfaceMismatch(OpenApiError):  # noqa: N818
+    code = 403
+    error_code = OpenApiErrorCode.RECIPIENT_SURFACE_MISMATCH
+    description = "This form's recipient can't be submitted via the OpenAPI surface."
+    hint = "Action it through its channel (web app or console)."
diff --git a/api/controllers/openapi/_models.py b/api/controllers/openapi/_models.py
index 7c225c85f65..6e8a9c9d439 100644
--- a/api/controllers/openapi/_models.py
+++ b/api/controllers/openapi/_models.py
@@ -2,7 +2,8 @@
 
 from __future__ import annotations
 
-from typing import Any, Literal
+from enum import StrEnum
+from typing import Any, Final, Literal
 
 from pydantic import BaseModel, ConfigDict, Field, field_validator, model_validator
 
@@ -13,6 +14,30 @@ from models.model import AppMode
 MAX_PAGE_LIMIT = 200
 
 
+class SupportedAppType(StrEnum):
+    """App types the ``app`` usage face (``get app``) lists and filters.
+
+    A curated subset of :class:`AppMode`: the real, user-facing app categories.
+    Excludes runtime-only mode tags that are not standalone apps
+    (``rag-pipeline`` is a knowledge ``Pipeline``; ``channel`` is unused) and the
+    roster-owned ``agent`` type (surfaced through the roster, not this list).
+
+    Members reference ``AppMode.*.value`` so the subset relationship is
+    type-checked: dropping a member from ``AppMode`` breaks this at import.
+    This is the single source for the listable set — params, filters, and the
+    generated CLI whitelist all derive from it.
+    """
+
+    COMPLETION = AppMode.COMPLETION.value
+    CHAT = AppMode.CHAT.value
+    ADVANCED_CHAT = AppMode.ADVANCED_CHAT.value
+    WORKFLOW = AppMode.WORKFLOW.value
+    AGENT_CHAT = AppMode.AGENT_CHAT.value
+
+
+SUPPORTED_APP_TYPES: Final[tuple[AppMode, ...]] = tuple(AppMode(t.value) for t in SupportedAppType)
+
+
 class UsageInfo(BaseModel):
     prompt_tokens: int = 0
     completion_tokens: int = 0
@@ -38,18 +63,12 @@ class PaginationEnvelope[T](BaseModel):
         return cls(page=page, limit=limit, total=total, has_more=page * limit < total, data=items)
 
 
-class TagItem(BaseModel):
-    name: str
-
-
 class AppListRow(BaseModel):
     id: str
     name: str
     description: str | None = None
     mode: AppMode
-    tags: list[TagItem] = []
     updated_at: str | None = None
-    created_by_name: str | None = None
     workspace_id: str | None = None
     workspace_name: str | None = None
 
@@ -70,16 +89,14 @@ class PermittedExternalAppsListResponse(BaseModel):
     data: list[AppListRow]
 
 
-class AppInfoResponse(BaseModel):
+class AppInfo(BaseModel):
     id: str
     name: str
     description: str | None = None
     mode: str
-    author: str | None = None
-    tags: list[TagItem] = []
 
 
-class AppDescribeInfo(AppInfoResponse):
+class AppDescribeInfo(AppInfo):
     updated_at: str | None = None
     service_api_enabled: bool
     is_agent: bool = False
@@ -287,14 +304,13 @@ class AppDescribeQuery(BaseModel):
 
 
 class AppListQuery(BaseModel):
-    """mode is a closed enum."""
+    """mode is a closed enum of listable app types."""
 
     workspace_id: UUIDStr
     page: int = Field(1, ge=1)
     limit: int = Field(20, ge=1, le=MAX_PAGE_LIMIT)
-    mode: AppMode | None = None
+    mode: SupportedAppType | None = None
     name: str | None = Field(None, max_length=200)
-    tag: str | None = Field(None, max_length=100)
 
 
 class AppRunRequest(BaseModel):
@@ -344,7 +360,7 @@ class PermittedExternalAppsListQuery(BaseModel):
 
     page: int = Field(1, ge=1)
     limit: int = Field(20, ge=1, le=MAX_PAGE_LIMIT)
-    mode: AppMode | None = None
+    mode: SupportedAppType | None = None
     name: str | None = Field(None, max_length=200)
 
 
diff --git a/api/controllers/openapi/app_dsl.py b/api/controllers/openapi/app_dsl.py
index 8a8c62f28ca..9b1abd24bac 100644
--- a/api/controllers/openapi/app_dsl.py
+++ b/api/controllers/openapi/app_dsl.py
@@ -5,11 +5,12 @@ from typing import cast
 from flask_restx import Resource
 from sqlalchemy.orm import Session
 
+from controllers.common.wraps import RBACPermission, RBACResourceScope
 from controllers.openapi import openapi_ns
 from controllers.openapi._contract import accepts, returns
 from controllers.openapi._models import AppDslExportQuery, AppDslExportResponse, AppDslImportPayload
 from controllers.openapi.auth.composition import auth_router
-from controllers.openapi.auth.data import AuthData
+from controllers.openapi.auth.data import AuthData, RBACRequirement
 from extensions.ext_database import db
 from libs.oauth_bearer import Scope, TokenType
 from models import Account, App
@@ -37,6 +38,11 @@ class AppDslImportApi(Resource):
         scope=Scope.WORKSPACE_WRITE,
         allowed_token_types=frozenset({TokenType.OAUTH_ACCOUNT}),
         allowed_roles=frozenset({TenantAccountRole.EDITOR, TenantAccountRole.ADMIN, TenantAccountRole.OWNER}),
+        rbac=RBACRequirement(
+            resource_type=RBACResourceScope.APP,
+            scene=RBACPermission.APP_IMPORT_EXPORT_DSL,
+            resource_required=False,
+        ),
     )
     @returns(200, Import, "Import completed")
     @returns(202, Import, "Import pending confirmation")
@@ -89,6 +95,11 @@ class AppDslImportConfirmApi(Resource):
         scope=Scope.WORKSPACE_WRITE,
         allowed_token_types=frozenset({TokenType.OAUTH_ACCOUNT}),
         allowed_roles=frozenset({TenantAccountRole.EDITOR, TenantAccountRole.ADMIN, TenantAccountRole.OWNER}),
+        rbac=RBACRequirement(
+            resource_type=RBACResourceScope.APP,
+            scene=RBACPermission.APP_IMPORT_EXPORT_DSL,
+            resource_required=False,
+        ),
     )
     @returns(200, Import, "Import confirmed")
     @returns(400, Import, "Import failed")
@@ -125,6 +136,7 @@ class AppDslExportApi(Resource):
         scope=Scope.APPS_READ,
         allowed_token_types=frozenset({TokenType.OAUTH_ACCOUNT}),
         allowed_roles=frozenset({TenantAccountRole.EDITOR, TenantAccountRole.ADMIN, TenantAccountRole.OWNER}),
+        rbac=RBACRequirement(resource_type=RBACResourceScope.APP, scene=RBACPermission.APP_IMPORT_EXPORT_DSL),
     )
     @accepts(query=AppDslExportQuery)
     @returns(200, AppDslExportResponse, "Export successful")
@@ -155,6 +167,7 @@ class AppDslCheckDependenciesApi(Resource):
         scope=Scope.APPS_READ,
         allowed_token_types=frozenset({TokenType.OAUTH_ACCOUNT}),
         allowed_roles=frozenset({TenantAccountRole.EDITOR, TenantAccountRole.ADMIN, TenantAccountRole.OWNER}),
+        rbac=RBACRequirement(resource_type=RBACResourceScope.APP, scene=RBACPermission.APP_IMPORT_EXPORT_DSL),
     )
     @returns(200, CheckDependenciesResult, "Dependencies checked")
     def get(self, app_id: str, *, auth_data: AuthData):
diff --git a/api/controllers/openapi/app_run.py b/api/controllers/openapi/app_run.py
index 76ddd166596..7e77e3aa747 100644
--- a/api/controllers/openapi/app_run.py
+++ b/api/controllers/openapi/app_run.py
@@ -19,12 +19,13 @@ from werkzeug.exceptions import (
 
 import services
 from controllers.common.fields import EventStreamResponse
+from controllers.common.wraps import RBACPermission, RBACResourceScope
 from controllers.openapi import openapi_ns
 from controllers.openapi._audit import emit_app_run
 from controllers.openapi._contract import accepts, returns
 from controllers.openapi._models import AppRunRequest, TaskStopResponse
 from controllers.openapi.auth.composition import auth_router
-from controllers.openapi.auth.data import AuthData
+from controllers.openapi.auth.data import AuthData, RBACRequirement
 from controllers.service_api.app.error import (
     AppUnavailableError,
     CompletionRequestError,
@@ -136,7 +137,10 @@ _DISPATCH: dict[AppMode, Callable[[App, Any, AppRunRequest], Any]] = {
 
 @openapi_ns.route("/apps/<string:app_id>/run")
 class AppRunApi(Resource):
-    @auth_router.guard(scope=Scope.APPS_RUN)
+    @auth_router.guard(
+        scope=Scope.APPS_RUN,
+        rbac=RBACRequirement(resource_type=RBACResourceScope.APP, scene=RBACPermission.APP_TEST_AND_RUN),
+    )
     @openapi_ns.response(200, "Run result (SSE stream)", openapi_ns.models[EventStreamResponse.__name__])
     @accepts(body=AppRunRequest)
     def post(self, app_id: str, *, auth_data: AuthData, body: AppRunRequest):
@@ -167,7 +171,10 @@ class AppRunApi(Resource):
 
 @openapi_ns.route("/apps/<string:app_id>/tasks/<string:task_id>/stop")
 class AppRunTaskStopApi(Resource):
-    @auth_router.guard(scope=Scope.APPS_RUN)
+    @auth_router.guard(
+        scope=Scope.APPS_RUN,
+        rbac=RBACRequirement(resource_type=RBACResourceScope.APP, scene=RBACPermission.APP_TEST_AND_RUN),
+    )
     @returns(200, TaskStopResponse, description="Task stopped")
     def post(self, app_id: str, task_id: str, *, auth_data: AuthData):
         app_model, caller, caller_kind = auth_data.require_app_context()
diff --git a/api/controllers/openapi/apps.py b/api/controllers/openapi/apps.py
index c4796313c0b..181af5c0742 100644
--- a/api/controllers/openapi/apps.py
+++ b/api/controllers/openapi/apps.py
@@ -8,33 +8,41 @@ from typing import Any, cast
 from flask_restx import Resource
 from werkzeug.exceptions import Conflict, NotFound, UnprocessableEntity
 
+from configs import dify_config
+from controllers.common.app_access import AppAccessFilter, resolve_app_access_filter
 from controllers.common.fields import Parameters
+from controllers.common.wraps import RBACPermission, RBACResourceScope
 from controllers.openapi import openapi_ns
 from controllers.openapi._contract import accepts, returns
 from controllers.openapi._input_schema import EMPTY_INPUT_SCHEMA, build_input_schema, resolve_app_config
 from controllers.openapi._models import (
+    SUPPORTED_APP_TYPES,
     AppDescribeInfo,
     AppDescribeQuery,
     AppDescribeResponse,
     AppListQuery,
     AppListResponse,
     AppListRow,
-    TagItem,
 )
 from controllers.openapi.auth.composition import auth_router
-from controllers.openapi.auth.data import AuthData
+from controllers.openapi.auth.data import AuthData, RBACRequirement
 from controllers.service_api.app.error import AppUnavailableError
 from core.app.app_config.common.parameters_mapping import get_parameters_from_feature_dict
 from extensions.ext_database import db
 from libs.oauth_bearer import Scope, TokenType
 from models import App
+from models.model import AppMode
 from services.account_service import TenantService
 from services.app_service import AppListParams, AppService
-from services.tag_service import TagService
 
 _ALLOWED_DESCRIBE_FIELDS: frozenset[str] = frozenset({"info", "parameters", "input_schema"})
 
 
+def _is_listable(app: App) -> bool:
+    """Whether the openapi app face exposes this app (curated, listable types only)."""
+    return app.mode in SUPPORTED_APP_TYPES
+
+
 _EMPTY_PARAMETERS: dict[str, Any] = {
     "opening_statement": None,
     "suggested_questions": [],
@@ -84,54 +92,55 @@ def parameters_payload(app: App) -> dict:
     return Parameters.model_validate(parameters).model_dump(mode="json")
 
 
+def build_app_describe_response(app: App, fields: set[str] | None) -> AppDescribeResponse:
+    """Public projection of an app (name / params / input schema) — never internal config."""
+    want_info = fields is None or "info" in fields
+    want_params = fields is None or "parameters" in fields
+    want_schema = fields is None or "input_schema" in fields
+
+    info = (
+        AppDescribeInfo(
+            id=str(app.id),
+            name=app.name,
+            mode=app.mode,
+            description=app.description,
+            updated_at=app.updated_at.isoformat() if app.updated_at else None,
+            service_api_enabled=bool(app.enable_api),
+            is_agent=app.mode in (AppMode.AGENT_CHAT, AppMode.ADVANCED_CHAT),
+        )
+        if want_info
+        else None
+    )
+
+    parameters: dict[str, Any] | None = None
+    input_schema: dict[str, Any] | None = None
+    if want_params:
+        try:
+            parameters = parameters_payload(app)
+        except AppUnavailableError:
+            parameters = dict(_EMPTY_PARAMETERS)
+    if want_schema:
+        try:
+            input_schema = build_input_schema(app)
+        except AppUnavailableError:
+            input_schema = dict(EMPTY_INPUT_SCHEMA)
+
+    return AppDescribeResponse(info=info, parameters=parameters, input_schema=input_schema)
+
+
 @openapi_ns.route("/apps/<string:app_id>/describe")
 class AppDescribeApi(AppReadResource):
-    @auth_router.guard(scope=Scope.APPS_READ, allowed_token_types=frozenset({TokenType.OAUTH_ACCOUNT}))
+    @auth_router.guard(
+        scope=Scope.APPS_READ,
+        allowed_token_types=frozenset({TokenType.OAUTH_ACCOUNT}),
+        rbac=RBACRequirement(resource_type=RBACResourceScope.APP, scene=RBACPermission.APP_VIEW_LAYOUT),
+    )
     @returns(200, AppDescribeResponse, description="App description")
     @accepts(query=AppDescribeQuery)
     def get(self, app_id: str, *, auth_data: AuthData, query: AppDescribeQuery):
         # describe is UUID-only (workspace_id query param dropped in #37212).
         app = self._load(app_id)
-
-        requested = query.fields
-        want_info = requested is None or "info" in requested
-        want_params = requested is None or "parameters" in requested
-        want_schema = requested is None or "input_schema" in requested
-
-        info = (
-            AppDescribeInfo(
-                id=str(app.id),
-                name=app.name,
-                mode=app.mode,
-                description=app.description,
-                tags=[TagItem(name=t.name) for t in app.tags],
-                author=app.author_name,
-                updated_at=app.updated_at.isoformat() if app.updated_at else None,
-                service_api_enabled=bool(app.enable_api),
-                is_agent=app.mode in ("agent-chat", "advanced-chat"),
-            )
-            if want_info
-            else None
-        )
-
-        parameters: dict[str, Any] | None = None
-        input_schema: dict[str, Any] | None = None
-        if want_params:
-            try:
-                parameters = parameters_payload(app)
-            except AppUnavailableError:
-                parameters = dict(_EMPTY_PARAMETERS)
-        if want_schema:
-            try:
-                input_schema = build_input_schema(app)
-            except AppUnavailableError:
-                input_schema = dict(EMPTY_INPUT_SCHEMA)
-
-        return AppDescribeResponse(
-            info=info,
-            parameters=parameters,
-            input_schema=input_schema,
-        )
+        return build_app_describe_response(app, query.fields)
 
 
 @openapi_ns.route("/apps")
@@ -152,45 +161,57 @@ class AppListApi(Resource):
         else:
             parsed_uuid = None
 
+        # Compute RBAC-accessible app IDs when RBAC is enabled and the caller is an account.
+        # ``None`` means unrestricted (caller can see all apps in the workspace);
+        # an empty set or list means the caller has no accessible apps.
+        # End-users bypass RBAC here — their access is controlled by scope upstream.
+        apply_rbac_filter = (
+            dify_config.RBAC_ENABLED and auth_data.caller_kind != "end_user" and auth_data.account_id is not None
+        )
+        access_filter = AppAccessFilter.unrestricted()
+        if apply_rbac_filter:
+            access_filter = resolve_app_access_filter(workspace_id, str(auth_data.account_id))
+
         tenant_name: str | None = None
         if parsed_uuid is not None:
             app: App | None = AppService.get_visible_app_by_id(db.session, str(parsed_uuid))
             if app is None or str(app.tenant_id) != workspace_id:
                 return empty
+            if not _is_listable(app):
+                return empty
+            # Apply RBAC visibility to the UUID fast-path the same way the service
+            # layer does for paginated queries (id in accessible set OR own app).
+            if apply_rbac_filter and not access_filter.is_app_accessible(
+                str(app.id), str(app.maintainer) if app.maintainer else None, str(auth_data.account_id)
+            ):
+                return empty
             tenant_name = TenantService.get_tenant_name(db.session, workspace_id)
             item = AppListRow(
                 id=str(app.id),
                 name=app.name,
                 description=app.description,
                 mode=app.mode,
-                tags=[TagItem(name=t.name) for t in app.tags],
                 updated_at=app.updated_at.isoformat() if app.updated_at else None,
-                created_by_name=getattr(app, "author_name", None),
                 workspace_id=str(workspace_id),
                 workspace_name=tenant_name,
             )
             env = AppListResponse(page=1, limit=1, total=1, has_more=False, data=[item])
             return env
 
-        tag_ids: list[str] | None = None
-        if query.tag:
-            tags = TagService.get_tag_by_tag_name("app", workspace_id, query.tag, db.session)
-            if not tags:
-                return empty
-            tag_ids = [tag.id for tag in tags]
-
         params = AppListParams(
             page=query.page,
             limit=query.limit,
             mode=query.mode.value if query.mode else "all",  # type:ignore
             name=query.name,
-            tag_ids=tag_ids,
             status="normal",
             # Visibility gate pushed into the query — pagination.total stays
             # consistent across pages because invisible rows never count.
             openapi_visible=True,
         )
 
+        if apply_rbac_filter:
+            access_filter.apply_to_params(params)
+
         pagination = AppService().get_paginate_apps(str(auth_data.account_id), workspace_id, params, db.session)
         if pagination is None:
             return empty
@@ -205,13 +226,12 @@ class AppListApi(Resource):
                 name=r.name,
                 description=r.description,
                 mode=r.mode,
-                tags=[TagItem(name=t.name) for t in r.tags],
                 updated_at=r.updated_at.isoformat() if r.updated_at else None,
-                created_by_name=getattr(r, "author_name", None),
                 workspace_id=str(workspace_id),
                 workspace_name=tenant_name,
             )
             for r in pagination.items
+            if _is_listable(r)
         ]
 
         env = AppListResponse(
diff --git a/api/controllers/openapi/apps_permitted_external.py b/api/controllers/openapi/apps_permitted_external.py
index 0e889a2951c..9bc400e5cc7 100644
--- a/api/controllers/openapi/apps_permitted_external.py
+++ b/api/controllers/openapi/apps_permitted_external.py
@@ -8,14 +8,18 @@ EE blueprint chain so this module is unreachable there.
 from __future__ import annotations
 
 from flask_restx import Resource
+from werkzeug.exceptions import NotFound
 
 from controllers.openapi import openapi_ns
 from controllers.openapi._contract import accepts, returns
 from controllers.openapi._models import (
+    AppDescribeQuery,
+    AppDescribeResponse,
     AppListRow,
     PermittedExternalAppsListQuery,
     PermittedExternalAppsListResponse,
 )
+from controllers.openapi.apps import build_app_describe_response
 from controllers.openapi.auth.composition import auth_router
 from controllers.openapi.auth.data import AuthData, Edition
 from extensions.ext_database import db
@@ -67,9 +71,7 @@ class PermittedExternalAppsListApi(Resource):
                     name=app.name,
                     description=app.description,
                     mode=app.mode,
-                    tags=[],  # tenant-scoped; not surfaced cross-tenant
                     updated_at=app.updated_at.isoformat() if app.updated_at else None,
-                    created_by_name=None,  # cross-tenant author leak prevention
                     workspace_id=str(app.tenant_id),
                     workspace_name=tenant.name if tenant else None,
                 )
@@ -82,3 +84,20 @@ class PermittedExternalAppsListApi(Resource):
             data=items,
         )
         return env
+
+
+@openapi_ns.route("/permitted-external-apps/<string:app_id>/describe")
+class PermittedExternalAppDescribeApi(Resource):
+    @auth_router.guard(
+        scope=Scope.APPS_READ_PERMITTED_EXTERNAL,
+        allowed_token_types=frozenset({TokenType.OAUTH_EXTERNAL_SSO}),
+        edition=frozenset({Edition.EE}),
+    )
+    @returns(200, AppDescribeResponse, description="Permitted external app description")
+    @accepts(query=AppDescribeQuery)
+    def get(self, app_id: str, *, auth_data: AuthData, query: AppDescribeQuery):
+        # App already loaded and ACL-checked by the external_sso pipeline; project it.
+        app = auth_data.app
+        if app is None:
+            raise NotFound("app not found")
+        return build_app_describe_response(app, query.fields)
diff --git a/api/controllers/openapi/auth/composition.py b/api/controllers/openapi/auth/composition.py
index 66f925c8cde..67f7001c080 100644
--- a/api/controllers/openapi/auth/composition.py
+++ b/api/controllers/openapi/auth/composition.py
@@ -3,9 +3,11 @@ from __future__ import annotations
 from controllers.openapi.auth.conditions import (
     EDITION_EE,
     HAS_ALLOWED_ROLES,
+    HAS_RBAC,
     LOADED_APP_IS_PRIVATE,
     PATH_HAS_APP_ID,
     WEBAPP_AUTH_ENABLED,
+    WEBAPP_RUN_SCOPED,
     WORKSPACE_MEMBERSHIP_REQUIRED,
     WORKSPACE_SCOPED,
 )
@@ -25,6 +27,7 @@ from controllers.openapi.auth.verify import (
     check_acl,
     check_app_api_enabled,
     check_private_app_permission,
+    check_rbac_permission,
     check_scope,
     check_workspace_member,
     check_workspace_mismatch,
@@ -47,8 +50,9 @@ account_pipeline = AuthPipeline(
         When(WORKSPACE_SCOPED, then=check_workspace_member),
         When(PATH_HAS_APP_ID, then=check_workspace_mismatch),
         When(HAS_ALLOWED_ROLES, then=check_workspace_role),
-        When(PATH_HAS_APP_ID & EDITION_EE & WEBAPP_AUTH_ENABLED, then=check_acl),
-        When(EDITION_EE & LOADED_APP_IS_PRIVATE, then=check_private_app_permission),
+        When(HAS_RBAC, then=check_rbac_permission),
+        When(PATH_HAS_APP_ID & EDITION_EE & WEBAPP_AUTH_ENABLED & WEBAPP_RUN_SCOPED, then=check_acl),
+        When(EDITION_EE & LOADED_APP_IS_PRIVATE & WEBAPP_RUN_SCOPED, then=check_private_app_permission),
     ],
 )
 
diff --git a/api/controllers/openapi/auth/conditions.py b/api/controllers/openapi/auth/conditions.py
index 5ad15e5e41c..73a767b8d8e 100644
--- a/api/controllers/openapi/auth/conditions.py
+++ b/api/controllers/openapi/auth/conditions.py
@@ -3,7 +3,7 @@ from __future__ import annotations
 from collections.abc import Callable
 
 from controllers.openapi.auth.data import AuthData, Edition, RequestContext, current_edition
-from libs.oauth_bearer import TokenType
+from libs.oauth_bearer import Scope, TokenType
 from services.enterprise.enterprise_service import WebAppAccessMode
 from services.feature_service import FeatureService
 
@@ -50,8 +50,11 @@ EDITION_SAAS = config_cond(lambda: current_edition() == Edition.SAAS)
 
 WEBAPP_AUTH_ENABLED = config_cond(lambda: FeatureService.get_system_features().webapp_auth.enabled)
 
+WEBAPP_RUN_SCOPED = request_cond(lambda ctx: ctx.scope == Scope.APPS_RUN)
+
 WORKSPACE_MEMBERSHIP_REQUIRED = request_cond(lambda ctx: ctx.workspace_membership)
 HAS_ALLOWED_ROLES = request_cond(lambda ctx: ctx.allowed_roles is not None)
+HAS_RBAC = request_cond(lambda ctx: ctx.rbac is not None)
 
 # Caller must belong to the resolved tenant: either an app-scoped path (tenant
 # from the app) or an explicit workspace-membership path (tenant from request).
diff --git a/api/controllers/openapi/auth/data.py b/api/controllers/openapi/auth/data.py
index 76b0d90cb45..9aefef0061c 100644
--- a/api/controllers/openapi/auth/data.py
+++ b/api/controllers/openapi/auth/data.py
@@ -8,6 +8,7 @@ from pydantic import BaseModel, ConfigDict, Field
 from werkzeug.exceptions import InternalServerError
 
 from configs import dify_config
+from core.rbac import RBACPermission, RBACResourceScope
 from libs.oauth_bearer import Scope, TokenType
 from models.account import Account, Tenant, TenantAccountRole
 from models.model import App, EndUser
@@ -35,6 +36,14 @@ class ExternalIdentity(BaseModel):
     issuer: str | None = None
 
 
+class RBACRequirement(BaseModel):
+    model_config = ConfigDict(frozen=True)
+
+    resource_type: RBACResourceScope
+    scene: RBACPermission
+    resource_required: bool = True
+
+
 class RequestContext(BaseModel):
     model_config = ConfigDict(frozen=True)
 
@@ -43,6 +52,7 @@ class RequestContext(BaseModel):
     path_params: dict[str, str]
     workspace_membership: bool = False
     allowed_roles: frozenset[TenantAccountRole] | None = None
+    rbac: RBACRequirement | None = None
 
 
 class AuthData(BaseModel):
@@ -59,6 +69,7 @@ class AuthData(BaseModel):
     path_params: dict[str, str] = Field(default_factory=dict)
 
     allowed_roles: frozenset[TenantAccountRole] | None = None
+    rbac: RBACRequirement | None = None
 
     app: App | None = None
     tenant: Tenant | None = None
diff --git a/api/controllers/openapi/auth/pipeline.py b/api/controllers/openapi/auth/pipeline.py
index 488a971b1e0..3e0aca53d3c 100644
--- a/api/controllers/openapi/auth/pipeline.py
+++ b/api/controllers/openapi/auth/pipeline.py
@@ -21,6 +21,7 @@ from controllers.openapi.auth.data import (
     AuthData,
     Edition,
     ExternalIdentity,
+    RBACRequirement,
     RequestContext,
     current_edition,
 )
@@ -59,6 +60,7 @@ class AuthPipeline:
         scope: Scope | None,
         workspace_membership: bool = False,
         allowed_roles: frozenset[TenantAccountRole] | None = None,
+        rbac: RBACRequirement | None = None,
     ) -> Any:
         req_ctx = RequestContext(
             token_type=identity.token_type,
@@ -66,6 +68,7 @@ class AuthPipeline:
             path_params=dict(request.view_args or {}),
             workspace_membership=workspace_membership,
             allowed_roles=allowed_roles,
+            rbac=rbac,
         )
 
         data = AuthData(
@@ -77,6 +80,7 @@ class AuthPipeline:
             tenants=dict(identity.verified_tenants),
             required_scope=scope,
             allowed_roles=allowed_roles,
+            rbac=rbac,
             path_params=dict(req_ctx.path_params),
             external_identity=(
                 ExternalIdentity(email=identity.subject_email, issuer=identity.subject_issuer)
@@ -129,6 +133,7 @@ class PipelineRouter:
         edition: frozenset[Edition] | None = None,
         workspace_membership: bool = False,
         allowed_roles: frozenset[TenantAccountRole] | None = None,
+        rbac: RBACRequirement | None = None,
     ) -> Callable:
         return self._make_decorator(
             scope=scope,
@@ -136,6 +141,7 @@ class PipelineRouter:
             edition=edition,
             workspace_membership=workspace_membership,
             allowed_roles=allowed_roles,
+            rbac=rbac,
         )
 
     def guard_workspace(
@@ -145,6 +151,7 @@ class PipelineRouter:
         allowed_token_types: frozenset[TokenType] | None = None,
         edition: frozenset[Edition] | None = None,
         allowed_roles: frozenset[TenantAccountRole] | None = None,
+        rbac: RBACRequirement | None = None,
     ) -> Callable:
         return self._make_decorator(
             scope=scope,
@@ -152,6 +159,7 @@ class PipelineRouter:
             edition=edition,
             workspace_membership=True,
             allowed_roles=allowed_roles,
+            rbac=rbac,
         )
 
     def _make_decorator(
@@ -162,6 +170,7 @@ class PipelineRouter:
         edition: frozenset[Edition] | None,
         workspace_membership: bool,
         allowed_roles: frozenset[TenantAccountRole] | None,
+        rbac: RBACRequirement | None,
     ) -> Callable:
         def decorator(view: Callable) -> Callable:
             @wraps(view)
@@ -175,6 +184,7 @@ class PipelineRouter:
                     edition=edition,
                     workspace_membership=workspace_membership,
                     allowed_roles=allowed_roles,
+                    rbac=rbac,
                 )
 
             return decorated
@@ -192,6 +202,7 @@ class PipelineRouter:
         edition: frozenset[Edition] | None,
         workspace_membership: bool = False,
         allowed_roles: frozenset[TenantAccountRole] | None = None,
+        rbac: RBACRequirement | None = None,
     ) -> Any:
         # 404 not 403 — this edition doesn't expose the feature at all
         if edition is not None and current_edition() not in edition:
@@ -235,6 +246,7 @@ class PipelineRouter:
             scope=scope,
             workspace_membership=workspace_membership,
             allowed_roles=allowed_roles,
+            rbac=rbac,
         )
 
 
diff --git a/api/controllers/openapi/auth/surface_gate.py b/api/controllers/openapi/auth/surface_gate.py
index 49485fb28c9..f3d2d0735bb 100644
--- a/api/controllers/openapi/auth/surface_gate.py
+++ b/api/controllers/openapi/auth/surface_gate.py
@@ -74,12 +74,13 @@ def accept_subjects(*accepted: SubjectType) -> Callable[[F], F]:
 
 
 def _coerce_subject_type(raw: object) -> SubjectType | None:
-    if raw is None:
-        return None
-    if isinstance(raw, SubjectType):
-        return raw
-    if isinstance(raw, str):
-        return SubjectType(raw)
+    match raw:
+        case None:
+            return None
+        case SubjectType():
+            return raw
+        case str():
+            return SubjectType(raw)
     return None
 
 
diff --git a/api/controllers/openapi/auth/verify.py b/api/controllers/openapi/auth/verify.py
index 8cd7a30f5e9..1323d142fb1 100644
--- a/api/controllers/openapi/auth/verify.py
+++ b/api/controllers/openapi/auth/verify.py
@@ -3,6 +3,8 @@ from __future__ import annotations
 from flask import request
 from werkzeug.exceptions import Forbidden, NotFound, UnprocessableEntity
 
+from configs import dify_config
+from controllers.common.wraps import enforce_rbac_access
 from controllers.openapi.auth.data import AuthData
 from extensions.ext_database import db
 from libs.oauth_bearer import Scope, TokenType
@@ -38,6 +40,9 @@ def check_workspace_mismatch(data: AuthData) -> None:
 
 
 def check_workspace_role(data: AuthData) -> None:
+    if dify_config.RBAC_ENABLED and data.rbac is not None:
+        # fine-grained permission check is performed by RBAC
+        return
     if data.allowed_roles is None:
         return
     if data.tenant_role is None:
@@ -46,6 +51,27 @@ def check_workspace_role(data: AuthData) -> None:
         raise Forbidden("insufficient workspace role")
 
 
+def check_rbac_permission(data: AuthData) -> None:
+    req = data.rbac
+    if req is None:
+        return
+    if not dify_config.RBAC_ENABLED:
+        return
+    # Only account callers are subject to RBAC; end_user access is scope-controlled.
+    if data.caller_kind != "account":
+        return
+    if data.account_id is None or data.tenant is None:
+        raise Forbidden("rbac context missing")
+    enforce_rbac_access(
+        tenant_id=str(data.tenant.id),
+        account_id=str(data.account_id),
+        resource_type=req.resource_type,
+        scene=req.scene,
+        resource_required=req.resource_required,
+        path_args=dict(data.path_params),
+    )
+
+
 def check_app_api_enabled(data: AuthData) -> None:
     if data.app is None:
         return
diff --git a/api/controllers/openapi/human_input_form.py b/api/controllers/openapi/human_input_form.py
index 995315150cc..223f748613b 100644
--- a/api/controllers/openapi/human_input_form.py
+++ b/api/controllers/openapi/human_input_form.py
@@ -12,16 +12,21 @@ import logging
 
 from flask import Response
 from flask_restx import Resource
-from werkzeug.exceptions import BadRequest, NotFound
+from werkzeug.exceptions import BadRequest
 
 from controllers.common.human_input import HumanInputFormSubmitPayload, stringify_form_default_values
 from controllers.common.schema import register_schema_models
+from controllers.common.wraps import RBACPermission, RBACResourceScope
 from controllers.openapi import openapi_ns
 from controllers.openapi._contract import accepts, returns
+from controllers.openapi._errors import HumanInputFormNotFound, RecipientSurfaceMismatch
 from controllers.openapi._models import FormSubmitResponse, HumanInputFormDefinitionResponse
 from controllers.openapi.auth.composition import auth_router
-from controllers.openapi.auth.data import AuthData
-from core.workflow.human_input_policy import HumanInputSurface, is_recipient_type_allowed_for_surface
+from controllers.openapi.auth.data import AuthData, RBACRequirement
+from core.workflow.human_input_policy import (
+    HumanInputSurface,
+    is_recipient_type_allowed_for_surface,
+)
 from extensions.ext_database import db
 from libs.helper import to_timestamp
 from libs.oauth_bearer import Scope
@@ -47,31 +52,37 @@ def _jsonify_form_definition(form) -> Response:
 
 def _ensure_form_belongs_to_app(form, app_model: App) -> None:
     if form.app_id != app_model.id or form.tenant_id != app_model.tenant_id:
-        raise NotFound("Form not found")
+        raise HumanInputFormNotFound()
 
 
 def _ensure_form_is_allowed_for_openapi(form) -> None:
     if not is_recipient_type_allowed_for_surface(form.recipient_type, HumanInputSurface.OPENAPI):
-        raise NotFound("Form not found")
+        raise RecipientSurfaceMismatch()
 
 
 @openapi_ns.route("/apps/<string:app_id>/form/human_input/<string:form_token>")
 class OpenApiWorkflowHumanInputFormApi(Resource):
     @openapi_ns.response(200, "Form definition", openapi_ns.models[HumanInputFormDefinitionResponse.__name__])
-    @auth_router.guard(scope=Scope.APPS_RUN)
+    @auth_router.guard(
+        scope=Scope.APPS_RUN,
+        rbac=RBACRequirement(resource_type=RBACResourceScope.APP, scene=RBACPermission.APP_TEST_AND_RUN),
+    )
     def get(self, app_id: str, form_token: str, *, auth_data: AuthData):
-        app_model, caller, caller_kind = auth_data.require_app_context()
+        app_model, _caller, _caller_kind = auth_data.require_app_context()
         service = HumanInputService(db.engine)
         form = service.get_form_by_token(form_token)
         if form is None:
-            raise NotFound("Form not found")
+            raise HumanInputFormNotFound()
 
         _ensure_form_belongs_to_app(form, app_model)
         _ensure_form_is_allowed_for_openapi(form)
         service.ensure_form_active(form)
         return _jsonify_form_definition(form)
 
-    @auth_router.guard(scope=Scope.APPS_RUN)
+    @auth_router.guard(
+        scope=Scope.APPS_RUN,
+        rbac=RBACRequirement(resource_type=RBACResourceScope.APP, scene=RBACPermission.APP_TEST_AND_RUN),
+    )
     @returns(200, FormSubmitResponse, description="Form submitted")
     @accepts(body=HumanInputFormSubmitPayload)
     def post(self, app_id: str, form_token: str, *, auth_data: AuthData, body: HumanInputFormSubmitPayload):
@@ -80,7 +91,7 @@ class OpenApiWorkflowHumanInputFormApi(Resource):
         service = HumanInputService(db.engine)
         form = service.get_form_by_token(form_token)
         if form is None:
-            raise NotFound("Form not found")
+            raise HumanInputFormNotFound()
 
         _ensure_form_belongs_to_app(form, app_model)
         _ensure_form_is_allowed_for_openapi(form)
@@ -106,6 +117,6 @@ class OpenApiWorkflowHumanInputFormApi(Resource):
                 submission_end_user_id=submission_end_user_id,
             )
         except FormNotFoundError:
-            raise NotFound("Form not found")
+            raise HumanInputFormNotFound()
 
         return FormSubmitResponse()
diff --git a/api/controllers/openapi/workflow_events.py b/api/controllers/openapi/workflow_events.py
index 61ebb3012dc..916c93707dd 100644
--- a/api/controllers/openapi/workflow_events.py
+++ b/api/controllers/openapi/workflow_events.py
@@ -19,9 +19,10 @@ from werkzeug.exceptions import NotFound, UnprocessableEntity
 
 from controllers.common.fields import EventStreamResponse
 from controllers.common.schema import query_params_from_model
+from controllers.common.wraps import RBACPermission, RBACResourceScope
 from controllers.openapi import openapi_ns
 from controllers.openapi.auth.composition import auth_router
-from controllers.openapi.auth.data import AuthData
+from controllers.openapi.auth.data import AuthData, RBACRequirement
 from core.app.apps.advanced_chat.app_generator import AdvancedChatAppGenerator
 from core.app.apps.base_app_generator import BaseAppGenerator
 from core.app.apps.common.workflow_response_converter import WorkflowResponseConverter
@@ -46,7 +47,10 @@ class WorkflowEventsQuery(BaseModel):
 class OpenApiWorkflowEventsApi(Resource):
     @openapi_ns.doc(params=query_params_from_model(WorkflowEventsQuery))
     @openapi_ns.response(200, "SSE event stream", openapi_ns.models[EventStreamResponse.__name__])
-    @auth_router.guard(scope=Scope.APPS_RUN)
+    @auth_router.guard(
+        scope=Scope.APPS_RUN,
+        rbac=RBACRequirement(resource_type=RBACResourceScope.APP, scene=RBACPermission.APP_TEST_AND_RUN),
+    )
     def get(self, app_id: str, task_id: str, *, auth_data: AuthData):
         app_model, caller, caller_kind = auth_data.require_app_context()
         app_mode = AppMode.value_of(app_model.mode)
diff --git a/api/controllers/service_api/app/app.py b/api/controllers/service_api/app/app.py
index d670c7f5a6f..932ec71c769 100644
--- a/api/controllers/service_api/app/app.py
+++ b/api/controllers/service_api/app/app.py
@@ -2,6 +2,7 @@ from typing import Any, cast
 
 from flask_restx import Resource
 from pydantic import Field
+from sqlalchemy import select
 
 from controllers.common.fields import Parameters
 from controllers.common.schema import register_response_schema_models
@@ -9,7 +10,11 @@ from controllers.service_api import service_api_ns
 from controllers.service_api.app.error import AppUnavailableError
 from controllers.service_api.wraps import validate_app_token
 from core.app.app_config.common.parameters_mapping import get_parameters_from_feature_dict
+from core.app.apps.agent_app.app_variable_projection import agent_app_variables_to_user_input_form
+from extensions.ext_database import db
 from fields.base import ResponseModel
+from models.agent import Agent, AgentConfigSnapshot, AgentScope, AgentSource, AgentStatus
+from models.agent_config_entities import AgentSoulConfig
 from models.model import App, AppMode
 from services.app_service import AppService
 
@@ -29,6 +34,40 @@ class AppMetaResponse(ResponseModel):
 register_response_schema_models(service_api_ns, Parameters, AppMetaResponse, AppInfoResponse)
 
 
+def _get_agent_app_feature_dict_and_user_input_form(app_model: App) -> tuple[dict[str, Any], list[dict[str, Any]]]:
+    app_model_config = app_model.app_model_config
+    features_dict = cast(dict[str, Any], app_model_config.to_dict()) if app_model_config is not None else {}
+
+    agent = db.session.scalar(
+        select(Agent)
+        .where(
+            Agent.tenant_id == app_model.tenant_id,
+            Agent.app_id == app_model.id,
+            Agent.scope == AgentScope.ROSTER,
+            Agent.source == AgentSource.AGENT_APP,
+            Agent.status == AgentStatus.ACTIVE,
+        )
+        .limit(1)
+    )
+    if agent is None or not agent.active_config_snapshot_id:
+        raise AppUnavailableError()
+
+    snapshot = db.session.scalar(
+        select(AgentConfigSnapshot)
+        .where(
+            AgentConfigSnapshot.tenant_id == app_model.tenant_id,
+            AgentConfigSnapshot.agent_id == agent.id,
+            AgentConfigSnapshot.id == agent.active_config_snapshot_id,
+        )
+        .limit(1)
+    )
+    if snapshot is None:
+        raise AppUnavailableError()
+
+    agent_soul = AgentSoulConfig.model_validate(snapshot.config_snapshot_dict)
+    return features_dict, agent_app_variables_to_user_input_form(agent_soul.app_variables)
+
+
 @service_api_ns.route("/parameters")
 class AppParameterApi(Resource):
     """Resource for app variables."""
@@ -61,12 +100,16 @@ class AppParameterApi(Resource):
 
         Returns the input form parameters and configuration for the application.
         """
-        if app_model.mode in {AppMode.ADVANCED_CHAT, AppMode.WORKFLOW}:
+        features_dict: dict[str, Any]
+        user_input_form: list[dict[str, Any]]
+        if app_model.mode == AppMode.AGENT:
+            features_dict, user_input_form = _get_agent_app_feature_dict_and_user_input_form(app_model)
+        elif app_model.mode in {AppMode.ADVANCED_CHAT, AppMode.WORKFLOW}:
             workflow = app_model.workflow
             if workflow is None:
                 raise AppUnavailableError()
 
-            features_dict: dict[str, Any] = workflow.features_dict
+            features_dict = workflow.features_dict
             user_input_form = workflow.user_input_form(to_old_structure=True)
         else:
             app_model_config = app_model.app_model_config
diff --git a/api/controllers/web/saved_message.py b/api/controllers/web/saved_message.py
index e3baa028e50..6e59a85e2b0 100644
--- a/api/controllers/web/saved_message.py
+++ b/api/controllers/web/saved_message.py
@@ -9,6 +9,7 @@ from controllers.common.schema import query_params_from_model, register_response
 from controllers.web import web_ns
 from controllers.web.error import NotCompletionAppError
 from controllers.web.wraps import WebApiResource
+from extensions.ext_database import db
 from fields.conversation_fields import ResultResponse
 from fields.message_fields import SavedMessageInfiniteScrollPagination, SavedMessageItem
 from models.model import App, EndUser
@@ -42,7 +43,9 @@ class SavedMessageListApi(WebApiResource):
         raw_args = request.args.to_dict()
         query = SavedMessageListQuery.model_validate(raw_args)
 
-        pagination = SavedMessageService.pagination_by_last_id(app_model, end_user, query.last_id, query.limit)
+        pagination = SavedMessageService.pagination_by_last_id(
+            db.session(), app_model, end_user, query.last_id, query.limit
+        )
         adapter = TypeAdapter(SavedMessageItem)
         items = [adapter.validate_python(message, from_attributes=True) for message in pagination.data]
         return SavedMessageInfiniteScrollPagination(
@@ -77,7 +80,7 @@ class SavedMessageListApi(WebApiResource):
         payload = SavedMessageCreatePayload.model_validate(web_ns.payload or {})
 
         try:
-            SavedMessageService.save(app_model, end_user, payload.message_id)
+            SavedMessageService.save(db.session(), app_model, end_user, payload.message_id)
         except MessageNotExistsError:
             raise NotFound("Message Not Exists.")
 
@@ -105,6 +108,6 @@ class SavedMessageApi(WebApiResource):
         if app_model.mode != "completion":
             raise NotCompletionAppError()
 
-        SavedMessageService.delete(app_model, end_user, message_id_str)
+        SavedMessageService.delete(db.session(), app_model, end_user, message_id_str)
 
         return "", 204
diff --git a/api/core/app/app_config/easy_ui_based_app/dataset/manager.py b/api/core/app/app_config/easy_ui_based_app/dataset/manager.py
index 3d857a4e9c0..be538455afb 100644
--- a/api/core/app/app_config/easy_ui_based_app/dataset/manager.py
+++ b/api/core/app/app_config/easy_ui_based_app/dataset/manager.py
@@ -213,6 +213,11 @@ class DatasetConfigManager:
             PlanningStrategy.REACT_ROUTER,
         }:
             for tool in config.get("agent_mode", {}).get("tools", []):
+                if not tool:
+                    # Skip malformed empty tool entries; list(tool.keys())[0]
+                    # would otherwise raise IndexError. The sibling convert()
+                    # already guards this with `if len(tool) == 1`.
+                    continue
                 key = list(tool.keys())[0]
                 if key == "dataset":
                     # old style, use tool name as key
diff --git a/api/core/app/apps/advanced_chat/app_runner.py b/api/core/app/apps/advanced_chat/app_runner.py
index 256521ab654..67397965384 100644
--- a/api/core/app/apps/advanced_chat/app_runner.py
+++ b/api/core/app/apps/advanced_chat/app_runner.py
@@ -4,7 +4,7 @@ from collections.abc import Mapping, Sequence
 from typing import Any, cast
 
 from sqlalchemy import select
-from sqlalchemy.orm import Session, sessionmaker
+from sqlalchemy.orm import Session
 
 from core.app.apps.advanced_chat.app_config_manager import AdvancedChatAppConfig
 from core.app.apps.base_app_queue_manager import AppQueueManager
@@ -22,7 +22,7 @@ from core.app.entities.queue_entities import (
 from core.app.features.annotation_reply.annotation_reply import AnnotationReplyFeature
 from core.app.layers.conversation_variable_persist_layer import ConversationVariablePersistenceLayer
 from core.app.workflow.layers.persistence import PersistenceWorkflowInfo, WorkflowPersistenceLayer
-from core.db.session_factory import session_factory
+from core.db.session_factory import create_session, session_factory
 from core.moderation.base import ModerationError
 from core.moderation.input_moderation import InputModeration
 from core.repositories.factory import WorkflowExecutionRepository, WorkflowNodeExecutionRepository
@@ -107,7 +107,7 @@ class AdvancedChatAppRunner(WorkflowBasedAppRunner):
             workflow_execution_id=self.application_generate_entity.workflow_run_id,
         )
 
-        with Session(db.engine, expire_on_commit=False) as session:
+        with create_session() as session:
             app_record = session.scalar(select(App).where(App.id == app_config.app_id))
 
         if not app_record:
@@ -204,6 +204,8 @@ class AdvancedChatAppRunner(WorkflowBasedAppRunner):
                 trace_session_id=self.application_generate_entity.extras.get("trace_session_id"),
             )
 
+        # Release the Flask scoped session before workflow execution so a checked-out DB connection
+        # is not held for the lifetime of the graph run.
         db.session.close()
 
         # RUN WORKFLOW
@@ -368,7 +370,7 @@ class AdvancedChatAppRunner(WorkflowBasedAppRunner):
 
         :return: List of conversation variables ready for use
         """
-        with sessionmaker(bind=db.engine).begin() as session:
+        with create_session() as session, session.begin():
             existing_variables = self._load_existing_conversation_variables(session)
 
             if not existing_variables:
diff --git a/api/core/app/apps/agent_app/app_config_manager.py b/api/core/app/apps/agent_app/app_config_manager.py
index 6721f8bcb1c..0dc04735cc0 100644
--- a/api/core/app/apps/agent_app/app_config_manager.py
+++ b/api/core/app/apps/agent_app/app_config_manager.py
@@ -21,6 +21,7 @@ from core.app.app_config.entities import (
     EasyUIBasedAppModelConfigFrom,
     PromptTemplateEntity,
 )
+from core.app.apps.agent_app.app_variable_projection import agent_app_variables_to_user_input_form
 from models.agent_config_entities import AgentSoulConfig
 from models.model import App, AppMode, AppModelConfig, AppModelConfigDict, Conversation
 
@@ -98,8 +99,7 @@ class AgentAppConfigManager(BaseAppConfigManager):
         # pipeline's bookkeeping (token counting, persistence).
         base["prompt_type"] = PromptTemplateEntity.PromptType.SIMPLE.value
         base["pre_prompt"] = agent_soul.prompt.system_prompt or ""
-        # Agent App takes the user message directly; no completion-style inputs form.
-        base.setdefault("user_input_form", [])
+        base["user_input_form"] = agent_app_variables_to_user_input_form(agent_soul.app_variables)
         return base
 
 
diff --git a/api/core/app/apps/agent_app/app_variable_projection.py b/api/core/app/apps/agent_app/app_variable_projection.py
new file mode 100644
index 00000000000..0feea12f5b8
--- /dev/null
+++ b/api/core/app/apps/agent_app/app_variable_projection.py
@@ -0,0 +1,37 @@
+from __future__ import annotations
+
+from collections.abc import Sequence
+from typing import Any
+
+from models.agent_config_entities import AppVariableConfig
+
+
+def agent_app_variables_to_user_input_form(app_variables: Sequence[AppVariableConfig]) -> list[dict[str, Any]]:
+    """Project Agent Soul app variables into the legacy service-API parameter form."""
+
+    user_input_form: list[dict[str, Any]] = []
+    for variable in app_variables:
+        form_type = _form_type_for_agent_variable(variable.type)
+        form_item: dict[str, Any] = {
+            "label": variable.name,
+            "variable": variable.name,
+            "required": variable.required,
+        }
+        if variable.default is not None:
+            form_item["default"] = variable.default
+        user_input_form.append({form_type: form_item})
+    return user_input_form
+
+
+def _form_type_for_agent_variable(variable_type: str) -> str:
+    normalized = variable_type.strip().lower()
+    if normalized in {"number", "integer", "float"}:
+        return "number"
+    if normalized in {"boolean", "bool"}:
+        return "checkbox"
+    if normalized in {"paragraph", "long_text", "multiline"}:
+        return "paragraph"
+    return "text-input"
+
+
+__all__ = ["agent_app_variables_to_user_input_form"]
diff --git a/api/core/app/apps/agent_app/runtime_request_builder.py b/api/core/app/apps/agent_app/runtime_request_builder.py
index 01206b12db6..fc1fcb0b168 100644
--- a/api/core/app/apps/agent_app/runtime_request_builder.py
+++ b/api/core/app/apps/agent_app/runtime_request_builder.py
@@ -37,6 +37,7 @@ from core.workflow.nodes.agent_v2.plugin_tools_builder import (
 from core.workflow.nodes.agent_v2.runtime_request_builder import (
     append_runtime_warnings,
     build_ask_human_layer_config,
+    build_drive_aware_soul_mention_resolver,
     build_drive_layer_config,
     build_knowledge_layer_config,
     build_shell_layer_config,
@@ -123,9 +124,19 @@ class AgentAppRuntimeRequestBuilder:
             }
 
         drive_config = None
+        soul_prompt_resolver = build_soul_mention_resolver(agent_soul)
         if dify_config.AGENT_DRIVE_MANIFEST_ENABLED:
-            drive_config, drive_warnings = build_drive_layer_config(agent_soul, agent_id=context.agent_id)
+            drive_config, drive_warnings = build_drive_layer_config(
+                agent_soul,
+                tenant_id=context.dify_context.tenant_id,
+                agent_id=context.agent_id,
+            )
             append_runtime_warnings(metadata, drive_warnings)
+            soul_prompt_resolver = build_drive_aware_soul_mention_resolver(
+                agent_soul,
+                tenant_id=context.dify_context.tenant_id,
+                agent_id=context.agent_id,
+            )
         knowledge_config = build_knowledge_layer_config(agent_soul)
 
         request = self._request_builder.build_for_agent_app(
@@ -154,9 +165,7 @@ class AgentAppRuntimeRequestBuilder:
                 ),
                 # ENG-616: expand slash-menu mention tokens to canonical names so
                 # no frontend-internal {{#…#}} marker ever reaches the model.
-                agent_soul_prompt=expand_prompt_mentions(
-                    agent_soul.prompt.system_prompt, build_soul_mention_resolver(agent_soul)
-                ).strip()
+                agent_soul_prompt=expand_prompt_mentions(agent_soul.prompt.system_prompt, soul_prompt_resolver).strip()
                 or None,
                 user_prompt=context.user_query,
                 tools=tools_layer,
diff --git a/api/core/app/apps/agent_chat/app_runner.py b/api/core/app/apps/agent_chat/app_runner.py
index cae0eee0df0..5f9c75129b5 100644
--- a/api/core/app/apps/agent_chat/app_runner.py
+++ b/api/core/app/apps/agent_chat/app_runner.py
@@ -12,10 +12,10 @@ from core.app.apps.base_app_queue_manager import AppQueueManager, PublishFrom
 from core.app.apps.base_app_runner import AppRunner
 from core.app.entities.app_invoke_entities import AgentChatAppGenerateEntity
 from core.app.entities.queue_entities import QueueAnnotationReplyEvent
+from core.db.session_factory import create_session
 from core.memory.token_buffer_memory import TokenBufferMemory
 from core.model_manager import ModelInstance
 from core.moderation.base import ModerationError
-from extensions.ext_database import db
 from graphon.model_runtime.entities.llm_entities import LLMMode
 from graphon.model_runtime.entities.model_entities import ModelFeature, ModelPropertyKey
 from graphon.model_runtime.model_providers.base.large_language_model import LargeLanguageModel
@@ -47,7 +47,10 @@ class AgentChatAppRunner(AppRunner):
         app_config = application_generate_entity.app_config
         app_config = cast(AgentChatAppConfig, app_config)
         app_stmt = select(App).where(App.id == app_config.app_id)
-        app_record = db.session.scalar(app_stmt)
+        with create_session() as session:
+            app_record = session.scalar(app_stmt)
+            if app_record:
+                session.expunge(app_record)
         if not app_record:
             raise ValueError("App not found")
 
@@ -185,14 +188,18 @@ class AgentChatAppRunner(AppRunner):
         if {ModelFeature.MULTI_TOOL_CALL, ModelFeature.TOOL_CALL}.intersection(model_schema.features or []):
             agent_entity.strategy = AgentEntity.Strategy.FUNCTION_CALLING
         conversation_stmt = select(Conversation).where(Conversation.id == conversation.id)
-        conversation_result = db.session.scalar(conversation_stmt)
-        if conversation_result is None:
-            raise ValueError("Conversation not found")
         msg_stmt = select(Message).where(Message.id == message.id)
-        message_result = db.session.scalar(msg_stmt)
+        with create_session() as session:
+            conversation_result = session.scalar(conversation_stmt)
+            if conversation_result is None:
+                raise ValueError("Conversation not found")
+
+            message_result = session.scalar(msg_stmt)
+            if message_result is not None:
+                session.expunge(message_result)
+            session.expunge(conversation_result)
         if message_result is None:
             raise ValueError("Message not found")
-        db.session.close()
 
         runner_cls: type[FunctionCallAgentRunner] | type[CotChatAgentRunner] | type[CotCompletionAgentRunner]
         # start agent runner
diff --git a/api/core/app/apps/chat/app_runner.py b/api/core/app/apps/chat/app_runner.py
index 077c5239f39..9c2eaf60dc7 100644
--- a/api/core/app/apps/chat/app_runner.py
+++ b/api/core/app/apps/chat/app_runner.py
@@ -11,6 +11,7 @@ from core.app.entities.app_invoke_entities import (
 )
 from core.app.entities.queue_entities import QueueAnnotationReplyEvent
 from core.callback_handler.index_tool_callback_handler import DatasetIndexToolCallbackHandler
+from core.db.session_factory import create_session
 from core.memory.token_buffer_memory import TokenBufferMemory
 from core.model_manager import ModelInstance
 from core.moderation.base import ModerationError
@@ -46,7 +47,10 @@ class ChatAppRunner(AppRunner):
         app_config = application_generate_entity.app_config
         app_config = cast(ChatAppConfig, app_config)
         stmt = select(App).where(App.id == app_config.app_id)
-        app_record = db.session.scalar(stmt)
+        with create_session() as session:
+            app_record = session.scalar(stmt)
+            if app_record:
+                session.expunge(app_record)
         if not app_record:
             raise ValueError("App not found")
 
@@ -216,6 +220,8 @@ class ChatAppRunner(AppRunner):
             model=application_generate_entity.model_conf.model,
         )
 
+        # Release the Flask scoped session before LLM streaming so a checked-out DB connection
+        # is not held for the lifetime of the provider response.
         db.session.close()
 
         invoke_result = model_instance.invoke_llm(
diff --git a/api/core/app/apps/common/workflow_response_converter.py b/api/core/app/apps/common/workflow_response_converter.py
index c9486b5821f..67f37e78ab9 100644
--- a/api/core/app/apps/common/workflow_response_converter.py
+++ b/api/core/app/apps/common/workflow_response_converter.py
@@ -51,8 +51,11 @@ from core.tools.entities.tool_entities import ToolProviderType
 from core.tools.tool_manager import ToolManager
 from core.trigger.constants import TRIGGER_PLUGIN_NODE_TYPE
 from core.trigger.trigger_manager import TriggerManager
-from core.workflow.human_input_forms import load_form_tokens_by_form_id
+from core.workflow.human_input_forms import (
+    load_form_dispositions_by_form_id,
+)
 from core.workflow.human_input_policy import (
+    FormDisposition,
     HumanInputSurface,
     enrich_human_input_pause_reasons,
     resolve_human_input_pause_reason_inputs,
@@ -340,13 +343,14 @@ class WorkflowResponseConverter:
         human_input_form_ids = [reason.form_id for reason in resolved_reasons if isinstance(reason, HumanInputRequired)]
         expiration_times_by_form_id: dict[str, datetime] = {}
         display_in_ui_by_form_id: dict[str, bool] = {}
-        form_token_by_form_id: dict[str, str] = {}
+        dispositions_by_form_id: dict[str, FormDisposition] = {}
         if human_input_form_ids:
             stmt = select(
                 HumanInputForm.id,
                 HumanInputForm.expiration_time,
                 HumanInputForm.form_definition,
             ).where(HumanInputForm.id.in_(human_input_form_ids))
+            hitl_surface = _INVOKE_FROM_TO_HITL_SURFACE.get(self._application_generate_entity.invoke_from)
             with Session(bind=db.engine) as session:
                 for form_id, expiration_time, form_definition in session.execute(stmt):
                     expiration_times_by_form_id[str(form_id)] = expiration_time
@@ -355,17 +359,17 @@ class WorkflowResponseConverter:
                     except (TypeError, json.JSONDecodeError):
                         definition_payload = {}
                     display_in_ui_by_form_id[str(form_id)] = bool(definition_payload.get("display_in_ui"))
-                form_token_by_form_id = load_form_tokens_by_form_id(
+                dispositions_by_form_id = load_form_dispositions_by_form_id(
                     human_input_form_ids,
                     session=session,
-                    surface=_INVOKE_FROM_TO_HITL_SURFACE.get(self._application_generate_entity.invoke_from),
+                    surface=hitl_surface,
                 )
 
         # Reconnect paths must preserve the same pause-reason contract as live streams;
         # otherwise clients see schema drift after resume.
         pause_reasons = enrich_human_input_pause_reasons(
             pause_reasons,
-            form_tokens_by_form_id=form_token_by_form_id,
+            dispositions_by_form_id=dispositions_by_form_id,
             expiration_times_by_form_id={
                 form_id: int(expiration_time.timestamp())
                 for form_id, expiration_time in expiration_times_by_form_id.items()
@@ -379,6 +383,7 @@ class WorkflowResponseConverter:
                 expiration_time = expiration_times_by_form_id.get(reason.form_id)
                 if expiration_time is None:
                     raise ValueError(f"HumanInputForm not found for pause reason, form_id={reason.form_id}")
+                disposition = dispositions_by_form_id.get(reason.form_id)
                 responses.append(
                     HumanInputRequiredResponse(
                         task_id=task_id,
@@ -391,7 +396,8 @@ class WorkflowResponseConverter:
                             inputs=reason.inputs,
                             actions=reason.actions,
                             display_in_ui=display_in_ui_by_form_id.get(reason.form_id, False),
-                            form_token=form_token_by_form_id.get(reason.form_id),
+                            form_token=disposition.form_token if disposition else None,
+                            approval_channels=list(disposition.approval_channels) if disposition else [],
                             resolved_default_values=reason.resolved_default_values,
                             expiration_time=int(expiration_time.timestamp()),
                         ),
diff --git a/api/core/app/apps/completion/app_runner.py b/api/core/app/apps/completion/app_runner.py
index 6bb1ecdcb19..38ef672ae22 100644
--- a/api/core/app/apps/completion/app_runner.py
+++ b/api/core/app/apps/completion/app_runner.py
@@ -10,6 +10,7 @@ from core.app.entities.app_invoke_entities import (
     CompletionAppGenerateEntity,
 )
 from core.callback_handler.index_tool_callback_handler import DatasetIndexToolCallbackHandler
+from core.db.session_factory import create_session
 from core.model_manager import ModelInstance
 from core.moderation.base import ModerationError
 from core.rag.retrieval.dataset_retrieval import DatasetRetrieval
@@ -39,7 +40,10 @@ class CompletionAppRunner(AppRunner):
         app_config = application_generate_entity.app_config
         app_config = cast(CompletionAppConfig, app_config)
         stmt = select(App).where(App.id == app_config.app_id)
-        app_record = db.session.scalar(stmt)
+        with create_session() as session:
+            app_record = session.scalar(stmt)
+            if app_record:
+                session.expunge(app_record)
         if not app_record:
             raise ValueError("App not found")
 
@@ -174,6 +178,8 @@ class CompletionAppRunner(AppRunner):
             model=application_generate_entity.model_conf.model,
         )
 
+        # Release the Flask scoped session before LLM streaming so a checked-out DB connection
+        # is not held for the lifetime of the provider response.
         db.session.close()
 
         invoke_result = model_instance.invoke_llm(
diff --git a/api/core/app/apps/message_based_app_queue_manager.py b/api/core/app/apps/message_based_app_queue_manager.py
index 0b97809bf3a..3c7102971f1 100644
--- a/api/core/app/apps/message_based_app_queue_manager.py
+++ b/api/core/app/apps/message_based_app_queue_manager.py
@@ -11,6 +11,7 @@ from core.app.entities.queue_entities import (
     QueueMessageEndEvent,
     QueueStopEvent,
 )
+from models.model import AppMode
 
 
 class MessageBasedAppQueueManager(AppQueueManager):
@@ -47,4 +48,6 @@ class MessageBasedAppQueueManager(AppQueueManager):
             self.stop_listen()
 
         if pub_from == PublishFrom.APPLICATION_MANAGER and self._is_stopped():
+            if self._app_mode == AppMode.ADVANCED_CHAT.value:
+                return
             raise GenerateTaskStoppedError()
diff --git a/api/core/app/apps/pipeline/pipeline_runner.py b/api/core/app/apps/pipeline/pipeline_runner.py
index 2ee0ae27ebc..3ad0990cbb4 100644
--- a/api/core/app/apps/pipeline/pipeline_runner.py
+++ b/api/core/app/apps/pipeline/pipeline_runner.py
@@ -3,6 +3,7 @@ import time
 from typing import cast
 
 from sqlalchemy import select
+from sqlalchemy.orm import Session
 
 from core.app.apps.base_app_queue_manager import AppQueueManager
 from core.app.apps.pipeline.pipeline_config_manager import PipelineConfig
@@ -14,12 +15,12 @@ from core.app.entities.app_invoke_entities import (
     build_dify_run_context,
 )
 from core.app.workflow.layers.persistence import PersistenceWorkflowInfo, WorkflowPersistenceLayer
+from core.db.session_factory import create_session
 from core.repositories.factory import WorkflowExecutionRepository, WorkflowNodeExecutionRepository
 from core.workflow.node_factory import DifyGraphInitContext, DifyNodeFactory, get_default_root_node_id
 from core.workflow.system_variables import build_bootstrap_variables, build_system_variables
 from core.workflow.variable_pool_initializer import add_node_inputs_to_pool, add_variables_to_pool
 from core.workflow.workflow_entry import WorkflowEntry
-from extensions.ext_database import db
 from graphon.enums import WorkflowType
 from graphon.graph import Graph
 from graphon.graph_events import GraphEngineEvent, GraphRunFailedEvent
@@ -83,22 +84,24 @@ class PipelineRunner(WorkflowBasedAppRunner):
         user_from = self._resolve_user_from(invoke_from)
 
         user_id = None
-        if invoke_from in {InvokeFrom.WEB_APP, InvokeFrom.SERVICE_API}:
-            end_user = db.session.get(EndUser, self.application_generate_entity.user_id)
-            if end_user:
-                user_id = end_user.session_id
-        else:
-            user_id = self.application_generate_entity.user_id
+        with create_session() as session:
+            if invoke_from in {InvokeFrom.WEB_APP, InvokeFrom.SERVICE_API}:
+                end_user = session.get(EndUser, self.application_generate_entity.user_id)
+                if end_user:
+                    user_id = end_user.session_id
+            else:
+                user_id = self.application_generate_entity.user_id
 
-        pipeline = db.session.get(Pipeline, app_config.app_id)
-        if not pipeline:
-            raise ValueError("Pipeline not found")
+            pipeline = session.get(Pipeline, app_config.app_id)
+            if not pipeline:
+                raise ValueError("Pipeline not found")
 
-        workflow = self.get_workflow(pipeline=pipeline, workflow_id=app_config.workflow_id)
-        if not workflow:
-            raise ValueError("Workflow not initialized")
+            workflow = self.get_workflow(session=session, pipeline=pipeline, workflow_id=app_config.workflow_id)
+            if not workflow:
+                raise ValueError("Workflow not initialized")
 
-        db.session.close()
+            session.expunge(pipeline)
+            session.expunge(workflow)
 
         # if only single iteration run is requested
         if self.application_generate_entity.single_iteration_run or self.application_generate_entity.single_loop_run:
@@ -208,12 +211,12 @@ class PipelineRunner(WorkflowBasedAppRunner):
             )
             self._handle_event(workflow_entry, event)
 
-    def get_workflow(self, pipeline: Pipeline, workflow_id: str) -> Workflow | None:
+    def get_workflow(self, session: Session, pipeline: Pipeline, workflow_id: str) -> Workflow | None:
         """
         Get workflow
         """
         # fetch workflow by workflow_id
-        workflow = db.session.scalar(
+        workflow = session.scalar(
             select(Workflow)
             .where(Workflow.tenant_id == pipeline.tenant_id, Workflow.app_id == pipeline.id, Workflow.id == workflow_id)
             .limit(1)
@@ -298,11 +301,11 @@ class PipelineRunner(WorkflowBasedAppRunner):
         """
         if isinstance(event, GraphRunFailedEvent):
             if document_id and dataset_id:
-                document = db.session.scalar(
-                    select(Document).where(Document.id == document_id, Document.dataset_id == dataset_id).limit(1)
-                )
-                if document:
-                    document.indexing_status = "error"
-                    document.error = event.error or "Unknown error"
-                    db.session.add(document)
-                    db.session.commit()
+                with create_session() as session, session.begin():
+                    document = session.scalar(
+                        select(Document).where(Document.id == document_id, Document.dataset_id == dataset_id).limit(1)
+                    )
+                    if document:
+                        document.indexing_status = "error"
+                        document.error = event.error or "Unknown error"
+                        session.add(document)
diff --git a/api/core/app/apps/workflow/app_queue_manager.py b/api/core/app/apps/workflow/app_queue_manager.py
index fcdd1465d4f..7824d33b875 100644
--- a/api/core/app/apps/workflow/app_queue_manager.py
+++ b/api/core/app/apps/workflow/app_queue_manager.py
@@ -1,7 +1,6 @@
 from typing import override
 
 from core.app.apps.base_app_queue_manager import AppQueueManager, PublishFrom
-from core.app.apps.exc import GenerateTaskStoppedError
 from core.app.entities.app_invoke_entities import InvokeFrom
 from core.app.entities.queue_entities import (
     AppQueueEvent,
@@ -43,6 +42,3 @@ class WorkflowAppQueueManager(AppQueueManager):
             | QueueWorkflowPartialSuccessEvent,
         ):
             self.stop_listen()
-
-        if pub_from == PublishFrom.APPLICATION_MANAGER and self._is_stopped():
-            raise GenerateTaskStoppedError()
diff --git a/api/core/app/entities/task_entities.py b/api/core/app/entities/task_entities.py
index 803fdacf78d..3a8107e0461 100644
--- a/api/core/app/entities/task_entities.py
+++ b/api/core/app/entities/task_entities.py
@@ -288,6 +288,7 @@ class HumanInputRequiredResponse(StreamResponse):
         actions: Sequence[UserActionConfig] = Field(default_factory=list)
         display_in_ui: bool = False
         form_token: str | None = None
+        approval_channels: list[str] = Field(default_factory=list)
         resolved_default_values: Mapping[str, Any] = Field(default_factory=dict)
         expiration_time: int = Field(..., description="Unix timestamp in seconds")
 
@@ -311,6 +312,7 @@ class HumanInputRequiredPauseReasonPayload(BaseModel):
     actions: Sequence[UserActionConfig] = Field(default_factory=list)
     display_in_ui: bool = False
     form_token: str | None = None
+    approval_channels: list[str] = Field(default_factory=list)
     resolved_default_values: Mapping[str, Any] = Field(default_factory=dict)
     expiration_time: int
 
@@ -325,6 +327,7 @@ class HumanInputRequiredPauseReasonPayload(BaseModel):
             actions=data.actions,
             display_in_ui=data.display_in_ui,
             form_token=data.form_token,
+            approval_channels=data.approval_channels,
             resolved_default_values=data.resolved_default_values,
             expiration_time=data.expiration_time,
         )
diff --git a/api/core/mcp/client/streamable_client.py b/api/core/mcp/client/streamable_client.py
index acba3e666b1..39dc676627e 100644
--- a/api/core/mcp/client/streamable_client.py
+++ b/api/core/mcp/client/streamable_client.py
@@ -14,6 +14,7 @@ from concurrent.futures import ThreadPoolExecutor
 from contextlib import contextmanager
 from dataclasses import dataclass
 from datetime import timedelta
+from http import HTTPStatus
 from typing import Any, cast
 
 import httpx
@@ -293,28 +294,27 @@ class StreamableHTTPTransport:
             json=message.model_dump(by_alias=True, mode="json", exclude_none=True),
             headers=headers,
         ) as response:
-            if response.status_code == 202:
-                logger.debug("Received 202 Accepted")
-                return
-
-            if response.status_code == 204:
-                logger.debug("Received 204 No Content")
-                return
-
-            if response.status_code == 404:
-                if isinstance(message.root, JSONRPCRequest):
-                    error_msg = (
-                        f"MCP server URL returned 404 Not Found: {self.url} "
-                        "— verify the server URL is correct and the server is running"
-                        if is_initialization
-                        else "Session terminated by server"
-                    )
-                    self._send_session_terminated_error(
-                        ctx.server_to_client_queue,
-                        message.root.id,
-                        message=error_msg,
-                    )
-                return
+            match response.status_code:
+                case HTTPStatus.ACCEPTED:
+                    logger.debug("Received 202 Accepted")
+                    return
+                case HTTPStatus.NO_CONTENT:
+                    logger.debug("Received 204 No Content")
+                    return
+                case HTTPStatus.NOT_FOUND:
+                    if isinstance(message.root, JSONRPCRequest):
+                        error_msg = (
+                            f"MCP server URL returned 404 Not Found: {self.url} "
+                            "— verify the server URL is correct and the server is running"
+                            if is_initialization
+                            else "Session terminated by server"
+                        )
+                        self._send_session_terminated_error(
+                            ctx.server_to_client_queue,
+                            message.root.id,
+                            message=error_msg,
+                        )
+                    return
 
             response.raise_for_status()
             if is_initialization:
diff --git a/api/core/plugin/backwards_invocation/app.py b/api/core/plugin/backwards_invocation/app.py
index c76cb865c31..d022b002f72 100644
--- a/api/core/plugin/backwards_invocation/app.py
+++ b/api/core/plugin/backwards_invocation/app.py
@@ -3,7 +3,6 @@ from collections.abc import Generator, Mapping
 from typing import Any, cast
 
 from sqlalchemy import select
-from sqlalchemy.orm import Session
 
 from core.app.app_config.common.parameters_mapping import get_parameters_from_feature_dict
 from core.app.apps.advanced_chat.app_generator import AdvancedChatAppGenerator
@@ -13,10 +12,19 @@ from core.app.apps.completion.app_generator import CompletionAppGenerator
 from core.app.apps.workflow.app_generator import WorkflowAppGenerator
 from core.app.entities.app_invoke_entities import InvokeFrom
 from core.app.layers.pause_state_persist_layer import PauseStateLayerConfig
+from core.db.session_factory import create_session
 from core.plugin.backwards_invocation.base import BaseBackwardsInvocation
 from extensions.ext_database import db
-from models import Account
-from models.model import App, AppMode, EndUser
+from models import Account, TenantAccountJoin
+from models.model import (
+    App,
+    AppMode,
+    AppModelConfig,
+    AppModelConfigDict,
+    EndUser,
+    load_annotation_reply_config,
+)
+from models.workflow import Workflow
 from services.end_user_service import EndUserService
 
 
@@ -30,18 +38,18 @@ class PluginAppBackwardsInvocation(BaseBackwardsInvocation):
 
         """Retrieve app parameters."""
         if app.mode in {AppMode.ADVANCED_CHAT, AppMode.WORKFLOW}:
-            workflow = app.workflow
+            workflow = cls._get_workflow(app)
             if workflow is None:
                 raise ValueError("unexpected app type")
 
             features_dict: dict[str, Any] = workflow.features_dict
             user_input_form = workflow.user_input_form(to_old_structure=True)
         else:
-            app_model_config = app.app_model_config
-            if app_model_config is None:
+            app_model_config_dict = cls._get_app_model_config_dict(app)
+            if app_model_config_dict is None:
                 raise ValueError("unexpected app type")
 
-            features_dict = cast(dict[str, Any], app_model_config.to_dict())
+            features_dict = cast(dict[str, Any], app_model_config_dict)
 
             user_input_form = features_dict.get("user_input_form", [])
 
@@ -68,7 +76,7 @@ class PluginAppBackwardsInvocation(BaseBackwardsInvocation):
         if not user_id:
             user = EndUserService.get_or_create_end_user(app)
         else:
-            user = cls._get_user(user_id)
+            user = cls._get_user(user_id, app)
 
         conversation_id = conversation_id or ""
 
@@ -79,7 +87,10 @@ class PluginAppBackwardsInvocation(BaseBackwardsInvocation):
 
                 return cls.invoke_chat_app(app, user, conversation_id, query, stream, inputs, files)
             case AppMode.WORKFLOW:
-                return cls.invoke_workflow_app(app, user, stream, inputs, files)
+                workflow = cls._get_workflow(app)
+                if not workflow:
+                    raise ValueError("unexpected app type")
+                return cls.invoke_workflow_app(app, workflow, user, stream, inputs, files)
             case AppMode.COMPLETION:
                 return cls.invoke_completion_app(app, user, stream, inputs, files)
             case _:
@@ -101,7 +112,7 @@ class PluginAppBackwardsInvocation(BaseBackwardsInvocation):
         """
         match app.mode:
             case AppMode.ADVANCED_CHAT:
-                workflow = app.workflow
+                workflow = cls._get_workflow(app)
                 if not workflow:
                     raise ValueError("unexpected app type")
 
@@ -158,6 +169,7 @@ class PluginAppBackwardsInvocation(BaseBackwardsInvocation):
     def invoke_workflow_app(
         cls,
         app: App,
+        workflow: Workflow,
         user: EndUser | Account,
         stream: bool,
         inputs: Mapping,
@@ -166,10 +178,6 @@ class PluginAppBackwardsInvocation(BaseBackwardsInvocation):
         """
         invoke workflow app
         """
-        workflow = app.workflow
-        if not workflow:
-            raise ValueError("unexpected app type")
-
         pause_config = PauseStateLayerConfig(
             session_factory=db.engine,
             state_owner_user_id=workflow.created_by,
@@ -207,16 +215,26 @@ class PluginAppBackwardsInvocation(BaseBackwardsInvocation):
         )
 
     @classmethod
-    def _get_user(cls, user_id: str) -> EndUser | Account:
+    def _get_user(cls, user_id: str, app: App) -> EndUser | Account:
         """
         get the user by user id
         """
-        with Session(db.engine, expire_on_commit=False) as session:
-            stmt = select(EndUser).where(EndUser.id == user_id)
+        with create_session() as session:
+            stmt = select(EndUser).where(
+                EndUser.id == user_id,
+                EndUser.tenant_id == app.tenant_id,
+                EndUser.app_id == app.id,
+            )
             user = session.scalar(stmt)
             if not user:
-                stmt = select(Account).where(Account.id == user_id)
+                stmt = select(Account).where(
+                    Account.id == user_id,
+                    Account.id == TenantAccountJoin.account_id,
+                    TenantAccountJoin.tenant_id == app.tenant_id,
+                )
                 user = session.scalar(stmt)
+            if user:
+                session.expunge(user)
 
         if not user:
             raise ValueError("user not found")
@@ -229,7 +247,10 @@ class PluginAppBackwardsInvocation(BaseBackwardsInvocation):
         get app
         """
         try:
-            app = db.session.scalar(select(App).where(App.id == app_id, App.tenant_id == tenant_id).limit(1))
+            with create_session() as session:
+                app = session.scalar(select(App).where(App.id == app_id, App.tenant_id == tenant_id).limit(1))
+                if app:
+                    session.expunge(app)
         except Exception:
             raise ValueError("app not found")
 
@@ -237,3 +258,41 @@ class PluginAppBackwardsInvocation(BaseBackwardsInvocation):
             raise ValueError("app not found")
 
         return app
+
+    @classmethod
+    def _get_workflow(cls, app: App) -> Workflow | None:
+        """
+        get workflow without relying on App.workflow's request-scoped session property
+        """
+        if not app.workflow_id:
+            return None
+
+        with create_session() as session:
+            workflow = session.scalar(
+                select(Workflow)
+                .where(Workflow.id == app.workflow_id, Workflow.tenant_id == app.tenant_id, Workflow.app_id == app.id)
+                .limit(1)
+            )
+            if workflow:
+                session.expunge(workflow)
+            return workflow
+
+    @classmethod
+    def _get_app_model_config_dict(cls, app: App) -> AppModelConfigDict | None:
+        """
+        get app model config features without relying on request-scoped session-backed model properties
+        """
+        if not app.app_model_config_id:
+            return None
+
+        with create_session() as session:
+            app_model_config = session.scalar(
+                select(AppModelConfig)
+                .where(AppModelConfig.id == app.app_model_config_id, AppModelConfig.app_id == app.id)
+                .limit(1)
+            )
+            if app_model_config is None:
+                return None
+
+            annotation_reply = load_annotation_reply_config(session, app_model_config.app_id)
+            return app_model_config.to_dict(annotation_reply=annotation_reply)
diff --git a/api/core/rag/extractor/watercrawl/client.py b/api/core/rag/extractor/watercrawl/client.py
index 1f4adc0d418..51dd26b1ad0 100644
--- a/api/core/rag/extractor/watercrawl/client.py
+++ b/api/core/rag/extractor/watercrawl/client.py
@@ -12,6 +12,14 @@ from core.rag.extractor.watercrawl.exceptions import (
     WaterCrawlPermissionError,
 )
 
+WATERCRAWL_REQUEST_TIMEOUT: httpx.Timeout = httpx.Timeout(30.0, connect=5.0)
+
+# The crawl-status stream is a long-lived SSE connection that can stay open for
+# the whole duration of a crawl, so it keeps an unbounded read while still
+# capping the initial connection. Regular requests use WATERCRAWL_REQUEST_TIMEOUT
+# so a stalled endpoint can't hang a worker forever.
+_STREAM_TIMEOUT = httpx.Timeout(None, connect=10.0)
+
 
 class SpiderOptions(TypedDict):
     max_depth: int
@@ -48,7 +56,9 @@ class BaseAPIClient:
             "User-Agent": "WaterCrawl-Plugin",
             "Accept-Language": "en-US",
         }
-        return httpx.Client(headers=headers, timeout=None)
+        # Regular requests use WATERCRAWL_REQUEST_TIMEOUT; the long-lived
+        # crawl-status stream overrides it with _STREAM_TIMEOUT in _request.
+        return httpx.Client(headers=headers, timeout=WATERCRAWL_REQUEST_TIMEOUT)
 
     def _request(
         self,
@@ -61,7 +71,7 @@ class BaseAPIClient:
         stream = kwargs.pop("stream", False)
         url = urljoin(self.base_url, endpoint)
         if stream:
-            request = self.session.build_request(method, url, params=query_params, json=data)
+            request = self.session.build_request(method, url, params=query_params, json=data, timeout=_STREAM_TIMEOUT)
             return self.session.send(request, stream=True, **kwargs)
 
         return self.session.request(method, url, params=query_params, json=data, **kwargs)
diff --git a/api/core/rbac/entities.py b/api/core/rbac/entities.py
index 7f08a530f57..d65f11edf7b 100644
--- a/api/core/rbac/entities.py
+++ b/api/core/rbac/entities.py
@@ -22,23 +22,35 @@ class RBACPermission(StrEnum):
 
     APP_VIEW_LAYOUT = "app_view_layout"
     APP_TEST_AND_RUN = "app_test_and_run"
+    APP_PREVIEW = "app_preview"
     APP_CREATE_AND_MANAGEMENT = "app_create_and_management"
     APP_RELEASE_AND_VERSION = "app_release_and_version"
     APP_IMPORT_EXPORT_DSL = "app_import_export_dsl"
     APP_EDIT = "app_edit"
     APP_MONITOR = "app_monitor"
     APP_DELETE = "app_delete"
+    APP_ACCESS_CONFIG = "app_access_config"
 
+    DATASET_PREVIEW = "dataset_preview"
     DATASET_READONLY = "dataset_readonly"
     DATASET_EDIT = "dataset_edit"
     DATASET_CREATE_AND_MANAGEMENT = "dataset_create_and_management"
     DATASET_PIPELINE_TEST = "dataset_pipeline_test"
     DATASET_DOCUMENT_DOWNLOAD = "dataset_document_download"
+    DATASET_RETRIEVAL_RECALL = "dataset_retrieval_recall"
+    DATASET_USE = "dataset_use"
+    DATASET_DELETE_FILE = "dataset_delete_file"
+    DATASET_PIPELINE_RELEASE = "dataset_pipeline_release"
+    DATASET_DELETE = "dataset_delete"
+    DATASET_ACCESS_CONFIG = "dataset_access_config"
     DATASET_API_KEY_MANAGE = "dataset_api_key_manage"
     DATASET_EXTERNAL_CONNECT = "dataset_external_connect"
     DATASET_IMPORT_EXPORT_DSL = "dataset_import_export_dsl"
 
+    WORKSPACE_MEMBER_MANAGE = "workspace_member_manage"
     WORKSPACE_ROLE_MANAGE = "workspace_role_manage"
+    API_EXTENSION_MANAGE = "api_extension_manage"
+    CUSTOMIZATION_MANAGE = "customization_manage"
 
     SNIPPETS_CREATE_AND_MODIFY = "snippets_create_and_modify"
     SNIPPETS_MANAGE = "snippets_management"
@@ -49,6 +61,7 @@ class RBACPermission(StrEnum):
     PLUGIN_DEBUG = "plugin_debug"
 
     CREDENTIAL_USE = "credential_use"
+    CREDENTIAL_CREATE = "credential_create"
     CREDENTIAL_MANAGE = "credential_manage"
 
     TOOL_MANAGE = "tool_manage"
diff --git a/api/core/tools/custom_tool/tool.py b/api/core/tools/custom_tool/tool.py
index 2e618b7ea51..3edb04d7b94 100644
--- a/api/core/tools/custom_tool/tool.py
+++ b/api/core/tools/custom_tool/tool.py
@@ -359,15 +359,16 @@ class ApiTool(Tool):
                     if value is None:
                         return None
                 elif property["type"] == "object" or property["type"] == "array":
-                    if isinstance(value, str):
-                        try:
-                            return json.loads(value)
-                        except ValueError:
+                    match value:
+                        case str():
+                            try:
+                                return json.loads(value)
+                            except ValueError:
+                                return value
+                        case dict():
+                            return value
+                        case _:
                             return value
-                    elif isinstance(value, dict):
-                        return value
-                    else:
-                        return value
                 else:
                     raise ValueError(f"Invalid type {property['type']} for property {property}")
             elif "anyOf" in property and isinstance(property["anyOf"], list):
diff --git a/api/core/workflow/human_input_forms.py b/api/core/workflow/human_input_forms.py
index fe3c161a326..b850cd23914 100644
--- a/api/core/workflow/human_input_forms.py
+++ b/api/core/workflow/human_input_forms.py
@@ -12,60 +12,61 @@ from collections.abc import Sequence
 from sqlalchemy import select
 from sqlalchemy.orm import Session
 
-from core.workflow.human_input_policy import HumanInputSurface, get_preferred_form_token
+from core.workflow.human_input_policy import (
+    FormDisposition,
+    HumanInputSurface,
+    disposition_for_surface,
+)
 from extensions.ext_database import db
 from models.human_input import HumanInputFormRecipient, RecipientType
 
 
+def load_form_dispositions_by_form_id(
+    form_ids: Sequence[str],
+    *,
+    session: Session | None = None,
+    surface: HumanInputSurface | None = None,
+) -> dict[str, FormDisposition]:
+    """Resolve each paused form's resume token and approval channels for `surface`."""
+    unique_form_ids = list(dict.fromkeys(form_ids))
+    if not unique_form_ids:
+        return {}
+
+    if session is not None:
+        return _load_form_dispositions_by_form_id(session, unique_form_ids, surface=surface)
+
+    with Session(bind=db.engine, expire_on_commit=False) as new_session:
+        return _load_form_dispositions_by_form_id(new_session, unique_form_ids, surface=surface)
+
+
+def _load_form_dispositions_by_form_id(
+    session: Session,
+    form_ids: Sequence[str],
+    *,
+    surface: HumanInputSurface | None,
+) -> dict[str, FormDisposition]:
+    recipients_by_form_id: dict[str, list[tuple[RecipientType, str]]] = {}
+    stmt = select(HumanInputFormRecipient).where(HumanInputFormRecipient.form_id.in_(form_ids))
+    for recipient in session.scalars(stmt):
+        recipients_by_form_id.setdefault(recipient.form_id, []).append(
+            (recipient.recipient_type, recipient.access_token or "")
+        )
+    return {
+        form_id: disposition_for_surface(recipients, surface=surface)
+        for form_id, recipients in recipients_by_form_id.items()
+    }
+
+
 def load_form_tokens_by_form_id(
     form_ids: Sequence[str],
     *,
     session: Session | None = None,
     surface: HumanInputSurface | None = None,
 ) -> dict[str, str]:
-    """Load the preferred access token for each human input form."""
-    unique_form_ids = list(dict.fromkeys(form_ids))
-    if not unique_form_ids:
-        return {}
-
-    if session is not None:
-        return _load_form_tokens_by_form_id(session, unique_form_ids, surface=surface)
-
-    with Session(bind=db.engine, expire_on_commit=False) as new_session:
-        return _load_form_tokens_by_form_id(new_session, unique_form_ids, surface=surface)
-
-
-def _load_form_tokens_by_form_id(
-    session: Session,
-    form_ids: Sequence[str],
-    *,
-    surface: HumanInputSurface | None = None,
-) -> dict[str, str]:
-    recipients_by_form_id: dict[str, list[tuple[RecipientType, str]]] = {}
-    stmt = select(HumanInputFormRecipient).where(HumanInputFormRecipient.form_id.in_(form_ids))
-    for recipient in session.scalars(stmt):
-        if not recipient.access_token:
-            continue
-        recipients_by_form_id.setdefault(recipient.form_id, []).append(
-            (recipient.recipient_type, recipient.access_token)
-        )
-
-    tokens_by_form_id: dict[str, str] = {}
-    for form_id, recipients in recipients_by_form_id.items():
-        token = _get_surface_form_token(recipients, surface=surface)
-        if token is not None:
-            tokens_by_form_id[form_id] = token
-    return tokens_by_form_id
-
-
-def _get_surface_form_token(
-    recipients: Sequence[tuple[RecipientType, str]],
-    *,
-    surface: HumanInputSurface | None,
-) -> str | None:
-    if surface in {HumanInputSurface.SERVICE_API, HumanInputSurface.OPENAPI}:
-        for recipient_type, token in recipients:
-            if recipient_type == RecipientType.STANDALONE_WEB_APP and token:
-                return token
-
-    return get_preferred_form_token(recipients)
+    """Resume tokens only, for callers that don't surface approval channels."""
+    dispositions = load_form_dispositions_by_form_id(form_ids, session=session, surface=surface)
+    return {
+        form_id: disposition.form_token
+        for form_id, disposition in dispositions.items()
+        if disposition.form_token is not None
+    }
diff --git a/api/core/workflow/human_input_policy.py b/api/core/workflow/human_input_policy.py
index e95d753ae96..d6f7df52354 100644
--- a/api/core/workflow/human_input_policy.py
+++ b/api/core/workflow/human_input_policy.py
@@ -2,14 +2,14 @@ from __future__ import annotations
 
 from collections.abc import Mapping, Sequence
 from enum import StrEnum
-from typing import Any
+from typing import Any, NamedTuple
 
 from graphon.entities.pause_reason import HumanInputRequired, PauseReason, PauseReasonType
 from graphon.nodes.human_input.entities import FormInputConfig, SelectInputConfig
 from graphon.nodes.human_input.enums import ValueSourceType
 from graphon.runtime.graph_runtime_state_protocol import ReadOnlyVariablePool
 from graphon.variables import ArrayStringSegment
-from models.human_input import RecipientType
+from models.human_input import ApprovalChannel, RecipientType
 
 
 class HumanInputSurface(StrEnum):
@@ -20,7 +20,7 @@ class HumanInputSurface(StrEnum):
 
 # SERVICE_API and OPENAPI are intentionally narrower than CONSOLE: token callers
 # should only be able to act on end-user web forms, not internal console flows.
-_ALLOWED_RECIPIENT_TYPES_BY_SURFACE: dict[HumanInputSurface, frozenset[RecipientType]] = {
+ALLOWED_RECIPIENT_TYPES_BY_SURFACE: dict[HumanInputSurface, frozenset[RecipientType]] = {
     HumanInputSurface.SERVICE_API: frozenset({RecipientType.STANDALONE_WEB_APP}),
     HumanInputSurface.CONSOLE: frozenset({RecipientType.CONSOLE, RecipientType.BACKSTAGE}),
     HumanInputSurface.OPENAPI: frozenset({RecipientType.STANDALONE_WEB_APP}),
@@ -41,7 +41,7 @@ def is_recipient_type_allowed_for_surface(
 ) -> bool:
     if recipient_type is None:
         return False
-    return recipient_type in _ALLOWED_RECIPIENT_TYPES_BY_SURFACE[surface]
+    return recipient_type in ALLOWED_RECIPIENT_TYPES_BY_SURFACE[surface]
 
 
 def get_preferred_form_token(
@@ -59,10 +59,39 @@ def get_preferred_form_token(
     return chosen_token
 
 
+class FormDisposition(NamedTuple):
+    """How a paused form resolves for one API surface.
+
+    A form's recipients split into those the surface may act on (yielding a resume
+    `form_token`) and those it may not (their channels named in `approval_channels`
+    so the caller is told where approval actually happens instead).
+    """
+
+    form_token: str | None
+    approval_channels: list[ApprovalChannel]
+
+
+def disposition_for_surface(
+    recipients: Sequence[tuple[RecipientType, str]],
+    *,
+    surface: HumanInputSurface | None,
+) -> FormDisposition:
+    if surface is None:
+        return FormDisposition(form_token=get_preferred_form_token(recipients), approval_channels=[])
+    allowed = ALLOWED_RECIPIENT_TYPES_BY_SURFACE[surface]
+    actionable = [(recipient_type, token) for recipient_type, token in recipients if recipient_type in allowed]
+    return FormDisposition(
+        form_token=get_preferred_form_token(actionable),
+        approval_channels=sorted(
+            {recipient_type.approval_channel for recipient_type, _ in recipients if recipient_type not in allowed}
+        ),
+    )
+
+
 def enrich_human_input_pause_reasons(
     reasons: Sequence[Mapping[str, Any]],
     *,
-    form_tokens_by_form_id: Mapping[str, str],
+    dispositions_by_form_id: Mapping[str, FormDisposition],
     expiration_times_by_form_id: Mapping[str, int],
 ) -> list[dict[str, Any]]:
     enriched: list[dict[str, Any]] = []
@@ -71,7 +100,9 @@ def enrich_human_input_pause_reasons(
         if updated.get("TYPE") == PauseReasonType.HUMAN_INPUT_REQUIRED:
             form_id = updated.get("form_id")
             if isinstance(form_id, str):
-                updated["form_token"] = form_tokens_by_form_id.get(form_id)
+                disposition = dispositions_by_form_id.get(form_id)
+                updated["form_token"] = disposition.form_token if disposition else None
+                updated["approval_channels"] = list(disposition.approval_channels) if disposition else []
                 expiration_time = expiration_times_by_form_id.get(form_id)
                 if expiration_time is not None:
                     updated["expiration_time"] = expiration_time
diff --git a/api/core/workflow/nodes/agent_v2/runtime_feature_manifest.py b/api/core/workflow/nodes/agent_v2/runtime_feature_manifest.py
index 65c5d42e916..fa7b28cbb0a 100644
--- a/api/core/workflow/nodes/agent_v2/runtime_feature_manifest.py
+++ b/api/core/workflow/nodes/agent_v2/runtime_feature_manifest.py
@@ -16,9 +16,6 @@ SUPPORTED_AGENT_BACKEND_FEATURES = frozenset(
         "knowledge",
         "env",
         "sandbox",
-        # ENG-623: exposed at runtime as the dify.drive declaration layer
-        # (an index the agent pulls through the back proxy).
-        "skills_files",
         # ENG-635: human involvement is exposed at runtime as the dify.ask_human
         # deferred tool; a call pauses via the existing HITL form mechanism.
         "human",
@@ -32,11 +29,7 @@ RESERVED_AGENT_BACKEND_FEATURES = frozenset(
 )
 
 
-def build_runtime_feature_manifest(
-    agent_soul: AgentSoulConfig,
-    *,
-    drive_manifest_enabled: bool = False,
-) -> dict[str, Any]:
+def build_runtime_feature_manifest(agent_soul: AgentSoulConfig) -> dict[str, Any]:
     """Describe PRD capabilities supported by or still reserved from Agent backend runtime."""
     warnings: list[dict[str, str]] = []
     soul_dump = agent_soul.model_dump(mode="json", exclude_none=True, exclude_defaults=True)
@@ -54,38 +47,10 @@ def build_runtime_feature_manifest(
                 }
             )
 
-    has_skills_files = bool(agent_soul.skills_files.skills or agent_soul.skills_files.files)
-    if has_skills_files and not drive_manifest_enabled:
-        warnings.append(
-            {
-                "section": "agent_soul.skills_files",
-                "code": "drive_manifest_disabled",
-                "message": (
-                    "skills_files is configured but AGENT_DRIVE_MANIFEST_ENABLED is off; "
-                    "the drive declaration layer is not injected into this run."
-                ),
-            }
-        )
-    for skill in agent_soul.skills_files.skills:
-        if not skill.skill_md_key:
-            warnings.append(
-                {
-                    "section": "agent_soul.skills_files",
-                    "code": "skill_ref_dangling",
-                    "message": (
-                        f"skill_ref_dangling: skill '{skill.name or skill.id or 'unknown'}' has no drive key; "
-                        "re-standardize it to expose it at runtime."
-                    ),
-                }
-            )
-
     reserved_status = dict.fromkeys(sorted(RESERVED_AGENT_BACKEND_FEATURES), "reserved_not_executed")
     reserved_status["knowledge"] = (
         "supported_by_knowledge_layer" if list_configured_knowledge_dataset_ids(agent_soul) else "not_configured"
     )
-    reserved_status["skills_files"] = (
-        "supported_by_drive_manifest" if drive_manifest_enabled else "drive_manifest_disabled"
-    )
     reserved_status["tools.dify_tools"] = "supported_when_config_valid"
     reserved_status["tools.cli_tools"] = "supported_by_shell_bootstrap"
     reserved_status["env"] = "supported_by_shell_bootstrap"
diff --git a/api/core/workflow/nodes/agent_v2/runtime_request_builder.py b/api/core/workflow/nodes/agent_v2/runtime_request_builder.py
index 8aaa4fcc1d3..e3c2dcee839 100644
--- a/api/core/workflow/nodes/agent_v2/runtime_request_builder.py
+++ b/api/core/workflow/nodes/agent_v2/runtime_request_builder.py
@@ -7,7 +7,6 @@ from typing import Any, Literal, Protocol, assert_never, cast
 from agenton.compositor import CompositorSessionSnapshot
 from dify_agent.layers.ask_human import DifyAskHumanLayerConfig
 from dify_agent.layers.drive import (
-    DifyDriveFileConfig,
     DifyDriveLayerConfig,
     DifyDriveSkillConfig,
 )
@@ -55,10 +54,13 @@ from models.agent_config_entities import (
 )
 from models.provider_ids import ModelProviderID
 from services.agent.prompt_mentions import (
+    MentionKind,
     build_node_job_mention_resolver,
     build_soul_mention_resolver,
     expand_prompt_mentions,
+    parse_prompt_mentions,
 )
+from services.agent_drive_service import AgentDriveService, decode_drive_mention_ref
 
 from .output_failure_orchestrator import retry_idempotency_key
 from .plugin_tools_builder import WorkflowAgentPluginToolsBuilder, WorkflowAgentPluginToolsBuildError
@@ -153,9 +155,6 @@ class WorkflowAgentRuntimeRequestBuilder:
             expand_prompt_mentions(node_job.workflow_prompt, build_node_job_mention_resolver(node_job)).strip()
             or "Run this workflow Agent Node for the current run."
         )
-        soul_prompt = expand_prompt_mentions(
-            agent_soul.prompt.system_prompt, build_soul_mention_resolver(agent_soul)
-        ).strip()
         user_prompt = workflow_context_prompt.strip() or "Use the current workflow context."
         credentials = self._credentials_provider.fetch(agent_soul.model.model_provider, agent_soul.model.model)
         try:
@@ -182,9 +181,20 @@ class WorkflowAgentRuntimeRequestBuilder:
             }
 
         drive_config: DifyDriveLayerConfig | None = None
+        soul_prompt_resolver = build_soul_mention_resolver(agent_soul)
         if dify_config.AGENT_DRIVE_MANIFEST_ENABLED:
-            drive_config, drive_warnings = build_drive_layer_config(agent_soul, agent_id=context.agent.id)
+            drive_config, drive_warnings = build_drive_layer_config(
+                agent_soul,
+                tenant_id=context.dify_context.tenant_id,
+                agent_id=context.agent.id,
+            )
             append_runtime_warnings(metadata, drive_warnings)
+            soul_prompt_resolver = build_drive_aware_soul_mention_resolver(
+                agent_soul,
+                tenant_id=context.dify_context.tenant_id,
+                agent_id=context.agent.id,
+            )
+        soul_prompt = expand_prompt_mentions(agent_soul.prompt.system_prompt, soul_prompt_resolver).strip()
         knowledge_config = build_knowledge_layer_config(agent_soul)
 
         request = self._request_builder.build_for_workflow_node(
@@ -292,10 +302,7 @@ class WorkflowAgentRuntimeRequestBuilder:
             "agent_config_snapshot_id": context.snapshot.id,
             "binding_id": context.binding.id,
             "workflow_node_job_mode": node_job.mode.value,
-            "runtime_support": build_runtime_feature_manifest(
-                agent_soul,
-                drive_manifest_enabled=dify_config.AGENT_DRIVE_MANIFEST_ENABLED,
-            ),
+            "runtime_support": build_runtime_feature_manifest(agent_soul),
         }
 
     def _build_workflow_context_prompt(
@@ -603,76 +610,107 @@ def append_runtime_warnings(metadata: dict[str, Any], warnings: list[dict[str, s
             existing.extend(warnings)
 
 
+def build_drive_aware_soul_mention_resolver(
+    agent_soul: AgentSoulConfig,
+    *,
+    tenant_id: str,
+    agent_id: str,
+):
+    """Resolve skill/file mentions against the agent drive and everything else via Agent Soul."""
+
+    base_resolver = build_soul_mention_resolver(agent_soul)
+    drive_service = AgentDriveService()
+    skill_catalog = drive_service.list_skills(tenant_id=tenant_id, agent_id=agent_id)
+    skill_names_by_key = {skill["skill_md_key"]: skill["name"] for skill in skill_catalog}
+    drive_keys = {item["key"] for item in drive_service.manifest(tenant_id=tenant_id, agent_id=agent_id)}
+
+    def _resolve(mention: object) -> str | None:
+        if not hasattr(mention, "kind") or not hasattr(mention, "ref_id"):
+            return None
+        kind = cast(MentionKind, mention.kind)
+        ref_id = cast(str, mention.ref_id)
+        label = cast(str | None, getattr(mention, "label", None))
+        if kind == MentionKind.SKILL:
+            decoded_key = decode_drive_mention_ref(ref_id)
+            return skill_names_by_key.get(decoded_key) or label or decoded_key
+        if kind == MentionKind.FILE:
+            decoded_key = decode_drive_mention_ref(ref_id)
+            if decoded_key in drive_keys:
+                return decoded_key.rsplit("/", 1)[-1]
+            return label or decoded_key
+        return base_resolver(cast(Any, mention))
+
+    return _resolve
+
+
 def build_drive_layer_config(
     agent_soul: AgentSoulConfig,
     *,
+    tenant_id: str,
     agent_id: str | None,
 ) -> tuple[DifyDriveLayerConfig | None, list[dict[str, str]]]:
-    """Catalog the soul's drive-backed Skills & Files into the dify.drive declaration.
+    """Derive drive runtime catalog + prompt-mentioned eager-pull keys from the drive."""
 
-    Returns ``(config, warnings)`` — ``config is None`` means nothing to inject
-    (no skills/files configured, or no agent identity to address the drive by).
-    Refs that predate standardization (no drive key) are skipped with a warning
-    instead of failing the run, so historic souls keep running.
-    """
-    skill_refs = agent_soul.skills_files.skills
-    file_refs = agent_soul.skills_files.files
-    if not skill_refs and not file_refs:
-        return None, []
-
-    warnings: list[dict[str, str]] = []
+    mentioned_drive_refs = [
+        decode_drive_mention_ref(mention.ref_id)
+        for mention in parse_prompt_mentions(agent_soul.prompt.system_prompt)
+        if mention.kind in {MentionKind.SKILL, MentionKind.FILE}
+    ]
+    ordered_mentions = list(dict.fromkeys(ref for ref in mentioned_drive_refs if ref))
     if not agent_id:
+        if not ordered_mentions:
+            return None, []
+        return None, [
+            {
+                "section": "agent_soul.prompt.system_prompt",
+                "code": "drive_ref_dangling",
+                "message": "drive mentions are configured but the run has no bound agent to address a drive by.",
+            }
+        ]
+
+    drive_service = AgentDriveService()
+    skills_catalog = drive_service.list_skills(tenant_id=tenant_id, agent_id=agent_id)
+    manifest_items = drive_service.manifest(tenant_id=tenant_id, agent_id=agent_id)
+    manifest_by_key = {item["key"]: item for item in manifest_items}
+    skill_keys = {skill["skill_md_key"] for skill in skills_catalog}
+    warnings: list[dict[str, str]] = []
+    mentioned_skill_keys: list[str] = []
+    mentioned_file_keys: list[str] = []
+    for drive_key in ordered_mentions:
+        if drive_key in skill_keys:
+            mentioned_skill_keys.append(drive_key)
+            continue
+        if drive_key in manifest_by_key:
+            mentioned_file_keys.append(drive_key)
+            continue
         warnings.append(
             {
-                "section": "agent_soul.skills_files",
-                "code": "skill_ref_dangling",
-                "message": "skills_files is configured but the run has no bound agent to address a drive by.",
+                "section": "agent_soul.prompt.system_prompt",
+                "code": "mention_target_missing",
+                "message": f"drive mention '{drive_key}' has no matching drive entry.",
             }
         )
-        return None, warnings
 
-    skills: list[DifyDriveSkillConfig] = []
-    for skill in skill_refs:
-        if not skill.skill_md_key:
-            warnings.append(
-                {
-                    "section": "agent_soul.skills_files",
-                    "code": "skill_ref_dangling",
-                    "message": (
-                        f"skill_ref_dangling: skill '{skill.name or skill.id or 'unknown'}' has no drive key; "
-                        "re-standardize it to expose it at runtime."
-                    ),
-                }
-            )
-            continue
-        skills.append(
-            DifyDriveSkillConfig(
-                name=skill.name or skill.skill_md_key.split("/", 1)[0],
-                description=skill.description or "",
-                skill_md_key=skill.skill_md_key,
-                archive_key=skill.full_archive_key,
-            )
+    skills = [
+        DifyDriveSkillConfig(
+            path=skill["path"],
+            name=skill["name"],
+            description=skill["description"],
+            skill_md_key=skill["skill_md_key"],
+            archive_key=skill["archive_key"],
         )
+        for skill in skills_catalog
+    ]
 
-    files: list[DifyDriveFileConfig] = []
-    for file in file_refs:
-        if not file.drive_key:
-            # Plain upload references (pre-ENG-625) are not drive-backed; they are
-            # simply invisible to the manifest rather than a defect worth warning on.
-            continue
-        size = file.get("size")
-        files.append(
-            DifyDriveFileConfig(
-                name=file.name or file.drive_key.rsplit("/", 1)[-1],
-                key=file.drive_key,
-                size=size if isinstance(size, int) else None,
-                mime_type=file.type,
-            )
-        )
-
-    if not skills and not files:
-        return None, warnings
-    return DifyDriveLayerConfig(drive_ref=f"agent-{agent_id}", skills=skills, files=files), warnings
+    return (
+        DifyDriveLayerConfig(
+            drive_ref=f"agent-{agent_id}",
+            skills=skills,
+            mentioned_skill_keys=mentioned_skill_keys,
+            mentioned_file_keys=mentioned_file_keys,
+        ),
+        warnings,
+    )
 
 
 def _cli_tool_enabled(item: object) -> bool:
diff --git a/api/core/workflow/nodes/agent_v2/validators.py b/api/core/workflow/nodes/agent_v2/validators.py
index ca3adb5b0d1..2eabac10dd6 100644
--- a/api/core/workflow/nodes/agent_v2/validators.py
+++ b/api/core/workflow/nodes/agent_v2/validators.py
@@ -35,7 +35,6 @@ class WorkflowAgentNodeValidator:
             "soul",
             "prompt",
             "system_prompt",
-            "skills_files",
             "skills",
             "files",
             "tools",
diff --git a/api/extensions/ext_commands.py b/api/extensions/ext_commands.py
index 6cd4b08b900..a85f6569978 100644
--- a/api/extensions/ext_commands.py
+++ b/api/extensions/ext_commands.py
@@ -5,6 +5,7 @@ def init_app(app: DifyApp):
     from commands import (
         add_qdrant_index,
         archive_workflow_runs,
+        archive_workflow_runs_plan,
         backfill_plugin_auto_upgrade,
         clean_expired_messages,
         clean_workflow_runs,
@@ -72,6 +73,7 @@ def init_app(app: DifyApp):
         setup_datasource_oauth_client,
         transform_datasource_credentials,
         install_rag_pipeline_plugins,
+        archive_workflow_runs_plan,
         archive_workflow_runs,
         delete_archived_workflow_runs,
         restore_workflow_runs,
diff --git a/api/extensions/ext_redis.py b/api/extensions/ext_redis.py
index af0d77411ba..f1c2d574e8c 100644
--- a/api/extensions/ext_redis.py
+++ b/api/extensions/ext_redis.py
@@ -25,7 +25,7 @@ from extensions.redis_names import (
     serialize_redis_name_args,
 )
 from libs.broadcast_channel.channel import BroadcastChannel as BroadcastChannelProtocol
-from libs.broadcast_channel.redis.channel import BroadcastChannel as RedisBroadcastChannel
+from libs.broadcast_channel.redis.pubsub_channel import BroadcastChannel as RedisBroadcastChannel
 from libs.broadcast_channel.redis.sharded_channel import ShardedRedisBroadcastChannel
 from libs.broadcast_channel.redis.streams_channel import StreamsBroadcastChannel
 
@@ -457,16 +457,14 @@ def init_app(app: DifyApp):
 
 def get_pubsub_broadcast_channel() -> BroadcastChannelProtocol:
     assert _pubsub_redis_client is not None, "PubSub redis Client should be initialized here."
-    join_timeout_ms = dify_config.PUBSUB_LISTENER_JOIN_TIMEOUT_MS
     if dify_config.PUBSUB_REDIS_CHANNEL_TYPE == "sharded":
-        return ShardedRedisBroadcastChannel(_pubsub_redis_client, join_timeout_ms=join_timeout_ms)
+        return ShardedRedisBroadcastChannel(_pubsub_redis_client)
     if dify_config.PUBSUB_REDIS_CHANNEL_TYPE == "streams":
         return StreamsBroadcastChannel(
             _pubsub_redis_client,
             retention_seconds=dify_config.PUBSUB_STREAMS_RETENTION_SECONDS,
-            join_timeout_ms=join_timeout_ms,
         )
-    return RedisBroadcastChannel(_pubsub_redis_client, join_timeout_ms=join_timeout_ms)
+    return RedisBroadcastChannel(_pubsub_redis_client)
 
 
 def redis_fallback[T](default_return: T | None = None):  # type: ignore
diff --git a/api/fields/agent_fields.py b/api/fields/agent_fields.py
index ec64395d6fd..e60a6b01426 100644
--- a/api/fields/agent_fields.py
+++ b/api/fields/agent_fields.py
@@ -1,5 +1,5 @@
 from datetime import datetime
-from typing import Annotated, Literal
+from typing import Literal
 
 from pydantic import Field, field_validator
 
@@ -16,10 +16,8 @@ from models.agent import (
 )
 from models.agent_config_entities import (
     AgentCliToolConfig,
-    AgentFileRefConfig,
     AgentHumanContactConfig,
     AgentKnowledgeDatasetConfig,
-    AgentSkillRefConfig,
     AgentSoulConfig,
     DeclaredOutputConfig,
     DeclaredOutputType,
@@ -291,6 +289,11 @@ class AgentConfigSnapshotListResponse(ResponseModel):
     data: list[AgentConfigSnapshotSummaryResponse]
 
 
+class AgentConfigSnapshotRestoreResponse(ResponseModel):
+    result: Literal["success"]
+    active_config_snapshot_id: str
+
+
 class AgentComposerAgentResponse(ResponseModel):
     id: str
     name: str
@@ -391,20 +394,6 @@ class AgentComposerDifyToolCandidateResponse(ResponseModel):
     tools_count: int | None = None
 
 
-class AgentComposerSkillCandidateResponse(AgentSkillRefConfig):
-    kind: Literal["skill"] = "skill"
-
-
-class AgentComposerFileCandidateResponse(AgentFileRefConfig):
-    kind: Literal["file"] = "file"
-
-
-AgentComposerSkillFileCandidateResponse = Annotated[
-    AgentComposerSkillCandidateResponse | AgentComposerFileCandidateResponse,
-    Field(discriminator="kind"),
-]
-
-
 class AgentComposerNodeJobCandidatesResponse(ResponseModel):
     previous_node_outputs: list[WorkflowPreviousNodeOutputRef] = Field(default_factory=list)
     declare_output_types: list[DeclaredOutputType] = Field(default_factory=list)
@@ -412,7 +401,6 @@ class AgentComposerNodeJobCandidatesResponse(ResponseModel):
 
 
 class AgentComposerSoulCandidatesResponse(ResponseModel):
-    skills_files: list[AgentComposerSkillFileCandidateResponse] = Field(default_factory=list)
     dify_tools: list[AgentComposerDifyToolCandidateResponse] = Field(default_factory=list)
     cli_tools: list[AgentCliToolConfig] = Field(default_factory=list)
     knowledge_datasets: list[AgentKnowledgeDatasetConfig] = Field(default_factory=list)
diff --git a/api/libs/broadcast_channel/redis/__init__.py b/api/libs/broadcast_channel/redis/__init__.py
index f92c94f7360..8ce71e2823e 100644
--- a/api/libs/broadcast_channel/redis/__init__.py
+++ b/api/libs/broadcast_channel/redis/__init__.py
@@ -1,4 +1,4 @@
-from .channel import BroadcastChannel
+from .pubsub_channel import BroadcastChannel
 from .sharded_channel import ShardedRedisBroadcastChannel
 
 __all__ = ["BroadcastChannel", "ShardedRedisBroadcastChannel"]
diff --git a/api/libs/broadcast_channel/redis/_subscription.py b/api/libs/broadcast_channel/redis/_subscription.py
index 5af42d12538..01a9e668bcc 100644
--- a/api/libs/broadcast_channel/redis/_subscription.py
+++ b/api/libs/broadcast_channel/redis/_subscription.py
@@ -7,6 +7,7 @@ from typing import Any, Self, override
 
 from libs.broadcast_channel.channel import Subscription
 from libs.broadcast_channel.exc import SubscriptionClosedError
+from libs.broadcast_channel.signals import SIG_CLOSE
 from redis import Redis, RedisCluster
 from redis.client import PubSub
 
@@ -26,8 +27,6 @@ class RedisSubscriptionBase(Subscription):
         client: Redis | RedisCluster,
         pubsub: PubSub,
         topic: str,
-        *,
-        join_timeout_ms: int = 2000,
     ):
         # The _pubsub is None only if the subscription is closed.
         self._client = client
@@ -39,11 +38,6 @@ class RedisSubscriptionBase(Subscription):
         self._listener_thread: threading.Thread | None = None
         self._start_lock = threading.Lock()
         self._started = False
-        # Max time close() will wait for the listener thread to finish before
-        # returning. Bounds SSE close tail latency. The listener is a daemon
-        # and exits on its own within one poll window (~1s), so a low value
-        # here just means close() returns sooner without breaking anything.
-        self._join_timeout_ms = max(int(join_timeout_ms or 0), 0)
 
     def _start_if_needed(self) -> None:
         """Start the subscription if not already started."""
@@ -90,6 +84,11 @@ class RedisSubscriptionBase(Subscription):
             if raw_message is None:
                 continue
 
+            # If close() sent a control event to unblock us, exit immediately
+            # without processing any message — the subscription is shutting down.
+            if self._closed.is_set():
+                break
+
             if raw_message.get("type") != self._get_message_type():
                 continue
 
@@ -119,6 +118,8 @@ class RedisSubscriptionBase(Subscription):
                 continue
 
             self._enqueue_message(payload_bytes)
+            if payload_bytes == SIG_CLOSE:
+                break
 
         _logger.debug("%s listener thread stopped for channel %s", self._get_subscription_type().title(), self._topic)
         try:
@@ -164,14 +165,20 @@ class RedisSubscriptionBase(Subscription):
             except queue.Empty:
                 continue
 
+            if self._closed.is_set():
+                return
+
             yield item
 
     @override
     def __iter__(self) -> Iterator[bytes]:
         """Return an iterator over messages from the subscription."""
         if self._closed.is_set():
-            raise SubscriptionClosedError(f"The Redis {self._get_subscription_type()} subscription is closed")
-        self._start_if_needed()
+            return iter(())
+        try:
+            self._start_if_needed()
+        except SubscriptionClosedError:
+            return iter(())
         return iter(self._message_iterator())
 
     @override
@@ -208,24 +215,55 @@ class RedisSubscriptionBase(Subscription):
     @override
     def close(self) -> None:
         """Close the subscription and clean up resources."""
-        if self._closed.is_set():
-            return
+        with self._start_lock:
+            if self._closed.is_set():
+                return
+
+            self._closed.set()
+            listener = self._listener_thread
+            self._listener_thread = None
+            started = self._started
+
+        if started:
+            self._unblock_message_iterator()
+
+        # Send a control event on the same Redis channel to unblock the
+        self._publish_close_event()
 
-        self._closed.set()
         # NOTE: PubSub is not thread-safe. More specifically, the `PubSub.close` method and the
         # message retrieval method should NOT be called concurrently.
         #
         # Due to the restriction above, the PubSub cleanup logic happens inside the consumer thread.
-        listener = self._listener_thread
-        if listener is not None:
-            listener.join(timeout=self._join_timeout_ms / 1000.0)
-            self._listener_thread = None
+        if listener is not None and listener.is_alive():
+            listener.join(timeout=2)
+
+    def _unblock_message_iterator(self) -> None:
+        try:
+            self._queue.put_nowait(SIG_CLOSE)
+        except queue.Full:
+            try:
+                self._queue.get_nowait()
+            except queue.Empty:
+                pass
+            try:
+                self._queue.put_nowait(SIG_CLOSE)
+            except queue.Full:
+                pass
 
     # Abstract methods to be implemented by subclasses
     def _get_subscription_type(self) -> str:
         """Return the subscription type (e.g., 'regular' or 'sharded')."""
         raise NotImplementedError
 
+    def _publish_close_event(self) -> None:
+        """Publish a control event on the Redis channel to unblock the listener.
+
+        This is called by close() after setting _closed. The subclass should
+        publish an empty message on the same topic so that a blocking
+        get_message() call in the listener thread returns promptly.
+        """
+        raise NotImplementedError
+
     def _subscribe(self) -> None:
         """Subscribe to the Redis topic using the appropriate command."""
         raise NotImplementedError
diff --git a/api/libs/broadcast_channel/redis/channel.py b/api/libs/broadcast_channel/redis/pubsub_channel.py
similarity index 82%
rename from api/libs/broadcast_channel/redis/channel.py
rename to api/libs/broadcast_channel/redis/pubsub_channel.py
index bf304cc4a0b..a784bb98f13 100644
--- a/api/libs/broadcast_channel/redis/channel.py
+++ b/api/libs/broadcast_channel/redis/pubsub_channel.py
@@ -1,13 +1,17 @@
 from __future__ import annotations
 
+import logging
 from typing import Any, override
 
 from extensions.redis_names import serialize_redis_name
 from libs.broadcast_channel.channel import Producer, Subscriber, Subscription
+from libs.broadcast_channel.signals import SIG_CLOSE
 from redis import Redis, RedisCluster
 
 from ._subscription import RedisSubscriptionBase
 
+logger = logging.getLogger(__name__)
+
 
 class BroadcastChannel:
     """
@@ -22,16 +26,11 @@ class BroadcastChannel:
     def __init__(
         self,
         redis_client: Redis | RedisCluster,
-        *,
-        join_timeout_ms: int = 2000,
     ):
         self._client = redis_client
-        # See `RedisSubscriptionBase._join_timeout_ms`: how long close()
-        # waits for the listener thread before returning.
-        self._join_timeout_ms = max(int(join_timeout_ms or 0), 0)
 
     def topic(self, topic: str) -> Topic:
-        return Topic(self._client, topic, join_timeout_ms=self._join_timeout_ms)
+        return Topic(self._client, topic)
 
 
 class Topic:
@@ -39,13 +38,10 @@ class Topic:
         self,
         redis_client: Redis | RedisCluster,
         topic: str,
-        *,
-        join_timeout_ms: int = 2000,
     ):
         self._client = redis_client
         self._topic = topic
         self._redis_topic = serialize_redis_name(topic)
-        self._join_timeout_ms = max(int(join_timeout_ms or 0), 0)
 
     def as_producer(self) -> Producer:
         return self
@@ -61,7 +57,6 @@ class Topic:
             client=self._client,
             pubsub=self._client.pubsub(),
             topic=self._redis_topic,
-            join_timeout_ms=self._join_timeout_ms,
         )
 
 
@@ -72,6 +67,13 @@ class _RedisSubscription(RedisSubscriptionBase):
     def _get_subscription_type(self) -> str:
         return "regular"
 
+    @override
+    def _publish_close_event(self) -> None:
+        try:
+            self._client.publish(self._topic, SIG_CLOSE)
+        except Exception:
+            logger.exception("failed to publish close event")
+
     @override
     def _subscribe(self) -> None:
         assert self._pubsub is not None
diff --git a/api/libs/broadcast_channel/redis/sharded_channel.py b/api/libs/broadcast_channel/redis/sharded_channel.py
index 68e9f8b23ef..aabae6a5c11 100644
--- a/api/libs/broadcast_channel/redis/sharded_channel.py
+++ b/api/libs/broadcast_channel/redis/sharded_channel.py
@@ -1,13 +1,17 @@
 from __future__ import annotations
 
+import logging
 from typing import Any, override
 
 from extensions.redis_names import serialize_redis_name
 from libs.broadcast_channel.channel import Producer, Subscriber, Subscription
+from libs.broadcast_channel.signals import SIG_CLOSE
 from redis import Redis, RedisCluster
 
 from ._subscription import RedisSubscriptionBase
 
+logger = logging.getLogger(__name__)
+
 
 class ShardedRedisBroadcastChannel:
     """
@@ -20,14 +24,11 @@ class ShardedRedisBroadcastChannel:
     def __init__(
         self,
         redis_client: Redis | RedisCluster,
-        *,
-        join_timeout_ms: int = 2000,
     ):
         self._client = redis_client
-        self._join_timeout_ms = max(int(join_timeout_ms or 0), 0)
 
     def topic(self, topic: str) -> ShardedTopic:
-        return ShardedTopic(self._client, topic, join_timeout_ms=self._join_timeout_ms)
+        return ShardedTopic(self._client, topic)
 
 
 class ShardedTopic:
@@ -35,13 +36,10 @@ class ShardedTopic:
         self,
         redis_client: Redis | RedisCluster,
         topic: str,
-        *,
-        join_timeout_ms: int = 2000,
     ):
         self._client = redis_client
         self._topic = topic
         self._redis_topic = serialize_redis_name(topic)
-        self._join_timeout_ms = max(int(join_timeout_ms or 0), 0)
 
     def as_producer(self) -> Producer:
         return self
@@ -57,7 +55,6 @@ class ShardedTopic:
             client=self._client,
             pubsub=self._client.pubsub(),
             topic=self._redis_topic,
-            join_timeout_ms=self._join_timeout_ms,
         )
 
 
@@ -68,6 +65,13 @@ class _RedisShardedSubscription(RedisSubscriptionBase):
     def _get_subscription_type(self) -> str:
         return "sharded"
 
+    @override
+    def _publish_close_event(self) -> None:
+        try:
+            self._client.spublish(self._topic, SIG_CLOSE)  # type: ignore[attr-defined,union-attr]
+        except Exception:
+            logger.exception("failed to publish close event")
+
     @override
     def _subscribe(self) -> None:
         assert self._pubsub is not None
diff --git a/api/libs/broadcast_channel/redis/streams_channel.py b/api/libs/broadcast_channel/redis/streams_channel.py
index 62e58798ab3..b3385b05388 100644
--- a/api/libs/broadcast_channel/redis/streams_channel.py
+++ b/api/libs/broadcast_channel/redis/streams_channel.py
@@ -9,6 +9,7 @@ from typing import Self, override
 from extensions.redis_names import serialize_redis_name
 from libs.broadcast_channel.channel import Producer, Subscriber, Subscription
 from libs.broadcast_channel.exc import SubscriptionClosedError
+from libs.broadcast_channel.signals import SIG_CLOSE
 from redis import Redis, RedisCluster
 
 logger = logging.getLogger(__name__)
@@ -29,20 +30,15 @@ class StreamsBroadcastChannel:
         redis_client: Redis | RedisCluster,
         *,
         retention_seconds: int = 600,
-        join_timeout_ms: int = 2000,
     ):
         self._client = redis_client
         self._retention_seconds = max(int(retention_seconds or 0), 0)
-        # Max time close() will wait for the listener thread to finish.
-        # See `_StreamsSubscription._join_timeout_ms` for the rationale.
-        self._join_timeout_ms = max(int(join_timeout_ms or 0), 0)
 
     def topic(self, topic: str) -> StreamsTopic:
         return StreamsTopic(
             self._client,
             topic,
             retention_seconds=self._retention_seconds,
-            join_timeout_ms=self._join_timeout_ms,
         )
 
 
@@ -53,13 +49,11 @@ class StreamsTopic:
         topic: str,
         *,
         retention_seconds: int = 600,
-        join_timeout_ms: int = 2000,
     ):
         self._client = redis_client
         self._topic = topic
         self._key = serialize_redis_name(f"stream:{topic}")
         self._retention_seconds = retention_seconds
-        self._join_timeout_ms = max(int(join_timeout_ms or 0), 0)
         self.max_length = 5000
 
     def as_producer(self) -> Producer:
@@ -77,23 +71,15 @@ class StreamsTopic:
         return self
 
     def subscribe(self) -> Subscription:
-        return _StreamsSubscription(self._client, self._key, join_timeout_ms=self._join_timeout_ms)
+        return _StreamsSubscription(self._client, self._key)
 
 
 class _StreamsSubscription(Subscription):
     _SENTINEL = object()
 
-    def __init__(self, client: Redis | RedisCluster, key: str, *, join_timeout_ms: int = 2000):
+    def __init__(self, client: Redis | RedisCluster, key: str):
         self._client = client
         self._key = key
-        # Max time close() will wait for the listener thread to finish before
-        # returning. Bounds SSE close tail latency: the listener blocks on
-        # XREAD with BLOCK=1000ms, so close() naturally waits up to ~1s for
-        # the thread to notice _closed. Setting this lower lets close()
-        # return promptly while the daemon listener exits on its own within
-        # one BLOCK window - safe because the listener holds no critical
-        # state. ``0`` means close() does not wait at all.
-        self._join_timeout_ms = max(int(join_timeout_ms or 0), 0)
 
         self._queue: queue.Queue[object] = queue.Queue()
 
@@ -106,7 +92,6 @@ class _StreamsSubscription(Subscription):
         # reading and writing the _listener / `_closed` attribute.
         self._lock = threading.Lock()
         self._closed: bool = False
-        # self._closed = threading.Event()
         self._listener: threading.Thread | None = None
 
     def _listen(self) -> None:
@@ -144,6 +129,8 @@ class _StreamsSubscription(Subscription):
                             case bytes() | bytearray():
                                 data_bytes = bytes(data)
                         if data_bytes is not None:
+                            if data_bytes == SIG_CLOSE:
+                                break
                             self._queue.put_nowait(data_bytes)
                         last_id = entry_id
         finally:
@@ -203,6 +190,13 @@ class _StreamsSubscription(Subscription):
         assert isinstance(item, (bytes, bytearray)), "Unexpected item type in stream queue"
         return bytes(item)
 
+    def _publish_close_event(self) -> None:
+        """Publish an empty message to the stream to unblock the listener's xread."""
+        try:
+            self._client.xadd(self._key, {b"data": SIG_CLOSE})
+        except Exception:
+            logger.exception("failed to publish close event")
+
     @override
     def close(self) -> None:
         with self._lock:
@@ -212,16 +206,17 @@ class _StreamsSubscription(Subscription):
             listener = self._listener
             if listener is not None:
                 self._listener = None
-        # We close the listener outside of the with block to avoid holding the
-        # lock for a long time.
+
+        if listener is not None:
+            self._publish_close_event()
+
         if listener is not None and listener.is_alive():
-            listener.join(timeout=self._join_timeout_ms / 1000.0)
+            listener.join(timeout=2)
             if listener.is_alive():
                 logger.debug(
-                    "Streams subscription listener for key %s did not stop within %dms; "
+                    "Streams subscription listener for key %s did not stop after join; "
                     "daemon thread will exit on its own within one poll window.",
                     self._key,
-                    self._join_timeout_ms,
                 )
 
     # Context manager helpers
diff --git a/api/libs/broadcast_channel/signals.py b/api/libs/broadcast_channel/signals.py
new file mode 100644
index 00000000000..812a0beb9af
--- /dev/null
+++ b/api/libs/broadcast_channel/signals.py
@@ -0,0 +1 @@
+SIG_CLOSE = b"__closed__"
diff --git a/api/libs/password.py b/api/libs/password.py
index cdf55c57e5b..3313278492a 100644
--- a/api/libs/password.py
+++ b/api/libs/password.py
@@ -13,7 +13,7 @@ def valid_password(password):
     if re.match(pattern, password) is not None:
         return password
 
-    raise ValueError("Password must contain letters and numbers, and the length must be greater than 8.")
+    raise ValueError("Password must contain letters and numbers, and the length must be at least 8 characters.")
 
 
 def hash_password(password_str, salt_byte):
diff --git a/api/migrations/versions/2026_06_15_1100-b7c2d9e8a1f4_add_tenant_last_opened_at.py b/api/migrations/versions/2026_06_15_1100-b7c2d9e8a1f4_add_tenant_last_opened_at.py
index ce2fd2b79ca..066a2ba8ca8 100644
--- a/api/migrations/versions/2026_06_15_1100-b7c2d9e8a1f4_add_tenant_last_opened_at.py
+++ b/api/migrations/versions/2026_06_15_1100-b7c2d9e8a1f4_add_tenant_last_opened_at.py
@@ -7,7 +7,7 @@ Create Date: 2026-06-05 11:00:00.000000
 """
 
 import sqlalchemy as sa
-from alembic import op
+from alembic import context, op
 
 # revision identifiers, used by Alembic.
 revision = "b7c2d9e8a1f4"
@@ -17,10 +17,23 @@ depends_on = None
 
 
 def upgrade():
+    if _has_last_opened_at_column():
+        return
     with op.batch_alter_table("tenant_account_joins", schema=None) as batch_op:
         batch_op.add_column(sa.Column("last_opened_at", sa.DateTime(), nullable=True))
 
 
 def downgrade():
+    if not _has_last_opened_at_column():
+        return
     with op.batch_alter_table("tenant_account_joins", schema=None) as batch_op:
         batch_op.drop_column("last_opened_at")
+
+
+def _has_last_opened_at_column() -> bool:
+    if context.is_offline_mode():
+        # Offline SQL generation cannot inspect the target schema. Assume the
+        # linear migration path so generated SQL stays explicit.
+        return False
+    inspector = sa.inspect(op.get_bind())
+    return "last_opened_at" in {column["name"] for column in inspector.get_columns("tenant_account_joins")}
diff --git a/api/migrations/versions/2026_06_18_2300-b2515f9d4c2a_agent_drive_skill_metadata_refactor.py b/api/migrations/versions/2026_06_18_2300-b2515f9d4c2a_agent_drive_skill_metadata_refactor.py
new file mode 100644
index 00000000000..3398c2eb018
--- /dev/null
+++ b/api/migrations/versions/2026_06_18_2300-b2515f9d4c2a_agent_drive_skill_metadata_refactor.py
@@ -0,0 +1,82 @@
+"""agent drive skill metadata refactor
+
+Revision ID: b2515f9d4c2a
+Revises: 4f7b2c8d9a10
+Create Date: 2026-06-18 23:00:00.000000
+
+"""
+
+from __future__ import annotations
+
+import json
+from typing import Any
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import mysql
+from sqlalchemy.engine.mock import MockConnection
+
+# revision identifiers, used by Alembic.
+revision = "b2515f9d4c2a"
+down_revision = "4f7b2c8d9a10"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "agent_drive_files",
+        sa.Column("is_skill", sa.Boolean(), nullable=False, server_default=sa.text("false")),
+    )
+    op.add_column(
+        "agent_drive_files",
+        sa.Column("skill_metadata", sa.Text().with_variant(mysql.LONGTEXT(), "mysql"), nullable=True),
+    )
+    op.create_index(
+        "agent_drive_files_tenant_agent_is_skill_key_idx",
+        "agent_drive_files",
+        ["tenant_id", "agent_id", "is_skill", "key"],
+    )
+    _remove_skills_files_from_snapshots()
+
+
+def downgrade() -> None:
+    op.drop_index("agent_drive_files_tenant_agent_is_skill_key_idx", table_name="agent_drive_files")
+    op.drop_column("agent_drive_files", "skill_metadata")
+    op.drop_column("agent_drive_files", "is_skill")
+
+
+def _remove_skills_files_from_snapshots() -> None:
+    connection = op.get_bind()
+    if connection is None or isinstance(connection, MockConnection):
+        return
+    snapshots = sa.table(
+        "agent_config_snapshots",
+        sa.column("id", sa.String()),
+        sa.column("config_snapshot", sa.Text()),
+    )
+    rows = connection.execute(sa.select(snapshots.c.id, snapshots.c.config_snapshot)).fetchall()
+    for row in rows:
+        cleaned = _strip_skills_files(row.config_snapshot)
+        if cleaned is None:
+            continue
+        connection.execute(
+            snapshots.update()
+            .where(snapshots.c.id == row.id)
+            .values(config_snapshot=json.dumps(cleaned, separators=(",", ":"), sort_keys=True))
+        )
+
+
+def _strip_skills_files(raw_snapshot: Any) -> dict[str, Any] | None:
+    if raw_snapshot is None:
+        return None
+    if isinstance(raw_snapshot, str):
+        snapshot = json.loads(raw_snapshot)
+    elif isinstance(raw_snapshot, dict):
+        snapshot = dict(raw_snapshot)
+    else:
+        snapshot = dict(raw_snapshot)
+    if not isinstance(snapshot, dict) or "skills_files" not in snapshot:
+        return None
+    snapshot.pop("skills_files", None)
+    return snapshot
diff --git a/api/migrations/versions/2026_06_22_1000-c8f4a6b2d3e1_add_agent_debug_conversation_id.py b/api/migrations/versions/2026_06_22_1000-c8f4a6b2d3e1_add_agent_debug_conversation_id.py
new file mode 100644
index 00000000000..213b8d36978
--- /dev/null
+++ b/api/migrations/versions/2026_06_22_1000-c8f4a6b2d3e1_add_agent_debug_conversation_id.py
@@ -0,0 +1,66 @@
+"""add agent debug conversations
+
+Revision ID: c8f4a6b2d3e1
+Revises: b2515f9d4c2a
+Create Date: 2026-06-22 10:00:00.000000
+
+"""
+
+import sqlalchemy as sa
+from alembic import op
+
+import models
+
+# revision identifiers, used by Alembic.
+revision = "c8f4a6b2d3e1"
+down_revision = "b2515f9d4c2a"
+branch_labels = None
+depends_on = None
+
+
+def _is_pg(conn) -> bool:
+    return conn.dialect.name == "postgresql"
+
+
+def _uuid_column(name: str, *, nullable: bool = False, primary_key: bool = False) -> sa.Column:
+    kwargs = {"nullable": nullable, "primary_key": primary_key}
+    if primary_key and _is_pg(op.get_bind()):
+        kwargs["server_default"] = sa.text("uuidv7()")
+    return sa.Column(name, models.types.StringUUID(), **kwargs)
+
+
+def upgrade():
+    op.create_table(
+        "agent_debug_conversations",
+        _uuid_column("id", primary_key=True),
+        sa.Column("tenant_id", models.types.StringUUID(), nullable=False),
+        sa.Column("agent_id", models.types.StringUUID(), nullable=False),
+        sa.Column("app_id", models.types.StringUUID(), nullable=False),
+        sa.Column("account_id", models.types.StringUUID(), nullable=False),
+        sa.Column("conversation_id", models.types.StringUUID(), nullable=False),
+        sa.Column("created_at", sa.DateTime(), server_default=sa.func.current_timestamp(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(), server_default=sa.func.current_timestamp(), nullable=False),
+        sa.PrimaryKeyConstraint("id", name=op.f("agent_debug_conversation_pkey")),
+        sa.UniqueConstraint(
+            "tenant_id",
+            "agent_id",
+            "account_id",
+            name=op.f("agent_debug_conversation_agent_account_unique"),
+        ),
+    )
+    op.create_index(
+        "agent_debug_conversation_conversation_idx",
+        "agent_debug_conversations",
+        ["conversation_id"],
+    )
+    op.create_index(
+        "agent_debug_conversation_account_idx",
+        "agent_debug_conversations",
+        ["tenant_id", "account_id"],
+    )
+
+
+def downgrade():
+    op.drop_index("agent_debug_conversation_account_idx", table_name="agent_debug_conversations")
+    op.drop_index("agent_debug_conversation_conversation_idx", table_name="agent_debug_conversations")
+    op.drop_table("agent_debug_conversations")
diff --git a/api/models/__init__.py b/api/models/__init__.py
index 78ca43fa374..9992de982c4 100644
--- a/api/models/__init__.py
+++ b/api/models/__init__.py
@@ -13,6 +13,7 @@ from .agent import (
     AgentConfigRevision,
     AgentConfigRevisionOperation,
     AgentConfigSnapshot,
+    AgentDebugConversation,
     AgentDriveFile,
     AgentDriveFileKind,
     AgentIconType,
@@ -156,6 +157,7 @@ __all__ = [
     "AgentConfigRevision",
     "AgentConfigRevisionOperation",
     "AgentConfigSnapshot",
+    "AgentDebugConversation",
     "AgentDriveFile",
     "AgentDriveFileKind",
     "AgentIconType",
diff --git a/api/models/agent.py b/api/models/agent.py
index 1a13ccde77b..46044edd5e7 100644
--- a/api/models/agent.py
+++ b/api/models/agent.py
@@ -83,6 +83,8 @@ class AgentConfigRevisionOperation(StrEnum):
     SAVE_NEW_AGENT = "save_new_agent"
     # Promotes a workflow-only Agent into the reusable Agent Roster.
     SAVE_TO_ROSTER = "save_to_roster"
+    # Switches the Agent's current published config back to an existing version.
+    RESTORE_VERSION = "restore_version"
 
 
 class WorkflowAgentBindingType(StrEnum):
@@ -180,6 +182,34 @@ class Agent(DefaultFieldsMixin, Base):
     archived_at: Mapped[datetime | None] = mapped_column(DateTime, nullable=True)
 
 
+class AgentDebugConversation(DefaultFieldsMixin, Base):
+    """Per-account console debug conversation for an Agent App.
+
+    Agent App preview state must be isolated by editor account. The Agent row is
+    shared by everyone in the workspace, so this table owns the user-specific
+    conversation pointer used by console debug chat.
+    """
+
+    __tablename__ = "agent_debug_conversations"
+    __table_args__ = (
+        sa.PrimaryKeyConstraint("id", name="agent_debug_conversation_pkey"),
+        UniqueConstraint(
+            "tenant_id",
+            "agent_id",
+            "account_id",
+            name="agent_debug_conversation_agent_account_unique",
+        ),
+        Index("agent_debug_conversation_conversation_idx", "conversation_id"),
+        Index("agent_debug_conversation_account_idx", "tenant_id", "account_id"),
+    )
+
+    tenant_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
+    agent_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
+    app_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
+    account_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
+    conversation_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
+
+
 class AgentConfigSnapshot(DefaultFieldsMixin, Base):
     """Immutable Agent Soul snapshot.
 
@@ -430,14 +460,17 @@ class AgentDriveFile(DefaultFieldsMixin, Base):
     synced. ``value_owned_by_drive`` gates physical cleanup: only drive-owned values
     (created by the agent runtime or Skill standardization, not shared with other
     business records) have their storage object + record deleted when the KV entry is
-    overwritten or removed; otherwise only the KV row is dropped. Lifecycle never relies
-    on ``UploadFile.used/used_by`` (not a reliable refcount).
+    overwritten or removed; otherwise only the KV row is dropped. Skills are represented
+    by the canonical ``<path>/SKILL.md`` row with ``is_skill=True`` and a serialized
+    ``skill_metadata`` string. Lifecycle never relies on ``UploadFile.used/used_by``
+    (not a reliable refcount).
     """
 
     __tablename__ = "agent_drive_files"
     __table_args__ = (
         sa.PrimaryKeyConstraint("id", name="agent_drive_file_pkey"),
         UniqueConstraint("tenant_id", "agent_id", "key", name="agent_drive_file_scope_key_unique"),
+        Index("agent_drive_files_tenant_agent_is_skill_key_idx", "tenant_id", "agent_id", "is_skill", "key"),
     )
 
     tenant_id: Mapped[str] = mapped_column(StringUUID, nullable=False)
@@ -453,6 +486,8 @@ class AgentDriveFile(DefaultFieldsMixin, Base):
     value_owned_by_drive: Mapped[bool] = mapped_column(
         sa.Boolean, nullable=False, default=False, server_default=sa.text("false")
     )
+    is_skill: Mapped[bool] = mapped_column(sa.Boolean, nullable=False, default=False, server_default=sa.text("false"))
+    skill_metadata: Mapped[str | None] = mapped_column(LongText, nullable=True)
     size: Mapped[int | None] = mapped_column(sa.BigInteger, nullable=True)
     hash: Mapped[str | None] = mapped_column(String(255), nullable=True)
     mime_type: Mapped[str | None] = mapped_column(String(255), nullable=True)
diff --git a/api/models/agent_config_entities.py b/api/models/agent_config_entities.py
index 76108f271d4..2503ba66f06 100644
--- a/api/models/agent_config_entities.py
+++ b/api/models/agent_config_entities.py
@@ -361,11 +361,6 @@ class AgentSoulPromptConfig(BaseModel):
     system_prompt: str = ""
 
 
-class AgentSoulSkillsFilesConfig(BaseModel):
-    files: list[AgentFileRefConfig] = Field(default_factory=list)
-    skills: list[AgentSkillRefConfig] = Field(default_factory=list)
-
-
 class AgentSoulDifyToolCredentialRef(BaseModel):
     """Reference to a stored Dify Plugin Tool credential.
 
@@ -514,7 +509,6 @@ class AgentSoulConfig(BaseModel):
 
     schema_version: int = 1
     prompt: AgentSoulPromptConfig = Field(default_factory=AgentSoulPromptConfig)
-    skills_files: AgentSoulSkillsFilesConfig = Field(default_factory=AgentSoulSkillsFilesConfig)
     tools: AgentSoulToolsConfig = Field(default_factory=AgentSoulToolsConfig)
     knowledge: AgentSoulKnowledgeConfig = Field(default_factory=AgentSoulKnowledgeConfig)
     human: AgentSoulHumanConfig = Field(default_factory=AgentSoulHumanConfig)
diff --git a/api/models/human_input.py b/api/models/human_input.py
index d11274bc921..b84579a4e09 100644
--- a/api/models/human_input.py
+++ b/api/models/human_input.py
@@ -134,20 +134,40 @@ class HumanInputDelivery(DefaultFieldsMixin, Base):
     )
 
 
+class ApprovalChannel(StrEnum):
+    """Where a paused human input form can be approved, surfaced to API callers."""
+
+    EMAIL = "email"
+    WEB_APP = "web_app"
+    CONSOLE = "console"
+
+
 class RecipientType(StrEnum):
-    # EMAIL_MEMBER member means that the
-    EMAIL_MEMBER = "email_member"
-    EMAIL_EXTERNAL = "email_external"
+    # Second value = the approval channel this recipient maps to (surfaced in `approval_channels`).
+    EMAIL_MEMBER = "email_member", ApprovalChannel.EMAIL
+    EMAIL_EXTERNAL = "email_external", ApprovalChannel.EMAIL
     # STANDALONE_WEB_APP is used by the standalone web app.
     #
     # It's not used while running workflows / chatflows containing HumanInput
     # node inside console.
-    STANDALONE_WEB_APP = "standalone_web_app"
+    STANDALONE_WEB_APP = "standalone_web_app", ApprovalChannel.WEB_APP
     # CONSOLE is used while running workflows / chatflows containing HumanInput
     # node inside console. (E.G. running installed apps or debugging workflows / chatflows)
-    CONSOLE = "console"
+    CONSOLE = "console", ApprovalChannel.CONSOLE
     # BACKSTAGE is used for backstage input inside console.
-    BACKSTAGE = "backstage"
+    BACKSTAGE = "backstage", ApprovalChannel.CONSOLE
+
+    _approval_channel: ApprovalChannel
+
+    def __new__(cls, value: str, approval_channel: ApprovalChannel) -> "RecipientType":
+        member = str.__new__(cls, value)
+        member._value_ = value
+        member._approval_channel = approval_channel
+        return member
+
+    @property
+    def approval_channel(self) -> ApprovalChannel:
+        return self._approval_channel
 
 
 @final
diff --git a/api/models/model.py b/api/models/model.py
index bbd5b19c809..0d0b51f65cc 100644
--- a/api/models/model.py
+++ b/api/models/model.py
@@ -774,26 +774,7 @@ class AppModelConfig(TypeBase):
 
     @property
     def annotation_reply_dict(self) -> AnnotationReplyConfig:
-        annotation_setting = db.session.scalar(
-            select(AppAnnotationSetting).where(AppAnnotationSetting.app_id == self.app_id)
-        )
-        if annotation_setting:
-            collection_binding_detail = annotation_setting.collection_binding_detail
-            if not collection_binding_detail:
-                raise ValueError("Collection binding detail not found")
-
-            return {
-                "id": annotation_setting.id,
-                "enabled": True,
-                "score_threshold": annotation_setting.score_threshold,
-                "embedding_model": {
-                    "embedding_provider_name": collection_binding_detail.provider_name,
-                    "embedding_model_name": collection_binding_detail.model_name,
-                },
-            }
-
-        else:
-            return {"enabled": False}
+        return load_annotation_reply_config(db.session(), self.app_id)
 
     @property
     def more_like_this_dict(self) -> EnabledConfig:
@@ -864,7 +845,7 @@ class AppModelConfig(TypeBase):
             },
         )
 
-    def to_dict(self) -> AppModelConfigDict:
+    def to_dict(self, *, annotation_reply: AnnotationReplyConfig | None = None) -> AppModelConfigDict:
         return {
             "opening_statement": self.opening_statement,
             "suggested_questions": self.suggested_questions_list,
@@ -872,7 +853,7 @@ class AppModelConfig(TypeBase):
             "speech_to_text": self.speech_to_text_dict,
             "text_to_speech": self.text_to_speech_dict,
             "retriever_resource": self.retriever_resource_dict,
-            "annotation_reply": self.annotation_reply_dict,
+            "annotation_reply": annotation_reply if annotation_reply is not None else self.annotation_reply_dict,
             "more_like_this": self.more_like_this_dict,
             "sensitive_word_avoidance": self.sensitive_word_avoidance_dict,
             "external_data_tools": self.external_data_tools_list,
@@ -2038,6 +2019,30 @@ class AppAnnotationSetting(TypeBase):
         )
 
 
+def load_annotation_reply_config(session: Session, app_id: str) -> AnnotationReplyConfig:
+    annotation_setting = session.scalar(select(AppAnnotationSetting).where(AppAnnotationSetting.app_id == app_id))
+    if annotation_setting is None:
+        return {"enabled": False}
+
+    from .dataset import DatasetCollectionBinding
+
+    collection_binding_detail = session.scalar(
+        select(DatasetCollectionBinding).where(DatasetCollectionBinding.id == annotation_setting.collection_binding_id)
+    )
+    if collection_binding_detail is None:
+        raise ValueError("Collection binding detail not found")
+
+    return {
+        "id": annotation_setting.id,
+        "enabled": True,
+        "score_threshold": annotation_setting.score_threshold,
+        "embedding_model": {
+            "embedding_provider_name": collection_binding_detail.provider_name,
+            "embedding_model_name": collection_binding_detail.model_name,
+        },
+    }
+
+
 class OperationLog(TypeBase):
     __tablename__ = "operation_logs"
     __table_args__ = (
diff --git a/api/openapi/markdown/console-openapi.md b/api/openapi/markdown/console-openapi.md
index c2c06db463c..49a053ea1c4 100644
--- a/api/openapi/markdown/console-openapi.md
+++ b/api/openapi/markdown/console-openapi.md
@@ -391,6 +391,80 @@ Check if activation token is valid
 | 400 | Invalid request parameters |  |
 | 403 | Insufficient permissions |  |
 
+### [GET] /agent/{agent_id}/api-access
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| agent_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Agent service API access | **application/json**: [AgentApiAccessResponse](#agentapiaccessresponse)<br> |
+
+### [POST] /agent/{agent_id}/api-enable
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| agent_id | path |  | Yes | string (uuid) |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [AgentApiStatusPayload](#agentapistatuspayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Agent service API status updated | **application/json**: [AgentApiAccessResponse](#agentapiaccessresponse)<br> |
+| 403 | Insufficient permissions |  |
+
+### [GET] /agent/{agent_id}/api-keys
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| agent_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Agent service API keys | **application/json**: [ApiKeyList](#apikeylist)<br> |
+
+### [POST] /agent/{agent_id}/api-keys
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| agent_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 201 | Agent service API key created | **application/json**: [ApiKeyItem](#apikeyitem)<br> |
+| 400 | Maximum keys exceeded |  |
+
+### [DELETE] /agent/{agent_id}/api-keys/{api_key_id}
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| agent_id | path |  | Yes | string (uuid) |
+| api_key_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description |
+| ---- | ----------- |
+| 204 | Agent service API key deleted |
+
 ### [GET] /agent/{agent_id}/chat-messages
 Get Agent App chat messages for a conversation with pagination
 
@@ -518,7 +592,7 @@ Stop a running Agent App chat message generation
 
 | Required | Schema |
 | -------- | ------ |
-|  Yes | **application/json**: [CopyAppPayload](#copyapppayload)<br> |
+|  Yes | **application/json**: [AgentAppCopyPayload](#agentappcopypayload)<br> |
 
 #### Responses
 
@@ -528,6 +602,20 @@ Stop a running Agent App chat message generation
 | 400 | Invalid request parameters |  |
 | 403 | Insufficient permissions |  |
 
+### [POST] /agent/{agent_id}/debug-conversation/refresh
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| agent_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Agent debug conversation refreshed | **application/json**: [AgentDebugConversationRefreshResponse](#agentdebugconversationrefreshresponse)<br> |
+| 403 | Insufficient permissions |  |
+
 ### [GET] /agent/{agent_id}/drive/files
 List agent drive entries for an Agent App
 
@@ -576,6 +664,37 @@ Truncated text preview of one Agent App drive value
 | ---- | ----------- | ------ |
 | 200 | Preview | **application/json**: [AgentDrivePreviewResponse](#agentdrivepreviewresponse)<br> |
 
+### [GET] /agent/{agent_id}/drive/skills
+List drive-backed skills for an Agent App
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| agent_id | path | Agent ID | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Drive skills | **application/json**: [AgentDriveSkillListResponse](#agentdriveskilllistresponse)<br> |
+
+### [GET] /agent/{agent_id}/drive/skills/{skill_path}/inspect
+Inspect one drive-backed skill for slash-menu hover/detail UI
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| agent_id | path | Agent ID | Yes | string (uuid) |
+| skill_path | path | Skill path/slug, e.g. tender-analyzer | Yes | string |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Drive skill inspect view | **application/json**: [AgentDriveSkillInspectResponse](#agentdriveskillinspectresponse)<br> |
+
 ### [POST] /agent/{agent_id}/features
 Update an Agent App's presentation features (opener, follow-up, citations, ...)
 
@@ -905,6 +1024,20 @@ Infer CLI tool + ENV suggestions from a standardized Agent App skill
 | ---- | ----------- | ------ |
 | 200 | Agent version detail | **application/json**: [AgentConfigSnapshotDetailResponse](#agentconfigsnapshotdetailresponse)<br> |
 
+### [POST] /agent/{agent_id}/versions/{version_id}/restore
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| agent_id | path |  | Yes | string (uuid) |
+| version_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Agent version restored | **application/json**: [AgentConfigSnapshotRestoreResponse](#agentconfigsnapshotrestoreresponse)<br> |
+
 ### [GET] /all-workspaces
 #### Parameters
 
@@ -1454,8 +1587,42 @@ Truncated text preview of one drive value (binary-safe; SKILL.md is the main cas
 | ---- | ----------- | ------ |
 | 200 | Preview | **application/json**: [AgentDrivePreviewResponse](#agentdrivepreviewresponse)<br> |
 
+### [GET] /apps/{app_id}/agent/drive/skills
+List drive-backed skills for the bound agent
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| app_id | path | Application ID | Yes | string (uuid) |
+| node_id | query | Workflow node ID (workflow composer variant) | No | string |
+| prefix | query | Key prefix filter: '<slug>/' for one skill, 'files/' for files | No | string |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Drive skills | **application/json**: [AgentDriveSkillListResponse](#agentdriveskilllistresponse)<br> |
+
+### [GET] /apps/{app_id}/agent/drive/skills/{skill_path}/inspect
+Inspect one drive-backed skill for slash-menu hover/detail UI
+
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| app_id | path | Application ID | Yes | string (uuid) |
+| skill_path | path | Skill path/slug, e.g. tender-analyzer | Yes | string |
+| node_id | query | Workflow node ID (workflow composer variant) | No | string |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Drive skill inspect view | **application/json**: [AgentDriveSkillInspectResponse](#agentdriveskillinspectresponse)<br> |
+
 ### [DELETE] /apps/{app_id}/agent/files
-Delete one drive file by key; soul ref first, then the KV row (ENG-625 D5)
+Delete one drive file by key via drive commit-null semantics
 
 #### Parameters
 
@@ -1541,7 +1708,7 @@ Upload + standardize a Skill into the agent drive
 | 400 | Invalid skill package or no bound agent |  |
 
 ### [DELETE] /apps/{app_id}/agent/skills/{slug}
-Delete a standardized skill: soul ref first, then the <slug>/ drive prefix (ENG-625 D5)
+Delete a standardized skill by removing its known drive keys via commit-null
 
 #### Parameters
 
@@ -7992,7 +8159,7 @@ Get all published workflows for a snippet
 
 | Code | Description | Schema |
 | ---- | ----------- | ------ |
-| 200 | Published workflows retrieved successfully | **application/json**: [WorkflowPaginationResponse](#workflowpaginationresponse)<br> |
+| 200 | Published workflows retrieved successfully | **application/json**: [SnippetWorkflowPaginationResponse](#snippetworkflowpaginationresponse)<br> |
 
 ### [GET] /snippets/{snippet_id}/workflows/default-workflow-block-configs
 **Get default block configurations for snippet workflow**
@@ -11954,6 +12121,31 @@ Default namespace
 | chat_prompt_config | object |  | No |
 | completion_prompt_config | object |  | No |
 
+#### AgentApiAccessResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| api_key_count | integer |  | Yes |
+| api_rph | integer |  | Yes |
+| api_rpm | integer |  | Yes |
+| chat_endpoint | string |  | Yes |
+| conversations_endpoint | string |  | Yes |
+| enabled | boolean |  | Yes |
+| files_upload_endpoint | string |  | Yes |
+| info_endpoint | string |  | Yes |
+| messages_endpoint | string |  | Yes |
+| meta_endpoint | string |  | Yes |
+| parameters_endpoint | string |  | Yes |
+| service_api_base_url | string |  | Yes |
+| stop_endpoint | string |  | Yes |
+| streaming_only | boolean, <br>**Default:** true |  | No |
+
+#### AgentApiStatusPayload
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| enable_api | boolean | Enable or disable Agent service API | Yes |
+
 #### AgentAppComposerResponse
 
 | Name | Type | Description | Required |
@@ -11965,6 +12157,17 @@ Default namespace
 | validation | [ComposerValidationFindingsResponse](#composervalidationfindingsresponse) |  | No |
 | variant | string |  | Yes |
 
+#### AgentAppCopyPayload
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| description | string | Description for the copied agent | No |
+| icon | string | Icon | No |
+| icon_background | string | Icon background color | No |
+| icon_type | [IconType](#icontype) | Icon type | No |
+| name | string | Name for the copied agent | No |
+| role | string | Role for the copied agent | No |
+
 #### AgentAppCreatePayload
 
 | Name | Type | Description | Required |
@@ -11987,6 +12190,7 @@ Default namespace
 | bound_agent_id | string |  | No |
 | created_at | integer |  | No |
 | created_by | string |  | No |
+| debug_conversation_id | string |  | No |
 | deleted_tools | [ [DeletedTool](#deletedtool) ] |  | No |
 | description | string |  | No |
 | enable_api | boolean |  | Yes |
@@ -12050,6 +12254,7 @@ default (the config form sends the full desired feature state on save).
 | create_user_name | string |  | No |
 | created_at | integer |  | No |
 | created_by | string |  | No |
+| debug_conversation_id | string |  | No |
 | description | string |  | No |
 | has_draft_trigger | boolean |  | No |
 | icon | string |  | No |
@@ -12212,23 +12417,6 @@ Risk marker for CLI tool bootstrap commands.
 | provider_id | string |  | No |
 | tools_count | integer |  | No |
 
-#### AgentComposerFileCandidateResponse
-
-| Name | Type | Description | Required |
-| ---- | ---- | ----------- | -------- |
-| drive_key | string |  | No |
-| file_id | string |  | No |
-| id | string |  | No |
-| kind | string, <br>**Default:** file |  | No |
-| name | string |  | No |
-| reference | string |  | No |
-| remote_url | string |  | No |
-| tenant_id | string |  | No |
-| transfer_method | string |  | No |
-| type | string |  | No |
-| upload_file_id | string |  | No |
-| url | string |  | No |
-
 #### AgentComposerImpactBindingResponse
 
 | Name | Type | Description | Required |
@@ -12253,22 +12441,6 @@ Risk marker for CLI tool bootstrap commands.
 | human_contacts | [ [AgentHumanContactConfig](#agenthumancontactconfig) ] |  | No |
 | previous_node_outputs | [ [WorkflowPreviousNodeOutputRef](#workflowpreviousnodeoutputref) ] |  | No |
 
-#### AgentComposerSkillCandidateResponse
-
-| Name | Type | Description | Required |
-| ---- | ---- | ----------- | -------- |
-| description | string |  | No |
-| file_id | string |  | No |
-| full_archive_file_id | string |  | No |
-| full_archive_key | string |  | No |
-| id | string |  | No |
-| kind | string, <br>**Default:** skill |  | No |
-| manifest_files | [ string ] |  | No |
-| name | string |  | No |
-| path | string |  | No |
-| skill_md_file_id | string |  | No |
-| skill_md_key | string |  | No |
-
 #### AgentComposerSoulCandidatesResponse
 
 | Name | Type | Description | Required |
@@ -12277,7 +12449,6 @@ Risk marker for CLI tool bootstrap commands.
 | dify_tools | [ [AgentComposerDifyToolCandidateResponse](#agentcomposerdifytoolcandidateresponse) ] |  | No |
 | human_contacts | [ [AgentHumanContactConfig](#agenthumancontactconfig) ] |  | No |
 | knowledge_datasets | [ [AgentKnowledgeDatasetConfig](#agentknowledgedatasetconfig) ] |  | No |
-| skills_files | [  ] |  | No |
 
 #### AgentComposerSoulLockResponse
 
@@ -12340,6 +12511,13 @@ Audit operation recorded for Agent Soul version/revision changes.
 | ---- | ---- | ----------- | -------- |
 | data | [ [AgentConfigSnapshotSummaryResponse](#agentconfigsnapshotsummaryresponse) ] |  | Yes |
 
+#### AgentConfigSnapshotRestoreResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| active_config_snapshot_id | string |  | Yes |
+| result | string |  | Yes |
+
 #### AgentConfigSnapshotSummaryResponse
 
 | Name | Type | Description | Required |
@@ -12375,6 +12553,12 @@ Audit operation recorded for Agent Soul version/revision changes.
 | date | string |  | Yes |
 | message_count | integer |  | Yes |
 
+#### AgentDebugConversationRefreshResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| debug_conversation_id | string |  | Yes |
+
 #### AgentDriveDeleteFileByAgentQuery
 
 | Name | Type | Description | Required |
@@ -12385,7 +12569,6 @@ Audit operation recorded for Agent Soul version/revision changes.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| config_version_id | string |  | No |
 | removed_keys | [ string ] |  | No |
 | result | string |  | Yes |
 
@@ -12399,7 +12582,6 @@ Audit operation recorded for Agent Soul version/revision changes.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| config_version_id | string |  | No |
 | file | [AgentDriveFileResponse](#agentdrivefileresponse) |  | Yes |
 
 #### AgentDriveFilePayload
@@ -12425,9 +12607,11 @@ Audit operation recorded for Agent Soul version/revision changes.
 | created_at | integer |  | No |
 | file_kind | string |  | Yes |
 | hash | string |  | No |
+| is_skill | boolean |  | No |
 | key | string |  | Yes |
 | mime_type | string |  | No |
 | size | integer |  | No |
+| skill_metadata | string |  | No |
 
 #### AgentDriveListResponse
 
@@ -12445,6 +12629,65 @@ Audit operation recorded for Agent Soul version/revision changes.
 | text | string |  | No |
 | truncated | boolean |  | Yes |
 
+#### AgentDriveSkillFileResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| available_in_drive | boolean |  | Yes |
+| drive_key | string |  | No |
+| name | string |  | Yes |
+| path | string |  | Yes |
+| type | string |  | Yes |
+
+#### AgentDriveSkillInspectResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| archive_key | string |  | No |
+| created_at | integer |  | No |
+| description | string |  | Yes |
+| file_tree | [ object ] |  | No |
+| files | [ [AgentDriveSkillFileResponse](#agentdriveskillfileresponse) ] |  | No |
+| hash | string |  | No |
+| mime_type | string |  | No |
+| name | string |  | Yes |
+| path | string |  | Yes |
+| size | integer |  | No |
+| skill_md | [AgentDriveSkillMarkdownResponse](#agentdriveskillmarkdownresponse) |  | Yes |
+| skill_md_key | string |  | Yes |
+| source | string |  | Yes |
+| warnings | [ string ] |  | No |
+
+#### AgentDriveSkillItemResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| archive_key | string |  | No |
+| created_at | integer |  | No |
+| description | string |  | Yes |
+| hash | string |  | No |
+| mime_type | string |  | No |
+| name | string |  | Yes |
+| path | string |  | Yes |
+| size | integer |  | No |
+| skill_md_key | string |  | Yes |
+
+#### AgentDriveSkillListResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| items | [ [AgentDriveSkillItemResponse](#agentdriveskillitemresponse) ] |  | No |
+
+#### AgentDriveSkillMarkdownResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| binary | boolean |  | Yes |
+| key | string |  | Yes |
+| size | integer |  | No |
+| text | string |  | No |
+| truncated | boolean |  | Yes |
+
 #### AgentEnvVariableConfig
 
 | Name | Type | Description | Required |
@@ -12924,27 +13167,12 @@ Visibility and lifecycle scope of an Agent record.
 | enabled | boolean |  | No |
 | type | string |  | No |
 
-#### AgentSkillRefConfig
-
-| Name | Type | Description | Required |
-| ---- | ---- | ----------- | -------- |
-| description | string |  | No |
-| file_id | string |  | No |
-| full_archive_file_id | string |  | No |
-| full_archive_key | string |  | No |
-| id | string |  | No |
-| manifest_files | [ string ] |  | No |
-| name | string |  | No |
-| path | string |  | No |
-| skill_md_file_id | string |  | No |
-| skill_md_key | string |  | No |
-
 #### AgentSkillUploadResponse
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
 | manifest | [SkillManifest](#skillmanifest) |  | Yes |
-| skill | [AgentSkillRefConfig](#agentskillrefconfig) |  | Yes |
+| skill | [AgentUploadedSkillResponse](#agentuploadedskillresponse) |  | Yes |
 
 #### AgentSoulAppFeaturesConfig
 
@@ -12973,7 +13201,6 @@ Visibility and lifecycle scope of an Agent record.
 | prompt | [AgentSoulPromptConfig](#agentsoulpromptconfig) |  | No |
 | sandbox | [AgentSoulSandboxConfig](#agentsoulsandboxconfig) |  | No |
 | schema_version | integer, <br>**Default:** 1 |  | No |
-| skills_files | [AgentSoulSkillsFilesConfig](#agentsoulskillsfilesconfig) |  | No |
 | tools | [AgentSoulToolsConfig](#agentsoultoolsconfig) |  | No |
 
 #### AgentSoulDifyToolConfig
@@ -13090,13 +13317,6 @@ Reference to model credentials resolved only at runtime.
 | config | [AgentSandboxProviderConfig](#agentsandboxproviderconfig) |  | No |
 | provider | string |  | No |
 
-#### AgentSoulSkillsFilesConfig
-
-| Name | Type | Description | Required |
-| ---- | ---- | ----------- | -------- |
-| files | [ [AgentFileRefConfig](#agentfilerefconfig) ] |  | No |
-| skills | [ [AgentSkillRefConfig](#agentskillrefconfig) ] |  | No |
-
 #### AgentSoulToolsConfig
 
 | Name | Type | Description | Required |
@@ -13228,6 +13448,16 @@ Soft lifecycle state for Agent records.
 | tool_output | object |  | Yes |
 | tool_parameters | object |  | Yes |
 
+#### AgentUploadedSkillResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| archive_key | string |  | No |
+| description | string |  | Yes |
+| name | string |  | Yes |
+| path | string |  | Yes |
+| skill_md_key | string |  | Yes |
+
 #### AgentUserSatisfactionRateStatisticResponse
 
 | Name | Type | Description | Required |
@@ -19188,6 +19418,15 @@ Query parameters for listing snippet published workflows.
 | limit | integer, <br>**Default:** 10 |  | No |
 | page | integer, <br>**Default:** 1 |  | No |
 
+#### SnippetWorkflowPaginationResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| has_more | boolean |  | Yes |
+| items | [ [SnippetWorkflowResponse](#snippetworkflowresponse) ] |  | Yes |
+| limit | integer |  | Yes |
+| page | integer |  | Yes |
+
 #### SnippetWorkflowResponse
 
 | Name | Type | Description | Required |
diff --git a/api/openapi/markdown/openapi-openapi.md b/api/openapi/markdown/openapi-openapi.md
index ce0150e8e88..4bb6761c22e 100644
--- a/api/openapi/markdown/openapi-openapi.md
+++ b/api/openapi/markdown/openapi-openapi.md
@@ -80,10 +80,9 @@ User-scoped operations
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | limit | query |  | No | integer, <br>**Default:** 20 |
-| mode | query |  | No | string, <br>**Available values:** "advanced-chat", "agent", "agent-chat", "channel", "chat", "completion", "rag-pipeline", "workflow" |
+| mode | query | App types the ``app`` usage face (``get app``) lists and filters.  A curated subset of :class:`AppMode`: the real, user-facing app categories. Excludes runtime-only mode tags that are not standalone apps (``rag-pipeline`` is a knowledge ``Pipeline``; ``channel`` is unused) and the roster-owned ``agent`` type (surfaced through the roster, not this list).  Members reference ``AppMode.*.value`` so the subset relationship is type-checked: dropping a member from ``AppMode`` breaks this at import. This is the single source for the listable set — params, filters, and the generated CLI whitelist all derive from it. | No | string, <br>**Available values:** "advanced-chat", "agent-chat", "chat", "completion", "workflow" |
 | name | query |  | No | string |
 | page | query |  | No | integer, <br>**Default:** 1 |
-| tag | query |  | No | string |
 | workspace_id | query |  | Yes | string |
 
 #### Responses
@@ -319,7 +318,7 @@ Upload a file to use as an input variable when running the app
 | Name | Located in | Description | Required | Schema |
 | ---- | ---------- | ----------- | -------- | ------ |
 | limit | query |  | No | integer, <br>**Default:** 20 |
-| mode | query |  | No | string, <br>**Available values:** "advanced-chat", "agent", "agent-chat", "channel", "chat", "completion", "rag-pipeline", "workflow" |
+| mode | query | App types the ``app`` usage face (``get app``) lists and filters.  A curated subset of :class:`AppMode`: the real, user-facing app categories. Excludes runtime-only mode tags that are not standalone apps (``rag-pipeline`` is a knowledge ``Pipeline``; ``channel`` is unused) and the roster-owned ``agent`` type (surfaced through the roster, not this list).  Members reference ``AppMode.*.value`` so the subset relationship is type-checked: dropping a member from ``AppMode`` breaks this at import. This is the single source for the listable set — params, filters, and the generated CLI whitelist all derive from it. | No | string, <br>**Available values:** "advanced-chat", "agent-chat", "chat", "completion", "workflow" |
 | name | query |  | No | string |
 | page | query |  | No | integer, <br>**Default:** 1 |
 
@@ -331,6 +330,22 @@ Upload a file to use as an input variable when running the app
 | 422 | Validation error | **application/json**: [ErrorBody](#errorbody)<br> |
 | default | Error | **application/json**: [ErrorBody](#errorbody)<br> |
 
+### [GET] /permitted-external-apps/{app_id}/describe
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| fields | query |  | No | string |
+| app_id | path |  | Yes | string |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Permitted external app description | **application/json**: [AppDescribeResponse](#appdescriberesponse)<br> |
+| 422 | Validation error | **application/json**: [ErrorBody](#errorbody)<br> |
+| default | Error | **application/json**: [ErrorBody](#errorbody)<br> |
+
 ### [GET] /workspaces
 #### Responses
 
@@ -507,14 +522,12 @@ Upload a file to use as an input variable when running the app
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| author | string |  | No |
 | description | string |  | No |
 | id | string |  | Yes |
 | is_agent | boolean |  | No |
 | mode | string |  | Yes |
 | name | string |  | Yes |
 | service_api_enabled | boolean |  | Yes |
-| tags | [ [TagItem](#tagitem) ], <br>**Default:**  |  | No |
 | updated_at | string |  | No |
 
 #### AppDescribeQuery
@@ -568,28 +581,25 @@ Request body for POST /workspaces/<workspace_id>/apps/imports.
 | yaml_content | string | Inline YAML DSL string (required when mode is yaml-content) | No |
 | yaml_url | string | Remote URL to fetch YAML from (required when mode is yaml-url) | No |
 
-#### AppInfoResponse
+#### AppInfo
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| author | string |  | No |
 | description | string |  | No |
 | id | string |  | Yes |
 | mode | string |  | Yes |
 | name | string |  | Yes |
-| tags | [ [TagItem](#tagitem) ], <br>**Default:**  |  | No |
 
 #### AppListQuery
 
-mode is a closed enum.
+mode is a closed enum of listable app types.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
 | limit | integer, <br>**Default:** 20 |  | No |
-| mode | [AppMode](#appmode) |  | No |
+| mode | [SupportedAppType](#supportedapptype) |  | No |
 | name | string |  | No |
 | page | integer, <br>**Default:** 1 |  | No |
-| tag | string |  | No |
 | workspace_id | string |  | Yes |
 
 #### AppListResponse
@@ -606,12 +616,10 @@ mode is a closed enum.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| created_by_name | string |  | No |
 | description | string |  | No |
 | id | string |  | Yes |
 | mode | [AppMode](#appmode) |  | Yes |
 | name | string |  | Yes |
-| tags | [ [TagItem](#tagitem) ], <br>**Default:**  |  | No |
 | updated_at | string |  | No |
 | workspace_id | string |  | No |
 | workspace_name | string |  | No |
@@ -914,7 +922,7 @@ Strict (extra='forbid').
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
 | limit | integer, <br>**Default:** 20 |  | No |
-| mode | [AppMode](#appmode) |  | No |
+| mode | [SupportedAppType](#supportedapptype) |  | No |
 | name | string |  | No |
 | page | integer, <br>**Default:** 1 |  | No |
 
@@ -982,11 +990,23 @@ Pagination for GET /account/sessions. Strict (extra='forbid').
 | last_used_at | string |  | No |
 | prefix | string |  | Yes |
 
-#### TagItem
+#### SupportedAppType
+
+App types the ``app`` usage face (``get app``) lists and filters.
+
+A curated subset of :class:`AppMode`: the real, user-facing app categories.
+Excludes runtime-only mode tags that are not standalone apps
+(``rag-pipeline`` is a knowledge ``Pipeline``; ``channel`` is unused) and the
+roster-owned ``agent`` type (surfaced through the roster, not this list).
+
+Members reference ``AppMode.*.value`` so the subset relationship is
+type-checked: dropping a member from ``AppMode`` breaks this at import.
+This is the single source for the listable set — params, filters, and the
+generated CLI whitelist all derive from it.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| name | string |  | Yes |
+| SupportedAppType | string | App types the ``app`` usage face (``get app``) lists and filters.  A curated subset of :class:`AppMode`: the real, user-facing app categories. Excludes runtime-only mode tags that are not standalone apps (``rag-pipeline`` is a knowledge ``Pipeline``; ``channel`` is unused) and the roster-owned ``agent`` type (surfaced through the roster, not this list).  Members reference ``AppMode.*.value`` so the subset relationship is type-checked: dropping a member from ``AppMode`` breaks this at import. This is the single source for the listable set — params, filters, and the generated CLI whitelist all derive from it. |  |
 
 #### TaskStopResponse
 
diff --git a/api/providers/trace/trace-aliyun/tests/unit_tests/aliyun_trace/data_exporter/test_traceclient.py b/api/providers/trace/trace-aliyun/tests/unit_tests/aliyun_trace/data_exporter/test_traceclient.py
index 12f91212c1f..797134b3619 100644
--- a/api/providers/trace/trace-aliyun/tests/unit_tests/aliyun_trace/data_exporter/test_traceclient.py
+++ b/api/providers/trace/trace-aliyun/tests/unit_tests/aliyun_trace/data_exporter/test_traceclient.py
@@ -1,3 +1,4 @@
+import logging
 import time
 import uuid
 from datetime import datetime
@@ -142,9 +143,8 @@ class TestTraceClient:
             mock_notify.assert_called_once()
 
     @patch("dify_trace_aliyun.data_exporter.traceclient.OTLPSpanExporter")
-    @patch("dify_trace_aliyun.data_exporter.traceclient.logger")
     def test_add_span_queue_full(
-        self, mock_logger: MagicMock, mock_exporter_class: MagicMock, trace_client_factory: type[TraceClient]
+        self, mock_exporter_class: MagicMock, trace_client_factory: type[TraceClient], caplog: pytest.LogCaptureFixture
     ):
         client = trace_client_factory(service_name="test-service", endpoint="http://test-endpoint", max_queue_size=1)
 
@@ -164,12 +164,15 @@ class TestTraceClient:
         client.add_span(span_data)
         assert len(client.queue) == 1
 
-        client.add_span(span_data)
-        assert len(client.queue) == 1
-        mock_logger.warning.assert_called_with("Queue is full, likely spans will be dropped.")
+        with caplog.at_level(logging.WARNING):
+            client.add_span(span_data)
+            assert len(client.queue) == 1
+            assert "Queue is full, likely spans will be dropped." in caplog.text
 
     @patch("dify_trace_aliyun.data_exporter.traceclient.OTLPSpanExporter")
-    def test_export_batch_error(self, mock_exporter_class: MagicMock, trace_client_factory: type[TraceClient]):
+    def test_export_batch_error(
+        self, mock_exporter_class: MagicMock, trace_client_factory: type[TraceClient], caplog: pytest.LogCaptureFixture
+    ):
         mock_exporter = mock_exporter_class.return_value
         mock_exporter.export.side_effect = Exception("Export failed")
 
@@ -177,9 +180,9 @@ class TestTraceClient:
         mock_span = MagicMock(spec=ReadableSpan)
         client.queue.append(mock_span)
 
-        with patch("dify_trace_aliyun.data_exporter.traceclient.logger") as mock_logger:
+        with caplog.at_level(logging.WARNING):
             client._export_batch()
-            mock_logger.warning.assert_called()
+            assert "Error exporting spans" in caplog.text
 
     @patch("dify_trace_aliyun.data_exporter.traceclient.OTLPSpanExporter")
     def test_worker_loop(self, mock_exporter_class: MagicMock, trace_client_factory: type[TraceClient]):
diff --git a/api/providers/trace/trace-weave/tests/unit_tests/weave_trace/test_weave_trace.py b/api/providers/trace/trace-weave/tests/unit_tests/weave_trace/test_weave_trace.py
index 30646815d83..0e1f33b437d 100644
--- a/api/providers/trace/trace-weave/tests/unit_tests/weave_trace/test_weave_trace.py
+++ b/api/providers/trace/trace-weave/tests/unit_tests/weave_trace/test_weave_trace.py
@@ -307,13 +307,12 @@ class TestGetProjectUrl:
         monkeypatch.setattr(trace_instance, "entity", None)
         monkeypatch.setattr(trace_instance, "project_name", None)
         # Force an error by making string formatting fail
-        with patch("dify_trace_weave.weave_trace.logger") as mock_logger:
-            # Simulate exception via property
-            original_entity = trace_instance.entity
-            trace_instance.entity = None
-            trace_instance.project_name = None
-            url = trace_instance.get_project_url()
-            assert "https://wandb.ai/" in url
+        # Simulate exception via property
+        original_entity = trace_instance.entity
+        trace_instance.entity = None
+        trace_instance.project_name = None
+        url = trace_instance.get_project_url()
+        assert "https://wandb.ai/" in url
 
 
 # ── TestTraceDispatcher ─────────────────────────────────────────────────────
diff --git a/api/repositories/api_workflow_run_repository.py b/api/repositories/api_workflow_run_repository.py
index 2659e550552..bc30e980619 100644
--- a/api/repositories/api_workflow_run_repository.py
+++ b/api/repositories/api_workflow_run_repository.py
@@ -290,7 +290,10 @@ class APIWorkflowRunRepository(WorkflowExecutionRepository, Protocol):
         batch_size: int,
         run_types: Sequence[WorkflowType] | None = None,
         tenant_ids: Sequence[str] | None = None,
+        tenant_prefixes: Sequence[str] | None = None,
         workflow_ids: Sequence[str] | None = None,
+        run_shard_index: int | None = None,
+        run_shard_total: int | None = None,
     ) -> Sequence[WorkflowRun]:
         """
         Fetch ended workflow runs in a time window for archival and clean batching.
@@ -298,7 +301,9 @@ class APIWorkflowRunRepository(WorkflowExecutionRepository, Protocol):
         Optional filters:
         - run_types
         - tenant_ids
+        - tenant_prefixes, using the first hexadecimal digit of tenant_id for rollout waves
         - workflow_ids
+        - run_shard_index/run_shard_total, using a deterministic workflow_run_id shard
         """
         ...
 
diff --git a/api/repositories/sqlalchemy_api_workflow_run_repository.py b/api/repositories/sqlalchemy_api_workflow_run_repository.py
index b40eb4bdd8a..2394377c9d4 100644
--- a/api/repositories/sqlalchemy_api_workflow_run_repository.py
+++ b/api/repositories/sqlalchemy_api_workflow_run_repository.py
@@ -56,6 +56,7 @@ from repositories.types import (
     DailyTerminalsStats,
     DailyTokenCostStats,
 )
+from services.retention.workflow_run.tenant_prefix import tenant_prefix_condition
 
 logger = logging.getLogger(__name__)
 
@@ -64,6 +65,40 @@ class _WorkflowRunError(Exception):
     pass
 
 
+_HEX_SHARD_VALUES = {
+    "0": 0,
+    "1": 1,
+    "2": 2,
+    "3": 3,
+    "4": 4,
+    "5": 5,
+    "6": 6,
+    "7": 7,
+    "8": 8,
+    "9": 9,
+    "a": 10,
+    "b": 11,
+    "c": 12,
+    "d": 13,
+    "e": 14,
+    "f": 15,
+}
+
+
+def _tenant_prefix_condition(prefixes: Sequence[str]) -> sa.ColumnElement[bool]:
+    conditions = [tenant_prefix_condition(WorkflowRun.tenant_id, prefix) for prefix in prefixes]
+    return sa.or_(*conditions)
+
+
+def _workflow_run_id_shard_expr() -> sa.ColumnElement[int]:
+    normalized_id = func.lower(func.replace(sa.cast(WorkflowRun.id, sa.String()), "-", ""))
+    last_hex = func.substr(normalized_id, func.length(normalized_id), 1)
+    return sa.case(
+        *[(last_hex == hex_digit, shard_value) for hex_digit, shard_value in _HEX_SHARD_VALUES.items()],
+        else_=0,
+    )
+
+
 def _build_human_input_required_reason(
     reason_model: WorkflowPauseReason,
     form_model: HumanInputForm | None,
@@ -378,7 +413,10 @@ class DifyAPISQLAlchemyWorkflowRunRepository(APIWorkflowRunRepository):
         batch_size: int,
         run_types: Sequence[WorkflowType] | None = None,
         tenant_ids: Sequence[str] | None = None,
+        tenant_prefixes: Sequence[str] | None = None,
         workflow_ids: Sequence[str] | None = None,
+        run_shard_index: int | None = None,
+        run_shard_total: int | None = None,
     ) -> Sequence[WorkflowRun]:
         """
         Fetch ended workflow runs in a time window for archival and clean batching.
@@ -387,7 +425,8 @@ class DifyAPISQLAlchemyWorkflowRunRepository(APIWorkflowRunRepository):
         - created_at in [start_from, end_before)
         - type in run_types (when provided)
         - status is an ended state
-        - optional tenant_id, workflow_id filters and cursor (last_seen) for pagination
+        - optional tenant_id, tenant_prefix, workflow_id filters and cursor (last_seen) for pagination
+        - optional deterministic shard by the last hexadecimal digit of workflow_run_id
         """
         with self._session_maker() as session:
             stmt = (
@@ -410,9 +449,15 @@ class DifyAPISQLAlchemyWorkflowRunRepository(APIWorkflowRunRepository):
             if tenant_ids:
                 stmt = stmt.where(WorkflowRun.tenant_id.in_(tenant_ids))
 
+            if tenant_prefixes:
+                stmt = stmt.where(_tenant_prefix_condition(tenant_prefixes))
+
             if workflow_ids:
                 stmt = stmt.where(WorkflowRun.workflow_id.in_(workflow_ids))
 
+            if run_shard_index is not None and run_shard_total is not None:
+                stmt = stmt.where((_workflow_run_id_shard_expr() % run_shard_total) == run_shard_index)
+
             if last_seen:
                 stmt = stmt.where(
                     tuple_(WorkflowRun.created_at, WorkflowRun.id)
diff --git a/api/services/account_service.py b/api/services/account_service.py
index a608f544747..21b5f1eedba 100644
--- a/api/services/account_service.py
+++ b/api/services/account_service.py
@@ -1280,7 +1280,7 @@ class TenantService:
             tenant = TenantService.create_tenant(name=name, is_setup=is_setup)
         else:
             tenant = TenantService.create_tenant(name=f"{account.name}'s Workspace", is_setup=is_setup)
-        TenantService.create_tenant_member(tenant, account, role="owner")
+        TenantService.create_tenant_member(tenant, account, db.session, role="owner")
         if dify_config.RBAC_ENABLED:
             owner_role_id = AccountService._resolve_legacy_role_id(str(tenant.id), account.id, TenantAccountRole.OWNER)
             RBACService.MemberRoles.replace(
@@ -1294,14 +1294,16 @@ class TenantService:
         tenant_was_created.send(tenant)
 
     @staticmethod
-    def create_tenant_member(tenant: Tenant, account: Account, role: str = "normal") -> TenantAccountJoin:
+    def create_tenant_member(
+        tenant: Tenant, account: Account, session: scoped_session, role: str = "normal"
+    ) -> TenantAccountJoin:
         """Create tenant member"""
         if role == TenantAccountRole.OWNER:
             if TenantService.has_roles(tenant, [TenantAccountRole.OWNER]):
                 logger.error("Tenant %s has already an owner.", tenant.id)
                 raise Exception("Tenant already has an owner.")
 
-        ta = db.session.scalar(
+        ta = session.scalar(
             select(TenantAccountJoin)
             .where(TenantAccountJoin.tenant_id == tenant.id, TenantAccountJoin.account_id == account.id)
             .limit(1)
@@ -1310,9 +1312,9 @@ class TenantService:
             ta.role = TenantAccountRole(role)
         else:
             ta = TenantAccountJoin(tenant_id=tenant.id, account_id=account.id, role=TenantAccountRole(role))
-            db.session.add(ta)
+            session.add(ta)
 
-        db.session.commit()
+        session.commit()
         if dify_config.BILLING_ENABLED:
             BillingService.clean_billing_info_cache(tenant.id)
         return ta
@@ -1915,7 +1917,7 @@ class RegisterService:
             ):
                 try:
                     tenant = TenantService.create_tenant(f"{account.name}'s Workspace")
-                    TenantService.create_tenant_member(tenant, account, role="owner")
+                    TenantService.create_tenant_member(tenant, account, db.session, role="owner")
                     account.current_tenant = tenant
                     tenant_was_created.send(tenant)
                 except Exception:
@@ -1970,7 +1972,7 @@ class RegisterService:
                 status=AccountStatus.PENDING,
                 is_setup=True,
             )
-            TenantService.create_tenant_member(tenant, account, tenant_join_role)
+            TenantService.create_tenant_member(tenant, account, db.session, tenant_join_role)
             TenantService.switch_tenant(account, tenant.id)
             requires_setup = True
         else:
@@ -1983,7 +1985,7 @@ class RegisterService:
             requires_setup = account.status == AccountStatus.PENDING
 
             if not ta and (account.status == AccountStatus.PENDING or dify_config.RBAC_ENABLED):
-                TenantService.create_tenant_member(tenant, account, tenant_join_role)
+                TenantService.create_tenant_member(tenant, account, db.session, tenant_join_role)
 
             # Support resend invitation email when the account is pending status
             if account.status != AccountStatus.PENDING:
diff --git a/api/services/agent/composer_candidates.py b/api/services/agent/composer_candidates.py
index 0a1419be399..7868f2a2f63 100644
--- a/api/services/agent/composer_candidates.py
+++ b/api/services/agent/composer_candidates.py
@@ -137,9 +137,6 @@ def soul_candidates(
     soul = agent_soul or AgentSoulConfig()
     truncated = False
 
-    skills_files = [{"kind": "skill", **skill.model_dump(exclude_none=True)} for skill in soul.skills_files.skills]
-    skills_files += [{"kind": "file", **file.model_dump(exclude_none=True)} for file in soul.skills_files.files]
-
     cli_tools = [tool.model_dump(exclude_none=True) for tool in soul.tools.cli_tools if tool.enabled]
 
     dataset_ids = [dataset.id for dataset in soul.knowledge.datasets if dataset.id]
@@ -162,7 +159,6 @@ def soul_candidates(
     dify_tools = workspace_tools_loader()
 
     lists = {
-        "skills_files": skills_files,
         "dify_tools": dify_tools,
         "cli_tools": cli_tools,
         "knowledge_datasets": knowledge_datasets,
diff --git a/api/services/agent/composer_service.py b/api/services/agent/composer_service.py
index 16ab3627929..0a17c06300f 100644
--- a/api/services/agent/composer_service.py
+++ b/api/services/agent/composer_service.py
@@ -21,7 +21,6 @@ from models.agent import (
     WorkflowAgentNodeBinding,
 )
 from models.agent_config_entities import (
-    AgentFileRefConfig,
     DeclaredOutputConfig,
 )
 from models.agent_config_entities import (
@@ -34,7 +33,6 @@ from services.agent.errors import (
     AgentNameConflictError,
     AgentNotFoundError,
     AgentVersionNotFoundError,
-    InvalidComposerConfigError,
 )
 from services.entities.agent_entities import (
     AgentSoulConfig,
@@ -48,6 +46,13 @@ from services.entities.agent_entities import (
 # WorkflowAgentNodeBinding.workflow_version tag for the draft workflow row.
 # Mirrors Workflow.version when it is "draft" (see models/workflow.py).
 _DRAFT_WORKFLOW_VERSION = "draft"
+_PUBLISH_SAVE_STRATEGIES = frozenset(
+    {
+        ComposerSaveStrategy.SAVE_AS_NEW_VERSION,
+        ComposerSaveStrategy.SAVE_AS_NEW_AGENT,
+        ComposerSaveStrategy.SAVE_TO_ROSTER,
+    }
+)
 
 logger = logging.getLogger(__name__)
 
@@ -73,6 +78,13 @@ def _backfill_cli_tool_ids(agent_soul: AgentSoulConfig | None) -> None:
         seen_ids.add(minted)
 
 
+def _validate_composer_payload_for_strategy(payload: ComposerSavePayload) -> None:
+    if payload.save_strategy in _PUBLISH_SAVE_STRATEGIES:
+        ComposerConfigValidator.validate_publish_payload(payload)
+        return
+    ComposerConfigValidator.validate_draft_save_payload(payload)
+
+
 class AgentComposerService:
     @classmethod
     def load_workflow_composer(cls, *, tenant_id: str, app_id: str, node_id: str) -> dict[str, Any]:
@@ -102,33 +114,10 @@ class AgentComposerService:
             raise ValueError("Workflow composer endpoint only accepts workflow variant")
 
         _backfill_cli_tool_ids(payload.agent_soul)
-        ComposerConfigValidator.validate_save_payload(payload)
+        _validate_composer_payload_for_strategy(payload)
         workflow = cls._get_draft_workflow(tenant_id=tenant_id, app_id=app_id)
         binding = cls._get_workflow_binding(tenant_id=tenant_id, workflow_id=workflow.id, node_id=node_id)
 
-        # ENG-623 §4.4: drive-backed refs must point at real drive rows before the
-        # soul is persisted. Only strategies that write the soul onto an *existing*
-        # agent are checked — new-agent strategies create a fresh (empty) drive, so
-        # any carried drive key would be flagged on the next save instead.
-        if (
-            payload.agent_soul is not None
-            and binding is not None
-            and binding.agent_id
-            and payload.save_strategy
-            in (
-                ComposerSaveStrategy.NODE_JOB_ONLY,
-                ComposerSaveStrategy.SAVE_TO_CURRENT_VERSION,
-                ComposerSaveStrategy.SAVE_AS_NEW_VERSION,
-            )
-            and (
-                payload.save_strategy != ComposerSaveStrategy.NODE_JOB_ONLY
-                or binding.binding_type == WorkflowAgentBindingType.INLINE_AGENT
-            )
-        ):
-            cls._require_drive_refs_resolved(
-                tenant_id=tenant_id, agent_id=binding.agent_id, agent_soul=payload.agent_soul
-            )
-
         match payload.save_strategy:
             case ComposerSaveStrategy.NODE_JOB_ONLY:
                 binding = cls._save_node_job_only(
@@ -176,7 +165,11 @@ class AgentComposerService:
             version_id=version_id,
         )
         state = cls._serialize_workflow_state(binding=binding, agent=agent, version=version)
-        state["validation"] = cls.collect_validation_findings(tenant_id=tenant_id, payload=payload)
+        state["validation"] = cls.collect_validation_findings(
+            tenant_id=tenant_id,
+            payload=payload,
+            agent_id=binding.agent_id,
+        )
         return state
 
     @classmethod
@@ -215,7 +208,7 @@ class AgentComposerService:
         if payload.variant != ComposerVariant.AGENT_APP:
             raise ValueError("Agent App composer endpoint only accepts agent_app variant")
         _backfill_cli_tool_ids(payload.agent_soul)
-        ComposerConfigValidator.validate_save_payload(payload)
+        _validate_composer_payload_for_strategy(payload)
         if payload.agent_soul is None:
             raise ValueError("agent_soul is required")
 
@@ -250,9 +243,6 @@ class AgentComposerService:
                 db.session.rollback()
                 raise AgentNameConflictError() from exc
 
-        # ENG-623 §4.4: dangling drive-backed refs are rejected before persisting.
-        cls._require_drive_refs_resolved(tenant_id=tenant_id, agent_id=agent.id, agent_soul=payload.agent_soul)
-
         if payload.save_strategy == ComposerSaveStrategy.SAVE_AS_NEW_VERSION or not agent.active_config_snapshot_id:
             version = cls._create_config_version(
                 tenant_id=tenant_id,
@@ -281,7 +271,11 @@ class AgentComposerService:
 
         db.session.commit()
         state = cls.load_agent_app_composer(tenant_id=tenant_id, app_id=app_id)
-        state["validation"] = cls.collect_validation_findings(tenant_id=tenant_id, payload=payload)
+        state["validation"] = cls.collect_validation_findings(
+            tenant_id=tenant_id,
+            payload=payload,
+            agent_id=agent.id,
+        )
         return state
 
     @classmethod
@@ -292,11 +286,7 @@ class AgentComposerService:
         payload: ComposerSavePayload,
         agent_id: str | None = None,
     ) -> dict[str, Any]:
-        """ENG-617 soft findings, with DB-backed dataset existence for placeholders.
-
-        With ``agent_id`` the drive-backed skill/file refs are also checked against
-        the agent drive (ENG-623 §4.4) and dangling ones surface as warnings.
-        """
+        """ENG-617 soft findings, with DB-backed dataset and drive mention checks."""
         from services.agent.prompt_mentions import MentionKind, parse_prompt_mentions
 
         mentioned_ids: set[str] = set()
@@ -312,136 +302,14 @@ class AgentComposerService:
         findings = ComposerConfigValidator.collect_soft_findings(payload, existing_dataset_ids=existing_dataset_ids)
         if agent_id and payload.agent_soul is not None:
             findings["warnings"].extend(
-                cls._drive_ref_findings(tenant_id=tenant_id, agent_id=agent_id, agent_soul=payload.agent_soul)
+                cls._drive_mention_findings(
+                    tenant_id=tenant_id,
+                    agent_id=agent_id,
+                    prompt=payload.agent_soul.prompt.system_prompt,
+                )
             )
         return findings
 
-    @classmethod
-    def remove_drive_refs(
-        cls,
-        *,
-        tenant_id: str,
-        agent_id: str,
-        account_id: str,
-        skill_slug: str | None = None,
-        file_key: str | None = None,
-        app_id: str | None = None,
-        node_id: str | None = None,
-    ) -> str | None:
-        """Drop the soul refs backed by a drive skill/file before the drive rows go.
-
-        Soul-first ordering (ENG-625 D5): a mid-failure leaves harmless orphan KV
-        rows that an idempotent DELETE retry cleans, instead of a soul ref that
-        keeps failing dangling-ref validation. Returns the new config version id,
-        or ``None`` when the soul held no matching ref (idempotent re-delete).
-        """
-        if (skill_slug is None) == (file_key is None):
-            raise ValueError("remove_drive_refs requires exactly one of skill_slug or file_key")
-        agent = db.session.scalar(select(Agent).where(Agent.tenant_id == tenant_id, Agent.id == agent_id).limit(1))
-        if agent is None or not agent.active_config_snapshot_id:
-            return None
-        current_snapshot = cls._require_version(
-            tenant_id=tenant_id, agent_id=agent.id, version_id=agent.active_config_snapshot_id
-        )
-        agent_soul = AgentSoulConfig.model_validate(current_snapshot.config_snapshot_dict)
-
-        removed_display: str | None = None
-        if skill_slug is not None:
-            kept_skills = []
-            for skill in agent_soul.skills_files.skills:
-                slug = (skill.skill_md_key or "").split("/", 1)[0] or (skill.path or "").strip("/")
-                if slug == skill_slug:
-                    removed_display = skill.name or skill.id or skill_slug
-                    continue
-                kept_skills.append(skill)
-            if removed_display is None:
-                return None
-            agent_soul.skills_files.skills = kept_skills
-            note = f"Removed skill '{removed_display}' from the drive."
-        else:
-            kept_files = []
-            for file in agent_soul.skills_files.files:
-                if file.drive_key == file_key:
-                    removed_display = file.name or file.drive_key
-                    continue
-                kept_files.append(file)
-            if removed_display is None:
-                return None
-            agent_soul.skills_files.files = kept_files
-            note = f"Removed file '{removed_display}' from the drive."
-
-        version = cls._update_current_version(
-            current_snapshot=current_snapshot,
-            account_id=account_id,
-            agent_soul=agent_soul,
-            operation=AgentConfigRevisionOperation.SAVE_CURRENT_VERSION,
-            version_note=note,
-        )
-        agent.active_config_snapshot_id = version.id
-        agent.updated_by = account_id
-        cls._sync_draft_binding_snapshot(
-            tenant_id=tenant_id,
-            app_id=app_id,
-            node_id=node_id,
-            agent_id=agent_id,
-            snapshot_id=version.id,
-            account_id=account_id,
-        )
-        db.session.commit()
-        return version.id
-
-    @classmethod
-    def add_drive_file_ref(
-        cls,
-        *,
-        tenant_id: str,
-        agent_id: str,
-        account_id: str,
-        file_ref: AgentFileRefConfig,
-        app_id: str | None = None,
-        node_id: str | None = None,
-    ) -> str | None:
-        """Add or replace one drive-backed file ref in the active Agent Soul.
-
-        ``POST /agent/files`` is an ADD FILE user action, not just a low-level
-        drive commit. The committed file must be present in ``skills_files.files``
-        because runtime ``dify.drive`` is built from the active Agent Soul.
-        """
-        if not file_ref.drive_key:
-            raise ValueError("file_ref.drive_key is required")
-        agent = db.session.scalar(select(Agent).where(Agent.tenant_id == tenant_id, Agent.id == agent_id).limit(1))
-        if agent is None or not agent.active_config_snapshot_id:
-            return None
-        current_snapshot = cls._require_version(
-            tenant_id=tenant_id, agent_id=agent.id, version_id=agent.active_config_snapshot_id
-        )
-        agent_soul = AgentSoulConfig.model_validate(current_snapshot.config_snapshot_dict)
-        kept_files = [item for item in agent_soul.skills_files.files if item.drive_key != file_ref.drive_key]
-        kept_files.append(file_ref)
-        agent_soul.skills_files.files = kept_files
-
-        display = file_ref.name or file_ref.drive_key
-        version = cls._update_current_version(
-            current_snapshot=current_snapshot,
-            account_id=account_id,
-            agent_soul=agent_soul,
-            operation=AgentConfigRevisionOperation.SAVE_CURRENT_VERSION,
-            version_note=f"Added file '{display}' to the drive.",
-        )
-        agent.active_config_snapshot_id = version.id
-        agent.active_config_has_model = agent_soul_has_model(agent_soul)
-        agent.updated_by = account_id
-        cls._sync_draft_binding_snapshot(
-            tenant_id=tenant_id,
-            app_id=app_id,
-            node_id=node_id,
-            agent_id=agent_id,
-            snapshot_id=version.id,
-            account_id=account_id,
-        )
-        db.session.commit()
-        return version.id
-
     @classmethod
     def resolve_bound_agent_id(cls, *, tenant_id: str, app_id: str) -> str | None:
         """The Agent App's bound roster agent id, if any (validate-endpoint context)."""
@@ -468,49 +336,25 @@ class AgentComposerService:
         return binding.agent_id if binding else None
 
     @classmethod
-    def _sync_draft_binding_snapshot(
-        cls,
-        *,
-        tenant_id: str,
-        app_id: str | None,
-        node_id: str | None,
-        agent_id: str,
-        snapshot_id: str,
-        account_id: str,
-    ) -> None:
-        """Keep workflow node bindings on the new active snapshot after direct drive edits."""
-        if not app_id or not node_id:
-            return
-        try:
-            workflow = cls._get_draft_workflow(tenant_id=tenant_id, app_id=app_id)
-        except ValueError:
-            return
-        binding = cls._get_workflow_binding(tenant_id=tenant_id, workflow_id=workflow.id, node_id=node_id)
-        if binding is None or binding.agent_id != agent_id:
-            return
-        binding.current_snapshot_id = snapshot_id
-        binding.updated_by = account_id
-
-    @classmethod
-    def _drive_ref_findings(
+    def _drive_mention_findings(
         cls,
         *,
         tenant_id: str,
         agent_id: str,
-        agent_soul: AgentSoulConfig,
+        prompt: str,
     ) -> list[dict[str, str | None]]:
-        """Drive-backed refs whose keys have no row in the agent drive (ENG-623 §4.4).
+        """Soft warnings for missing drive-backed prompt mentions."""
+        from services.agent.prompt_mentions import MentionKind, parse_prompt_mentions
+        from services.agent_drive_service import decode_drive_mention_ref
 
-        Each finding message starts with its stable code token
-        (``skill_ref_dangling`` / ``file_ref_dangling``) in the ENG-616/617 style.
-        """
         wanted_keys: dict[str, tuple[str, str]] = {}
-        for skill in agent_soul.skills_files.skills:
-            if skill.skill_md_key:
-                wanted_keys[skill.skill_md_key] = ("skill_ref_dangling", skill.name or skill.id or "unknown")
-        for file in agent_soul.skills_files.files:
-            if file.drive_key:
-                wanted_keys[file.drive_key] = ("file_ref_dangling", file.name or file.id or "unknown")
+        for mention in parse_prompt_mentions(prompt):
+            if mention.kind not in {MentionKind.SKILL, MentionKind.FILE}:
+                continue
+            decoded_key = decode_drive_mention_ref(mention.ref_id)
+            if not decoded_key:
+                continue
+            wanted_keys[decoded_key] = (mention.kind.value, mention.label or decoded_key)
         if not wanted_keys:
             return []
 
@@ -524,28 +368,20 @@ class AgentComposerService:
             )
         )
         findings: list[dict[str, str | None]] = []
-        for key, (code, display) in wanted_keys.items():
+        for key, (kind, display) in wanted_keys.items():
             if key in existing_keys:
                 continue
-            kind = "skill" if code == "skill_ref_dangling" else "file"
             findings.append(
                 {
-                    "code": code,
+                    "code": "mention_target_missing",
                     "surface": "agent_soul",
                     "kind": kind,
                     "id": key,
-                    "message": f"{code}: {kind} '{display}' has no drive entry for key '{key}'.",
+                    "message": f"{kind} '{display}' has no drive entry for key '{key}'.",
                 }
             )
         return findings
 
-    @classmethod
-    def _require_drive_refs_resolved(cls, *, tenant_id: str, agent_id: str, agent_soul: AgentSoulConfig) -> None:
-        """Hard save-time guard: dangling drive-backed refs are rejected (400)."""
-        findings = cls._drive_ref_findings(tenant_id=tenant_id, agent_id=agent_id, agent_soul=agent_soul)
-        if findings:
-            raise InvalidComposerConfigError("; ".join(str(finding["message"]) for finding in findings))
-
     @classmethod
     def get_workflow_candidates(cls, *, tenant_id: str, app_id: str, node_id: str, user_id: str) -> dict[str, Any]:
         """Slash-menu data source for the workflow Agent node composer (ENG-615)."""
@@ -830,6 +666,16 @@ class AgentComposerService:
     ) -> WorkflowAgentNodeBinding:
         node_job = payload.node_job or WorkflowNodeJobConfig()
         if binding:
+            if cls._is_start_from_scratch_request(binding=binding, payload=payload):
+                return cls._switch_roster_binding_to_inline_agent(
+                    tenant_id=tenant_id,
+                    app_id=app_id,
+                    workflow_id=workflow_id,
+                    node_id=node_id,
+                    account_id=account_id,
+                    binding=binding,
+                    payload=payload,
+                )
             binding.node_job_config = node_job
             if payload.agent_soul is not None and binding.binding_type == WorkflowAgentBindingType.INLINE_AGENT:
                 current_snapshot = cls._require_version(
@@ -880,6 +726,46 @@ class AgentComposerService:
         db.session.flush()
         return binding
 
+    @classmethod
+    def _is_start_from_scratch_request(cls, *, binding: WorkflowAgentNodeBinding, payload: ComposerSavePayload) -> bool:
+        return (
+            binding.binding_type == WorkflowAgentBindingType.ROSTER_AGENT
+            and payload.binding is not None
+            and payload.binding.binding_type == WorkflowAgentBindingType.INLINE_AGENT.value
+        )
+
+    @classmethod
+    def _switch_roster_binding_to_inline_agent(
+        cls,
+        *,
+        tenant_id: str,
+        app_id: str,
+        workflow_id: str,
+        node_id: str,
+        account_id: str,
+        binding: WorkflowAgentNodeBinding,
+        payload: ComposerSavePayload,
+    ) -> WorkflowAgentNodeBinding:
+        if payload.binding and (payload.binding.agent_id or payload.binding.current_snapshot_id):
+            raise ValueError("Start from Scratch must not provide an existing inline agent binding.")
+
+        agent_soul = payload.agent_soul or AgentSoulConfig()
+        agent = cls._create_workflow_only_agent(
+            tenant_id=tenant_id,
+            app_id=app_id,
+            workflow_id=workflow_id,
+            node_id=node_id,
+            account_id=account_id,
+            agent_soul=agent_soul,
+        )
+        binding.binding_type = WorkflowAgentBindingType.INLINE_AGENT
+        binding.agent_id = agent.id
+        binding.current_snapshot_id = agent.active_config_snapshot_id
+        binding.node_job_config = payload.node_job or binding.node_job_config
+        binding.updated_by = account_id
+        db.session.flush()
+        return binding
+
     @classmethod
     def _save_to_current_version(
         cls,
diff --git a/api/services/agent/composer_validator.py b/api/services/agent/composer_validator.py
index b9519272c4a..34b80b8a9d0 100644
--- a/api/services/agent/composer_validator.py
+++ b/api/services/agent/composer_validator.py
@@ -50,7 +50,7 @@ _DANGEROUS_ACK_KEYS = (
 
 class ComposerConfigValidator:
     @classmethod
-    def validate_save_payload(cls, payload: ComposerSavePayload) -> None:
+    def validate_draft_save_payload(cls, payload: ComposerSavePayload) -> None:
         if (
             payload.variant == ComposerVariant.WORKFLOW
             and payload.soul_lock.locked
@@ -59,6 +59,13 @@ class ComposerConfigValidator:
         ):
             raise AgentSoulLockedError()
 
+    @classmethod
+    def validate_save_payload(cls, payload: ComposerSavePayload) -> None:
+        cls.validate_publish_payload(payload)
+
+    @classmethod
+    def validate_publish_payload(cls, payload: ComposerSavePayload) -> None:
+        cls.validate_draft_save_payload(payload)
         if payload.agent_soul is not None:
             cls.validate_agent_soul(payload.agent_soul)
         if payload.node_job is not None:
@@ -191,6 +198,8 @@ class ComposerConfigValidator:
                             }
                         )
                     continue
+                if mention.kind in {MentionKind.SKILL, MentionKind.FILE}:
+                    continue
                 if resolved is None:
                     warnings.append(
                         {
diff --git a/api/services/agent/prompt_mentions.py b/api/services/agent/prompt_mentions.py
index 921d6838b26..27bed49c53b 100644
--- a/api/services/agent/prompt_mentions.py
+++ b/api/services/agent/prompt_mentions.py
@@ -4,13 +4,14 @@ Slash-menu insertions are stored inline in the plain-string prompt as tokens:
 
     [§<kind>:<id>[:<label>]§]
 
-``kind`` is a fixed lowercase word; ``id`` points at an item in the Agent config
-lists (mentions are pointers — the entity itself lives in ``skills_files`` /
-``tools`` / ``knowledge.datasets`` / ``human.contacts`` /
-``previous_node_output_refs`` / ``declared_outputs``); ``label`` is an optional
-plain-text fallback only (the backend always re-resolves by id, so renames never
-break references). A single ``:`` separates all three fields; ``label`` is the
-trailing remainder and may itself contain ``:``.
+``kind`` is a fixed lowercase word; ``id`` points at an item in the Agent
+runtime context. For prompt-owned entities that means Agent Soul lists such as
+``tools`` / ``knowledge.datasets`` / ``human.contacts`` and workflow job lists
+such as ``previous_node_output_refs`` / ``declared_outputs``. For drive-backed
+``skill`` / ``file`` mentions the field stores a URL-encoded drive key and is
+resolved against ``agent_drive_files`` at runtime. ``label`` is an optional
+plain-text fallback only. A single ``:`` separates all three fields; ``label``
+is the trailing remainder and may itself contain ``:``.
 
 The ``[§…§]`` wrapper uses the section sign ``§`` (U+00A7), which never appears
 in Dify template syntax (``{{var}}`` / ``{{#a.b#}}``) nor in normal prompt text,
@@ -55,7 +56,11 @@ MENTION_PATTERN = re.compile(
 _RESIDUAL_MENTION_PATTERN = re.compile(r"\[§([A-Za-z_][A-Za-z0-9_]*:[^§]*?)§\]")
 
 MAX_MENTIONS_PER_PROMPT = 200
-MAX_MENTION_FIELD_LENGTH = 255
+# Drive keys are validated up to 512 Unicode code points before URL encoding.
+# Worst case, one code point becomes 4 UTF-8 bytes and each byte becomes a
+# 3-character ``%XX`` escape, so a valid encoded drive key can reach 6144 chars.
+MAX_MENTION_REF_ID_LENGTH = 6144
+MAX_MENTION_LABEL_LENGTH = 255
 
 # Reserved ``tool`` mention id suffix: ``<provider>/*`` means "every tool of this
 # provider" (a provider hosts many tools, like an MCP server). Single tools use
@@ -102,7 +107,7 @@ def parse_prompt_mentions(prompt: str) -> list[PromptMention]:
     for match in MENTION_PATTERN.finditer(prompt or ""):
         ref_id = match.group(2)
         label = match.group(3)
-        if len(ref_id) > MAX_MENTION_FIELD_LENGTH or (label is not None and len(label) > MAX_MENTION_FIELD_LENGTH):
+        if len(ref_id) > MAX_MENTION_REF_ID_LENGTH or (label is not None and len(label) > MAX_MENTION_LABEL_LENGTH):
             continue
         mentions.append(
             PromptMention(
@@ -127,8 +132,8 @@ def expand_prompt_mentions(prompt: str, resolver: MentionResolver) -> str:
     def _replace(match: re.Match[str]) -> str:
         ref_id = match.group(2)
         label = match.group(3) or None
-        fallback = (label or ref_id)[:MAX_MENTION_FIELD_LENGTH]
-        if len(ref_id) > MAX_MENTION_FIELD_LENGTH or (label is not None and len(label) > MAX_MENTION_FIELD_LENGTH):
+        fallback = (label or ref_id)[:MAX_MENTION_LABEL_LENGTH]
+        if len(ref_id) > MAX_MENTION_REF_ID_LENGTH or (label is not None and len(label) > MAX_MENTION_LABEL_LENGTH):
             return fallback
         mention = PromptMention(
             kind=MentionKind(match.group(1)),
@@ -141,7 +146,7 @@ def expand_prompt_mentions(prompt: str, resolver: MentionResolver) -> str:
         resolved = resolver(mention)
         if resolved is None or not resolved.strip():
             return fallback
-        return resolved[:MAX_MENTION_FIELD_LENGTH]
+        return resolved[:MAX_MENTION_LABEL_LENGTH]
 
     return scrub_mention_markers(MENTION_PATTERN.sub(_replace, prompt))
 
@@ -163,27 +168,19 @@ def scrub_mention_markers(text: str) -> str:
         # inner is ``kind:id[:label]``; prefer the label, else the id.
         parts = match.group(1).split(":", 2)
         if len(parts) >= 3 and parts[2].strip():
-            return parts[2].strip()[:MAX_MENTION_FIELD_LENGTH]
+            return parts[2].strip()[:MAX_MENTION_LABEL_LENGTH]
         if len(parts) >= 2 and parts[1].strip():
-            return parts[1].strip()[:MAX_MENTION_FIELD_LENGTH]
-        return match.group(1)[:MAX_MENTION_FIELD_LENGTH]
+            return parts[1].strip()[:MAX_MENTION_LABEL_LENGTH]
+        return match.group(1)[:MAX_MENTION_LABEL_LENGTH]
 
     return _RESIDUAL_MENTION_PATTERN.sub(_degrade, text)
 
 
 def build_soul_mention_resolver(agent_soul: AgentSoulConfig) -> MentionResolver:
-    """Resolve soul-surface mentions to canonical display names from the soul config."""
+    """Resolve non-drive soul-surface mentions to canonical display names."""
 
     def _resolve(mention: PromptMention) -> str | None:
         match mention.kind:
-            case MentionKind.SKILL:
-                for skill in agent_soul.skills_files.skills:
-                    if mention.ref_id in (skill.id, skill.name):
-                        return skill.name or skill.id
-            case MentionKind.FILE:
-                for file in agent_soul.skills_files.files:
-                    if mention.ref_id in (file.id, file.name):
-                        return file.name or file.id
             case MentionKind.TOOL:
                 for tool in agent_soul.tools.dify_tools:
                     prefixes = {prefix for prefix in (tool.provider, tool.provider_id, tool.plugin_id) if prefix}
@@ -273,7 +270,8 @@ def _selector_from_ref(ref: WorkflowPreviousNodeOutputRef) -> tuple[str, str] |
 __all__ = [
     "ALL_PROVIDER_TOOLS_SUFFIX",
     "MAX_MENTIONS_PER_PROMPT",
-    "MAX_MENTION_FIELD_LENGTH",
+    "MAX_MENTION_LABEL_LENGTH",
+    "MAX_MENTION_REF_ID_LENGTH",
     "MENTION_PATTERN",
     "NODE_JOB_PROMPT_ALLOWED_KINDS",
     "SOUL_PROMPT_ALLOWED_KINDS",
diff --git a/api/services/agent/roster_service.py b/api/services/agent/roster_service.py
index ca8428b4f7c..6a9d5818647 100644
--- a/api/services/agent/roster_service.py
+++ b/api/services/agent/roster_service.py
@@ -3,6 +3,7 @@ from typing import Any, TypedDict
 from sqlalchemy import and_, func, or_, select
 from sqlalchemy.exc import IntegrityError
 
+from core.app.entities.app_invoke_entities import InvokeFrom
 from libs.datetime_utils import naive_utc_now
 from libs.helper import to_timestamp
 from models.agent import (
@@ -10,6 +11,7 @@ from models.agent import (
     AgentConfigRevision,
     AgentConfigRevisionOperation,
     AgentConfigSnapshot,
+    AgentDebugConversation,
     AgentKind,
     AgentScope,
     AgentSource,
@@ -18,8 +20,8 @@ from models.agent import (
     WorkflowAgentNodeBinding,
 )
 from models.agent_config_entities import AgentSoulConfig
-from models.enums import AppStatus
-from models.model import App, AppMode, IconType
+from models.enums import AppStatus, ConversationFromSource, ConversationStatus
+from models.model import App, AppMode, Conversation, IconType
 from models.workflow import Workflow
 from services.agent.agent_soul_state import agent_soul_has_model
 from services.agent.composer_validator import ComposerConfigValidator
@@ -96,6 +98,7 @@ class AgentRosterService:
             "scope": agent.scope.value,
             "source": agent.source.value,
             "app_id": agent.app_id,
+            "debug_conversation_id": None,
             "workflow_id": agent.workflow_id,
             "workflow_node_id": agent.workflow_node_id,
             "active_config_snapshot_id": agent.active_config_snapshot_id,
@@ -392,8 +395,172 @@ class AgentRosterService:
         agent.active_config_snapshot_id = version.id
         agent.active_config_has_model = agent_soul_has_model(AgentSoulConfig())
         self._session.flush()
+        self._get_or_create_agent_app_debug_conversation(agent=agent, account_id=account_id)
         return agent
 
+    def _create_agent_app_debug_conversation(self, *, app_id: str, account_id: str) -> str:
+        """Create one console debug conversation for an Agent App editor."""
+
+        conversation = Conversation(
+            app_id=app_id,
+            app_model_config_id=None,
+            model_provider=None,
+            model_id="",
+            override_model_configs=None,
+            mode=AppMode.AGENT,
+            name="Agent Debugging Conversation",
+            inputs={},
+            introduction="",
+            system_instruction="",
+            system_instruction_tokens=0,
+            status=ConversationStatus.NORMAL,
+            invoke_from=InvokeFrom.DEBUGGER,
+            from_source=ConversationFromSource.CONSOLE,
+            from_end_user_id=None,
+            from_account_id=account_id,
+        )
+        self._session.add(conversation)
+        self._session.flush()
+        return conversation.id
+
+    def _get_or_create_agent_app_debug_conversation(self, *, agent: Agent, account_id: str) -> str:
+        if not agent.app_id:
+            raise AgentNotFoundError()
+
+        mapping = self._session.scalar(
+            select(AgentDebugConversation).where(
+                AgentDebugConversation.tenant_id == agent.tenant_id,
+                AgentDebugConversation.agent_id == agent.id,
+                AgentDebugConversation.account_id == account_id,
+            )
+        )
+        if mapping is not None:
+            conversation_id = self._session.scalar(
+                select(Conversation.id).where(
+                    Conversation.id == mapping.conversation_id,
+                    Conversation.app_id == agent.app_id,
+                    Conversation.from_source == ConversationFromSource.CONSOLE,
+                    Conversation.from_account_id == account_id,
+                    Conversation.is_deleted.is_(False),
+                )
+            )
+            if conversation_id:
+                return conversation_id
+
+            mapping.conversation_id = self._create_agent_app_debug_conversation(
+                app_id=agent.app_id,
+                account_id=account_id,
+            )
+            self._session.flush()
+            return mapping.conversation_id
+
+        conversation_id = self._create_agent_app_debug_conversation(
+            app_id=agent.app_id,
+            account_id=account_id,
+        )
+        self._session.add(
+            AgentDebugConversation(
+                tenant_id=agent.tenant_id,
+                agent_id=agent.id,
+                app_id=agent.app_id,
+                account_id=account_id,
+                conversation_id=conversation_id,
+            )
+        )
+        self._session.flush()
+        return conversation_id
+
+    def get_or_create_agent_app_debug_conversation_id(
+        self, *, tenant_id: str, agent_id: str, account_id: str, commit: bool = True
+    ) -> str:
+        """Return the current editor's debug conversation for an Agent App."""
+
+        agent = self._session.scalar(
+            select(Agent).where(
+                Agent.tenant_id == tenant_id,
+                Agent.id == agent_id,
+                Agent.scope == AgentScope.ROSTER,
+                Agent.source == AgentSource.AGENT_APP,
+                Agent.status == AgentStatus.ACTIVE,
+            )
+        )
+        if agent is None:
+            raise AgentNotFoundError()
+
+        conversation_id = self._get_or_create_agent_app_debug_conversation(agent=agent, account_id=account_id)
+        if commit:
+            self._session.commit()
+        return conversation_id
+
+    def refresh_agent_app_debug_conversation_id(
+        self, *, tenant_id: str, agent_id: str, account_id: str, commit: bool = True
+    ) -> str:
+        """Start a new console debug conversation for the current Agent App editor."""
+
+        agent = self._session.scalar(
+            select(Agent).where(
+                Agent.tenant_id == tenant_id,
+                Agent.id == agent_id,
+                Agent.scope == AgentScope.ROSTER,
+                Agent.source == AgentSource.AGENT_APP,
+                Agent.status == AgentStatus.ACTIVE,
+            )
+        )
+        if agent is None or not agent.app_id:
+            raise AgentNotFoundError()
+
+        conversation_id = self._create_agent_app_debug_conversation(
+            app_id=agent.app_id,
+            account_id=account_id,
+        )
+        mapping = self._session.scalar(
+            select(AgentDebugConversation).where(
+                AgentDebugConversation.tenant_id == tenant_id,
+                AgentDebugConversation.agent_id == agent_id,
+                AgentDebugConversation.account_id == account_id,
+            )
+        )
+        if mapping is None:
+            self._session.add(
+                AgentDebugConversation(
+                    tenant_id=tenant_id,
+                    agent_id=agent_id,
+                    app_id=agent.app_id,
+                    account_id=account_id,
+                    conversation_id=conversation_id,
+                )
+            )
+        else:
+            mapping.app_id = agent.app_id
+            mapping.conversation_id = conversation_id
+        self._session.flush()
+        if commit:
+            self._session.commit()
+        return conversation_id
+
+    def load_or_create_agent_app_debug_conversation_ids_by_agent_id(
+        self, *, tenant_id: str, agents: list[Agent], account_id: str
+    ) -> dict[str, str]:
+        """Return per-account debug conversations for a page of Agent Apps."""
+
+        conversation_ids_by_agent_id: dict[str, str] = {}
+        changed = False
+        for agent in agents:
+            if (
+                agent.tenant_id != tenant_id
+                or agent.scope != AgentScope.ROSTER
+                or agent.source != AgentSource.AGENT_APP
+            ):
+                continue
+            conversation_ids_by_agent_id[agent.id] = self._get_or_create_agent_app_debug_conversation(
+                agent=agent,
+                account_id=account_id,
+            )
+            changed = True
+        if changed:
+            self._session.commit()
+        return conversation_ids_by_agent_id
+
     def load_app_backing_agents_by_app_id(self, *, tenant_id: str, app_ids: list[str]) -> dict[str, Agent]:
         """Return active app-backed Agents keyed by Agent App id."""
         if not app_ids:
@@ -466,6 +633,7 @@ class AgentRosterService:
         account: Any,
         name: str | None = None,
         description: str | None = None,
+        role: str | None = None,
         icon_type: Any = None,
         icon: str | None = None,
         icon_background: str | None = None,
@@ -477,6 +645,7 @@ class AgentRosterService:
 
         copied_name = name or self._next_duplicate_agent_name(tenant_id=tenant_id, base_name=source_app.name)
         copied_description = description if description is not None else source_app.description
+        copied_role = role if role is not None else source_agent.role or ""
         copied_icon_type = icon_type if icon_type is not None else source_app.icon_type
         copied_icon = icon if icon is not None else source_app.icon
         copied_icon_background = icon_background if icon_background is not None else source_app.icon_background
@@ -487,7 +656,7 @@ class AgentRosterService:
                 name=copied_name,
                 description=copied_description,
                 mode="agent",
-                agent_role=source_agent.role or "",
+                agent_role=copied_role,
                 icon_type=self._normalize_app_icon_type(copied_icon_type),
                 icon=copied_icon,
                 icon_background=copied_icon_background,
@@ -666,12 +835,16 @@ class AgentRosterService:
     @staticmethod
     def _visible_version_operations(agent: Agent) -> set[AgentConfigRevisionOperation]:
         if agent.source == AgentSource.AGENT_APP:
-            return {AgentConfigRevisionOperation.SAVE_NEW_VERSION}
+            return {
+                AgentConfigRevisionOperation.SAVE_NEW_VERSION,
+                AgentConfigRevisionOperation.RESTORE_VERSION,
+            }
         return {
             AgentConfigRevisionOperation.CREATE_VERSION,
             AgentConfigRevisionOperation.SAVE_NEW_VERSION,
             AgentConfigRevisionOperation.SAVE_NEW_AGENT,
             AgentConfigRevisionOperation.SAVE_TO_ROSTER,
+            AgentConfigRevisionOperation.RESTORE_VERSION,
         }
 
     def active_config_is_published(self, *, tenant_id: str, agent: Agent) -> bool:
@@ -764,6 +937,46 @@ class AgentRosterService:
         ]
         return result
 
+    def restore_agent_version(
+        self, *, tenant_id: str, agent_id: str, version_id: str, account_id: str
+    ) -> dict[str, Any]:
+        agent = self._get_agent(tenant_id=tenant_id, agent_id=agent_id, roster_only=True)
+        visible_version_ids = self._visible_version_ids_stmt(tenant_id=tenant_id, agent_id=agent_id, agent=agent)
+        visible_version_id = self._session.scalar(
+            select(AgentConfigSnapshot.id)
+            .where(
+                AgentConfigSnapshot.tenant_id == tenant_id,
+                AgentConfigSnapshot.agent_id == agent_id,
+                AgentConfigSnapshot.id == version_id,
+                AgentConfigSnapshot.id.in_(select(visible_version_ids.c.current_snapshot_id)),
+            )
+            .limit(1)
+        )
+        if not visible_version_id:
+            raise AgentVersionNotFoundError()
+
+        version = self._get_version(tenant_id=tenant_id, agent_id=agent_id, version_id=version_id)
+        if agent.active_config_snapshot_id == version.id:
+            return {"result": "success", "active_config_snapshot_id": version.id}
+
+        previous_snapshot_id = agent.active_config_snapshot_id
+        agent.active_config_snapshot_id = version.id
+        agent.active_config_has_model = agent_soul_has_model(version.config_snapshot)
+        agent.updated_by = account_id
+        self._session.add(
+            AgentConfigRevision(
+                tenant_id=tenant_id,
+                agent_id=agent_id,
+                previous_snapshot_id=previous_snapshot_id,
+                current_snapshot_id=version.id,
+                revision=self._next_revision(tenant_id=tenant_id, agent_id=agent_id),
+                operation=AgentConfigRevisionOperation.RESTORE_VERSION,
+                created_by=account_id,
+            )
+        )
+        self._session.commit()
+        return {"result": "success", "active_config_snapshot_id": version.id}
+
     def _get_agent(self, *, tenant_id: str, agent_id: str, roster_only: bool = False) -> Agent:
         stmt = select(Agent).where(Agent.tenant_id == tenant_id, Agent.id == agent_id)
         if roster_only:
@@ -789,6 +1002,17 @@ class AgentRosterService:
             raise AgentVersionNotFoundError()
         return version
 
+    def _next_revision(self, *, tenant_id: str, agent_id: str) -> int:
+        return (
+            self._session.scalar(
+                select(func.max(AgentConfigRevision.revision)).where(
+                    AgentConfigRevision.tenant_id == tenant_id,
+                    AgentConfigRevision.agent_id == agent_id,
+                )
+            )
+            or 0
+        ) + 1
+
     def _load_published_active_snapshot_agent_ids(self, *, tenant_id: str, agents: list[Agent]) -> set[str]:
         predicates = [
             and_(
diff --git a/api/services/agent/skill_package_service.py b/api/services/agent/skill_package_service.py
index 6452329904d..c4c25d48143 100644
--- a/api/services/agent/skill_package_service.py
+++ b/api/services/agent/skill_package_service.py
@@ -4,11 +4,12 @@ A Skill is a ``.zip`` / ``.skill`` archive that must contain a ``SKILL.md`` entr
 file (Anthropic Skills convention: YAML frontmatter with ``name`` + ``description``,
 followed by markdown instructions). This service validates the archive (extension,
 size, zip integrity, zip-slip safety, SKILL.md presence/encoding/fields) and
-extracts a manifest the API can bind to an Agent config version's skill list.
+extracts a manifest consumed by drive standardization.
 
 It does NOT execute or load the skill — the agent backend owns execution. It also
-does not (here) standardize the package into the agent drive; that is ENG-594 (S6),
-which consumes the manifest produced here.
+does not persist anything into Agent Soul or bind anything to config versions;
+``SkillStandardizeService`` consumes the manifest and commits the canonical drive
+rows instead.
 """
 
 from __future__ import annotations
@@ -22,8 +23,6 @@ import zipfile
 import yaml
 from pydantic import BaseModel
 
-from models.agent_config_entities import AgentSkillRefConfig
-
 # Bounds — generous but finite so a hostile upload can't exhaust memory/disk.
 _MAX_ARCHIVE_BYTES = 50 * 1024 * 1024
 _MAX_UNCOMPRESSED_BYTES = 200 * 1024 * 1024
@@ -58,22 +57,6 @@ class SkillManifest(BaseModel):
     size: int  # total uncompressed bytes
     hash: str  # sha256 of the archive bytes
 
-    def to_skill_ref(self, *, file_id: str, path: str | None = None) -> AgentSkillRefConfig:
-        """Build a config skill ref. ``path`` is the stable drive path (set by S6)."""
-        return AgentSkillRefConfig.model_validate(
-            {
-                "id": self.hash,
-                "name": self.name,
-                "description": self.description,
-                "file_id": file_id,
-                "path": path,
-                "size": self.size,
-                "hash": self.hash,
-                "entry_path": self.entry_path,
-                "manifest_files": self.files,
-            }
-        )
-
 
 class SkillPackageService:
     """Validate Skill archives and extract their manifest."""
diff --git a/api/services/agent/skill_standardize_service.py b/api/services/agent/skill_standardize_service.py
index b83004f3c4b..7e64d6f0422 100644
--- a/api/services/agent/skill_standardize_service.py
+++ b/api/services/agent/skill_standardize_service.py
@@ -9,21 +9,23 @@ to the agent drive (Agent Files §5.4 / §4):
 
 Both are stored as ``ToolFile`` records and bound via ``AgentDriveService.commit``
 with ``value_owned_by_drive=True`` (the drive owns their lifecycle). The returned
-skill ref records the stable drive paths + file ids (not just the raw upload id),
-so the Composer can reload the bound skill list. The console ``/skills/upload``
-endpoints delegate to this service so "upload" now always means drive-backed skill
-normalization.
+payload is the slim drive-derived skill DTO the UI needs to work with the drive
+catalog — ``name``, ``description``, ``path``, ``skill_md_key``, and
+``archive_key`` — plus the extracted manifest for upload feedback. The console
+``/skills/upload`` endpoints delegate to this service so "upload" now always means
+drive-backed skill normalization rather than Agent Soul binding.
 """
 
 from __future__ import annotations
 
+import mimetypes
+import posixpath
 import re
 from typing import Any
 
 from core.tools.tool_file_manager import ToolFileManager
-from models.agent_config_entities import AgentSkillRefConfig
 from services.agent.skill_package_service import SkillPackageService
-from services.agent_drive_service import AgentDriveService, DriveCommitItem, DriveFileRef
+from services.agent_drive_service import AgentDriveService, DriveCommitItem, DriveFileRef, DriveSkillMetadata
 
 _FULL_ARCHIVE_NAME = ".DIFY-SKILL-FULL.zip"
 _SKILL_MD_NAME = "SKILL.md"
@@ -62,7 +64,8 @@ class SkillStandardizeService:
         skill_md_bytes = self._package.read_member_bytes(content=content, member_path=manifest.entry_path)
         slug = slugify_skill_name(manifest.name)
 
-        # Two drive-owned ToolFiles: canonical SKILL.md + the full archive.
+        # Drive-owned files: canonical SKILL.md, every inspectable archive file,
+        # and the full archive for future restore/export.
         md_tool_file = self._tool_files.create_file_by_raw(
             user_id=user_id,
             tenant_id=tenant_id,
@@ -82,6 +85,30 @@ class SkillStandardizeService:
 
         skill_md_key = f"{slug}/{_SKILL_MD_NAME}"
         archive_key = f"{slug}/{_FULL_ARCHIVE_NAME}"
+        member_items: list[DriveCommitItem] = []
+        for member_path in sorted(set(manifest.files)):
+            member_key = f"{slug}/{member_path}"
+            if member_key in {skill_md_key, archive_key}:
+                continue
+
+            member_bytes = self._package.read_member_bytes(content=content, member_path=member_path)
+            mimetype = mimetypes.guess_type(member_path)[0] or "application/octet-stream"
+            member_tool_file = self._tool_files.create_file_by_raw(
+                user_id=user_id,
+                tenant_id=tenant_id,
+                conversation_id=None,
+                file_binary=member_bytes,
+                mimetype=mimetype,
+                filename=posixpath.basename(member_path),
+            )
+            member_items.append(
+                DriveCommitItem(
+                    key=member_key,
+                    file_ref=DriveFileRef(kind="tool_file", id=member_tool_file.id),
+                    value_owned_by_drive=True,
+                )
+            )
+
         self._drive.commit(
             tenant_id=tenant_id,
             user_id=user_id,
@@ -91,35 +118,36 @@ class SkillStandardizeService:
                     key=skill_md_key,
                     file_ref=DriveFileRef(kind="tool_file", id=md_tool_file.id),
                     value_owned_by_drive=True,
+                    is_skill=True,
+                    skill_metadata=DriveSkillMetadata(
+                        name=manifest.name,
+                        description=manifest.description,
+                        manifest_files=manifest.files,
+                    ),
                 ),
                 DriveCommitItem(
                     key=archive_key,
                     file_ref=DriveFileRef(kind="tool_file", id=archive_tool_file.id),
                     value_owned_by_drive=True,
                 ),
+                *member_items,
             ],
         )
 
-        skill_ref = AgentSkillRefConfig.model_validate(
-            {
-                "id": manifest.hash,
-                "name": manifest.name,
-                "description": manifest.description,
-                "file_id": archive_tool_file.id,
-                "path": slug,
-                "size": manifest.size,
-                "hash": manifest.hash,
-                "entry_path": skill_md_key,
-                "skill_md_file_id": md_tool_file.id,
-                "skill_md_key": skill_md_key,
-                "full_archive_file_id": archive_tool_file.id,
-                "full_archive_key": archive_key,
-                # ENG-371: zip member listing — strong signals (scripts/*.sh) for infer-tools.
-                "manifest_files": manifest.files,
-            }
+        drive_skill = next(
+            skill
+            for skill in self._drive.list_skills(tenant_id=tenant_id, agent_id=agent_id)
+            if skill["skill_md_key"] == skill_md_key
         )
+
         return {
-            "skill": skill_ref.model_dump(exclude_none=True),
+            "skill": {
+                "name": drive_skill["name"],
+                "description": drive_skill["description"],
+                "path": drive_skill["path"],
+                "skill_md_key": drive_skill["skill_md_key"],
+                "archive_key": drive_skill["archive_key"],
+            },
             "manifest": manifest.model_dump(),
         }
 
diff --git a/api/services/agent/skill_tool_inference_service.py b/api/services/agent/skill_tool_inference_service.py
index 343ab370f81..a6d5e6b2de9 100644
--- a/api/services/agent/skill_tool_inference_service.py
+++ b/api/services/agent/skill_tool_inference_service.py
@@ -19,15 +19,11 @@ from typing import Any
 
 import json_repair
 from pydantic import BaseModel, Field, ValidationError
-from sqlalchemy import select
 
 from core.errors.error import ProviderTokenNotInitError
 from core.model_manager import ModelManager
-from extensions.ext_database import db
 from graphon.model_runtime.entities.message_entities import SystemPromptMessage, UserPromptMessage
 from graphon.model_runtime.entities.model_entities import ModelType
-from models.agent import Agent
-from models.agent_config_entities import AgentSoulConfig
 from services.agent_drive_service import AgentDriveError, AgentDriveService
 
 logger = logging.getLogger(__name__)
@@ -97,12 +93,8 @@ class SkillToolInferenceService:
 
     def infer(self, *, tenant_id: str, agent_id: str, slug: str) -> dict[str, Any]:
         skill_md = self._load_skill_md(tenant_id=tenant_id, agent_id=agent_id, slug=slug)
-        manifest_files = self._manifest_files_from_soul(tenant_id=tenant_id, agent_id=agent_id, slug=slug)
 
         user_prompt = f"SKILL.md of skill '{slug}':\n\n{skill_md}"
-        if manifest_files:
-            listing = "\n".join(manifest_files[:200])
-            user_prompt += f"\n\nFiles inside the skill package:\n{listing}"
 
         raw = self._invoke(tenant_id=tenant_id, user_prompt=user_prompt)
         try:
@@ -138,37 +130,6 @@ class SkillToolInferenceService:
             )
         return str(preview["text"])
 
-    @staticmethod
-    def _manifest_files_from_soul(*, tenant_id: str, agent_id: str, slug: str) -> list[str]:
-        """The zip path listing standardize persisted onto the ref, if present.
-
-        Degrades to an empty list (SKILL.md-only inference) for refs that
-        predate ``manifest_files``.
-        """
-        agent = db.session.scalar(select(Agent).where(Agent.tenant_id == tenant_id, Agent.id == agent_id).limit(1))
-        if agent is None or not agent.active_config_snapshot_id:
-            return []
-        from models.agent import AgentConfigSnapshot
-
-        snapshot = db.session.scalar(
-            select(AgentConfigSnapshot).where(
-                AgentConfigSnapshot.tenant_id == tenant_id,
-                AgentConfigSnapshot.agent_id == agent_id,
-                AgentConfigSnapshot.id == agent.active_config_snapshot_id,
-            )
-        )
-        if snapshot is None:
-            return []
-        soul = AgentSoulConfig.model_validate(snapshot.config_snapshot_dict)
-        for skill in soul.skills_files.skills:
-            ref_slug = (skill.skill_md_key or "").split("/", 1)[0] or (skill.path or "").strip("/")
-            if ref_slug != slug:
-                continue
-            files = skill.get("manifest_files")
-            if isinstance(files, list):
-                return [str(item) for item in files]
-        return []
-
     @staticmethod
     def _invoke(*, tenant_id: str, user_prompt: str) -> str:
         try:
diff --git a/api/services/agent/workflow_publish_service.py b/api/services/agent/workflow_publish_service.py
index 3d39419d794..eb3766996bf 100644
--- a/api/services/agent/workflow_publish_service.py
+++ b/api/services/agent/workflow_publish_service.py
@@ -8,17 +8,25 @@ from pydantic import ValidationError
 from sqlalchemy import select
 from sqlalchemy.orm import Session
 
-from core.workflow.nodes.agent_v2.validators import WorkflowAgentNodeValidator
+from core.workflow.nodes.agent_v2.validators import WorkflowAgentNodeValidationError, WorkflowAgentNodeValidator
 from models.agent import (
     Agent,
     AgentConfigSnapshot,
+    AgentDriveFile,
     AgentScope,
     AgentStatus,
     WorkflowAgentBindingType,
     WorkflowAgentNodeBinding,
 )
-from models.agent_config_entities import DeclaredOutputConfig, WorkflowNodeJobConfig
+from models.agent_config_entities import AgentSoulConfig, DeclaredOutputConfig, WorkflowNodeJobConfig
 from models.workflow import Workflow
+from services.agent.composer_validator import ComposerConfigValidator
+from services.entities.agent_entities import (
+    ComposerSavePayload,
+    ComposerSaveStrategy,
+    ComposerSoulLockPayload,
+    ComposerVariant,
+)
 
 
 class WorkflowAgentPublishService:
@@ -67,11 +75,131 @@ class WorkflowAgentPublishService:
     @classmethod
     def validate_agent_nodes_for_publish(cls, *, session: Session, draft_workflow: Workflow) -> None:
         WorkflowAgentNodeValidator.validate_published_workflow(session=session, workflow=draft_workflow)
+        cls._validate_composer_configs_for_publish(session=session, draft_workflow=draft_workflow)
 
     @classmethod
     def validate_agent_nodes_for_draft_sync(cls, *, session: Session, draft_workflow: Workflow) -> None:
         WorkflowAgentNodeValidator.validate_draft_workflow(session=session, workflow=draft_workflow)
 
+    @classmethod
+    def _validate_composer_configs_for_publish(cls, *, session: Session, draft_workflow: Workflow) -> None:
+        node_ids = {
+            node_id for node_id, _node_data in WorkflowAgentNodeValidator.iter_agent_v2_nodes(draft_workflow.graph_dict)
+        }
+        if not node_ids:
+            return
+
+        bindings = session.scalars(
+            select(WorkflowAgentNodeBinding).where(
+                WorkflowAgentNodeBinding.tenant_id == draft_workflow.tenant_id,
+                WorkflowAgentNodeBinding.app_id == draft_workflow.app_id,
+                WorkflowAgentNodeBinding.workflow_id == draft_workflow.id,
+                WorkflowAgentNodeBinding.workflow_version == draft_workflow.version,
+                WorkflowAgentNodeBinding.node_id.in_(node_ids),
+            )
+        ).all()
+        for binding in bindings:
+            cls._validate_binding_composer_config_for_publish(session=session, binding=binding)
+
+    @classmethod
+    def _validate_binding_composer_config_for_publish(
+        cls,
+        *,
+        session: Session,
+        binding: WorkflowAgentNodeBinding,
+    ) -> None:
+        if not binding.agent_id:
+            return
+
+        agent = session.scalar(
+            select(Agent)
+            .where(
+                Agent.tenant_id == binding.tenant_id,
+                Agent.id == binding.agent_id,
+            )
+            .limit(1)
+        )
+        if agent is None:
+            return
+
+        snapshot_id = (
+            agent.active_config_snapshot_id
+            if binding.binding_type == WorkflowAgentBindingType.ROSTER_AGENT
+            else binding.current_snapshot_id
+        )
+        if snapshot_id is None:
+            return
+
+        snapshot = session.scalar(
+            select(AgentConfigSnapshot)
+            .where(
+                AgentConfigSnapshot.tenant_id == binding.tenant_id,
+                AgentConfigSnapshot.agent_id == agent.id,
+                AgentConfigSnapshot.id == snapshot_id,
+            )
+            .limit(1)
+        )
+        if snapshot is None:
+            return
+
+        agent_soul = AgentSoulConfig.model_validate(snapshot.config_snapshot_dict)
+        node_job = WorkflowNodeJobConfig.model_validate(binding.node_job_config_dict)
+        payload = ComposerSavePayload.model_construct(
+            variant=ComposerVariant.WORKFLOW,
+            save_strategy=ComposerSaveStrategy.NODE_JOB_ONLY,
+            soul_lock=ComposerSoulLockPayload(locked=False),
+            agent_soul=agent_soul,
+            node_job=node_job,
+        )
+        ComposerConfigValidator.validate_publish_payload(payload)
+        # ENG-623 §4.4: drive-backed refs must point at real drive rows before
+        # publishing. This stays out of composer save so autosave/save-draft can
+        # persist incomplete refs and surface them as non-blocking findings.
+        cls._require_drive_refs_resolved_for_publish(session=session, binding=binding, agent_soul=agent_soul)
+
+    @classmethod
+    def _require_drive_refs_resolved_for_publish(
+        cls,
+        *,
+        session: Session,
+        binding: WorkflowAgentNodeBinding,
+        agent_soul: AgentSoulConfig,
+    ) -> None:
+        from services.agent.prompt_mentions import MentionKind, parse_prompt_mentions
+        from services.agent_drive_service import decode_drive_mention_ref
+
+        wanted_keys: dict[str, tuple[str, str]] = {}
+        for mention in parse_prompt_mentions(agent_soul.prompt.system_prompt):
+            if mention.kind not in {MentionKind.SKILL, MentionKind.FILE}:
+                continue
+            drive_key = decode_drive_mention_ref(mention.ref_id)
+            if not drive_key:
+                continue
+            code = "skill_ref_dangling" if mention.kind == MentionKind.SKILL else "file_ref_dangling"
+            wanted_keys[drive_key] = (code, mention.label or drive_key)
+        if not wanted_keys or not binding.agent_id:
+            return
+
+        existing_keys = set(
+            session.scalars(
+                select(AgentDriveFile.key).where(
+                    AgentDriveFile.tenant_id == binding.tenant_id,
+                    AgentDriveFile.agent_id == binding.agent_id,
+                    AgentDriveFile.key.in_(sorted(wanted_keys)),
+                )
+            ).all()
+        )
+        messages: list[str] = []
+        for key, (code, display) in wanted_keys.items():
+            if key in existing_keys:
+                continue
+            kind = "skill" if code == "skill_ref_dangling" else "file"
+            messages.append(f"{code}: {kind} '{display}' has no drive entry for key '{key}'.")
+        if messages:
+            raise WorkflowAgentNodeValidationError(
+                f"Workflow Agent node {binding.node_id} has invalid Agent Soul drive refs: {'; '.join(messages)}"
+            )
+
     @classmethod
     def sync_agent_bindings_for_draft(
         cls,
diff --git a/api/services/agent_app_feature_service.py b/api/services/agent_app_feature_service.py
index cc0fe67802d..b8e98653c8e 100644
--- a/api/services/agent_app_feature_service.py
+++ b/api/services/agent_app_feature_service.py
@@ -13,6 +13,8 @@ from __future__ import annotations
 
 from typing import Any, cast
 
+from sqlalchemy.orm import scoped_session
+
 from core.app.app_config.common.sensitive_word_avoidance.manager import SensitiveWordAvoidanceConfigManager
 from core.app.app_config.features.opening_statement.manager import OpeningStatementConfigManager
 from core.app.app_config.features.retrieval_resource.manager import RetrievalResourceConfigManager
@@ -21,7 +23,6 @@ from core.app.app_config.features.suggested_questions_after_answer.manager impor
     SuggestedQuestionsAfterAnswerConfigManager,
 )
 from core.app.app_config.features.text_to_speech.manager import TextToSpeechConfigManager
-from extensions.ext_database import db
 from libs.datetime_utils import naive_utc_now
 from models.account import Account
 from models.model import App, AppModelConfig, AppModelConfigDict
@@ -67,7 +68,9 @@ class AgentAppFeatureConfigService:
         return cast(AppModelConfigDict, filtered)
 
     @classmethod
-    def update_features(cls, *, app_model: App, account: Account, config: dict[str, Any]) -> AppModelConfig:
+    def update_features(
+        cls, *, app_model: App, account: Account, config: dict[str, Any], session: scoped_session
+    ) -> AppModelConfig:
         """Persist the presentation features as a new app_model_config version.
 
         Returns the new ``AppModelConfig`` row (now referenced by the app); the
@@ -82,13 +85,13 @@ class AgentAppFeatureConfigService:
             updated_by=account.id,
         ).from_model_config_dict(validated)
 
-        db.session.add(new_config)
-        db.session.flush()
+        session.add(new_config)
+        session.flush()
 
         app_model.app_model_config_id = new_config.id
         app_model.updated_by = account.id
         app_model.updated_at = naive_utc_now()
-        db.session.commit()
+        session.commit()
 
         return new_config
 
diff --git a/api/services/agent_drive_service.py b/api/services/agent_drive_service.py
index bb3f8ca69e3..c20b3f570a3 100644
--- a/api/services/agent_drive_service.py
+++ b/api/services/agent_drive_service.py
@@ -1,4 +1,4 @@
-"""Agent 网盘 (agent drive) service — list/manifest + commit with lifecycle (ENG-591).
+"""Agent 网盘 (agent drive) service — manifest/catalog + commit lifecycle.
 
 The agent drive is a per-agent path-like KV index over existing UploadFile /
 ToolFile records (see ``AgentDriveFile``). This service is the control plane:
@@ -8,27 +8,30 @@ ToolFile records (see ``AgentDriveFile``). This service is the control plane:
   ``FileAccessScope`` (Agent Files §3.1.2). We reuse the standard
   ``file_factory.build_from_mapping`` + ``resolve_file_url`` rebuild, which always
   filters by ``tenant_id`` in the builders, so omitting the scope is safe.
-* ``commit`` binds a batch of existing file refs to keys. Source ToolFiles must
+* ``commit`` is the single mutation entry point for writes and removals.
+  ``file_ref=None`` removes an exact key idempotently; otherwise the service
+  binds the referenced UploadFile/ToolFile to the key. Source ToolFiles must
   belong to the current run user. Overwriting a key whose previous value is
   ``value_owned_by_drive`` physically cleans the old value (storage + record),
   unless another drive entry still references it. Re-committing the same
-  ``key -> file_ref`` is idempotent.
+  ``key -> file_ref`` is idempotent and still refreshes skill metadata.
 """
 
 from __future__ import annotations
 
+import json
 import logging
 import re
 import urllib.parse
-from typing import Any, Literal
+from typing import Any, Literal, TypedDict
+from urllib.parse import unquote
 
-from pydantic import BaseModel
+from pydantic import BaseModel, ConfigDict, field_validator
 from sqlalchemy import func, select
 from sqlalchemy.exc import DataError, SQLAlchemyError
 from sqlalchemy.orm import Session
 
 from core.app.file_access.controller import DatabaseFileAccessController
-from core.app.workflow.file_runtime import DifyWorkflowFileRuntime
 from core.db.session_factory import session_factory
 from extensions.ext_storage import storage
 from factories import file_factory
@@ -41,6 +44,8 @@ logger = logging.getLogger(__name__)
 
 _MAX_KEY_LENGTH = 512
 _DRIVE_REF_PREFIX = "agent-"
+_SKILL_MD_SUFFIX = "/SKILL.md"
+_SKILL_ARCHIVE_NAME = ".DIFY-SKILL-FULL.zip"
 
 
 class AgentDriveError(Exception):
@@ -58,16 +63,86 @@ class AgentDriveError(Exception):
 
 
 class DriveFileRef(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
     kind: Literal["upload_file", "tool_file"]
     id: str
 
 
+class DriveSkillMetadata(BaseModel):
+    """Validated skill catalog metadata stored as a JSON string on the drive row."""
+
+    model_config = ConfigDict(extra="forbid")
+
+    name: str
+    description: str = ""
+    # Safe archive member paths captured during skill standardization. The drive
+    # stores only canonical SKILL.md + full archive, so the UI uses this manifest
+    # to show the original uploaded package contents.
+    manifest_files: list[str] | None = None
+
+    @field_validator("name")
+    @classmethod
+    def _validate_name(cls, value: str) -> str:
+        normalized = value.strip()
+        if not normalized:
+            raise ValueError("skill metadata name must not be blank")
+        return normalized
+
+
 class DriveCommitItem(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
     key: str
-    file_ref: DriveFileRef
+    file_ref: DriveFileRef | None = None
     # Drive-owned values may be physically cleaned on overwrite/removal; refs to
     # files shared with other business records should set this False.
     value_owned_by_drive: bool = True
+    is_skill: bool = False
+    skill_metadata: DriveSkillMetadata | None = None
+
+
+class AgentDriveSkillInfo(TypedDict):
+    path: str
+    skill_md_key: str
+    archive_key: str | None
+    name: str
+    description: str
+    size: int | None
+    mime_type: str | None
+    hash: str | None
+    created_at: int | None
+
+
+class AgentDriveSkillFileInfo(TypedDict):
+    path: str
+    name: str
+    type: str
+    drive_key: str | None
+    available_in_drive: bool
+
+
+class AgentDriveSkillInspectInfo(TypedDict):
+    path: str
+    skill_md_key: str
+    archive_key: str | None
+    name: str
+    description: str
+    size: int | None
+    mime_type: str | None
+    hash: str | None
+    created_at: int | None
+    source: str
+    files: list[AgentDriveSkillFileInfo]
+    file_tree: list[dict[str, Any]]
+    skill_md: dict[str, Any]
+    warnings: list[str]
+
+
+def decode_drive_mention_ref(ref_id: str) -> str:
+    """Decode the prompt token's URL-encoded drive-key field."""
+
+    return unquote(ref_id or "")
 
 
 def parse_agent_drive_ref(drive_ref: str) -> str:
@@ -132,6 +207,8 @@ class AgentDriveService:
                     "mime_type": row.mime_type,
                     "file_kind": row.file_kind.value,
                     "file_id": row.file_id,
+                    "is_skill": row.is_skill,
+                    "skill_metadata": row.skill_metadata,
                     "created_at": int(row.created_at.timestamp()) if row.created_at else None,
                 }
                 if include_download_url:
@@ -217,6 +294,87 @@ class AgentDriveService:
             self._delete_storage(storage_key)
         return removed_keys
 
+    def list_skills(self, *, tenant_id: str, agent_id: str) -> list[AgentDriveSkillInfo]:
+        """Return the drive-backed skill catalog derived from canonical ``SKILL.md`` rows."""
+
+        with session_factory.create_session() as session:
+            self._assert_agent_belongs_to_tenant(session, tenant_id=tenant_id, agent_id=agent_id)
+            skill_rows = list(
+                session.scalars(
+                    select(AgentDriveFile)
+                    .where(
+                        AgentDriveFile.tenant_id == tenant_id,
+                        AgentDriveFile.agent_id == agent_id,
+                        AgentDriveFile.is_skill.is_(True),
+                    )
+                    .order_by(AgentDriveFile.key)
+                )
+            )
+            archive_keys = set(
+                session.scalars(
+                    select(AgentDriveFile.key).where(
+                        AgentDriveFile.tenant_id == tenant_id,
+                        AgentDriveFile.agent_id == agent_id,
+                        AgentDriveFile.key.in_([self._skill_archive_key(row.key) for row in skill_rows]),
+                    )
+                )
+            )
+
+        skills: list[AgentDriveSkillInfo] = []
+        for row in skill_rows:
+            metadata = self._parse_skill_metadata(row.key, row.skill_metadata)
+            archive_key = self._skill_archive_key(row.key)
+            skills.append(
+                {
+                    "path": self._skill_path_from_key(row.key),
+                    "skill_md_key": row.key,
+                    "archive_key": archive_key if archive_key in archive_keys else None,
+                    "name": metadata.name,
+                    "description": metadata.description,
+                    "size": row.size,
+                    "mime_type": row.mime_type,
+                    "hash": row.hash,
+                    "created_at": int(row.created_at.timestamp()) if row.created_at else None,
+                }
+            )
+        return skills
+
+    def inspect_skill(self, *, tenant_id: str, agent_id: str, skill_path: str) -> AgentDriveSkillInspectInfo:
+        """Return the UI-facing skill inspect view for slash-menu hover/detail."""
+
+        skill_path = normalize_drive_key(skill_path)
+        skill_md_key = skill_path if skill_path.endswith(_SKILL_MD_SUFFIX) else f"{skill_path}{_SKILL_MD_SUFFIX}"
+        skill_path = self._skill_path_from_key(skill_md_key)
+        catalog = next(
+            (item for item in self.list_skills(tenant_id=tenant_id, agent_id=agent_id) if item["path"] == skill_path),
+            None,
+        )
+        if catalog is None:
+            raise AgentDriveError("skill_not_found", "no drive-backed skill for this path", status_code=404)
+
+        manifest_files = self._manifest_files_from_skill_metadata(
+            tenant_id=tenant_id,
+            agent_id=agent_id,
+            skill_md_key=skill_md_key,
+        )
+        drive_items = self.manifest(tenant_id=tenant_id, agent_id=agent_id, prefix=f"{skill_path}/")
+        drive_keys = {item["key"] for item in drive_items}
+        preview = self.preview(tenant_id=tenant_id, agent_id=agent_id, key=skill_md_key)
+        files, warnings = self._skill_file_entries(
+            skill_path=skill_path,
+            skill_md_key=skill_md_key,
+            manifest_files=manifest_files,
+            drive_keys=drive_keys,
+        )
+        return {
+            **catalog,
+            "source": "skill_md",
+            "files": files,
+            "file_tree": self._build_file_tree(files),
+            "skill_md": preview,
+            "warnings": warnings,
+        }
+
     def _commit_one(
         self,
         session: Session,
@@ -228,9 +386,19 @@ class AgentDriveService:
         pending_storage_deletes: list[str],
     ) -> dict[str, Any]:
         key = normalize_drive_key(item.key)
+        if item.file_ref is None:
+            return self._remove_one(
+                session,
+                tenant_id=tenant_id,
+                agent_id=agent_id,
+                key=key,
+                pending_storage_deletes=pending_storage_deletes,
+            )
+
+        skill_metadata = self._validate_skill_commit_fields(key=key, item=item)
         file_kind = AgentDriveFileKind(item.file_ref.kind)
         file_id = item.file_ref.id
-        size, mime_type = self._validate_source(
+        size, mime_type, file_hash = self._validate_source(
             session, tenant_id=tenant_id, user_id=user_id, file_kind=file_kind, file_id=file_id
         )
 
@@ -245,6 +413,11 @@ class AgentDriveService:
             # Idempotent re-commit of the same value: leave it (do not clean).
             if existing.file_kind == file_kind and existing.file_id == file_id:
                 existing.value_owned_by_drive = item.value_owned_by_drive
+                existing.is_skill = item.is_skill
+                existing.skill_metadata = skill_metadata
+                existing.size = size
+                existing.mime_type = mime_type
+                existing.hash = file_hash
                 return self._row_dict(existing)
             # Overwrite: clean the previous drive-owned value if no longer referenced.
             if existing.value_owned_by_drive:
@@ -259,7 +432,10 @@ class AgentDriveService:
             existing.file_kind = file_kind
             existing.file_id = file_id
             existing.value_owned_by_drive = item.value_owned_by_drive
+            existing.is_skill = item.is_skill
+            existing.skill_metadata = skill_metadata
             existing.size = size
+            existing.hash = file_hash
             existing.mime_type = mime_type
             return self._row_dict(existing)
 
@@ -271,13 +447,55 @@ class AgentDriveService:
             file_kind=file_kind,
             file_id=file_id,
             value_owned_by_drive=item.value_owned_by_drive,
+            is_skill=item.is_skill,
+            skill_metadata=skill_metadata,
             size=size,
+            hash=file_hash,
             mime_type=mime_type,
             created_by=user_id,
         )
         session.add(row)
         return self._row_dict(row)
 
+    def _remove_one(
+        self,
+        session: Session,
+        *,
+        tenant_id: str,
+        agent_id: str,
+        key: str,
+        pending_storage_deletes: list[str],
+    ) -> dict[str, Any]:
+        existing = session.scalar(
+            select(AgentDriveFile).where(
+                AgentDriveFile.tenant_id == tenant_id,
+                AgentDriveFile.agent_id == agent_id,
+                AgentDriveFile.key == key,
+            )
+        )
+        if existing is None:
+            return {"key": key, "removed": True, "noop": True}
+        result = {
+            "key": key,
+            "removed": True,
+            "file_kind": existing.file_kind.value,
+            "file_id": existing.file_id,
+            "value_owned_by_drive": existing.value_owned_by_drive,
+            "is_skill": existing.is_skill,
+            "skill_metadata": existing.skill_metadata,
+        }
+        if existing.value_owned_by_drive:
+            self._cleanup_value(
+                session,
+                tenant_id=tenant_id,
+                file_kind=existing.file_kind,
+                file_id=existing.file_id,
+                exclude_row_id=existing.id,
+                pending_storage_deletes=pending_storage_deletes,
+            )
+        session.delete(existing)
+        return result
+
     @staticmethod
     def _row_dict(row: AgentDriveFile) -> dict[str, Any]:
         return {
@@ -287,8 +505,187 @@ class AgentDriveService:
             "size": row.size,
             "mime_type": row.mime_type,
             "value_owned_by_drive": row.value_owned_by_drive,
+            "is_skill": row.is_skill,
+            "skill_metadata": row.skill_metadata,
         }
 
+    @staticmethod
+    def _skill_path_from_key(key: str) -> str:
+        if not key.endswith(_SKILL_MD_SUFFIX):
+            raise AgentDriveError(
+                "invalid_skill_key",
+                "skill rows must use the canonical '<path>/SKILL.md' key",
+                status_code=500,
+            )
+        path = key[: -len(_SKILL_MD_SUFFIX)]
+        if not path:
+            raise AgentDriveError(
+                "invalid_skill_key",
+                "skill rows must use the canonical '<path>/SKILL.md' key",
+                status_code=500,
+            )
+        return path
+
+    @classmethod
+    def _skill_archive_key(cls, key: str) -> str:
+        return f"{cls._skill_path_from_key(key)}/{_SKILL_ARCHIVE_NAME}"
+
+    @classmethod
+    def _validate_skill_commit_fields(cls, *, key: str, item: DriveCommitItem) -> str | None:
+        if not item.is_skill:
+            if item.skill_metadata is not None:
+                raise AgentDriveError(
+                    "invalid_skill_metadata",
+                    "skill metadata is only allowed for canonical skill rows",
+                    status_code=400,
+                )
+            return None
+        cls._skill_path_from_key(key)
+        if item.skill_metadata is None:
+            raise AgentDriveError(
+                "invalid_skill_metadata",
+                "skill metadata is required for canonical skill rows",
+                status_code=400,
+            )
+        return json.dumps(
+            item.skill_metadata.model_dump(mode="json", exclude_none=True),
+            separators=(",", ":"),
+            sort_keys=True,
+        )
+
+    @staticmethod
+    def _parse_skill_metadata(key: str, raw_metadata: str | None) -> DriveSkillMetadata:
+        if raw_metadata is None:
+            raise AgentDriveError(
+                "invalid_skill_metadata",
+                f"skill row '{key}' is missing required metadata",
+                status_code=500,
+            )
+        try:
+            return DriveSkillMetadata.model_validate(json.loads(raw_metadata))
+        except (ValueError, TypeError) as exc:
+            raise AgentDriveError(
+                "invalid_skill_metadata",
+                f"skill row '{key}' has invalid stored metadata",
+                status_code=500,
+            ) from exc
+
+    @staticmethod
+    def _manifest_files_from_skill_metadata(*, tenant_id: str, agent_id: str, skill_md_key: str) -> list[str] | None:
+        with session_factory.create_session() as session:
+            row = session.scalar(
+                select(AgentDriveFile).where(
+                    AgentDriveFile.tenant_id == tenant_id,
+                    AgentDriveFile.agent_id == agent_id,
+                    AgentDriveFile.key == skill_md_key,
+                    AgentDriveFile.is_skill.is_(True),
+                )
+            )
+            if row is None:
+                return None
+            try:
+                metadata = AgentDriveService._parse_skill_metadata(row.key, row.skill_metadata)
+            except Exception:
+                logger.warning("drive skill inspect: malformed skill metadata for %s", skill_md_key, exc_info=True)
+                return None
+        return [str(item) for item in (metadata.manifest_files or []) if str(item).strip()] or None
+
+    @classmethod
+    def _skill_file_entries(
+        cls,
+        *,
+        skill_path: str,
+        skill_md_key: str,
+        manifest_files: list[str] | None,
+        drive_keys: set[str],
+    ) -> tuple[list[AgentDriveSkillFileInfo], list[str]]:
+        warnings: list[str] = []
+        if manifest_files:
+            paths = sorted({normalize_drive_key(path) for path in manifest_files})
+        else:
+            paths = sorted(
+                {
+                    key.removeprefix(f"{skill_path}/")
+                    for key in drive_keys
+                    if not key.endswith(f"/{_SKILL_ARCHIVE_NAME}")
+                }
+            )
+            warnings.append("manifest_files_unavailable")
+
+        files: list[AgentDriveSkillFileInfo] = []
+        for path in paths:
+            if path == _SKILL_ARCHIVE_NAME:
+                continue
+            drive_key = f"{skill_path}/{path}"
+            files.append(
+                {
+                    "path": path,
+                    "name": path.rsplit("/", 1)[-1],
+                    "type": "file",
+                    "drive_key": drive_key if drive_key in drive_keys else None,
+                    "available_in_drive": drive_key in drive_keys,
+                }
+            )
+        if "SKILL.md" not in {file["path"] for file in files}:
+            files.insert(
+                0,
+                {
+                    "path": "SKILL.md",
+                    "name": "SKILL.md",
+                    "type": "file",
+                    "drive_key": skill_md_key,
+                    "available_in_drive": skill_md_key in drive_keys,
+                },
+            )
+        return files, warnings
+
+    @staticmethod
+    def _build_file_tree(files: list[AgentDriveSkillFileInfo]) -> list[dict[str, Any]]:
+        root: dict[str, Any] = {}
+        for file in files:
+            cursor = root
+            parts = [part for part in file["path"].split("/") if part]
+            path_parts: list[str] = []
+            for part in parts[:-1]:
+                path_parts.append(part)
+                directory = cursor.setdefault(
+                    part,
+                    {
+                        "name": part,
+                        "path": "/".join(path_parts),
+                        "type": "directory",
+                        "children": {},
+                    },
+                )
+                cursor = directory["children"]
+            leaf_name = parts[-1] if parts else file["name"]
+            cursor[leaf_name] = {
+                "name": leaf_name,
+                "path": file["path"],
+                "type": file["type"],
+                "drive_key": file["drive_key"],
+                "available_in_drive": file["available_in_drive"],
+            }
+
+        def serialize(node: dict[str, Any]) -> list[dict[str, Any]]:
+            result: list[dict[str, Any]] = []
+            for item in sorted(node.values(), key=lambda value: (value["type"] != "directory", value["name"])):
+                if item["type"] == "directory":
+                    children = serialize(item["children"])
+                    result.append(
+                        {
+                            "name": item["name"],
+                            "path": item["path"],
+                            "type": "directory",
+                            "children": children,
+                        }
+                    )
+                else:
+                    result.append(item)
+            return result
+
+        return serialize(root)
+
     @staticmethod
     def _assert_agent_belongs_to_tenant(session: Session, *, tenant_id: str, agent_id: str) -> None:
         try:
@@ -309,7 +706,7 @@ class AgentDriveService:
         user_id: str,
         file_kind: AgentDriveFileKind,
         file_id: str,
-    ) -> tuple[int | None, str | None]:
+    ) -> tuple[int | None, str | None, str | None]:
         """Verify the source file exists for the tenant (and user, for ToolFile).
 
         Malformed ids (e.g. a non-UUID hitting a UUID column) are treated as a
@@ -328,7 +725,7 @@ class AgentDriveService:
                     raise AgentDriveError(
                         "source_not_found", "source ToolFile not found for this tenant/user", status_code=404
                     )
-                return tool_file.size, tool_file.mimetype
+                return tool_file.size, tool_file.mimetype, None
             upload_file = session.scalar(
                 select(UploadFile).where(UploadFile.id == file_id, UploadFile.tenant_id == tenant_id)
             )
@@ -337,7 +734,7 @@ class AgentDriveService:
             raise AgentDriveError("source_not_found", "source file ref is invalid", status_code=404) from exc
         if upload_file is None:
             raise AgentDriveError("source_not_found", "source UploadFile not found for this tenant", status_code=404)
-        return upload_file.size, upload_file.mime_type
+        return upload_file.size, upload_file.mime_type, upload_file.hash
 
     def _cleanup_value(
         self,
@@ -402,6 +799,11 @@ class AgentDriveService:
         else:
             mapping = {"transfer_method": "local_file", "upload_file_id": file_id}
         controller = DatabaseFileAccessController()
+        # Keep workflow runtime wiring lazy: importing this service is part of
+        # Agent v2 node bootstrap, while ``core.app.workflow`` re-exports the
+        # node factory. A module-level import here would close that cycle.
+        from core.app.workflow.file_runtime import DifyWorkflowFileRuntime
+
         runtime = DifyWorkflowFileRuntime(file_access_controller=controller)
         try:
             if file_kind == AgentDriveFileKind.UPLOAD_FILE:
@@ -509,6 +911,8 @@ __all__ = [
     "AgentDriveService",
     "DriveCommitItem",
     "DriveFileRef",
+    "DriveSkillMetadata",
+    "decode_drive_mention_ref",
     "normalize_drive_key",
     "parse_agent_drive_ref",
 ]
diff --git a/api/services/api_based_extension_service.py b/api/services/api_based_extension_service.py
index fdb377694bb..25f554b6bdc 100644
--- a/api/services/api_based_extension_service.py
+++ b/api/services/api_based_extension_service.py
@@ -1,16 +1,16 @@
 from sqlalchemy import select
+from sqlalchemy.orm import Session
 
 from core.extension.api_based_extension_requestor import APIBasedExtensionRequestor
 from core.helper.encrypter import decrypt_token, encrypt_token
-from extensions.ext_database import db
 from models.api_based_extension import APIBasedExtension, APIBasedExtensionPoint
 
 
 class APIBasedExtensionService:
     @staticmethod
-    def get_all_by_tenant_id(tenant_id: str) -> list[APIBasedExtension]:
+    def get_all_by_tenant_id(session: Session, tenant_id: str) -> list[APIBasedExtension]:
         extension_list = list(
-            db.session.scalars(
+            session.scalars(
                 select(APIBasedExtension)
                 .where(APIBasedExtension.tenant_id == tenant_id)
                 .order_by(APIBasedExtension.created_at.desc())
@@ -23,23 +23,23 @@ class APIBasedExtensionService:
         return extension_list
 
     @classmethod
-    def save(cls, extension_data: APIBasedExtension) -> APIBasedExtension:
-        cls._validation(extension_data)
+    def save(cls, session: Session, extension_data: APIBasedExtension) -> APIBasedExtension:
+        cls._validation(session, extension_data)
 
         extension_data.api_key = encrypt_token(extension_data.tenant_id, extension_data.api_key)
 
-        db.session.add(extension_data)
-        db.session.commit()
+        session.add(extension_data)
+        session.commit()
         return extension_data
 
     @staticmethod
-    def delete(extension_data: APIBasedExtension):
-        db.session.delete(extension_data)
-        db.session.commit()
+    def delete(session: Session, extension_data: APIBasedExtension):
+        session.delete(extension_data)
+        session.commit()
 
     @staticmethod
-    def get_with_tenant_id(tenant_id: str, api_based_extension_id: str) -> APIBasedExtension:
-        extension = db.session.scalar(
+    def get_with_tenant_id(session: Session, tenant_id: str, api_based_extension_id: str) -> APIBasedExtension:
+        extension = session.scalar(
             select(APIBasedExtension)
             .where(APIBasedExtension.tenant_id == tenant_id, APIBasedExtension.id == api_based_extension_id)
             .limit(1)
@@ -53,14 +53,14 @@ class APIBasedExtensionService:
         return extension
 
     @classmethod
-    def _validation(cls, extension_data: APIBasedExtension):
+    def _validation(cls, session: Session, extension_data: APIBasedExtension):
         # name
         if not extension_data.name:
             raise ValueError("name must not be empty")
 
         if not extension_data.id:
             # case one: check new data, name must be unique
-            is_name_existed = db.session.scalar(
+            is_name_existed = session.scalar(
                 select(APIBasedExtension)
                 .where(
                     APIBasedExtension.tenant_id == extension_data.tenant_id,
@@ -73,7 +73,7 @@ class APIBasedExtensionService:
                 raise ValueError("name must be unique, it is already existed")
         else:
             # case two: check existing data, name must be unique
-            is_name_existed = db.session.scalar(
+            is_name_existed = session.scalar(
                 select(APIBasedExtension)
                 .where(
                     APIBasedExtension.tenant_id == extension_data.tenant_id,
diff --git a/api/services/app_service.py b/api/services/app_service.py
index 0f346433265..941855b8321 100644
--- a/api/services/app_service.py
+++ b/api/services/app_service.py
@@ -8,6 +8,7 @@ import sqlalchemy as sa
 from flask_sqlalchemy.pagination import Pagination
 from pydantic import BaseModel, Field
 from sqlalchemy import ColumnElement, select
+from sqlalchemy.exc import IntegrityError
 from sqlalchemy.orm import Session, scoped_session
 
 from configs import dify_config
@@ -27,6 +28,7 @@ from models import Account, AppStar
 from models.agent import Agent, AgentIconType, AgentScope, AgentSource, AgentStatus
 from models.model import App, AppMode, AppModelConfig, IconType, Site
 from models.tools import ApiToolProvider
+from services.agent.errors import AgentNameConflictError
 from services.billing_service import BillingService
 from services.enterprise import rbac_service as enterprise_rbac_service
 from services.enterprise.enterprise_service import EnterpriseService
@@ -593,6 +595,16 @@ class AppService:
         if updated_at is not None:
             agent.updated_at = updated_at
 
+    @staticmethod
+    def _commit_app_identity_update(app: App) -> None:
+        try:
+            db.session.commit()
+        except IntegrityError as exc:
+            db.session.rollback()
+            if app.mode == AppMode.AGENT:
+                raise AgentNameConflictError() from exc
+            raise
+
     def update_app(self, app: App, args: ArgsDict) -> App:
         """
         Update app
@@ -629,7 +641,7 @@ class AppService:
             account_id=current_user.id,
             updated_at=app.updated_at,
         )
-        db.session.commit()
+        self._commit_app_identity_update(app)
 
         app_was_updated.send(app)
 
@@ -652,7 +664,7 @@ class AppService:
             account_id=current_user.id,
             updated_at=app.updated_at,
         )
-        db.session.commit()
+        self._commit_app_identity_update(app)
 
         app_was_updated.send(app)
 
diff --git a/api/services/auth/firecrawl/firecrawl.py b/api/services/auth/firecrawl/firecrawl.py
index bfced19128c..387f75dee94 100644
--- a/api/services/auth/firecrawl/firecrawl.py
+++ b/api/services/auth/firecrawl/firecrawl.py
@@ -5,6 +5,10 @@ import httpx
 
 from services.auth.api_key_auth_base import ApiKeyAuthBase, AuthCredentials
 
+# Explicit bounded timeout for credential-validation requests so a slow or
+# hanging Firecrawl endpoint cannot block the worker indefinitely.
+_CREDENTIAL_TIMEOUT = httpx.Timeout(10.0)
+
 
 class FirecrawlAuth(ApiKeyAuthBase):
     def __init__(self, credentials: AuthCredentials):
@@ -42,7 +46,7 @@ class FirecrawlAuth(ApiKeyAuthBase):
         return f"{self.base_url.rstrip('/')}/{path.lstrip('/')}"
 
     def _post_request(self, url, data, headers):
-        return httpx.post(url, headers=headers, json=data)
+        return httpx.post(url, headers=headers, json=data, timeout=_CREDENTIAL_TIMEOUT)
 
     def _handle_error(self, response):
         try:
diff --git a/api/services/auth/jina.py b/api/services/auth/jina.py
index c5e9ac2d1c5..125596e1a60 100644
--- a/api/services/auth/jina.py
+++ b/api/services/auth/jina.py
@@ -8,7 +8,10 @@ from services.auth.api_key_auth_base import ApiKeyAuthBase, AuthCredentials
 
 _http_client: httpx.Client = get_pooled_http_client(
     "auth:jina_standalone",
-    lambda: httpx.Client(limits=httpx.Limits(max_keepalive_connections=50, max_connections=100)),
+    lambda: httpx.Client(
+        timeout=httpx.Timeout(10.0),
+        limits=httpx.Limits(max_keepalive_connections=50, max_connections=100),
+    ),
 )
 
 
diff --git a/api/services/auth/jina/jina.py b/api/services/auth/jina/jina.py
index 6260b6b48ad..da0696b94fa 100644
--- a/api/services/auth/jina/jina.py
+++ b/api/services/auth/jina/jina.py
@@ -8,7 +8,10 @@ from services.auth.api_key_auth_base import ApiKeyAuthBase, AuthCredentials
 
 _http_client: httpx.Client = get_pooled_http_client(
     "auth:jina",
-    lambda: httpx.Client(limits=httpx.Limits(max_keepalive_connections=50, max_connections=100)),
+    lambda: httpx.Client(
+        timeout=httpx.Timeout(10.0),
+        limits=httpx.Limits(max_keepalive_connections=50, max_connections=100),
+    ),
 )
 
 
diff --git a/api/services/credit_pool_service.py b/api/services/credit_pool_service.py
index 2e103dec153..94515309e79 100644
--- a/api/services/credit_pool_service.py
+++ b/api/services/credit_pool_service.py
@@ -1,4 +1,12 @@
+"""Tenant credit pool accounting.
+
+Credit deductions are guarded by a tenant-level Redis lock before the database
+row lock is acquired. This keeps concurrent usage accounting for one tenant
+from piling up database transactions while preserving cross-tenant concurrency.
+"""
+
 import logging
+from collections.abc import Callable
 
 from sqlalchemy import select
 from sqlalchemy.orm import Session
@@ -7,13 +15,44 @@ from configs import dify_config
 from core.db.session_factory import session_factory
 from core.errors.error import QuotaExceededError
 from extensions.ext_database import db
+from extensions.ext_redis import redis_client
 from models import TenantCreditPool
 from models.enums import ProviderQuotaType
 
 logger = logging.getLogger(__name__)
 
+CREDIT_POOL_TENANT_LOCK_TIMEOUT_SECONDS = 10
+CREDIT_POOL_TENANT_LOCK_BLOCKING_TIMEOUT_SECONDS = 5
+
 
 class CreditPoolService:
+    @staticmethod
+    def _get_tenant_lock_key(tenant_id: str) -> str:
+        return f"credit_pool:tenant:{tenant_id}:deduct_lock"
+
+    @classmethod
+    def _deduct_with_tenant_lock(cls, tenant_id: str, deduct: Callable[[], int]) -> int:
+        lock_key = cls._get_tenant_lock_key(tenant_id)
+        lock = redis_client.lock(
+            lock_key,
+            timeout=CREDIT_POOL_TENANT_LOCK_TIMEOUT_SECONDS,
+            blocking_timeout=CREDIT_POOL_TENANT_LOCK_BLOCKING_TIMEOUT_SECONDS,
+        )
+        lock_acquired = False
+
+        try:
+            lock_acquired = lock.acquire(blocking=True)
+            if not lock_acquired:
+                raise QuotaExceededError("Failed to acquire credit pool lock")
+
+            return deduct()
+        finally:
+            if lock_acquired:
+                try:
+                    lock.release()
+                except Exception:
+                    logger.warning("Failed to release credit pool lock, tenant_id=%s", tenant_id, exc_info=True)
+
     @staticmethod
     def _get_locked_pool(session: Session, tenant_id: str, pool_type: str) -> TenantCreditPool | None:
         return session.scalar(
@@ -76,7 +115,7 @@ class CreditPoolService:
         if credits_required <= 0:
             return 0
 
-        try:
+        def deduct() -> int:
             with session_factory.get_session_maker().begin() as session:
                 pool = cls._get_locked_pool(session=session, tenant_id=tenant_id, pool_type=pool_type)
                 if not pool:
@@ -89,14 +128,16 @@ class CreditPoolService:
                     raise QuotaExceededError("Insufficient credits remaining")
 
                 pool.quota_used += credits_required
+                return credits_required
+
+        try:
+            return cls._deduct_with_tenant_lock(tenant_id, deduct)
         except QuotaExceededError:
             raise
         except Exception:
             logger.exception("Failed to deduct credits for tenant %s", tenant_id)
             raise QuotaExceededError("Failed to deduct credits")
 
-        return credits_required
-
     @classmethod
     def deduct_credits_capped(
         cls,
@@ -108,7 +149,7 @@ class CreditPoolService:
         if credits_required <= 0:
             return 0
 
-        try:
+        def deduct() -> int:
             with session_factory.get_session_maker().begin() as session:
                 pool = cls._get_locked_pool(session=session, tenant_id=tenant_id, pool_type=pool_type)
                 if not pool:
@@ -121,6 +162,9 @@ class CreditPoolService:
 
                 pool.quota_used += deducted_credits
                 return deducted_credits
+
+        try:
+            return cls._deduct_with_tenant_lock(tenant_id, deduct)
         except QuotaExceededError:
             raise
         except Exception:
diff --git a/api/services/dataset_service.py b/api/services/dataset_service.py
index 125f3a8e6b8..a8f341fdd04 100644
--- a/api/services/dataset_service.py
+++ b/api/services/dataset_service.py
@@ -1778,7 +1778,7 @@ class DocumentService:
             invalid_source_message="Document does not have an uploaded file to download.",
             missing_file_message="Uploaded file not found.",
         )
-        upload_files_by_id = FileService.get_upload_files_by_ids(document.tenant_id, [upload_file_id])
+        upload_files_by_id = FileService.get_upload_files_by_ids(db.session(), document.tenant_id, [upload_file_id])
         upload_file = upload_files_by_id.get(upload_file_id)
         if not upload_file:
             raise NotFound("Uploaded file not found.")
@@ -1817,7 +1817,7 @@ class DocumentService:
             upload_file_ids.append(upload_file_id)
             upload_file_ids_by_document_id[document_id] = upload_file_id
 
-        upload_files_by_id = FileService.get_upload_files_by_ids(tenant_id, upload_file_ids)
+        upload_files_by_id = FileService.get_upload_files_by_ids(db.session(), tenant_id, upload_file_ids)
         missing_upload_file_ids: set[str] = set(upload_file_ids) - set(upload_files_by_id.keys())
         if missing_upload_file_ids:
             raise NotFound("Only uploaded-file documents can be downloaded as ZIP.")
diff --git a/api/services/enterprise/base.py b/api/services/enterprise/base.py
index 71deec752e5..7ded11a1658 100644
--- a/api/services/enterprise/base.py
+++ b/api/services/enterprise/base.py
@@ -182,6 +182,10 @@ class EnterpriseRequest(BaseRequest):
         inner_headers: dict[str, str] = {INNER_TENANT_ID_HEADER: tenant_id}
         if account_id:
             inner_headers[INNER_ACCOUNT_ID_HEADER] = account_id
+
+        if not cls.base_url.startswith("http") or not cls.base_url.startswith("https") or not cls.base_url:
+            raise ValueError("ENTERPRISE_RBAC_API_URL is required when RBAC_ENABLED=true")
+
         url = f"{cls.rbac_base_url}{endpoint}"
         mounts = cls._build_mounts()
 
diff --git a/api/services/enterprise/rbac_service.py b/api/services/enterprise/rbac_service.py
index 39a3a61a781..be94925b94a 100644
--- a/api/services/enterprise/rbac_service.py
+++ b/api/services/enterprise/rbac_service.py
@@ -312,15 +312,26 @@ _LEGACY_WORKSPACE_OWNER_KEYS: list[str] = [
     "plugin.manage",
     "plugin.debug",
     "credential.use",
+    "credential.create",
     "credential.manage",
+    "billing.view",
+    "billing.subscription.manage",
+    "billing.manage",
+    "app.acl.preview",
     "app_library.access",
     "app.create_and_management",
     "app.tag.manage",
+    "dataset.acl.preview",
     "dataset.create_and_management",
     "dataset.tag.manage",
     "dataset.external.connect",
+    "dataset.api_key.manage",
+    "snippets.create_and_modify",
+    "snippets.management",
     "tool.manage",
     "mcp.manage",
+    "snippets.create_and_modify",
+    "snippets.management",
 ]
 
 _LEGACY_WORKSPACE_ADMIN_KEYS: list[str] = [
@@ -334,15 +345,24 @@ _LEGACY_WORKSPACE_ADMIN_KEYS: list[str] = [
     "plugin.manage",
     "plugin.debug",
     "credential.use",
+    "credential.create",
     "credential.manage",
+    "billing.view",
+    "billing.subscription.manage",
+    "billing.manage",
     "app_library.access",
     "app.create_and_management",
     "app.tag.manage",
     "dataset.create_and_management",
     "dataset.tag.manage",
     "dataset.external.connect",
+    "dataset.api_key.manage",
+    "snippets.create_and_modify",
+    "snippets.management",
     "tool.manage",
     "mcp.manage",
+    "snippets.create_and_modify",
+    "snippets.management",
 ]
 
 _LEGACY_WORKSPACE_EDITOR_KEYS: list[str] = [
@@ -356,7 +376,9 @@ _LEGACY_WORKSPACE_EDITOR_KEYS: list[str] = [
     "dataset.create_and_management",
     "dataset.tag.manage",
     "dataset.external.connect",
+    "snippets.create_and_modify",
     "tool.manage",
+    "snippets.create_and_modify",
 ]
 
 _LEGACY_WORKSPACE_NORMAL_KEYS: list[str] = [
@@ -373,6 +395,7 @@ _LEGACY_WORKSPACE_DATASET_OPERATOR_KEYS: list[str] = [
 ]
 
 _LEGACY_APP_OWNER_KEYS: list[str] = [
+    "app.acl.preview",
     "app.acl.view_layout",
     "app.acl.test_and_run",
     "app.acl.edit",
@@ -384,6 +407,7 @@ _LEGACY_APP_OWNER_KEYS: list[str] = [
 ]
 
 _LEGACY_APP_ADMIN_KEYS: list[str] = [
+    "app.acl.preview",
     "app.acl.view_layout",
     "app.acl.test_and_run",
     "app.acl.edit",
@@ -395,6 +419,7 @@ _LEGACY_APP_ADMIN_KEYS: list[str] = [
 ]
 
 _LEGACY_APP_EDITOR_KEYS: list[str] = [
+    "app.acl.preview",
     "app.acl.view_layout",
     "app.acl.test_and_run",
     "app.acl.edit",
@@ -406,12 +431,14 @@ _LEGACY_APP_EDITOR_KEYS: list[str] = [
 ]
 
 _LEGACY_APP_NORMAL_KEYS: list[str] = [
+    "app.acl.preview",
     "app.acl.view_layout",
     "app.acl.test_and_run",
     "app.acl.monitor",
 ]
 
 _LEGACY_DATASET_OWNER_KEYS: list[str] = [
+    "dataset.acl.preview",
     "dataset.acl.readonly",
     "dataset.acl.edit",
     "dataset.acl.import_export_dsl",
@@ -427,6 +454,7 @@ _LEGACY_DATASET_OWNER_KEYS: list[str] = [
 ]
 
 _LEGACY_DATASET_ADMIN_KEYS: list[str] = [
+    "dataset.acl.preview",
     "dataset.acl.readonly",
     "dataset.acl.edit",
     "dataset.acl.import_export_dsl",
@@ -442,6 +470,7 @@ _LEGACY_DATASET_ADMIN_KEYS: list[str] = [
 ]
 
 _LEGACY_DATASET_EDITOR_KEYS: list[str] = [
+    "dataset.acl.preview",
     "dataset.acl.readonly",
     "dataset.acl.edit",
     "dataset.acl.import_export_dsl",
@@ -492,6 +521,19 @@ _LEGACY_MY_PERMISSIONS: dict[TenantAccountRole, dict[str, list[str]]] = {
 }
 
 
+def _legacy_role_permission_keys(role: TenantAccountRole) -> list[str]:
+    permissions = _LEGACY_MY_PERMISSIONS.get(role, {})
+    return list(
+        dict.fromkeys(
+            [
+                *permissions.get("workspace", []),
+                *permissions.get("app", []),
+                *permissions.get("dataset", []),
+            ]
+        )
+    )
+
+
 def _legacy_my_permissions(tenant_id: str, account_id: str | None) -> MyPermissionsResponse:
     if not account_id:
         return MyPermissionsResponse()
@@ -728,6 +770,7 @@ class RBACService:
             data = _inner_call(
                 "GET",
                 f"{_INNER_PREFIX}/role-permissions/catalog",
+                params={"billing_enabled": dify_config.BILLING_ENABLED},
                 tenant_id=tenant_id,
                 account_id=account_id,
             )
@@ -1518,21 +1561,44 @@ class RBACService:
             )
             return AccessMatrixItem.model_validate(data or {})
 
-    # ------------------------------------------------------------------
-    # Member ↔ role bindings (screenshot 3: Settings > Members > Assign roles).
-    # ------------------------------------------------------------------
     class MemberRoles:
         @staticmethod
         def get(tenant_id: str, account_id: str | None, member_account_id: str) -> MemberRolesResponse:
-            data = _inner_call(
-                "GET",
-                f"{_INNER_PREFIX}/members/rbac-roles",
-                tenant_id=tenant_id,
-                account_id=account_id,
-                params={"account_id": member_account_id},
-            )
-            rst = MemberRolesResponse.model_validate(data or {})
-            return rst
+            if dify_config.RBAC_ENABLED:
+                data = _inner_call(
+                    "GET",
+                    f"{_INNER_PREFIX}/members/rbac-roles",
+                    tenant_id=tenant_id,
+                    account_id=account_id,
+                    params={"account_id": member_account_id},
+                )
+                rst = MemberRolesResponse.model_validate(data or {})
+                return rst
+            else:
+                with session_factory.create_session() as session:
+                    role = session.scalar(
+                        select(TenantAccountJoin.role).where(
+                            TenantAccountJoin.tenant_id == tenant_id,
+                            TenantAccountJoin.account_id == member_account_id,
+                        )
+                    )
+                    return MemberRolesResponse(
+                        account_id=member_account_id,
+                        roles=[
+                            RBACRole(
+                                id=role,
+                                name=role,
+                                description="",
+                                is_builtin=True,
+                                type="",
+                                permission_keys=_legacy_role_permission_keys(role),
+                                role_tag="owner" if role == "owner" else role,
+                                tenant_id=tenant_id,
+                            )
+                        ]
+                        if role
+                        else [],
+                    )
 
         @staticmethod
         def batch_get(
diff --git a/api/services/feedback_service.py b/api/services/feedback_service.py
index d6c338a830d..24cfb8aa852 100644
--- a/api/services/feedback_service.py
+++ b/api/services/feedback_service.py
@@ -5,8 +5,8 @@ from datetime import datetime
 
 from flask import Response
 from sqlalchemy import or_, select
+from sqlalchemy.orm import Session
 
-from extensions.ext_database import db
 from models.enums import FeedbackRating
 from models.model import Account, App, Conversation, Message, MessageFeedback
 
@@ -14,6 +14,7 @@ from models.model import Account, App, Conversation, Message, MessageFeedback
 class FeedbackService:
     @staticmethod
     def export_feedbacks(
+        session: Session,
         app_id: str,
         from_source: str | None = None,
         rating: str | None = None,
@@ -81,7 +82,7 @@ class FeedbackService:
         stmt = stmt.order_by(MessageFeedback.created_at.desc())
 
         # Execute query
-        results = db.session.execute(stmt).all()
+        results = session.execute(stmt).all()
 
         # Prepare data for export
         export_data = []
diff --git a/api/services/file_service.py b/api/services/file_service.py
index 1781f0c9727..e41d74ad3eb 100644
--- a/api/services/file_service.py
+++ b/api/services/file_service.py
@@ -20,7 +20,6 @@ from constants import (
     VIDEO_EXTENSIONS,
 )
 from core.rag.extractor.extract_processor import ExtractProcessor
-from extensions.ext_database import db
 from extensions.ext_storage import storage
 from extensions.storage.storage_type import StorageType
 from graphon.file import helpers as file_helpers
@@ -268,7 +267,9 @@ class FileService:
             session.delete(upload_file)
 
     @staticmethod
-    def get_upload_files_by_ids(tenant_id: str, upload_file_ids: Sequence[str]) -> dict[str, UploadFile]:
+    def get_upload_files_by_ids(
+        session: Session, tenant_id: str, upload_file_ids: Sequence[str]
+    ) -> dict[str, UploadFile]:
         """
         Fetch `UploadFile` rows for a tenant in a single batch query.
 
@@ -282,7 +283,7 @@ class FileService:
         unique_upload_file_ids: list[str] = list(set(upload_file_id_list))
 
         # Fetch upload files in one query for efficient batch access.
-        upload_files: Sequence[UploadFile] = db.session.scalars(
+        upload_files: Sequence[UploadFile] = session.scalars(
             select(UploadFile).where(
                 UploadFile.tenant_id == tenant_id,
                 UploadFile.id.in_(unique_upload_file_ids),
diff --git a/api/services/hit_testing_service.py b/api/services/hit_testing_service.py
index 6c70e324b17..9a2843864d9 100644
--- a/api/services/hit_testing_service.py
+++ b/api/services/hit_testing_service.py
@@ -4,6 +4,7 @@ import time
 from typing import Any, TypedDict, cast
 
 from sqlalchemy import select
+from sqlalchemy.orm import Session, scoped_session
 
 from core.app.app_config.entities import ModelConfig
 from core.rag.datasource.retrieval_service import DefaultRetrievalModelDict, RetrievalService
@@ -12,7 +13,6 @@ from core.rag.index_processor.constant.query_type import QueryType
 from core.rag.models.document import Document
 from core.rag.retrieval.dataset_retrieval import DatasetRetrieval
 from core.rag.retrieval.retrieval_methods import RetrievalMethod
-from extensions.ext_database import db
 from graphon.model_runtime.entities import LLMMode
 from models import Account
 from models.dataset import Dataset, DatasetQuery
@@ -56,7 +56,9 @@ class HitTestingService:
         }
 
     @classmethod
-    def _dump_retrieval_records(cls, records: list[RetrievalSegments]) -> list[dict[str, Any]]:
+    def _dump_retrieval_records(
+        cls, session: Session | scoped_session, records: list[RetrievalSegments]
+    ) -> list[dict[str, Any]]:
         document_ids = {
             document_id
             for record in records
@@ -69,9 +71,7 @@ class HitTestingService:
 
         documents = {
             document.id: cls._dump_dataset_document(document)
-            for document in db.session.scalars(
-                select(DatasetDocument).where(DatasetDocument.id.in_(document_ids))
-            ).all()
+            for document in session.scalars(select(DatasetDocument).where(DatasetDocument.id.in_(document_ids))).all()
         }
 
         records_with_documents: list[dict[str, Any]] = []
@@ -105,6 +105,7 @@ class HitTestingService:
     @classmethod
     def retrieve(
         cls,
+        session: Session | scoped_session,
         dataset: Dataset,
         query: str,
         account: Account,
@@ -142,7 +143,7 @@ class HitTestingService:
             if metadata_filter_document_ids:
                 document_ids_filter = metadata_filter_document_ids.get(dataset.id, [])
             if metadata_condition and not document_ids_filter:
-                return cls.compact_retrieve_response(query, [])
+                return cls.compact_retrieve_response(session, query, [])
         all_documents = RetrievalService.retrieve(
             retrieval_method=RetrievalMethod(
                 resolved_retrieval_model.get("search_method", RetrievalMethod.SEMANTIC_SEARCH)
@@ -181,14 +182,15 @@ class HitTestingService:
                 created_by_role=CreatorUserRole.ACCOUNT,
                 created_by=account.id,
             )
-            db.session.add(dataset_query)
-        db.session.commit()
+            session.add(dataset_query)
+        session.commit()
 
-        return cls.compact_retrieve_response(query, all_documents)
+        return cls.compact_retrieve_response(session, query, all_documents)
 
     @classmethod
     def external_retrieve(
         cls,
+        session: Session | scoped_session,
         dataset: Dataset,
         query: str,
         account: Account,
@@ -222,20 +224,22 @@ class HitTestingService:
             created_by=account.id,
         )
 
-        db.session.add(dataset_query)
-        db.session.commit()
+        session.add(dataset_query)
+        session.commit()
 
         return dict(cls.compact_external_retrieve_response(dataset, query, all_documents))
 
     @classmethod
-    def compact_retrieve_response(cls, query: str, documents: list[Document]) -> RetrieveResponseDict:
+    def compact_retrieve_response(
+        cls, session: Session | scoped_session, query: str, documents: list[Document]
+    ) -> RetrieveResponseDict:
         records = RetrievalService.format_retrieval_documents(documents)
 
         return {
             "query": {
                 "content": query,
             },
-            "records": cls._dump_retrieval_records(records),
+            "records": cls._dump_retrieval_records(session, records),
         }
 
     @classmethod
diff --git a/api/services/operation_service.py b/api/services/operation_service.py
index 903efd26ae7..6869cf23ea2 100644
--- a/api/services/operation_service.py
+++ b/api/services/operation_service.py
@@ -3,6 +3,8 @@ from typing import TypedDict
 
 import httpx
 
+OPERATION_REQUEST_TIMEOUT = httpx.Timeout(10.0, connect=3.0)
+
 
 class UtmInfo(TypedDict, total=False):
     """Expected shape of the utm_info dict passed to record_utm.
@@ -26,7 +28,9 @@ class OperationService:
         headers = {"Content-Type": "application/json", "Billing-Api-Secret-Key": cls.secret_key}
 
         url = f"{cls.base_url}{endpoint}"
-        response = httpx.request(method, url, json=json, params=params, headers=headers)
+        response = httpx.request(
+            method, url, json=json, params=params, headers=headers, timeout=OPERATION_REQUEST_TIMEOUT
+        )
 
         return response.json()
 
diff --git a/api/services/retention/workflow_run/archive_paid_plan_workflow_run.py b/api/services/retention/workflow_run/archive_paid_plan_workflow_run.py
index 21be411bea7..e046013b2ce 100644
--- a/api/services/retention/workflow_run/archive_paid_plan_workflow_run.py
+++ b/api/services/retention/workflow_run/archive_paid_plan_workflow_run.py
@@ -1,8 +1,12 @@
 """
 Archive Paid Plan Workflow Run Logs Service.
 
-This service archives workflow run logs for paid plan users older than the configured
-retention period (default: 90 days) to S3-compatible storage.
+This service archives workflow run logs for paid plan users older than the configured retention period (default:
+90 days) to S3-compatible storage.
+
+Archive V2 writes bundle-level Parquet objects. A bundle contains many workflow runs and their related table rows.
+Bundle metadata lives in the object-store manifest instead of a database table, so archive/delete/restore does not move
+the large-table retention problem into another OLTP table.
 
 Archived tables:
 - workflow_runs
@@ -16,18 +20,19 @@ Archived tables:
 """
 
 import datetime
-import io
+import hashlib
 import json
 import logging
 import time
-import zipfile
 from collections.abc import Sequence
-from concurrent.futures import ThreadPoolExecutor
 from dataclasses import dataclass, field
+from enum import Enum
 from typing import Any, TypedDict
 
 import click
-from sqlalchemy import inspect
+import pyarrow as pa
+import pyarrow.parquet as pq
+from sqlalchemy import inspect, select
 from sqlalchemy.orm import Session, sessionmaker
 
 from configs import dify_config
@@ -39,12 +44,24 @@ from libs.archive_storage import (
     ArchiveStorageNotConfiguredError,
     get_archive_storage,
 )
-from models.workflow import WorkflowAppLog, WorkflowRun
+from models.trigger import WorkflowTriggerLog
+from models.workflow import (
+    WorkflowAppLog,
+    WorkflowNodeExecutionModel,
+    WorkflowNodeExecutionOffload,
+    WorkflowPause,
+    WorkflowPauseReason,
+    WorkflowRun,
+)
 from repositories.api_workflow_node_execution_repository import DifyAPIWorkflowNodeExecutionRepository
 from repositories.api_workflow_run_repository import APIWorkflowRunRepository
 from repositories.sqlalchemy_workflow_trigger_log_repository import SQLAlchemyWorkflowTriggerLogRepository
 from services.billing_service import BillingService
-from services.retention.workflow_run.constants import ARCHIVE_BUNDLE_NAME, ARCHIVE_SCHEMA_VERSION
+from services.retention.workflow_run.constants import (
+    ARCHIVE_BUNDLE_FORMAT,
+    ARCHIVE_BUNDLE_MANIFEST_NAME,
+    ARCHIVE_BUNDLE_SCHEMA_VERSION,
+)
 
 logger = logging.getLogger(__name__)
 
@@ -53,17 +70,41 @@ class TableStatsManifestEntry(TypedDict):
     row_count: int
     checksum: str
     size_bytes: int
+    object_key: str
 
 
 class ArchiveManifestDict(TypedDict):
     schema_version: str
-    workflow_run_id: str
+    archive_format: str
     tenant_id: str
-    app_id: str
-    workflow_id: str
-    created_at: str
+    tenant_prefix: str
+    year: int
+    month: int
+    shard: str
+    bundle_id: str
+    object_prefix: str
+    workflow_run_count: int
+    workflow_node_execution_count: int
+    min_created_at: str
+    max_created_at: str
+    min_run_id: str
+    max_run_id: str
     archived_at: str
     tables: dict[str, TableStatsManifestEntry]
+    run_ids: list[str]
+
+
+@dataclass(frozen=True)
+class ArchiveBundleIdentity:
+    """Stable identity and object prefix for one V2 archive bundle."""
+
+    tenant_prefix: str
+    tenant_id: str
+    year: int
+    month: int
+    shard: str
+    bundle_id: str
+    object_prefix: str
 
 
 @dataclass
@@ -74,16 +115,21 @@ class TableStats:
     row_count: int
     checksum: str
     size_bytes: int
+    object_key: str = ""
 
 
 @dataclass
 class ArchiveResult:
-    """Result of archiving a single workflow run."""
+    """Result of archiving a bundle of workflow runs."""
 
-    run_id: str
+    bundle_id: str
     tenant_id: str
+    object_prefix: str
     success: bool
+    run_count: int = 0
     tables: list[TableStats] = field(default_factory=list)
+    object_size_bytes: int = 0
+    skipped: bool = False
     error: str | None = None
     elapsed_time: float = 0.0
 
@@ -96,6 +142,12 @@ class ArchiveSummary:
     runs_archived: int = 0
     runs_skipped: int = 0
     runs_failed: int = 0
+    total_bundles_processed: int = 0
+    bundles_archived: int = 0
+    bundles_skipped: int = 0
+    bundles_failed: int = 0
+    total_object_size_bytes: int = 0
+    table_stats: dict[str, TableStats] = field(default_factory=dict)
     total_elapsed_time: float = 0.0
 
 
@@ -104,16 +156,20 @@ class WorkflowRunArchiver:
     Archive workflow run logs for paid plan users.
 
     Storage Layout:
-    {tenant_id}/app_id={app_id}/year={YYYY}/month={MM}/workflow_run_id={run_id}/
-        └── archive.v1.0.zip
+    workflow-runs/v2/tenant_prefix={prefix}/tenant_id={tenant_id}/year={YYYY}/month={MM}/
+        shard={shard}/bundle={bundle_id}/
             ├── manifest.json
-            ├── workflow_runs.jsonl
-            ├── workflow_app_logs.jsonl
-            ├── workflow_node_executions.jsonl
-            ├── workflow_node_execution_offload.jsonl
-            ├── workflow_pauses.jsonl
-            ├── workflow_pause_reasons.jsonl
-            └── workflow_trigger_logs.jsonl
+            ├── workflow_runs.parquet
+            ├── workflow_app_logs.parquet
+            ├── workflow_node_executions.parquet
+            ├── workflow_node_execution_offload.parquet
+            ├── workflow_pauses.parquet
+            ├── workflow_pause_reasons.parquet
+            └── workflow_trigger_logs.parquet
+
+    `batch_size` is the maximum workflow_runs per bundle. The current implementation groups each fetched page by
+    tenant/month before writing bundles. Bundle idempotency is based on the manifest object key; the manifest is
+    uploaded after all table objects, so a missing manifest means the bundle should be retried.
     """
 
     ARCHIVED_TYPE = [
@@ -132,6 +188,10 @@ class WorkflowRunArchiver:
 
     start_from: datetime.datetime | None
     end_before: datetime.datetime
+    paid_tenant_ids: set[str] | None
+    tenant_prefixes: list[str]
+    run_shard_index: int | None
+    run_shard_total: int | None
 
     def __init__(
         self,
@@ -141,6 +201,10 @@ class WorkflowRunArchiver:
         end_before: datetime.datetime | None = None,
         workers: int = 1,
         tenant_ids: Sequence[str] | None = None,
+        tenant_prefixes: Sequence[str] | None = None,
+        paid_tenant_ids: Sequence[str] | None = None,
+        run_shard_index: int | None = None,
+        run_shard_total: int | None = None,
         limit: int | None = None,
         dry_run: bool = False,
         delete_after_archive: bool = False,
@@ -156,10 +220,19 @@ class WorkflowRunArchiver:
             end_before: Optional end time (exclusive) for archiving
             workers: Number of concurrent workflow runs to archive
             tenant_ids: Optional tenant IDs for grayscale rollout
+            tenant_prefixes: Optional tenant ID first-hex prefixes for rollout waves. CLI callers should resolve these
+                to tenant_ids during planning so workflow_runs scan uses tenant_id IN (...) instead of a prefix range.
+            paid_tenant_ids: Optional paid-tenant whitelist resolved by the archive plan. When provided, archive uses it
+                for per-run paid filtering and does not call billing on every fetched page.
+            run_shard_index: Optional zero-based workflow run shard index for parallel cron jobs
+            run_shard_total: Optional total workflow run shard count for parallel cron jobs
             limit: Maximum number of runs to archive (None for unlimited)
             dry_run: If True, only preview without making changes
-            delete_after_archive: If True, delete runs and related data after archiving
+            delete_after_archive: Reserved for the V1 per-run path. Bundle archive requires a separate validated
+                bundle delete workflow.
         """
+        if delete_after_archive:
+            raise ValueError("delete_after_archive is not supported by bundle archive")
         self.days = days
         self.batch_size = batch_size
         if start_from or end_before:
@@ -176,6 +249,16 @@ class WorkflowRunArchiver:
             raise ValueError("workers must be at least 1")
         self.workers = workers
         self.tenant_ids = sorted(set(tenant_ids)) if tenant_ids else []
+        self.tenant_prefixes = sorted(set(tenant_prefixes)) if tenant_prefixes else []
+        self.paid_tenant_ids = set(paid_tenant_ids) if paid_tenant_ids is not None else None
+        if (run_shard_index is None) ^ (run_shard_total is None):
+            raise ValueError("run_shard_index and run_shard_total must be provided together")
+        if run_shard_total is not None and not 1 <= run_shard_total <= 16:
+            raise ValueError("run_shard_total must be between 1 and 16")
+        if run_shard_index is not None and run_shard_total is not None and not 0 <= run_shard_index < run_shard_total:
+            raise ValueError("run_shard_index must be between 0 and run_shard_total - 1")
+        self.run_shard_index = run_shard_index
+        self.run_shard_total = run_shard_total
         self.limit = limit
         self.dry_run = dry_run
         self.delete_after_archive = delete_after_archive
@@ -209,124 +292,185 @@ class WorkflowRunArchiver:
             return summary
 
         session_maker = sessionmaker(bind=db.engine, expire_on_commit=False)
-        repo = self._get_workflow_run_repo()
+        attempted_count = 0
 
-        def _archive_with_session(run: WorkflowRun) -> ArchiveResult:
-            with session_maker() as session:
-                return self._archive_run(session, storage, run)
-
-        last_seen: tuple[datetime.datetime, str] | None = None
-        archived_count = 0
-
-        with ThreadPoolExecutor(max_workers=self.workers) as executor:
+        for tenant_scope in self._tenant_scan_scopes():
+            last_seen: tuple[datetime.datetime, str] | None = None
             while True:
-                # Check limit
-                if self.limit and archived_count >= self.limit:
+                if self.limit and attempted_count >= self.limit:
                     click.echo(click.style(f"Reached limit of {self.limit} runs", fg="yellow"))
                     break
 
-                # Fetch batch of runs
-                runs = self._get_runs_batch(last_seen)
-
+                runs = self._get_runs_batch(last_seen, tenant_scope=tenant_scope)
                 if not runs:
                     break
 
-                run_ids = [run.id for run in runs]
-                with session_maker() as session:
-                    archived_run_ids = repo.get_archived_run_ids(session, run_ids)
-
                 last_seen = (runs[-1].created_at, runs[-1].id)
-
-                # Filter to paid tenants only
                 tenant_ids = {run.tenant_id for run in runs}
                 paid_tenants = self._filter_paid_tenants(tenant_ids)
 
                 runs_to_process: list[WorkflowRun] = []
                 for run in runs:
                     summary.total_runs_processed += 1
-
-                    # Skip non-paid tenants
                     if run.tenant_id not in paid_tenants:
                         summary.runs_skipped += 1
                         continue
-
-                    # Skip already archived runs
-                    if run.id in archived_run_ids:
-                        summary.runs_skipped += 1
-                        continue
-
-                    # Check limit
-                    if self.limit and archived_count + len(runs_to_process) >= self.limit:
+                    if self.limit and attempted_count + len(runs_to_process) >= self.limit:
                         break
-
                     runs_to_process.append(run)
 
                 if not runs_to_process:
                     continue
 
-                results = list(executor.map(_archive_with_session, runs_to_process))
+                for bundle_runs in self._group_runs_for_bundles(runs_to_process):
+                    summary.total_bundles_processed += 1
+                    with session_maker() as session:
+                        result = self._archive_bundle(session, storage, bundle_runs)
 
-                for run, result in zip(runs_to_process, results):
-                    if result.success:
-                        summary.runs_archived += 1
-                        archived_count += 1
+                    if result.skipped:
+                        attempted_count += result.run_count
+                        summary.bundles_skipped += 1
+                        summary.runs_skipped += result.run_count
+                        click.echo(
+                            click.style(
+                                f"Skipped bundle {result.bundle_id} (tenant={result.tenant_id}, "
+                                f"runs={result.run_count}, reason={result.error or 'already handled'})",
+                                fg="yellow",
+                            )
+                        )
+                    elif result.success:
+                        attempted_count += result.run_count
+                        summary.bundles_archived += 1
+                        summary.runs_archived += result.run_count
+                        self._merge_result_stats(summary, result)
                         click.echo(
                             click.style(
                                 f"{'[DRY RUN] Would archive' if self.dry_run else 'Archived'} "
-                                f"run {run.id} (tenant={run.tenant_id}, "
-                                f"tables={len(result.tables)}, time={result.elapsed_time:.2f}s)",
+                                f"bundle {result.bundle_id} (tenant={result.tenant_id}, runs={result.run_count}, "
+                                f"tables={len(result.tables)}, object_size_bytes={result.object_size_bytes}, "
+                                f"time={result.elapsed_time:.2f}s)",
                                 fg="green",
                             )
                         )
+                        if self.dry_run:
+                            self._echo_table_estimates(result.tables)
                     else:
-                        summary.runs_failed += 1
+                        attempted_count += result.run_count
+                        summary.bundles_failed += 1
+                        summary.runs_failed += result.run_count
                         click.echo(
                             click.style(
-                                f"Failed to archive run {run.id}: {result.error}",
+                                f"Failed to archive bundle {result.bundle_id}: {result.error}",
                                 fg="red",
                             )
                         )
 
+            if self.limit and attempted_count >= self.limit:
+                break
+
         summary.total_elapsed_time = time.time() - start_time
         click.echo(
             click.style(
                 f"{'[DRY RUN] ' if self.dry_run else ''}Archive complete: "
                 f"processed={summary.total_runs_processed}, archived={summary.runs_archived}, "
                 f"skipped={summary.runs_skipped}, failed={summary.runs_failed}, "
+                f"bundles_archived={summary.bundles_archived}, bundles_skipped={summary.bundles_skipped}, "
+                f"bundles_failed={summary.bundles_failed}, "
+                f"object_size_bytes={summary.total_object_size_bytes}, "
                 f"time={summary.total_elapsed_time:.2f}s",
                 fg="white",
             )
         )
+        if self.dry_run:
+            self._echo_summary_estimates(summary)
 
         return summary
 
+    @staticmethod
+    def _merge_result_stats(summary: ArchiveSummary, result: ArchiveResult) -> None:
+        summary.total_object_size_bytes += result.object_size_bytes
+        for table_stat in result.tables:
+            summary_stat = summary.table_stats.get(table_stat.table_name)
+            if summary_stat is None:
+                summary.table_stats[table_stat.table_name] = TableStats(
+                    table_name=table_stat.table_name,
+                    row_count=table_stat.row_count,
+                    checksum="",
+                    size_bytes=table_stat.size_bytes,
+                )
+                continue
+            summary_stat.row_count += table_stat.row_count
+            summary_stat.size_bytes += table_stat.size_bytes
+
+    @staticmethod
+    def _echo_table_estimates(table_stats: Sequence[TableStats]) -> None:
+        for stat in table_stats:
+            click.echo(
+                click.style(
+                    f"  table={stat.table_name} rows={stat.row_count} parquet_bytes={stat.size_bytes}",
+                    fg="white",
+                )
+            )
+
+    def _echo_summary_estimates(self, summary: ArchiveSummary) -> None:
+        click.echo(click.style("[DRY RUN] Estimated archive totals by table:", fg="white"))
+        for table_name in self.ARCHIVED_TABLES:
+            stat = summary.table_stats.get(table_name)
+            row_count = stat.row_count if stat else 0
+            size_bytes = stat.size_bytes if stat else 0
+            click.echo(click.style(f"  table={table_name} rows={row_count} parquet_bytes={size_bytes}", fg="white"))
+
     def _get_runs_batch(
         self,
         last_seen: tuple[datetime.datetime, str] | None,
+        tenant_scope: Sequence[str] | None = None,
     ) -> Sequence[WorkflowRun]:
         """Fetch a batch of workflow runs to archive."""
         repo = self._get_workflow_run_repo()
+        tenant_ids = list(tenant_scope) if tenant_scope is not None else self.tenant_ids or None
         return repo.get_runs_batch_by_time_range(
             start_from=self.start_from,
             end_before=self.end_before,
             last_seen=last_seen,
             batch_size=self.batch_size,
             run_types=self.ARCHIVED_TYPE,
-            tenant_ids=self.tenant_ids or None,
+            tenant_ids=tenant_ids,
+            tenant_prefixes=None if tenant_ids else self.tenant_prefixes or None,
+            run_shard_index=self.run_shard_index,
+            run_shard_total=self.run_shard_total,
         )
 
+    def _tenant_scan_scopes(self) -> list[list[str] | None]:
+        if not self.tenant_ids:
+            return [None]
+        return [[tenant_id] for tenant_id in self.tenant_ids]
+
     def _build_start_message(self) -> str:
         range_desc = f"before {self.end_before.isoformat()}"
         if self.start_from:
             range_desc = f"between {self.start_from.isoformat()} and {self.end_before.isoformat()}"
+        run_shard_desc = "all"
+        if self.run_shard_index is not None and self.run_shard_total is not None:
+            run_shard_desc = f"{self.run_shard_index}/{self.run_shard_total}"
         return (
             f"{'[DRY RUN] ' if self.dry_run else ''}Starting workflow run archiving "
             f"for runs {range_desc} "
-            f"(batch_size={self.batch_size}, tenant_ids={','.join(self.tenant_ids) or 'all'})"
+            f"(batch_size={self.batch_size}, tenant_ids={self._format_tenant_scope()}, "
+            f"tenant_prefixes={','.join(self.tenant_prefixes) or 'all'}, run_shard={run_shard_desc})"
         )
 
+    def _format_tenant_scope(self) -> str:
+        if not self.tenant_ids:
+            return "all"
+        if len(self.tenant_ids) <= 10:
+            return ",".join(self.tenant_ids)
+        return f"{len(self.tenant_ids)} planned tenants"
+
     def _filter_paid_tenants(self, tenant_ids: set[str]) -> set[str]:
         """Filter tenant IDs to only include paid tenants."""
+        if self.paid_tenant_ids is not None:
+            return tenant_ids & self.paid_tenant_ids
+
         if not dify_config.BILLING_ENABLED:
             # If billing is not enabled, treat all tenants as paid
             return tenant_ids
@@ -349,177 +493,293 @@ class WorkflowRunArchiver:
 
         return paid
 
-    def _archive_run(
+    def _archive_bundle(
         self,
         session: Session,
         storage: ArchiveStorage | None,
-        run: WorkflowRun,
+        runs: Sequence[WorkflowRun],
     ) -> ArchiveResult:
-        """Archive a single workflow run."""
+        """Archive one tenant/month bundle of workflow runs."""
+        if not runs:
+            raise ValueError("runs must not be empty")
         start_time = time.time()
-        result = ArchiveResult(run_id=run.id, tenant_id=run.tenant_id, success=False)
+        identity = self._build_bundle_identity(runs)
+        result = ArchiveResult(
+            bundle_id=identity.bundle_id,
+            tenant_id=identity.tenant_id,
+            object_prefix=identity.object_prefix,
+            run_count=len(runs),
+            success=False,
+        )
 
         try:
-            # Extract data from all tables
-            table_data, app_logs, trigger_metadata = self._extract_data(session, run)
+            if not self.dry_run:
+                if storage is None:
+                    raise ArchiveStorageNotConfiguredError("Archive storage not configured")
+                if storage.object_exists(self._get_manifest_object_key(identity)):
+                    result.success = True
+                    result.skipped = True
+                    result.error = "bundle already archived"
+                    result.elapsed_time = time.time() - start_time
+                    return result
+
+                locked_runs = self._lock_runs_for_archive(session, [run.id for run in runs])
+                if len(locked_runs) != len(runs):
+                    result.success = True
+                    result.skipped = True
+                    result.error = "one or more runs locked or deleted by another archiver"
+                    result.elapsed_time = time.time() - start_time
+                    return result
+                runs = locked_runs
+
+            table_data = self._extract_bundle_data(session, runs)
+            table_stats, table_payloads, manifest_data = self._build_archive_payload(identity, runs, table_data)
+            object_size = len(manifest_data) + sum(len(payload) for payload in table_payloads.values())
 
             if self.dry_run:
-                # In dry run, just report what would be archived
-                for table_name in self.ARCHIVED_TABLES:
-                    records = table_data.get(table_name, [])
-                    result.tables.append(
-                        TableStats(
-                            table_name=table_name,
-                            row_count=len(records),
-                            checksum="",
-                            size_bytes=0,
-                        )
-                    )
+                result.tables = table_stats
+                result.object_size_bytes = object_size
                 result.success = True
             else:
                 if storage is None:
                     raise ArchiveStorageNotConfiguredError("Archive storage not configured")
-                archive_key = self._get_archive_key(run)
 
-                # Serialize tables for the archive bundle
-                table_stats: list[TableStats] = []
-                table_payloads: dict[str, bytes] = {}
-                for table_name in self.ARCHIVED_TABLES:
-                    records = table_data.get(table_name, [])
-                    data = ArchiveStorage.serialize_to_jsonl(records)
-                    table_payloads[table_name] = data
-                    checksum = ArchiveStorage.compute_checksum(data)
-
-                    table_stats.append(
-                        TableStats(
-                            table_name=table_name,
-                            row_count=len(records),
-                            checksum=checksum,
-                            size_bytes=len(data),
-                        )
-                    )
-
-                # Generate and upload archive bundle
-                manifest = self._generate_manifest(run, table_stats)
-                manifest_data = json.dumps(manifest, indent=2, default=str).encode("utf-8")
-                archive_data = self._build_archive_bundle(manifest_data, table_payloads)
-                storage.put_object(archive_key, archive_data)
-
-                repo = self._get_workflow_run_repo()
-                archived_log_count = repo.create_archive_logs(session, run, app_logs, trigger_metadata)
+                for table_name, payload in table_payloads.items():
+                    storage.put_object(self._get_table_object_key(identity, table_name), payload)
+                storage.put_object(self._get_manifest_object_key(identity), manifest_data)
                 session.commit()
 
-                deleted_counts = None
-                if self.delete_after_archive:
-                    deleted_counts = repo.delete_runs_with_related(
-                        [run],
-                        delete_node_executions=self._delete_node_executions,
-                        delete_trigger_logs=self._delete_trigger_logs,
-                    )
-
                 logger.info(
-                    "Archived workflow run %s: tables=%s, archived_logs=%s, deleted=%s",
-                    run.id,
+                    "Archived workflow run bundle %s: tenant=%s runs=%s tables=%s object_prefix=%s",
+                    identity.bundle_id,
+                    identity.tenant_id,
+                    len(runs),
                     {s.table_name: s.row_count for s in table_stats},
-                    archived_log_count,
-                    deleted_counts,
+                    identity.object_prefix,
                 )
 
                 result.tables = table_stats
+                result.object_size_bytes = object_size
                 result.success = True
 
         except Exception as e:
-            logger.exception("Failed to archive workflow run %s", run.id)
+            logger.exception("Failed to archive workflow run bundle %s", identity.bundle_id)
             result.error = str(e)
             session.rollback()
 
         result.elapsed_time = time.time() - start_time
         return result
 
-    def _extract_data(
+    def _lock_runs_for_archive(
         self,
         session: Session,
-        run: WorkflowRun,
-    ) -> tuple[dict[str, list[dict[str, Any]]], Sequence[WorkflowAppLog], str | None]:
+        run_ids: Sequence[str],
+    ) -> list[WorkflowRun]:
+        """
+        Lock workflow runs before archiving a bundle.
+
+        Parallel cron jobs may select overlapping pages. Row-level SKIP LOCKED keeps duplicate archivers from uploading
+        conflicting bundle objects for the same source rows.
+        """
+        if not run_ids:
+            return []
+        stmt = (
+            select(WorkflowRun)
+            .where(WorkflowRun.id.in_(run_ids))
+            .order_by(WorkflowRun.created_at.asc(), WorkflowRun.id.asc())
+            .with_for_update(skip_locked=True)
+        )
+        return list(session.scalars(stmt))
+
+    def _extract_bundle_data(
+        self,
+        session: Session,
+        runs: Sequence[WorkflowRun],
+    ) -> dict[str, list[dict[str, Any]]]:
+        """Extract all archived table rows for a bundle."""
+        run_ids = [run.id for run in runs]
         table_data: dict[str, list[dict[str, Any]]] = {}
-        table_data["workflow_runs"] = [self._row_to_dict(run)]
-        repo = self._get_workflow_run_repo()
-        app_logs = repo.get_app_logs_by_run_id(session, run.id)
+        table_data["workflow_runs"] = [self._row_to_dict(run) for run in runs]
+
+        app_logs = list(session.scalars(select(WorkflowAppLog).where(WorkflowAppLog.workflow_run_id.in_(run_ids))))
         table_data["workflow_app_logs"] = [self._row_to_dict(row) for row in app_logs]
-        node_exec_repo = self._get_workflow_node_execution_repo(session)
-        node_exec_records = node_exec_repo.get_executions_by_workflow_run(
-            tenant_id=run.tenant_id,
-            app_id=run.app_id,
-            workflow_run_id=run.id,
+
+        node_exec_records = list(
+            session.scalars(
+                select(WorkflowNodeExecutionModel).where(WorkflowNodeExecutionModel.workflow_run_id.in_(run_ids))
+            )
         )
         node_exec_ids = [record.id for record in node_exec_records]
-        offload_records = node_exec_repo.get_offloads_by_execution_ids(session, node_exec_ids)
+        offload_records = []
+        if node_exec_ids:
+            offload_records = list(
+                session.scalars(
+                    select(WorkflowNodeExecutionOffload).where(
+                        WorkflowNodeExecutionOffload.node_execution_id.in_(node_exec_ids)
+                    )
+                )
+            )
         table_data["workflow_node_executions"] = [self._row_to_dict(row) for row in node_exec_records]
         table_data["workflow_node_execution_offload"] = [self._row_to_dict(row) for row in offload_records]
-        repo = self._get_workflow_run_repo()
-        pause_records = repo.get_pause_records_by_run_id(session, run.id)
+
+        pause_records = list(session.scalars(select(WorkflowPause).where(WorkflowPause.workflow_run_id.in_(run_ids))))
         pause_ids = [pause.id for pause in pause_records]
-        pause_reason_records = repo.get_pause_reason_records_by_run_id(
-            session,
-            pause_ids,
-        )
+        pause_reason_records = []
+        if pause_ids:
+            pause_reason_records = list(
+                session.scalars(select(WorkflowPauseReason).where(WorkflowPauseReason.pause_id.in_(pause_ids)))
+            )
         table_data["workflow_pauses"] = [self._row_to_dict(row) for row in pause_records]
         table_data["workflow_pause_reasons"] = [self._row_to_dict(row) for row in pause_reason_records]
+
         trigger_repo = SQLAlchemyWorkflowTriggerLogRepository(session)
-        trigger_records = trigger_repo.list_by_run_id(run.id)
+        trigger_records: list[WorkflowTriggerLog] = []
+        for run_id in run_ids:
+            trigger_records.extend(trigger_repo.list_by_run_id(run_id))
         table_data["workflow_trigger_logs"] = [self._row_to_dict(row) for row in trigger_records]
-        trigger_metadata = trigger_records[0].trigger_metadata if trigger_records else None
-        return table_data, app_logs, trigger_metadata
+        return table_data
 
     @staticmethod
     def _row_to_dict(row: Any) -> dict[str, Any]:
         mapper = inspect(row).mapper
         return {str(column.name): getattr(row, mapper.get_property_by_column(column).key) for column in mapper.columns}
 
-    def _get_archive_key(self, run: WorkflowRun) -> str:
-        """Get the storage key for the archive bundle."""
-        created_at = run.created_at
-        prefix = (
-            f"{run.tenant_id}/app_id={run.app_id}/year={created_at.strftime('%Y')}/"
-            f"month={created_at.strftime('%m')}/workflow_run_id={run.id}"
-        )
-        return f"{prefix}/{ARCHIVE_BUNDLE_NAME}"
+    def _build_archive_payload(
+        self,
+        identity: ArchiveBundleIdentity,
+        runs: Sequence[WorkflowRun],
+        table_data: dict[str, list[dict[str, Any]]],
+    ) -> tuple[list[TableStats], dict[str, bytes], bytes]:
+        """Build the archive payload and size stats without writing it to storage."""
+        table_stats: list[TableStats] = []
+        table_payloads: dict[str, bytes] = {}
+        for table_name in self.ARCHIVED_TABLES:
+            records = table_data.get(table_name, [])
+            data = self._serialize_to_parquet(records)
+            table_payloads[table_name] = data
+            checksum = ArchiveStorage.compute_checksum(data)
+
+            table_stats.append(
+                TableStats(
+                    table_name=table_name,
+                    row_count=len(records),
+                    checksum=checksum,
+                    size_bytes=len(data),
+                    object_key=self._get_table_object_key(identity, table_name),
+                )
+            )
+
+        manifest = self._generate_manifest(identity, runs, table_stats)
+        manifest_data = json.dumps(manifest, indent=2, default=str).encode("utf-8")
+        return table_stats, table_payloads, manifest_data
 
     def _generate_manifest(
         self,
-        run: WorkflowRun,
+        identity: ArchiveBundleIdentity,
+        runs: Sequence[WorkflowRun],
         table_stats: list[TableStats],
     ) -> ArchiveManifestDict:
-        """Generate a manifest for the archived workflow run."""
+        """Generate a manifest for the archived workflow run bundle."""
         tables: dict[str, TableStatsManifestEntry] = {
             stat.table_name: {
                 "row_count": stat.row_count,
                 "checksum": stat.checksum,
                 "size_bytes": stat.size_bytes,
+                "object_key": stat.object_key,
             }
             for stat in table_stats
         }
+        sorted_runs = sorted(runs, key=lambda run: (run.created_at, run.id))
         return ArchiveManifestDict(
-            schema_version=ARCHIVE_SCHEMA_VERSION,
-            workflow_run_id=run.id,
-            tenant_id=run.tenant_id,
-            app_id=run.app_id,
-            workflow_id=run.workflow_id,
-            created_at=run.created_at.isoformat(),
+            schema_version=ARCHIVE_BUNDLE_SCHEMA_VERSION,
+            archive_format=ARCHIVE_BUNDLE_FORMAT,
+            tenant_id=identity.tenant_id,
+            tenant_prefix=identity.tenant_prefix,
+            year=identity.year,
+            month=identity.month,
+            shard=identity.shard,
+            bundle_id=identity.bundle_id,
+            object_prefix=identity.object_prefix,
+            workflow_run_count=len(runs),
+            workflow_node_execution_count=tables["workflow_node_executions"]["row_count"],
+            min_created_at=sorted_runs[0].created_at.isoformat(),
+            max_created_at=sorted_runs[-1].created_at.isoformat(),
+            min_run_id=min(run.id for run in runs),
+            max_run_id=max(run.id for run in runs),
             archived_at=datetime.datetime.now(datetime.UTC).isoformat(),
             tables=tables,
+            run_ids=[run.id for run in sorted_runs],
         )
 
-    def _build_archive_bundle(self, manifest_data: bytes, table_payloads: dict[str, bytes]) -> bytes:
-        buffer = io.BytesIO()
-        with zipfile.ZipFile(buffer, mode="w", compression=zipfile.ZIP_DEFLATED) as archive:
-            archive.writestr("manifest.json", manifest_data)
-            for table_name in self.ARCHIVED_TABLES:
-                data = table_payloads.get(table_name)
-                if data is None:
-                    raise ValueError(f"Missing archive payload for {table_name}")
-                archive.writestr(f"{table_name}.jsonl", data)
-        return buffer.getvalue()
+    @staticmethod
+    def _serialize_to_parquet(records: list[dict[str, Any]]) -> bytes:
+        normalized_records = [WorkflowRunArchiver._normalize_record_for_parquet(record) for record in records]
+        table = pa.Table.from_pylist(normalized_records) if normalized_records else pa.table({})
+        sink = pa.BufferOutputStream()
+        pq.write_table(table, sink, compression="zstd")
+        return sink.getvalue().to_pybytes()
+
+    @staticmethod
+    def _normalize_record_for_parquet(record: dict[str, Any]) -> dict[str, Any]:
+        def normalize(value: Any) -> Any:
+            if isinstance(value, Enum):
+                return value.value
+            if isinstance(value, dict | list):
+                return json.dumps(value, default=str, ensure_ascii=False)
+            return value
+
+        return {key: normalize(value) for key, value in record.items()}
+
+    def _group_runs_for_bundles(self, runs: Sequence[WorkflowRun]) -> list[list[WorkflowRun]]:
+        """Group a fetched page into tenant/month bundles."""
+        grouped: dict[tuple[str, int, int], list[WorkflowRun]] = {}
+        for run in runs:
+            key = (run.tenant_id, run.created_at.year, run.created_at.month)
+            grouped.setdefault(key, []).append(run)
+        return [sorted(group, key=lambda run: (run.created_at, run.id)) for group in grouped.values()]
+
+    def _build_bundle_identity(self, runs: Sequence[WorkflowRun]) -> ArchiveBundleIdentity:
+        """Build the object-store identity for a bundle."""
+        sorted_runs = sorted(runs, key=lambda run: (run.created_at, run.id))
+        first_run = sorted_runs[0]
+        tenant_ids = {run.tenant_id for run in sorted_runs}
+        if len(tenant_ids) != 1:
+            raise ValueError("archive bundle cannot span multiple tenants")
+        years_months = {(run.created_at.year, run.created_at.month) for run in sorted_runs}
+        if len(years_months) != 1:
+            raise ValueError("archive bundle cannot span multiple months")
+
+        run_ids_digest = hashlib.sha256(",".join(run.id for run in sorted_runs).encode("utf-8")).hexdigest()
+        tenant_prefix = first_run.tenant_id[0].lower()
+        shard = self._bundle_shard_name()
+        year, month = next(iter(years_months))
+        bundle_id = run_ids_digest[:16]
+        object_prefix = (
+            f"workflow-runs/v2/tenant_prefix={tenant_prefix}/tenant_id={first_run.tenant_id}/"
+            f"year={year:04d}/month={month:02d}/shard={shard}/bundle={bundle_id}"
+        )
+        return ArchiveBundleIdentity(
+            tenant_prefix=tenant_prefix,
+            tenant_id=first_run.tenant_id,
+            year=year,
+            month=month,
+            shard=shard,
+            bundle_id=bundle_id,
+            object_prefix=object_prefix,
+        )
+
+    def _bundle_shard_name(self) -> str:
+        if self.run_shard_index is None or self.run_shard_total is None:
+            return "00-of-01"
+        return f"{self.run_shard_index:02d}-of-{self.run_shard_total:02d}"
+
+    @staticmethod
+    def _get_table_object_key(identity: ArchiveBundleIdentity, table_name: str) -> str:
+        return f"{identity.object_prefix}/{table_name}.parquet"
+
+    @staticmethod
+    def _get_manifest_object_key(identity: ArchiveBundleIdentity) -> str:
+        return f"{identity.object_prefix}/{ARCHIVE_BUNDLE_MANIFEST_NAME}"
 
     def _delete_trigger_logs(self, session: Session, run_ids: Sequence[str]) -> int:
         trigger_repo = SQLAlchemyWorkflowTriggerLogRepository(session)
diff --git a/api/services/retention/workflow_run/bundle_archive_maintenance.py b/api/services/retention/workflow_run/bundle_archive_maintenance.py
new file mode 100644
index 00000000000..8678e044c5e
--- /dev/null
+++ b/api/services/retention/workflow_run/bundle_archive_maintenance.py
@@ -0,0 +1,872 @@
+"""
+Maintain V2 workflow-run archive bundles.
+
+Archive V2 keeps bundle metadata in object-store manifests, not in a database table. This module discovers bundles by
+listing `manifest.json` objects, uses object-store marker files for delete/restore state, and only touches the database
+for source-table validation, deletion, and restoration.
+
+Each bundle is processed in its own database transaction. A failed bundle leaves source rows unchanged unless the
+transaction has already committed; marker handling makes the next run able to reconcile the common committed-but-marker
+not-updated case.
+"""
+
+import datetime
+import io
+import json
+import logging
+import time
+from collections.abc import Sequence
+from dataclasses import dataclass, field
+from enum import Enum
+from typing import Any, TypedDict, cast
+
+import pyarrow.parquet as pq
+import sqlalchemy as sa
+from sqlalchemy import delete, func, inspect, select
+from sqlalchemy.dialects.postgresql import insert as pg_insert
+from sqlalchemy.engine import CursorResult
+from sqlalchemy.orm import Session, sessionmaker
+
+from extensions.ext_database import db
+from libs.archive_storage import ArchiveStorage, ArchiveStorageNotConfiguredError, get_archive_storage
+from models.trigger import WorkflowTriggerLog
+from models.workflow import (
+    WorkflowAppLog,
+    WorkflowNodeExecutionModel,
+    WorkflowNodeExecutionOffload,
+    WorkflowPause,
+    WorkflowPauseReason,
+    WorkflowRun,
+)
+from services.retention.workflow_run.constants import (
+    ARCHIVE_BUNDLE_DELETE_STARTED_MARKER_NAME,
+    ARCHIVE_BUNDLE_DELETED_MARKER_NAME,
+    ARCHIVE_BUNDLE_FORMAT,
+    ARCHIVE_BUNDLE_MANIFEST_NAME,
+    ARCHIVE_BUNDLE_RESTORE_STARTED_MARKER_NAME,
+    ARCHIVE_BUNDLE_RESTORED_MARKER_NAME,
+    ARCHIVE_BUNDLE_SCHEMA_VERSION,
+)
+
+logger = logging.getLogger(__name__)
+
+_ARCHIVE_ROOT_PREFIX = "workflow-runs/v2/"
+_CHUNK_SIZE = 5_000
+
+
+class TableManifestEntry(TypedDict):
+    row_count: int
+    checksum: str
+    size_bytes: int
+    object_key: str
+
+
+class BundleManifest(TypedDict):
+    schema_version: str
+    archive_format: str
+    tenant_id: str
+    tenant_prefix: str
+    year: int
+    month: int
+    shard: str
+    bundle_id: str
+    object_prefix: str
+    workflow_run_count: int
+    workflow_node_execution_count: int
+    min_created_at: str
+    max_created_at: str
+    min_run_id: str
+    max_run_id: str
+    archived_at: str
+    tables: dict[str, TableManifestEntry]
+    run_ids: list[str]
+
+
+@dataclass(frozen=True)
+class BundleReference:
+    """Object-store reference for one V2 archive bundle."""
+
+    object_prefix: str
+    manifest_key: str
+    manifest: BundleManifest
+
+
+@dataclass
+class BundleOperationResult:
+    """Result for one V2 bundle delete or restore operation."""
+
+    bundle_id: str
+    tenant_id: str
+    object_prefix: str
+    success: bool = False
+    table_counts: dict[str, int] = field(default_factory=dict)
+    archive_bytes: int = 0
+    elapsed_time: float = 0.0
+    validation_time: float = 0.0
+    error: str | None = None
+
+    @property
+    def run_count(self) -> int:
+        return self.table_counts.get("workflow_runs", 0)
+
+    @property
+    def row_count(self) -> int:
+        return sum(self.table_counts.values())
+
+
+@dataclass
+class BundleOperationSummary:
+    """Aggregate metrics for a V2 bundle maintenance command."""
+
+    operation: str
+    bundles_processed: int = 0
+    bundles_succeeded: int = 0
+    bundles_failed: int = 0
+    rows_processed: int = 0
+    runs_processed: int = 0
+    archive_bytes: int = 0
+    elapsed_time: float = 0.0
+    validation_time: float = 0.0
+    table_counts: dict[str, int] = field(default_factory=dict)
+    results: list[BundleOperationResult] = field(default_factory=list)
+
+    @property
+    def runs_per_second(self) -> float:
+        if self.elapsed_time <= 0:
+            return 0.0
+        return self.runs_processed / self.elapsed_time
+
+    @property
+    def rows_per_second(self) -> float:
+        if self.elapsed_time <= 0:
+            return 0.0
+        return self.rows_processed / self.elapsed_time
+
+    @property
+    def bytes_per_second(self) -> float:
+        if self.elapsed_time <= 0:
+            return 0.0
+        return self.archive_bytes / self.elapsed_time
+
+
+TABLE_MODELS: dict[str, Any] = {
+    "workflow_runs": WorkflowRun,
+    "workflow_app_logs": WorkflowAppLog,
+    "workflow_node_executions": WorkflowNodeExecutionModel,
+    "workflow_node_execution_offload": WorkflowNodeExecutionOffload,
+    "workflow_pauses": WorkflowPause,
+    "workflow_pause_reasons": WorkflowPauseReason,
+    "workflow_trigger_logs": WorkflowTriggerLog,
+}
+
+ARCHIVED_TABLES = [
+    "workflow_runs",
+    "workflow_app_logs",
+    "workflow_node_executions",
+    "workflow_node_execution_offload",
+    "workflow_pauses",
+    "workflow_pause_reasons",
+    "workflow_trigger_logs",
+]
+
+RESTORE_ORDER = [
+    "workflow_runs",
+    "workflow_app_logs",
+    "workflow_node_executions",
+    "workflow_node_execution_offload",
+    "workflow_pauses",
+    "workflow_pause_reasons",
+    "workflow_trigger_logs",
+]
+
+
+class WorkflowRunBundleArchiveMaintenance:
+    """
+    Delete and restore V2 workflow-run archive bundles.
+
+    Args:
+        dry_run: Validate and report counts without changing source rows or object-store markers.
+        strict_content_validation: Compare source-table content checksums against Parquet content before destructive
+            delete and after restore. Keep enabled for real maintenance.
+        stop_on_error: Stop batch processing after the first failed bundle.
+    """
+
+    dry_run: bool
+    strict_content_validation: bool
+    stop_on_error: bool
+
+    def __init__(
+        self,
+        *,
+        dry_run: bool = False,
+        strict_content_validation: bool = True,
+        stop_on_error: bool = True,
+    ) -> None:
+        self.dry_run = dry_run
+        self.strict_content_validation = strict_content_validation
+        self.stop_on_error = stop_on_error
+
+    def delete_batch(
+        self,
+        *,
+        tenant_ids: Sequence[str] | None,
+        start_date: datetime.datetime,
+        end_date: datetime.datetime,
+        limit: int,
+    ) -> BundleOperationSummary:
+        """Validate and delete source rows for archived V2 bundles in the requested created_at window."""
+        return self._process_batch(
+            operation="delete",
+            tenant_ids=tenant_ids,
+            start_date=start_date,
+            end_date=end_date,
+            limit=limit,
+        )
+
+    def restore_batch(
+        self,
+        *,
+        tenant_ids: Sequence[str] | None,
+        start_date: datetime.datetime,
+        end_date: datetime.datetime,
+        limit: int,
+    ) -> BundleOperationSummary:
+        """Restore source rows for deleted V2 bundles in the requested created_at window."""
+        return self._process_batch(
+            operation="restore",
+            tenant_ids=tenant_ids,
+            start_date=start_date,
+            end_date=end_date,
+            limit=limit,
+        )
+
+    def _process_batch(
+        self,
+        *,
+        operation: str,
+        tenant_ids: Sequence[str] | None,
+        start_date: datetime.datetime,
+        end_date: datetime.datetime,
+        limit: int,
+    ) -> BundleOperationSummary:
+        start_time = time.time()
+        summary = BundleOperationSummary(operation=operation)
+        if tenant_ids is not None and not tenant_ids:
+            return summary
+
+        storage = self._get_archive_storage()
+        bundle_refs = self._list_bundle_refs(
+            storage,
+            operation=operation,
+            tenant_ids=tenant_ids,
+            start_date=start_date,
+            end_date=end_date,
+            limit=limit,
+        )
+
+        logger.info("Found %s V2 archive bundles for %s", len(bundle_refs), operation)
+        session_maker = sessionmaker(bind=db.engine, expire_on_commit=False)
+        for bundle_ref in bundle_refs:
+            with session_maker() as session:
+                if operation == "delete":
+                    result = self._delete_bundle(session, storage, bundle_ref)
+                elif operation == "restore":
+                    result = self._restore_bundle(session, storage, bundle_ref)
+                else:
+                    raise ValueError(f"Unsupported operation: {operation}")
+
+            self._merge_result(summary, result)
+            if not result.success and self.stop_on_error:
+                logger.error("Stopping V2 bundle %s after failure: %s", operation, result.error)
+                break
+
+        summary.elapsed_time = time.time() - start_time
+        return summary
+
+    def _list_bundle_refs(
+        self,
+        storage: ArchiveStorage,
+        *,
+        operation: str,
+        tenant_ids: Sequence[str] | None,
+        start_date: datetime.datetime,
+        end_date: datetime.datetime,
+        limit: int,
+    ) -> list[BundleReference]:
+        start_date = self._to_naive_utc(start_date)
+        end_date = self._to_naive_utc(end_date)
+        manifest_keys = self._list_manifest_keys(storage, tenant_ids)
+        refs: list[BundleReference] = []
+        for manifest_key in manifest_keys:
+            manifest_data = self._get_checked_object(storage, manifest_key)
+            object_prefix = manifest_key.removesuffix(f"/{ARCHIVE_BUNDLE_MANIFEST_NAME}")
+            manifest = self._load_and_validate_manifest(manifest_data, object_prefix=object_prefix)
+            min_created_at = self._parse_manifest_datetime(manifest["min_created_at"])
+            max_created_at = self._parse_manifest_datetime(manifest["max_created_at"])
+            if max_created_at < start_date or min_created_at >= end_date:
+                continue
+            if tenant_ids and manifest["tenant_id"] not in tenant_ids:
+                continue
+            if operation == "delete" and self._is_deleted(storage, object_prefix):
+                continue
+            if operation == "restore" and not self._is_deleted(storage, object_prefix):
+                continue
+            refs.append(BundleReference(object_prefix=object_prefix, manifest_key=manifest_key, manifest=manifest))
+
+        refs.sort(
+            key=lambda ref: (
+                self._parse_manifest_datetime(ref.manifest["min_created_at"]),
+                ref.manifest["tenant_id"],
+                ref.manifest["bundle_id"],
+            )
+        )
+        return refs[:limit]
+
+    @staticmethod
+    def _list_manifest_keys(storage: ArchiveStorage, tenant_ids: Sequence[str] | None) -> list[str]:
+        keys: list[str] = []
+        if tenant_ids:
+            prefixes = [
+                f"{_ARCHIVE_ROOT_PREFIX}tenant_prefix={tenant_id[0].lower()}/tenant_id={tenant_id}/"
+                for tenant_id in tenant_ids
+            ]
+        else:
+            prefixes = [_ARCHIVE_ROOT_PREFIX]
+        for prefix in prefixes:
+            keys.extend(storage.list_objects(prefix))
+        return sorted(key for key in keys if key.endswith(f"/{ARCHIVE_BUNDLE_MANIFEST_NAME}"))
+
+    def _delete_bundle(
+        self,
+        session: Session,
+        storage: ArchiveStorage,
+        bundle_ref: BundleReference,
+    ) -> BundleOperationResult:
+        start_time = time.time()
+        result = self._new_result(bundle_ref.manifest)
+        try:
+            validation_start = time.time()
+            manifest, table_records, archive_bytes = self._validate_archive_object(storage, bundle_ref)
+            result.table_counts = self._manifest_table_counts(manifest)
+            result.archive_bytes = archive_bytes
+
+            self._lock_workflow_runs(session, manifest["run_ids"])
+            if self._is_delete_started(storage, bundle_ref.object_prefix) and self._live_counts_match(
+                session, manifest, expected_present=False
+            ):
+                result.validation_time = time.time() - validation_start
+                if not self.dry_run:
+                    self._mark_deleted(storage, bundle_ref.object_prefix)
+                    self._delete_marker(storage, bundle_ref.object_prefix, ARCHIVE_BUNDLE_DELETE_STARTED_MARKER_NAME)
+                result.success = True
+                return result
+
+            self._validate_live_counts(session, manifest, expected_present=True)
+            if self.strict_content_validation:
+                self._validate_live_content(session, table_records)
+            result.validation_time = time.time() - validation_start
+
+            if not self.dry_run:
+                self._put_marker(storage, bundle_ref.object_prefix, ARCHIVE_BUNDLE_DELETE_STARTED_MARKER_NAME)
+                deleted_counts = self._delete_bundle_rows(session, table_records)
+                if deleted_counts != result.table_counts:
+                    raise ValueError(
+                        f"Deleted row count mismatch: expected={result.table_counts}, actual={deleted_counts}"
+                    )
+                self._validate_live_counts(session, manifest, expected_present=False)
+                session.commit()
+                self._mark_deleted(storage, bundle_ref.object_prefix)
+                self._delete_marker(storage, bundle_ref.object_prefix, ARCHIVE_BUNDLE_DELETE_STARTED_MARKER_NAME)
+                self._delete_marker(storage, bundle_ref.object_prefix, ARCHIVE_BUNDLE_RESTORED_MARKER_NAME)
+            result.success = True
+        except Exception as e:
+            session.rollback()
+            result.error = str(e)
+            logger.exception("Failed to delete V2 archive bundle %s", bundle_ref.object_prefix)
+        result.elapsed_time = time.time() - start_time
+        return result
+
+    def _restore_bundle(
+        self,
+        session: Session,
+        storage: ArchiveStorage,
+        bundle_ref: BundleReference,
+    ) -> BundleOperationResult:
+        start_time = time.time()
+        result = self._new_result(bundle_ref.manifest)
+        try:
+            validation_start = time.time()
+            manifest, table_records, archive_bytes = self._validate_archive_object(storage, bundle_ref)
+            result.table_counts = self._manifest_table_counts(manifest)
+            result.archive_bytes = archive_bytes
+
+            if self._live_counts_match(session, manifest, expected_present=True):
+                if self.strict_content_validation:
+                    self._validate_live_content(session, table_records)
+                result.validation_time = time.time() - validation_start
+                if not self.dry_run:
+                    self._mark_restored(storage, bundle_ref.object_prefix)
+                result.success = True
+                return result
+
+            self._validate_live_counts(session, manifest, expected_present=False)
+            result.validation_time = time.time() - validation_start
+
+            if not self.dry_run:
+                self._put_marker(storage, bundle_ref.object_prefix, ARCHIVE_BUNDLE_RESTORE_STARTED_MARKER_NAME)
+                restored_counts = self._restore_bundle_rows(session, table_records)
+                if restored_counts != result.table_counts:
+                    self._validate_live_counts(session, manifest, expected_present=True)
+                self._validate_live_counts(session, manifest, expected_present=True)
+                if self.strict_content_validation:
+                    self._validate_live_content(session, table_records)
+                session.commit()
+                self._mark_restored(storage, bundle_ref.object_prefix)
+            result.success = True
+        except Exception as e:
+            session.rollback()
+            result.error = str(e)
+            logger.exception("Failed to restore V2 archive bundle %s", bundle_ref.object_prefix)
+        result.elapsed_time = time.time() - start_time
+        return result
+
+    @staticmethod
+    def _new_result(manifest: BundleManifest) -> BundleOperationResult:
+        return BundleOperationResult(
+            bundle_id=manifest["bundle_id"],
+            tenant_id=manifest["tenant_id"],
+            object_prefix=manifest["object_prefix"],
+        )
+
+    def _validate_archive_object(
+        self,
+        storage: ArchiveStorage,
+        bundle_ref: BundleReference,
+    ) -> tuple[BundleManifest, dict[str, list[dict[str, Any]]], int]:
+        manifest = bundle_ref.manifest
+        table_records: dict[str, list[dict[str, Any]]] = {}
+        total_size = len(storage.get_object(bundle_ref.manifest_key))
+        for table_name in ARCHIVED_TABLES:
+            info = manifest["tables"][table_name]
+            payload = self._get_checked_object(storage, info["object_key"])
+            total_size += len(payload)
+            if len(payload) != info["size_bytes"]:
+                raise ValueError(
+                    f"Archive object size mismatch for {info['object_key']}: "
+                    f"expected={info['size_bytes']}, actual={len(payload)}"
+                )
+            checksum = ArchiveStorage.compute_checksum(payload)
+            if checksum != info["checksum"]:
+                raise ValueError(
+                    f"Archive object checksum mismatch for {info['object_key']}: "
+                    f"expected={info['checksum']}, actual={checksum}"
+                )
+            records = self._deserialize_parquet(payload)
+            if len(records) != info["row_count"]:
+                raise ValueError(
+                    f"Parquet row count mismatch for {info['object_key']}: "
+                    f"expected={info['row_count']}, actual={len(records)}"
+                )
+            table_records[table_name] = records
+        return manifest, table_records, total_size
+
+    @staticmethod
+    def _get_checked_object(storage: ArchiveStorage, object_key: str) -> bytes:
+        if not storage.object_exists(object_key):
+            raise FileNotFoundError(f"Archive object not found: {object_key}")
+        return storage.get_object(object_key)
+
+    @staticmethod
+    def _load_and_validate_manifest(
+        manifest_data: bytes,
+        *,
+        object_prefix: str,
+    ) -> BundleManifest:
+        loaded = json.loads(manifest_data)
+        if not isinstance(loaded, dict):
+            raise ValueError("manifest.json must be an object")
+        required_fields = {
+            "schema_version",
+            "archive_format",
+            "tenant_id",
+            "tenant_prefix",
+            "year",
+            "month",
+            "shard",
+            "bundle_id",
+            "object_prefix",
+            "workflow_run_count",
+            "workflow_node_execution_count",
+            "tables",
+            "run_ids",
+        }
+        missing_fields = sorted(required_fields - set(loaded))
+        if missing_fields:
+            raise ValueError(f"manifest missing required fields: {', '.join(missing_fields)}")
+        manifest = cast(BundleManifest, loaded)
+        if manifest["schema_version"] != ARCHIVE_BUNDLE_SCHEMA_VERSION:
+            raise ValueError(f"unsupported bundle schema_version: {manifest['schema_version']}")
+        if manifest["archive_format"] != ARCHIVE_BUNDLE_FORMAT:
+            raise ValueError(f"unsupported bundle archive_format: {manifest['archive_format']}")
+        if manifest["object_prefix"] != object_prefix:
+            raise ValueError("manifest object_prefix does not match object key")
+        if manifest["tenant_id"][0].lower() != manifest["tenant_prefix"]:
+            raise ValueError("manifest tenant_prefix does not match tenant_id")
+        if len(manifest["run_ids"]) != manifest["workflow_run_count"]:
+            raise ValueError("manifest run_ids count does not match workflow_run_count")
+
+        tables = manifest["tables"]
+        if not isinstance(tables, dict):
+            raise ValueError("manifest tables must be an object")
+        for table_name in ARCHIVED_TABLES:
+            if table_name not in tables:
+                raise ValueError(f"manifest missing table: {table_name}")
+            info = tables[table_name]
+            for key in ("row_count", "checksum", "size_bytes", "object_key"):
+                if key not in info:
+                    raise ValueError(f"manifest table {table_name} missing {key}")
+            expected_key = f"{object_prefix}/{table_name}.parquet"
+            if info["object_key"] != expected_key:
+                raise ValueError(
+                    f"manifest object_key mismatch for {table_name}: "
+                    f"expected={expected_key}, actual={info['object_key']}"
+                )
+        return manifest
+
+    @staticmethod
+    def _deserialize_parquet(payload: bytes) -> list[dict[str, Any]]:
+        table = pq.read_table(io.BytesIO(payload))
+        return table.to_pylist()
+
+    def _validate_live_counts(
+        self,
+        session: Session,
+        manifest: BundleManifest,
+        *,
+        expected_present: bool,
+    ) -> None:
+        expected_counts = self._manifest_table_counts(manifest)
+        actual_counts = self._count_live_rows(session, manifest["run_ids"])
+        if not expected_present:
+            expected_counts = dict.fromkeys(expected_counts, 0)
+        if actual_counts != expected_counts:
+            state = "present" if expected_present else "deleted"
+            raise ValueError(
+                f"Live row count mismatch for {state} bundle: expected={expected_counts}, actual={actual_counts}"
+            )
+
+    def _live_counts_match(self, session: Session, manifest: BundleManifest, *, expected_present: bool) -> bool:
+        expected_counts = self._manifest_table_counts(manifest)
+        if not expected_present:
+            expected_counts = dict.fromkeys(expected_counts, 0)
+        return self._count_live_rows(session, manifest["run_ids"]) == expected_counts
+
+    @staticmethod
+    def _manifest_table_counts(manifest: BundleManifest) -> dict[str, int]:
+        return {table_name: manifest["tables"][table_name]["row_count"] for table_name in ARCHIVED_TABLES}
+
+    def _count_live_rows(self, session: Session, run_ids: Sequence[str]) -> dict[str, int]:
+        node_ids = self._select_ids_by_run_ids(session, WorkflowNodeExecutionModel, run_ids)
+        pause_ids = self._select_ids_by_run_ids(session, WorkflowPause, run_ids)
+        return {
+            "workflow_runs": self._count_by_run_ids(session, WorkflowRun, run_ids),
+            "workflow_app_logs": self._count_by_run_ids(session, WorkflowAppLog, run_ids),
+            "workflow_node_executions": len(node_ids),
+            "workflow_node_execution_offload": self._count_by_column(
+                session, WorkflowNodeExecutionOffload, WorkflowNodeExecutionOffload.node_execution_id, node_ids
+            ),
+            "workflow_pauses": len(pause_ids),
+            "workflow_pause_reasons": self._count_by_column(
+                session, WorkflowPauseReason, WorkflowPauseReason.pause_id, pause_ids
+            ),
+            "workflow_trigger_logs": self._count_by_run_ids(session, WorkflowTriggerLog, run_ids),
+        }
+
+    def _validate_live_content(
+        self,
+        session: Session,
+        table_records: dict[str, list[dict[str, Any]]],
+    ) -> None:
+        run_ids = [str(record["id"]) for record in table_records["workflow_runs"]]
+        node_ids = [str(record["id"]) for record in table_records["workflow_node_executions"]]
+        pause_ids = [str(record["id"]) for record in table_records["workflow_pauses"]]
+
+        live_records = {
+            "workflow_runs": self._load_records_by_run_ids(session, WorkflowRun, run_ids),
+            "workflow_app_logs": self._load_records_by_run_ids(session, WorkflowAppLog, run_ids),
+            "workflow_node_executions": self._load_records_by_run_ids(session, WorkflowNodeExecutionModel, run_ids),
+            "workflow_node_execution_offload": self._load_records_by_column(
+                session, WorkflowNodeExecutionOffload, WorkflowNodeExecutionOffload.node_execution_id, node_ids
+            ),
+            "workflow_pauses": self._load_records_by_run_ids(session, WorkflowPause, run_ids),
+            "workflow_pause_reasons": self._load_records_by_column(
+                session, WorkflowPauseReason, WorkflowPauseReason.pause_id, pause_ids
+            ),
+            "workflow_trigger_logs": self._load_records_by_run_ids(session, WorkflowTriggerLog, run_ids),
+        }
+        for table_name in ARCHIVED_TABLES:
+            live_checksum = self._records_checksum(live_records[table_name])
+            archive_checksum = self._records_checksum(table_records[table_name])
+            if live_checksum != archive_checksum:
+                raise ValueError(
+                    f"Live/archive content checksum mismatch for {table_name}: "
+                    f"expected={archive_checksum}, actual={live_checksum}"
+                )
+
+    def _delete_bundle_rows(
+        self,
+        session: Session,
+        table_records: dict[str, list[dict[str, Any]]],
+    ) -> dict[str, int]:
+        run_ids = [str(record["id"]) for record in table_records["workflow_runs"]]
+        node_ids = [str(record["id"]) for record in table_records["workflow_node_executions"]]
+        pause_ids = [str(record["id"]) for record in table_records["workflow_pauses"]]
+
+        deleted_counts = dict.fromkeys(ARCHIVED_TABLES, 0)
+        deleted_counts["workflow_pause_reasons"] = self._delete_by_column(
+            session, WorkflowPauseReason, WorkflowPauseReason.pause_id, pause_ids
+        )
+        deleted_counts["workflow_node_execution_offload"] = self._delete_by_column(
+            session, WorkflowNodeExecutionOffload, WorkflowNodeExecutionOffload.node_execution_id, node_ids
+        )
+        deleted_counts["workflow_trigger_logs"] = self._delete_by_run_ids(session, WorkflowTriggerLog, run_ids)
+        deleted_counts["workflow_app_logs"] = self._delete_by_run_ids(session, WorkflowAppLog, run_ids)
+        deleted_counts["workflow_node_executions"] = self._delete_by_run_ids(
+            session, WorkflowNodeExecutionModel, run_ids
+        )
+        deleted_counts["workflow_pauses"] = self._delete_by_run_ids(session, WorkflowPause, run_ids)
+        deleted_counts["workflow_runs"] = self._delete_by_run_ids(session, WorkflowRun, run_ids)
+        return deleted_counts
+
+    def _restore_bundle_rows(
+        self,
+        session: Session,
+        table_records: dict[str, list[dict[str, Any]]],
+    ) -> dict[str, int]:
+        restored_counts = dict.fromkeys(ARCHIVED_TABLES, 0)
+        for table_name in RESTORE_ORDER:
+            restored_counts[table_name] = self._restore_table_records(session, table_name, table_records[table_name])
+        return restored_counts
+
+    def _restore_table_records(
+        self,
+        session: Session,
+        table_name: str,
+        records: list[dict[str, Any]],
+    ) -> int:
+        if not records:
+            return 0
+        model = TABLE_MODELS[table_name]
+        total = 0
+        for chunk in self._chunks(records, _CHUNK_SIZE):
+            converted = [self._prepare_insert_record(model, record) for record in chunk]
+            stmt = pg_insert(cast(Any, model.__table__)).values(converted)
+            stmt = stmt.on_conflict_do_nothing(index_elements=["id"])
+            result = session.execute(stmt)
+            total += cast(CursorResult, result).rowcount or 0
+        return total
+
+    def _prepare_insert_record(
+        self,
+        model: Any,
+        record: dict[str, Any],
+    ) -> dict[str, Any]:
+        table = model.__table__
+        columns_by_name = {column.name: column for column in table.columns}
+        prepared = {key: value for key, value in record.items() if key in columns_by_name}
+        for column_name, value in list(prepared.items()):
+            column = columns_by_name[column_name]
+            if value is None:
+                continue
+            if isinstance(column.type, sa.DateTime) and isinstance(value, str):
+                prepared[column_name] = datetime.datetime.fromisoformat(value)
+            elif isinstance(column.type, sa.JSON) and isinstance(value, str):
+                prepared[column_name] = json.loads(value)
+        return prepared
+
+    @staticmethod
+    def _row_to_dict(row: Any) -> dict[str, Any]:
+        mapper = inspect(row).mapper
+        return {str(column.name): getattr(row, mapper.get_property_by_column(column).key) for column in mapper.columns}
+
+    @staticmethod
+    def _normalize_record_for_checksum(record: dict[str, Any]) -> dict[str, Any]:
+        def normalize(value: Any) -> Any:
+            if isinstance(value, Enum):
+                return value.value
+            if isinstance(value, dict | list):
+                return json.dumps(value, default=str, ensure_ascii=False)
+            return value
+
+        return {key: normalize(value) for key, value in record.items()}
+
+    @classmethod
+    def _records_checksum(cls, records: list[dict[str, Any]]) -> str:
+        normalized = [cls._normalize_record_for_checksum(record) for record in records]
+        normalized.sort(key=lambda record: json.dumps(record, sort_keys=True, default=str, ensure_ascii=False))
+        payload = json.dumps(normalized, sort_keys=True, default=str, ensure_ascii=False, separators=(",", ":"))
+        return ArchiveStorage.compute_checksum(payload.encode("utf-8"))
+
+    @staticmethod
+    def _lock_workflow_runs(session: Session, run_ids: Sequence[str]) -> None:
+        for chunk in WorkflowRunBundleArchiveMaintenance._chunks(run_ids, _CHUNK_SIZE):
+            list(session.scalars(select(WorkflowRun.id).where(WorkflowRun.id.in_(chunk)).with_for_update()))
+
+    @staticmethod
+    def _select_ids_by_run_ids(
+        session: Session,
+        model: Any,
+        run_ids: Sequence[str],
+    ) -> list[str]:
+        if not run_ids:
+            return []
+        ids: list[str] = []
+        for chunk in WorkflowRunBundleArchiveMaintenance._chunks(run_ids, _CHUNK_SIZE):
+            ids.extend(
+                str(row_id) for row_id in session.scalars(select(model.id).where(model.workflow_run_id.in_(chunk)))
+            )
+        return ids
+
+    @staticmethod
+    def _count_by_run_ids(
+        session: Session,
+        model: Any,
+        run_ids: Sequence[str],
+    ) -> int:
+        return WorkflowRunBundleArchiveMaintenance._count_by_column(
+            session, model, WorkflowRunBundleArchiveMaintenance._run_id_column(model), run_ids
+        )
+
+    @staticmethod
+    def _count_by_column(
+        session: Session,
+        model: Any,
+        column: Any,
+        values: Sequence[str],
+    ) -> int:
+        if not values:
+            return 0
+        total = 0
+        for chunk in WorkflowRunBundleArchiveMaintenance._chunks(values, _CHUNK_SIZE):
+            total += session.scalar(select(func.count()).select_from(model).where(column.in_(chunk))) or 0
+        return total
+
+    def _load_records_by_run_ids(
+        self,
+        session: Session,
+        model: Any,
+        run_ids: Sequence[str],
+    ) -> list[dict[str, Any]]:
+        return self._load_records_by_column(session, model, self._run_id_column(model), run_ids)
+
+    def _load_records_by_column(
+        self,
+        session: Session,
+        model: Any,
+        column: Any,
+        values: Sequence[str],
+    ) -> list[dict[str, Any]]:
+        if not values:
+            return []
+        rows: list[Any] = []
+        for chunk in self._chunks(values, _CHUNK_SIZE):
+            rows.extend(session.scalars(select(model).where(column.in_(chunk))))
+        return [self._row_to_dict(row) for row in rows]
+
+    @staticmethod
+    def _delete_by_run_ids(
+        session: Session,
+        model: Any,
+        run_ids: Sequence[str],
+    ) -> int:
+        return WorkflowRunBundleArchiveMaintenance._delete_by_column(
+            session, model, WorkflowRunBundleArchiveMaintenance._run_id_column(model), run_ids
+        )
+
+    @staticmethod
+    def _run_id_column(model: Any) -> Any:
+        if model is WorkflowRun:
+            return WorkflowRun.id
+        return model.workflow_run_id
+
+    @staticmethod
+    def _delete_by_column(
+        session: Session,
+        model: Any,
+        column: Any,
+        values: Sequence[str],
+    ) -> int:
+        if not values:
+            return 0
+        total = 0
+        for chunk in WorkflowRunBundleArchiveMaintenance._chunks(values, _CHUNK_SIZE):
+            result = session.execute(delete(model).where(column.in_(chunk)))
+            total += cast(CursorResult, result).rowcount or 0
+        return total
+
+    @staticmethod
+    def _is_deleted(storage: ArchiveStorage, object_prefix: str) -> bool:
+        return storage.object_exists(f"{object_prefix}/{ARCHIVE_BUNDLE_DELETED_MARKER_NAME}")
+
+    @staticmethod
+    def _is_delete_started(storage: ArchiveStorage, object_prefix: str) -> bool:
+        return storage.object_exists(f"{object_prefix}/{ARCHIVE_BUNDLE_DELETE_STARTED_MARKER_NAME}")
+
+    @staticmethod
+    def _mark_deleted(storage: ArchiveStorage, object_prefix: str) -> None:
+        WorkflowRunBundleArchiveMaintenance._put_marker(storage, object_prefix, ARCHIVE_BUNDLE_DELETED_MARKER_NAME)
+
+    @staticmethod
+    def _mark_restored(storage: ArchiveStorage, object_prefix: str) -> None:
+        WorkflowRunBundleArchiveMaintenance._delete_marker(storage, object_prefix, ARCHIVE_BUNDLE_DELETED_MARKER_NAME)
+        WorkflowRunBundleArchiveMaintenance._delete_marker(
+            storage, object_prefix, ARCHIVE_BUNDLE_RESTORE_STARTED_MARKER_NAME
+        )
+        WorkflowRunBundleArchiveMaintenance._put_marker(storage, object_prefix, ARCHIVE_BUNDLE_RESTORED_MARKER_NAME)
+
+    @staticmethod
+    def _put_marker(storage: ArchiveStorage, object_prefix: str, marker_name: str) -> None:
+        payload = json.dumps({"created_at": datetime.datetime.now(datetime.UTC).isoformat()}).encode("utf-8")
+        storage.put_object(f"{object_prefix}/{marker_name}", payload)
+
+    @staticmethod
+    def _delete_marker(storage: ArchiveStorage, object_prefix: str, marker_name: str) -> None:
+        marker_key = f"{object_prefix}/{marker_name}"
+        if storage.object_exists(marker_key):
+            storage.delete_object(marker_key)
+
+    @staticmethod
+    def _parse_manifest_datetime(value: str) -> datetime.datetime:
+        return WorkflowRunBundleArchiveMaintenance._to_naive_utc(datetime.datetime.fromisoformat(value))
+
+    @staticmethod
+    def _to_naive_utc(value: datetime.datetime) -> datetime.datetime:
+        if value.tzinfo is None:
+            return value
+        return value.astimezone(datetime.UTC).replace(tzinfo=None)
+
+    @staticmethod
+    def _chunks(values: Sequence[Any], size: int) -> list[Sequence[Any]]:
+        return [values[index : index + size] for index in range(0, len(values), size)]
+
+    @staticmethod
+    def _get_archive_storage() -> ArchiveStorage:
+        try:
+            return get_archive_storage()
+        except ArchiveStorageNotConfiguredError as e:
+            raise RuntimeError(f"Archive storage not configured: {e}") from e
+
+    @staticmethod
+    def _merge_result(summary: BundleOperationSummary, result: BundleOperationResult) -> None:
+        summary.results.append(result)
+        summary.bundles_processed += 1
+        summary.validation_time += result.validation_time
+        if result.success:
+            summary.bundles_succeeded += 1
+            summary.rows_processed += result.row_count
+            summary.runs_processed += result.run_count
+            summary.archive_bytes += result.archive_bytes
+            for table_name, count in result.table_counts.items():
+                summary.table_counts[table_name] = summary.table_counts.get(table_name, 0) + count
+        else:
+            summary.bundles_failed += 1
diff --git a/api/services/retention/workflow_run/constants.py b/api/services/retention/workflow_run/constants.py
index 162bb4947df..d8d2807bb16 100644
--- a/api/services/retention/workflow_run/constants.py
+++ b/api/services/retention/workflow_run/constants.py
@@ -1,2 +1,10 @@
 ARCHIVE_SCHEMA_VERSION = "1.0"
 ARCHIVE_BUNDLE_NAME = f"archive.v{ARCHIVE_SCHEMA_VERSION}.zip"
+
+ARCHIVE_BUNDLE_SCHEMA_VERSION = "2.0"
+ARCHIVE_BUNDLE_FORMAT = "parquet"
+ARCHIVE_BUNDLE_MANIFEST_NAME = "manifest.json"
+ARCHIVE_BUNDLE_DELETE_STARTED_MARKER_NAME = "_DELETE_STARTED"
+ARCHIVE_BUNDLE_DELETED_MARKER_NAME = "_DELETED"
+ARCHIVE_BUNDLE_RESTORE_STARTED_MARKER_NAME = "_RESTORE_STARTED"
+ARCHIVE_BUNDLE_RESTORED_MARKER_NAME = "_RESTORED"
diff --git a/api/services/retention/workflow_run/delete_archived_workflow_run.py b/api/services/retention/workflow_run/delete_archived_workflow_run.py
index 937a1067105..8fd8b3c8989 100644
--- a/api/services/retention/workflow_run/delete_archived_workflow_run.py
+++ b/api/services/retention/workflow_run/delete_archived_workflow_run.py
@@ -2,20 +2,68 @@
 Delete Archived Workflow Run Service.
 
 This service deletes archived workflow run data from the database while keeping
-archive logs intact.
+archive logs intact. Deletion is intentionally gated by archive-object validation:
+the archive bundle must exist, have a supported manifest, pass zip/member checksum
+checks, and match the live row counts for every cleanup-owned table before rows
+are removed from the primary database.
 """
 
+import io
+import json
+import logging
 import time
+import zipfile
 from collections.abc import Sequence
 from dataclasses import dataclass, field
 from datetime import datetime
+from typing import TypedDict
 
 from sqlalchemy.orm import Session, sessionmaker
 
 from extensions.ext_database import db
-from models.workflow import WorkflowRun
+from libs.archive_storage import ArchiveStorage, ArchiveStorageNotConfiguredError, get_archive_storage
+from models.workflow import WorkflowArchiveLog, WorkflowRun
 from repositories.api_workflow_run_repository import APIWorkflowRunRepository, RunsWithRelatedCountsDict
 from repositories.sqlalchemy_workflow_trigger_log_repository import SQLAlchemyWorkflowTriggerLogRepository
+from services.retention.workflow_run.constants import ARCHIVE_BUNDLE_NAME, ARCHIVE_SCHEMA_VERSION
+
+logger = logging.getLogger(__name__)
+
+
+class _TableManifestEntry(TypedDict):
+    row_count: int
+    checksum: str
+    size_bytes: int
+
+
+class _ArchiveManifest(TypedDict):
+    schema_version: str
+    workflow_run_id: str
+    tenant_id: str
+    app_id: str
+    workflow_id: str
+    tables: dict[str, _TableManifestEntry]
+
+
+_ARCHIVED_TABLES = [
+    "workflow_runs",
+    "workflow_app_logs",
+    "workflow_node_executions",
+    "workflow_node_execution_offload",
+    "workflow_pauses",
+    "workflow_pause_reasons",
+    "workflow_trigger_logs",
+]
+
+_TABLE_TO_COUNT_KEY = {
+    "workflow_runs": "runs",
+    "workflow_app_logs": "app_logs",
+    "workflow_node_executions": "node_executions",
+    "workflow_node_execution_offload": "offloads",
+    "workflow_pauses": "pauses",
+    "workflow_pause_reasons": "pause_reasons",
+    "workflow_trigger_logs": "trigger_logs",
+}
 
 
 @dataclass
@@ -34,13 +82,49 @@ class DeleteResult:
             "pause_reasons": 0,
         }
     )
+    validated_counts: RunsWithRelatedCountsDict = field(
+        default_factory=lambda: {  # type: ignore[assignment]
+            "runs": 0,
+            "node_executions": 0,
+            "offloads": 0,
+            "app_logs": 0,
+            "trigger_logs": 0,
+            "pauses": 0,
+            "pause_reasons": 0,
+        }
+    )
+    archive_key: str | None = None
+    restore_sampled: bool = False
+    restore_sample_success: bool | None = None
     error: str | None = None
     elapsed_time: float = 0.0
 
 
 class ArchivedWorkflowRunDeletion:
-    def __init__(self, dry_run: bool = False):
+    """
+    Delete archived workflow-run rows after validating the archive bundle.
+
+    Args:
+        dry_run: Preview validation and row counts without deleting.
+        skip_bad_archives: Continue batch deletion after a validation/delete failure.
+        restore_sample_interval: Run restore dry-run for every Nth successful deletion; 0 disables sampling.
+    """
+
+    _delete_attempt_count: int
+
+    def __init__(
+        self,
+        dry_run: bool = False,
+        *,
+        skip_bad_archives: bool = False,
+        restore_sample_interval: int = 0,
+    ):
         self.dry_run = dry_run
+        self.skip_bad_archives = skip_bad_archives
+        if restore_sample_interval < 0:
+            raise ValueError("restore_sample_interval must be >= 0")
+        self.restore_sample_interval = restore_sample_interval
+        self._delete_attempt_count = 0
         self.workflow_run_repo: APIWorkflowRunRepository | None = None
 
     def delete_by_run_id(self, run_id: str) -> DeleteResult:
@@ -57,12 +141,13 @@ class ArchivedWorkflowRunDeletion:
                 return result
 
             result.tenant_id = run.tenant_id
-            if not repo.get_archived_run_ids(session, [run.id]):
+            archive_log = repo.get_archived_log_by_run_id(run.id)
+            if archive_log is None:
                 result.error = f"Workflow run {run_id} is not archived"
                 result.elapsed_time = time.time() - start_time
                 return result
 
-        result = self._delete_run(run)
+        result = self._delete_run(run, archive_log)
         result.elapsed_time = time.time() - start_time
         return result
 
@@ -78,8 +163,8 @@ class ArchivedWorkflowRunDeletion:
 
         repo = self._get_workflow_run_repo()
         with session_maker() as session:
-            runs = list(
-                repo.get_archived_runs_by_time_range(
+            archive_logs = list(
+                repo.get_archived_logs_by_time_range(
                     session=session,
                     tenant_ids=tenant_ids,
                     start_date=start_date,
@@ -87,14 +172,44 @@ class ArchivedWorkflowRunDeletion:
                     limit=limit,
                 )
             )
-        for run in runs:
-            results.append(self._delete_run(run))
+            run_ids = [archive_log.workflow_run_id for archive_log in archive_logs]
+            runs_by_id = {run.id: run for run in session.query(WorkflowRun).where(WorkflowRun.id.in_(run_ids)).all()}
+        for archive_log in archive_logs:
+            run = runs_by_id.get(archive_log.workflow_run_id)
+            if run is None:
+                result = DeleteResult(
+                    run_id=archive_log.workflow_run_id,
+                    tenant_id=archive_log.tenant_id,
+                    success=False,
+                    error=f"Workflow run {archive_log.workflow_run_id} not found",
+                )
+            else:
+                result = self._delete_run(run, archive_log)
+            results.append(result)
+            if not result.success and not self.skip_bad_archives:
+                logger.error("Stopping archived workflow run deletion after failure: %s", result.error)
+                break
 
         return results
 
-    def _delete_run(self, run: WorkflowRun) -> DeleteResult:
+    def _delete_run(self, run: WorkflowRun, archive_log: WorkflowArchiveLog | None = None) -> DeleteResult:
         start_time = time.time()
         result = DeleteResult(run_id=run.id, tenant_id=run.tenant_id, success=False)
+        if archive_log is None:
+            archive_log = self._get_workflow_run_repo().get_archived_log_by_run_id(run.id)
+            if archive_log is None:
+                result.error = f"Workflow run {run.id} is not archived"
+                result.elapsed_time = time.time() - start_time
+                return result
+
+        try:
+            result.archive_key = self._validate_archive_before_delete(run, archive_log)
+            result.validated_counts = self._count_live_related_rows(run)
+        except Exception as e:
+            result.error = str(e)
+            result.elapsed_time = time.time() - start_time
+            return result
+
         if self.dry_run:
             result.success = True
             result.elapsed_time = time.time() - start_time
@@ -108,17 +223,202 @@ class ArchivedWorkflowRunDeletion:
                 delete_trigger_logs=self._delete_trigger_logs,
             )
             result.deleted_counts = deleted_counts
+            self._verify_post_delete(run.id)
+            if self._should_run_restore_sample():
+                result.restore_sampled = True
+                result.restore_sample_success = self._run_restore_dry_run_sample(archive_log)
+                if not result.restore_sample_success:
+                    raise RuntimeError(f"Restore dry-run sample failed for workflow run {run.id}")
             result.success = True
         except Exception as e:
             result.error = str(e)
         result.elapsed_time = time.time() - start_time
         return result
 
+    def _validate_archive_before_delete(self, run: WorkflowRun, archive_log: WorkflowArchiveLog) -> str:
+        storage = self._get_archive_storage()
+        archive_key = self._get_archive_key(archive_log)
+        if not storage.object_exists(archive_key):
+            raise FileNotFoundError(f"Archive bundle not found: {archive_key}")
+
+        archive_data = storage.get_object(archive_key)
+        manifest = self._validate_archive_bundle(
+            archive_data,
+            run_id=run.id,
+            tenant_id=run.tenant_id,
+            app_id=run.app_id,
+            workflow_id=run.workflow_id,
+        )
+        expected_counts = self._counts_from_manifest(manifest)
+        current_counts = self._count_live_related_rows(run)
+        if current_counts != expected_counts:
+            raise ValueError(
+                "Archive row count mismatch before delete: "
+                f"run_id={run.id}, expected={expected_counts}, current={current_counts}"
+            )
+        return archive_key
+
+    @staticmethod
+    def _validate_archive_bundle(
+        archive_data: bytes,
+        *,
+        run_id: str,
+        tenant_id: str,
+        app_id: str,
+        workflow_id: str,
+    ) -> _ArchiveManifest:
+        try:
+            with zipfile.ZipFile(io.BytesIO(archive_data), mode="r") as archive:
+                bad_member = archive.testzip()
+                if bad_member:
+                    raise ValueError(f"zip CRC check failed for member {bad_member}")
+                try:
+                    manifest_data = archive.read("manifest.json")
+                except KeyError as e:
+                    raise ValueError("manifest.json missing from archive bundle") from e
+                loaded = json.loads(manifest_data)
+                if not isinstance(loaded, dict):
+                    raise ValueError("manifest.json must be an object")
+                manifest = loaded
+
+                required_fields = {
+                    "schema_version",
+                    "workflow_run_id",
+                    "tenant_id",
+                    "app_id",
+                    "workflow_id",
+                    "tables",
+                }
+                missing_fields = sorted(required_fields - set(manifest))
+                if missing_fields:
+                    raise ValueError(f"manifest missing required fields: {', '.join(missing_fields)}")
+                if manifest["schema_version"] != ARCHIVE_SCHEMA_VERSION:
+                    raise ValueError(
+                        f"unsupported archive schema_version: {manifest['schema_version']} "
+                        f"(expected {ARCHIVE_SCHEMA_VERSION})"
+                    )
+                if manifest["workflow_run_id"] != run_id:
+                    raise ValueError("manifest workflow_run_id does not match delete target")
+                if manifest["tenant_id"] != tenant_id:
+                    raise ValueError("manifest tenant_id does not match delete target")
+                if manifest["app_id"] != app_id:
+                    raise ValueError("manifest app_id does not match delete target")
+                if manifest["workflow_id"] != workflow_id:
+                    raise ValueError("manifest workflow_id does not match delete target")
+
+                tables = manifest["tables"]
+                if not isinstance(tables, dict):
+                    raise ValueError("manifest tables must be an object")
+                missing_tables = [table_name for table_name in _ARCHIVED_TABLES if table_name not in tables]
+                if missing_tables:
+                    raise ValueError(f"manifest missing tables: {', '.join(missing_tables)}")
+
+                for table_name in _ARCHIVED_TABLES:
+                    info = tables[table_name]
+                    if not isinstance(info, dict):
+                        raise ValueError(f"manifest table entry must be an object: {table_name}")
+                    for key in ("row_count", "checksum", "size_bytes"):
+                        if key not in info:
+                            raise ValueError(f"manifest table {table_name} missing {key}")
+                    member_path = f"{table_name}.jsonl"
+                    try:
+                        payload = archive.read(member_path)
+                    except KeyError as e:
+                        raise ValueError(f"archive member missing: {member_path}") from e
+                    if len(payload) != info["size_bytes"]:
+                        raise ValueError(
+                            f"archive member size mismatch for {member_path}: "
+                            f"expected={info['size_bytes']}, actual={len(payload)}"
+                        )
+                    checksum = ArchiveStorage.compute_checksum(payload)
+                    if checksum != info["checksum"]:
+                        raise ValueError(
+                            f"archive member checksum mismatch for {member_path}: "
+                            f"expected={info['checksum']}, actual={checksum}"
+                        )
+                    row_count = len(ArchiveStorage.deserialize_from_jsonl(payload))
+                    if row_count != info["row_count"]:
+                        raise ValueError(
+                            f"archive row count mismatch for {member_path}: "
+                            f"expected={info['row_count']}, actual={row_count}"
+                        )
+
+                return manifest  # type: ignore[return-value]
+        except zipfile.BadZipFile as e:
+            raise ValueError("archive bundle is not a valid zip file") from e
+
+    @staticmethod
+    def _counts_from_manifest(manifest: _ArchiveManifest) -> RunsWithRelatedCountsDict:
+        counts: RunsWithRelatedCountsDict = {
+            "runs": 0,
+            "node_executions": 0,
+            "offloads": 0,
+            "app_logs": 0,
+            "trigger_logs": 0,
+            "pauses": 0,
+            "pause_reasons": 0,
+        }
+        for table_name, count_key in _TABLE_TO_COUNT_KEY.items():
+            counts[count_key] = manifest["tables"][table_name]["row_count"]  # type: ignore[literal-required]
+        return counts
+
+    def _count_live_related_rows(self, run: WorkflowRun) -> RunsWithRelatedCountsDict:
+        repo = self._get_workflow_run_repo()
+        return repo.count_runs_with_related(
+            [run],
+            count_node_executions=self._count_node_executions,
+            count_trigger_logs=self._count_trigger_logs,
+        )
+
+    def _verify_post_delete(self, run_id: str) -> None:
+        with sessionmaker(bind=db.engine, expire_on_commit=False)() as session:
+            if session.get(WorkflowRun, run_id) is not None:
+                raise RuntimeError(f"Post-delete verification failed: workflow run {run_id} still exists")
+
+    def _should_run_restore_sample(self) -> bool:
+        if self.restore_sample_interval == 0:
+            return False
+        self._delete_attempt_count += 1
+        return self._delete_attempt_count % self.restore_sample_interval == 0
+
+    @staticmethod
+    def _run_restore_dry_run_sample(archive_log: WorkflowArchiveLog) -> bool:
+        from services.retention.workflow_run.restore_archived_workflow_run import WorkflowRunRestore
+
+        restorer = WorkflowRunRestore(dry_run=True, workers=1)
+        # Reuse restore's dry-run path so the runbook exercises the actual restore code.
+        result = restorer._restore_from_run(
+            archive_log,
+            session_maker=sessionmaker(bind=db.engine, expire_on_commit=False),
+        )
+        return result.success
+
+    @staticmethod
+    def _get_archive_key(archive_log: WorkflowArchiveLog) -> str:
+        created_at = archive_log.run_created_at
+        prefix = (
+            f"{archive_log.tenant_id}/app_id={archive_log.app_id}/year={created_at.strftime('%Y')}/"
+            f"month={created_at.strftime('%m')}/workflow_run_id={archive_log.workflow_run_id}"
+        )
+        return f"{prefix}/{ARCHIVE_BUNDLE_NAME}"
+
+    @staticmethod
+    def _get_archive_storage() -> ArchiveStorage:
+        try:
+            return get_archive_storage()
+        except ArchiveStorageNotConfiguredError as e:
+            raise RuntimeError(f"Archive storage not configured: {e}") from e
+
     @staticmethod
     def _delete_trigger_logs(session: Session, run_ids: Sequence[str]) -> int:
         trigger_repo = SQLAlchemyWorkflowTriggerLogRepository(session)
         return trigger_repo.delete_by_run_ids(run_ids)
 
+    @staticmethod
+    def _count_trigger_logs(session: Session, run_ids: Sequence[str]) -> int:
+        trigger_repo = SQLAlchemyWorkflowTriggerLogRepository(session)
+        return trigger_repo.count_by_run_ids(run_ids)
+
     @staticmethod
     def _delete_node_executions(
         session: Session,
@@ -132,6 +432,19 @@ class ArchivedWorkflowRunDeletion:
         )
         return repo.delete_by_runs(session, run_ids)
 
+    @staticmethod
+    def _count_node_executions(
+        session: Session,
+        runs: Sequence[WorkflowRun],
+    ) -> tuple[int, int]:
+        from repositories.factory import DifyAPIRepositoryFactory
+
+        run_ids = [run.id for run in runs]
+        repo = DifyAPIRepositoryFactory.create_api_workflow_node_execution_repository(
+            session_maker=sessionmaker(bind=session.get_bind(), expire_on_commit=False)
+        )
+        return repo.count_by_runs(session, run_ids)
+
     def _get_workflow_run_repo(self) -> APIWorkflowRunRepository:
         if self.workflow_run_repo is not None:
             return self.workflow_run_repo
diff --git a/api/services/retention/workflow_run/tenant_prefix.py b/api/services/retention/workflow_run/tenant_prefix.py
new file mode 100644
index 00000000000..34d1591c70d
--- /dev/null
+++ b/api/services/retention/workflow_run/tenant_prefix.py
@@ -0,0 +1,20 @@
+from __future__ import annotations
+
+import sqlalchemy as sa
+
+
+def tenant_prefix_bounds(prefix: str) -> tuple[str, str | None]:
+    prefix_value = int(prefix, 16)
+    lower_bound = f"{prefix}0000000-0000-0000-0000-000000000000"
+    if prefix_value == 15:
+        return lower_bound, None
+    upper_bound = f"{prefix_value + 1:x}0000000-0000-0000-0000-000000000000"
+    return lower_bound, upper_bound
+
+
+def tenant_prefix_condition(column, prefix: str):
+    lower_bound, upper_bound = tenant_prefix_bounds(prefix)
+    condition = column >= lower_bound
+    if upper_bound is not None:
+        condition = sa.and_(condition, column < upper_bound)
+    return condition
diff --git a/api/services/saved_message_service.py b/api/services/saved_message_service.py
index 90f01377123..9a65429748e 100644
--- a/api/services/saved_message_service.py
+++ b/api/services/saved_message_service.py
@@ -1,6 +1,6 @@
 from sqlalchemy import select
+from sqlalchemy.orm import Session
 
-from extensions.ext_database import db
 from libs.infinite_scroll_pagination import InfiniteScrollPagination
 from models import Account
 from models.enums import CreatorUserRole
@@ -12,11 +12,11 @@ from services.message_service import MessageService
 class SavedMessageService:
     @classmethod
     def pagination_by_last_id(
-        cls, app_model: App, user: Account | EndUser | None, last_id: str | None, limit: int
+        cls, session: Session, app_model: App, user: Account | EndUser | None, last_id: str | None, limit: int
     ) -> InfiniteScrollPagination:
         if not user:
             raise ValueError("User is required")
-        saved_messages = db.session.scalars(
+        saved_messages = session.scalars(
             select(SavedMessage)
             .where(
                 SavedMessage.app_id == app_model.id,
@@ -32,10 +32,10 @@ class SavedMessageService:
         )
 
     @classmethod
-    def save(cls, app_model: App, user: Account | EndUser | None, message_id: str):
+    def save(cls, session: Session, app_model: App, user: Account | EndUser | None, message_id: str):
         if not user:
             return
-        saved_message = db.session.scalar(
+        saved_message = session.scalar(
             select(SavedMessage)
             .where(
                 SavedMessage.app_id == app_model.id,
@@ -58,14 +58,14 @@ class SavedMessageService:
             created_by=user.id,
         )
 
-        db.session.add(saved_message)
-        db.session.commit()
+        session.add(saved_message)
+        session.commit()
 
     @classmethod
-    def delete(cls, app_model: App, user: Account | EndUser | None, message_id: str):
+    def delete(cls, session: Session, app_model: App, user: Account | EndUser | None, message_id: str):
         if not user:
             return
-        saved_message = db.session.scalar(
+        saved_message = session.scalar(
             select(SavedMessage)
             .where(
                 SavedMessage.app_id == app_model.id,
@@ -79,5 +79,5 @@ class SavedMessageService:
         if not saved_message:
             return
 
-        db.session.delete(saved_message)
-        db.session.commit()
+        session.delete(saved_message)
+        session.commit()
diff --git a/api/services/trigger/trigger_provider_service.py b/api/services/trigger/trigger_provider_service.py
index d5d258aeabc..b0a3de1cee8 100644
--- a/api/services/trigger/trigger_provider_service.py
+++ b/api/services/trigger/trigger_provider_service.py
@@ -475,7 +475,7 @@ class TriggerProviderService:
                 tenant_id=tenant_id, provider_id=provider_id
             )
             # Create encrypter
-            encrypter, cache = create_provider_encrypter(
+            encrypter, _ = create_provider_encrypter(
                 tenant_id=tenant_id,
                 config=[x.to_basic_provider_config() for x in provider_controller.get_oauth_client_schema()],
                 cache=NoOpProviderCredentialCache(),
@@ -506,14 +506,20 @@ class TriggerProviderService:
             subscription.credentials = dict(encrypter.encrypt(dict(refreshed_credentials.credentials)))
             subscription.credential_expires_at = refreshed_credentials.expires_at
 
-            # Clear cache
-            cache.delete()
-
-            return {
+            provider_id_value = subscription.provider_id
+            result = {
                 "result": "success",
                 "expires_at": refreshed_credentials.expires_at,
             }
 
+        # Clear the trigger runtime credential cache after the DB commit so dispatch uses the refreshed token.
+        delete_cache_for_subscription(
+            tenant_id=tenant_id,
+            provider_id=provider_id_value,
+            subscription_id=subscription_id,
+        )
+        return result
+
     @classmethod
     def refresh_subscription(
         cls,
diff --git a/api/services/workflow_event_snapshot_service.py b/api/services/workflow_event_snapshot_service.py
index dad7dff292e..c693f6318bd 100644
--- a/api/services/workflow_event_snapshot_service.py
+++ b/api/services/workflow_event_snapshot_service.py
@@ -23,8 +23,11 @@ from core.app.entities.task_entities import (
     WorkflowStartStreamResponse,
 )
 from core.app.layers.pause_state_persist_layer import WorkflowResumptionContext
-from core.workflow.human_input_forms import load_form_tokens_by_form_id
+from core.workflow.human_input_forms import (
+    load_form_dispositions_by_form_id,
+)
 from core.workflow.human_input_policy import (
+    FormDisposition,
     HumanInputSurface,
     enrich_human_input_pause_reasons,
     resolve_human_input_pause_reason_inputs,
@@ -359,7 +362,7 @@ def _build_human_input_required_events(
 
     expiration_times_by_form_id: dict[str, int] = {}
     display_in_ui_by_form_id: dict[str, bool] = {}
-    form_tokens_by_form_id: dict[str, str] = {}
+    dispositions_by_form_id: dict[str, FormDisposition] = {}
     if human_input_form_ids and session_maker is not None:
         stmt = select(HumanInputForm.id, HumanInputForm.expiration_time, HumanInputForm.form_definition).where(
             HumanInputForm.id.in_(human_input_form_ids)
@@ -372,7 +375,7 @@ def _build_human_input_required_events(
                 except (TypeError, json.JSONDecodeError):
                     definition_payload = {}
                 display_in_ui_by_form_id[str(form_id)] = bool(definition_payload.get("display_in_ui"))
-            form_tokens_by_form_id = load_form_tokens_by_form_id(
+            dispositions_by_form_id = load_form_dispositions_by_form_id(
                 human_input_form_ids,
                 session=session,
                 surface=human_input_surface,
@@ -393,6 +396,7 @@ def _build_human_input_required_events(
             reason.inputs,
             variable_pool=variable_pool,
         )
+        disposition = dispositions_by_form_id.get(form_id)
 
         response = HumanInputRequiredResponse(
             task_id=task_id,
@@ -405,7 +409,8 @@ def _build_human_input_required_events(
                 inputs=resolved_inputs,
                 actions=reason.actions,
                 display_in_ui=display_in_ui_by_form_id.get(form_id, False),
-                form_token=form_tokens_by_form_id.get(form_id),
+                form_token=disposition.form_token if disposition else None,
+                approval_channels=list(disposition.approval_channels) if disposition else [],
                 resolved_default_values=reason.resolved_default_values,
                 expiration_time=expiration_time,
             ),
@@ -493,11 +498,11 @@ def _build_pause_event(
         for form_id in [reason.get("form_id")]
         if isinstance(form_id, str)
     ]
-    form_tokens_by_form_id: dict[str, str] = {}
+    dispositions_by_form_id: dict[str, FormDisposition] = {}
     expiration_times_by_form_id: dict[str, int] = {}
     if human_input_form_ids and session_maker is not None:
         with session_maker() as session:
-            form_tokens_by_form_id = load_form_tokens_by_form_id(
+            dispositions_by_form_id = load_form_dispositions_by_form_id(
                 human_input_form_ids,
                 session=session,
                 surface=human_input_surface,
@@ -512,7 +517,7 @@ def _build_pause_event(
         # otherwise clients see schema drift after resume.
         reasons = enrich_human_input_pause_reasons(
             reasons,
-            form_tokens_by_form_id=form_tokens_by_form_id,
+            dispositions_by_form_id=dispositions_by_form_id,
             expiration_times_by_form_id=expiration_times_by_form_id,
         )
 
diff --git a/api/tests/integration_tests/controllers/console/app/test_feedback_export_api.py b/api/tests/integration_tests/controllers/console/app/test_feedback_export_api.py
index 93310ad3805..f30abb4ed05 100644
--- a/api/tests/integration_tests/controllers/console/app/test_feedback_export_api.py
+++ b/api/tests/integration_tests/controllers/console/app/test_feedback_export_api.py
@@ -289,6 +289,7 @@ class TestFeedbackExportApi:
 
         # Verify service was called with correct parameters
         mock_export_feedbacks.assert_called_once_with(
+            mock.ANY,
             app_id=mock_app_model.id,
             from_source=FeedbackFromSource.USER,
             rating=FeedbackRating.DISLIKE,
diff --git a/api/tests/integration_tests/services/retention/test_workflow_run_archiver.py b/api/tests/integration_tests/services/retention/test_workflow_run_archiver.py
index 5728eacdfb4..9ce15c86e75 100644
--- a/api/tests/integration_tests/services/retention/test_workflow_run_archiver.py
+++ b/api/tests/integration_tests/services/retention/test_workflow_run_archiver.py
@@ -1,17 +1,17 @@
 import datetime
-import io
 import json
 import uuid
-import zipfile
 from unittest.mock import MagicMock, patch
 
+import pyarrow as pa
+import pyarrow.parquet as pq
 import pytest
 
 from services.retention.workflow_run.archive_paid_plan_workflow_run import (
     ArchiveSummary,
     WorkflowRunArchiver,
 )
-from services.retention.workflow_run.constants import ARCHIVE_SCHEMA_VERSION
+from services.retention.workflow_run.constants import ARCHIVE_BUNDLE_FORMAT, ARCHIVE_BUNDLE_SCHEMA_VERSION
 
 
 class TestWorkflowRunArchiverInit:
@@ -39,6 +39,22 @@ class TestWorkflowRunArchiverInit:
         with pytest.raises(ValueError, match="workers must be at least 1"):
             WorkflowRunArchiver(workers=0)
 
+    def test_run_shard_index_without_total_raises(self):
+        with pytest.raises(ValueError, match="run_shard_index and run_shard_total must be provided together"):
+            WorkflowRunArchiver(run_shard_index=0)
+
+    def test_run_shard_total_without_index_raises(self):
+        with pytest.raises(ValueError, match="run_shard_index and run_shard_total must be provided together"):
+            WorkflowRunArchiver(run_shard_total=4)
+
+    def test_run_shard_total_above_supported_range_raises(self):
+        with pytest.raises(ValueError, match="run_shard_total must be between 1 and 16"):
+            WorkflowRunArchiver(run_shard_index=0, run_shard_total=17)
+
+    def test_run_shard_index_must_be_less_than_total(self):
+        with pytest.raises(ValueError, match="run_shard_index must be between 0 and run_shard_total - 1"):
+            WorkflowRunArchiver(run_shard_index=4, run_shard_total=4)
+
     def test_valid_init_defaults(self):
         archiver = WorkflowRunArchiver(days=30, batch_size=50)
         assert archiver.days == 30
@@ -55,29 +71,93 @@ class TestWorkflowRunArchiverInit:
         assert archiver.end_before is not None
         assert archiver.workers == 2
 
+    def test_delete_after_archive_is_not_supported_for_bundle_archive(self):
+        with pytest.raises(ValueError, match="delete_after_archive is not supported by bundle archive"):
+            WorkflowRunArchiver(delete_after_archive=True)
+
+    def test_get_runs_batch_passes_shard_options(self):
+        repo = MagicMock()
+        repo.get_runs_batch_by_time_range.return_value = []
+        archiver = WorkflowRunArchiver(
+            tenant_prefixes=["0", "a"],
+            run_shard_index=1,
+            run_shard_total=4,
+            workflow_run_repo=repo,
+        )
+
+        archiver._get_runs_batch(None)
+
+        repo.get_runs_batch_by_time_range.assert_called_once()
+        assert repo.get_runs_batch_by_time_range.call_args.kwargs["tenant_prefixes"] == ["0", "a"]
+        assert repo.get_runs_batch_by_time_range.call_args.kwargs["run_shard_index"] == 1
+        assert repo.get_runs_batch_by_time_range.call_args.kwargs["run_shard_total"] == 4
+
+    def test_get_runs_batch_prefers_planned_tenant_ids_over_prefix_filter(self):
+        repo = MagicMock()
+        repo.get_runs_batch_by_time_range.return_value = []
+        archiver = WorkflowRunArchiver(
+            tenant_ids=["0tenant"],
+            tenant_prefixes=["0"],
+            paid_tenant_ids=["0tenant"],
+            workflow_run_repo=repo,
+        )
+
+        archiver._get_runs_batch(None)
+
+        repo.get_runs_batch_by_time_range.assert_called_once()
+        assert repo.get_runs_batch_by_time_range.call_args.kwargs["tenant_ids"] == ["0tenant"]
+        assert repo.get_runs_batch_by_time_range.call_args.kwargs["tenant_prefixes"] is None
+
+    def test_get_runs_batch_uses_current_tenant_scan_scope(self):
+        repo = MagicMock()
+        repo.get_runs_batch_by_time_range.return_value = []
+        archiver = WorkflowRunArchiver(
+            tenant_ids=["tenant-a", "tenant-b"],
+            workflow_run_repo=repo,
+        )
+
+        archiver._get_runs_batch(None, tenant_scope=["tenant-b"])
+
+        repo.get_runs_batch_by_time_range.assert_called_once()
+        assert repo.get_runs_batch_by_time_range.call_args.kwargs["tenant_ids"] == ["tenant-b"]
+
+    def test_start_message_includes_shard(self):
+        archiver = WorkflowRunArchiver(tenant_prefixes=["0"], run_shard_index=1, run_shard_total=4)
+
+        message = archiver._build_start_message()
+
+        assert "tenant_prefixes=0" in message
+        assert "run_shard=1/4" in message
+
+    def test_start_message_summarizes_large_planned_tenant_list(self):
+        tenant_ids = [f"tenant-{index}" for index in range(11)]
+        archiver = WorkflowRunArchiver(tenant_ids=tenant_ids, tenant_prefixes=["0"])
+
+        message = archiver._build_start_message()
+
+        assert "tenant_ids=11 planned tenants" in message
+        assert "tenant-10" not in message
+
 
 class TestBuildArchiveBundle:
-    def test_bundle_contains_manifest_and_all_tables(self):
+    def test_bundle_contains_manifest_and_all_table_objects(self):
         archiver = WorkflowRunArchiver(days=90)
+        run = MagicMock()
+        run.id = str(uuid.uuid4())
+        run.tenant_id = str(uuid.uuid4())
+        run.created_at = datetime.datetime(2025, 3, 15, 10, 0, 0)
+        identity = archiver._build_bundle_identity([run])
+        table_data = {"workflow_runs": [{"id": run.id, "tenant_id": run.tenant_id}]}
 
-        manifest_data = json.dumps({"schema_version": ARCHIVE_SCHEMA_VERSION}).encode("utf-8")
-        table_payloads = dict.fromkeys(archiver.ARCHIVED_TABLES, b"")
+        table_stats, table_payloads, manifest_data = archiver._build_archive_payload(identity, [run], table_data)
+        manifest = json.loads(manifest_data)
 
-        bundle_bytes = archiver._build_archive_bundle(manifest_data, table_payloads)
-
-        with zipfile.ZipFile(io.BytesIO(bundle_bytes), "r") as zf:
-            names = set(zf.namelist())
-            assert "manifest.json" in names
-            for table in archiver.ARCHIVED_TABLES:
-                assert f"{table}.jsonl" in names, f"Missing {table}.jsonl in bundle"
-
-    def test_bundle_missing_table_payload_raises(self):
-        archiver = WorkflowRunArchiver(days=90)
-        manifest_data = b"{}"
-        incomplete_payloads = {archiver.ARCHIVED_TABLES[0]: b"data"}
-
-        with pytest.raises(ValueError, match="Missing archive payload"):
-            archiver._build_archive_bundle(manifest_data, incomplete_payloads)
+        assert manifest["schema_version"] == ARCHIVE_BUNDLE_SCHEMA_VERSION
+        assert manifest["archive_format"] == ARCHIVE_BUNDLE_FORMAT
+        assert manifest["object_prefix"] == identity.object_prefix
+        assert set(table_payloads) == set(archiver.ARCHIVED_TABLES)
+        assert {stat.table_name for stat in table_stats} == set(archiver.ARCHIVED_TABLES)
+        assert pq.read_table(pa.BufferReader(table_payloads["workflow_runs"])).num_rows == 1
 
 
 class TestGenerateManifest:
@@ -88,25 +168,39 @@ class TestGenerateManifest:
         run = MagicMock()
         run.id = str(uuid.uuid4())
         run.tenant_id = str(uuid.uuid4())
-        run.app_id = str(uuid.uuid4())
-        run.workflow_id = str(uuid.uuid4())
         run.created_at = datetime.datetime(2025, 3, 15, 10, 0, 0)
+        identity = archiver._build_bundle_identity([run])
 
         stats = [
-            TableStats(table_name="workflow_runs", row_count=1, checksum="abc123", size_bytes=512),
-            TableStats(table_name="workflow_app_logs", row_count=2, checksum="def456", size_bytes=1024),
+            TableStats(
+                table_name="workflow_runs",
+                row_count=1,
+                checksum="abc123",
+                size_bytes=512,
+                object_key="workflow_runs.parquet",
+            ),
+            TableStats(
+                table_name="workflow_node_executions",
+                row_count=2,
+                checksum="def456",
+                size_bytes=1024,
+                object_key="workflow_node_executions.parquet",
+            ),
         ]
 
-        manifest = archiver._generate_manifest(run, stats)
+        manifest = archiver._generate_manifest(identity, [run], stats)
 
-        assert manifest["schema_version"] == ARCHIVE_SCHEMA_VERSION
-        assert manifest["workflow_run_id"] == run.id
+        assert manifest["schema_version"] == ARCHIVE_BUNDLE_SCHEMA_VERSION
+        assert manifest["archive_format"] == ARCHIVE_BUNDLE_FORMAT
+        assert manifest["bundle_id"] == identity.bundle_id
         assert manifest["tenant_id"] == run.tenant_id
-        assert manifest["app_id"] == run.app_id
+        assert manifest["workflow_run_count"] == 1
+        assert manifest["workflow_node_execution_count"] == 2
+        assert manifest["run_ids"] == [run.id]
         assert "tables" in manifest
         assert manifest["tables"]["workflow_runs"]["row_count"] == 1
         assert manifest["tables"]["workflow_runs"]["checksum"] == "abc123"
-        assert manifest["tables"]["workflow_app_logs"]["row_count"] == 2
+        assert manifest["tables"]["workflow_node_executions"]["row_count"] == 2
 
 
 class TestFilterPaidTenants:
@@ -163,6 +257,19 @@ class TestFilterPaidTenants:
 
         assert result == set()
 
+    def test_planned_paid_tenants_skip_billing_lookup(self):
+        archiver = WorkflowRunArchiver(days=90, paid_tenant_ids=["t1", "t3"])
+
+        with (
+            patch("services.retention.workflow_run.archive_paid_plan_workflow_run.dify_config") as cfg,
+            patch("services.retention.workflow_run.archive_paid_plan_workflow_run.BillingService") as billing,
+        ):
+            cfg.BILLING_ENABLED = True
+            result = archiver._filter_paid_tenants({"t1", "t2", "t3"})
+
+        billing.get_plan_bulk_with_cache.assert_not_called()
+        assert result == {"t1", "t3"}
+
 
 class TestDryRunArchive:
     @patch("services.retention.workflow_run.archive_paid_plan_workflow_run.get_archive_storage")
@@ -175,3 +282,81 @@ class TestDryRunArchive:
         mock_get_storage.assert_not_called()
         assert isinstance(summary, ArchiveSummary)
         assert summary.runs_failed == 0
+
+    def test_dry_run_estimates_table_and_object_sizes(self):
+        archiver = WorkflowRunArchiver(days=90, dry_run=True)
+        run = MagicMock()
+        run.id = "run-1"
+        run.tenant_id = "tenant-1"
+        run.app_id = "app-1"
+        run.workflow_id = "workflow-1"
+        run.created_at = datetime.datetime(2025, 3, 15, 10, 0, 0)
+        table_data = {
+            "workflow_runs": [{"id": "run-1", "tenant_id": "tenant-1"}],
+            "workflow_app_logs": [{"id": "log-1", "workflow_run_id": "run-1"}],
+        }
+
+        with patch.object(archiver, "_extract_bundle_data", return_value=table_data):
+            result = archiver._archive_bundle(MagicMock(), None, [run])
+
+        stats_by_table = {stat.table_name: stat for stat in result.tables}
+        assert result.success is True
+        assert result.object_size_bytes > 0
+        assert stats_by_table["workflow_runs"].row_count == 1
+        assert stats_by_table["workflow_runs"].size_bytes > 0
+        assert stats_by_table["workflow_app_logs"].row_count == 1
+        assert stats_by_table["workflow_app_logs"].size_bytes > 0
+        assert stats_by_table["workflow_node_executions"].row_count == 0
+        assert stats_by_table["workflow_node_executions"].size_bytes > 0
+
+    def test_summary_merges_dry_run_estimates(self):
+        summary = ArchiveSummary()
+        result = MagicMock()
+        result.object_size_bytes = 128
+        result.tables = [
+            MagicMock(table_name="workflow_runs", row_count=1, size_bytes=64),
+            MagicMock(table_name="workflow_app_logs", row_count=2, size_bytes=32),
+        ]
+
+        WorkflowRunArchiver._merge_result_stats(summary, result)
+
+        assert summary.total_object_size_bytes == 128
+        assert summary.table_stats["workflow_runs"].row_count == 1
+        assert summary.table_stats["workflow_runs"].size_bytes == 64
+        assert summary.table_stats["workflow_app_logs"].row_count == 2
+        assert summary.table_stats["workflow_app_logs"].size_bytes == 32
+
+
+class TestArchiveRunIdempotency:
+    def test_locked_bundle_is_skipped(self):
+        archiver = WorkflowRunArchiver(days=90)
+        run = MagicMock()
+        run.id = "run-1"
+        run.tenant_id = "tenant-1"
+        run.created_at = datetime.datetime(2025, 3, 15, 10, 0, 0)
+
+        with (
+            patch.object(archiver, "_lock_runs_for_archive", return_value=[]),
+        ):
+            storage = MagicMock()
+            storage.object_exists.return_value = False
+            result = archiver._archive_bundle(MagicMock(), storage, [run])
+
+        assert result.success is True
+        assert result.skipped is True
+        assert result.error == "one or more runs locked or deleted by another archiver"
+
+    def test_already_archived_bundle_is_skipped(self):
+        archiver = WorkflowRunArchiver(days=90)
+        run = MagicMock()
+        run.id = "run-1"
+        run.tenant_id = "tenant-1"
+        run.created_at = datetime.datetime(2025, 3, 15, 10, 0, 0)
+        storage = MagicMock()
+        storage.object_exists.return_value = True
+
+        result = archiver._archive_bundle(MagicMock(), storage, [run])
+
+        assert result.success is True
+        assert result.skipped is True
+        assert result.error == "bundle already archived"
diff --git a/api/tests/test_containers_integration_tests/.ruff.toml b/api/tests/test_containers_integration_tests/.ruff.toml
index 250cf103ab9..68e3f9af4bd 100644
--- a/api/tests/test_containers_integration_tests/.ruff.toml
+++ b/api/tests/test_containers_integration_tests/.ruff.toml
@@ -9,7 +9,6 @@ extend-select = ["ANN401", "ARG", "TID251"]
 "models/test_types_enum_text.py" = ["ANN401", "TID251"]
 "services/test_app_dsl_service.py" = ["ANN401", "TID251", "ARG"]
 "services/test_file_service_zip_and_lookup.py" = ["ANN401", "TID251", "ARG"]
-"services/test_hit_testing_service.py" = ["ANN401", "TID251"]
 "trigger/conftest.py" = ["ANN401", "TID251"]
 "trigger/test_trigger_e2e.py" = ["ANN401", "TID251", "ARG"]
 "controllers/console/app/test_app_apis.py" = ["ARG"]
diff --git a/api/tests/test_containers_integration_tests/controllers/console/auth/test_oauth.py b/api/tests/test_containers_integration_tests/controllers/console/auth/test_oauth.py
index 9ef6b903066..d043c0d413a 100644
--- a/api/tests/test_containers_integration_tests/controllers/console/auth/test_oauth.py
+++ b/api/tests/test_containers_integration_tests/controllers/console/auth/test_oauth.py
@@ -2,7 +2,7 @@
 
 from __future__ import annotations
 
-from unittest.mock import MagicMock, patch
+from unittest.mock import ANY, MagicMock, patch
 
 import pytest
 from flask import Flask
@@ -655,11 +655,11 @@ class TestAccountGeneration:
     @patch("controllers.console.auth.oauth.tenant_was_created")
     def test_should_create_workspace_for_account_without_tenant(
         self,
-        mock_event,
-        mock_account_service,
-        mock_feature_service,
-        mock_tenant_service,
-        mock_get_account,
+        mock_event: MagicMock,
+        mock_account_service: MagicMock,
+        mock_feature_service: MagicMock,
+        mock_tenant_service: MagicMock,
+        mock_get_account: MagicMock,
         app: Flask,
         user_info: OAuthUserInfo,
         mock_account,
@@ -678,6 +678,6 @@ class TestAccountGeneration:
             assert oauth_new_user is False
             mock_tenant_service.create_tenant.assert_called_once_with("Test User's Workspace")
             mock_tenant_service.create_tenant_member.assert_called_once_with(
-                mock_new_tenant, mock_account, role="owner"
+                mock_new_tenant, mock_account, ANY, role="owner"
             )
             mock_event.send.assert_called_once_with(mock_new_tenant)
diff --git a/api/tests/test_containers_integration_tests/controllers/console/test_api_based_extension.py b/api/tests/test_containers_integration_tests/controllers/console/test_api_based_extension.py
index 058f4e5fa34..e60558040a5 100644
--- a/api/tests/test_containers_integration_tests/controllers/console/test_api_based_extension.py
+++ b/api/tests/test_containers_integration_tests/controllers/console/test_api_based_extension.py
@@ -97,12 +97,13 @@ def test_list_scopes_api_based_extensions_to_authenticated_tenant(
     assert account_create_response.status_code == 201
 
     APIBasedExtensionService.save(
+        db_session_with_containers,
         APIBasedExtension(
             tenant_id=foreign_tenant_id,
             name="Foreign API",
             api_endpoint="https://foreign.example.com/hook",
             api_key="foreign-secret-12345",
-        )
+        ),
     )
 
     response = test_client_with_containers.get(
diff --git a/api/tests/test_containers_integration_tests/controllers/openapi/conftest.py b/api/tests/test_containers_integration_tests/controllers/openapi/conftest.py
index d961479f55b..5fe0f787524 100644
--- a/api/tests/test_containers_integration_tests/controllers/openapi/conftest.py
+++ b/api/tests/test_containers_integration_tests/controllers/openapi/conftest.py
@@ -12,6 +12,7 @@ from flask import Flask
 from sqlalchemy.orm import Session
 
 from controllers.openapi.auth.data import AuthData
+from extensions.ext_database import db
 from libs.oauth_bearer import AuthContext, Scope, SubjectType, TokenType, reset_auth_ctx, set_auth_ctx
 from models import Account, Tenant
 from services.account_service import AccountService, TenantService
@@ -58,7 +59,7 @@ def add_tenant_for_account(account: Account, *, role: str = "normal", name: str
     with patch("services.account_service.FeatureService") as mock_feature_service:
         mock_feature_service.get_system_features.return_value.is_allow_create_workspace = True
         tenant = TenantService.create_tenant(name=name)
-    TenantService.create_tenant_member(tenant, account, role=role)
+    TenantService.create_tenant_member(tenant, account, db.session, role=role)
     return tenant
 
 
diff --git a/api/tests/test_containers_integration_tests/libs/broadcast_channel/redis/test_channel.py b/api/tests/test_containers_integration_tests/libs/broadcast_channel/redis/test_channel.py
index 9282c878f00..b3799018cae 100644
--- a/api/tests/test_containers_integration_tests/libs/broadcast_channel/redis/test_channel.py
+++ b/api/tests/test_containers_integration_tests/libs/broadcast_channel/redis/test_channel.py
@@ -20,7 +20,7 @@ from testcontainers.redis import RedisContainer
 
 from libs.broadcast_channel.channel import BroadcastChannel, Subscription, Topic
 from libs.broadcast_channel.exc import SubscriptionClosedError
-from libs.broadcast_channel.redis.channel import BroadcastChannel as RedisBroadcastChannel
+from libs.broadcast_channel.redis.pubsub_channel import BroadcastChannel as RedisBroadcastChannel
 
 
 class TestRedisBroadcastChannelIntegration:
diff --git a/api/tests/test_containers_integration_tests/pyrefly.toml b/api/tests/test_containers_integration_tests/pyrefly.toml
index 06ea10036f5..92c84320d9a 100644
--- a/api/tests/test_containers_integration_tests/pyrefly.toml
+++ b/api/tests/test_containers_integration_tests/pyrefly.toml
@@ -100,7 +100,6 @@ project-excludes = [
   "services/test_feature_service.py",
   "services/test_feedback_service.py",
   "services/test_file_service.py",
-  "services/test_hit_testing_service.py",
   "services/test_human_input_delivery_test.py",
   "services/test_human_input_delivery_test_service.py",
   "services/test_message_export_service.py",
diff --git a/api/tests/test_containers_integration_tests/services/test_account_service.py b/api/tests/test_containers_integration_tests/services/test_account_service.py
index 61dca361f3e..a2f5370cb76 100644
--- a/api/tests/test_containers_integration_tests/services/test_account_service.py
+++ b/api/tests/test_containers_integration_tests/services/test_account_service.py
@@ -1276,7 +1276,7 @@ class TestTenantService:
         )
 
         # Create tenant member
-        tenant_member = TenantService.create_tenant_member(tenant, account, role="admin")
+        tenant_member = TenantService.create_tenant_member(tenant, account, db_session_with_containers, role="admin")
 
         assert tenant_member.tenant_id == tenant.id
         assert tenant_member.account_id == account.id
@@ -1317,11 +1317,11 @@ class TestTenantService:
         )
 
         # Create first owner
-        TenantService.create_tenant_member(tenant, account1, role="owner")
+        TenantService.create_tenant_member(tenant, account1, db_session_with_containers, role="owner")
 
         # Try to create second owner (should fail)
         with pytest.raises(Exception, match="Tenant already has an owner"):
-            TenantService.create_tenant_member(tenant, account2, role="owner")
+            TenantService.create_tenant_member(tenant, account2, db_session_with_containers, role="owner")
 
     def test_create_tenant_member_existing_member(
         self, db_session_with_containers: Session, mock_external_service_dependencies
@@ -1349,11 +1349,11 @@ class TestTenantService:
         )
 
         # Create member with initial role
-        tenant_member1 = TenantService.create_tenant_member(tenant, account, role="normal")
+        tenant_member1 = TenantService.create_tenant_member(tenant, account, db_session_with_containers, role="normal")
         assert tenant_member1.role == "normal"
 
         # Update member role
-        tenant_member2 = TenantService.create_tenant_member(tenant, account, role="editor")
+        tenant_member2 = TenantService.create_tenant_member(tenant, account, db_session_with_containers, role="editor")
         assert tenant_member2.tenant_id == tenant_member1.tenant_id
         assert tenant_member2.account_id == tenant_member1.account_id
         assert tenant_member2.role == "editor"
@@ -1384,8 +1384,8 @@ class TestTenantService:
         tenant2 = TenantService.create_tenant(name=tenant2_name)
 
         # Add account to both tenants
-        TenantService.create_tenant_member(tenant1, account, role="normal")
-        TenantService.create_tenant_member(tenant2, account, role="admin")
+        TenantService.create_tenant_member(tenant1, account, db_session_with_containers, role="normal")
+        TenantService.create_tenant_member(tenant2, account, db_session_with_containers, role="admin")
 
         # Get join tenants
         join_tenants = TenantService.get_join_tenants(account)
@@ -1421,7 +1421,7 @@ class TestTenantService:
         tenant = TenantService.create_tenant(name=tenant_name)
 
         # Add account to tenant and set as current
-        TenantService.create_tenant_member(tenant, account, role="owner")
+        TenantService.create_tenant_member(tenant, account, db_session_with_containers, role="owner")
         account.current_tenant = tenant
 
         db_session_with_containers.commit()
@@ -1486,8 +1486,8 @@ class TestTenantService:
         tenant2 = TenantService.create_tenant(name=tenant2_name)
 
         # Add account to both tenants
-        TenantService.create_tenant_member(tenant1, account, role="owner")
-        TenantService.create_tenant_member(tenant2, account, role="admin")
+        TenantService.create_tenant_member(tenant1, account, db_session_with_containers, role="owner")
+        TenantService.create_tenant_member(tenant2, account, db_session_with_containers, role="admin")
 
         # Set initial current tenant
         account.current_tenant = tenant1
@@ -1588,8 +1588,8 @@ class TestTenantService:
         )
 
         # Add members with different roles
-        TenantService.create_tenant_member(tenant, owner_account, role="owner")
-        TenantService.create_tenant_member(tenant, admin_account, role="admin")
+        TenantService.create_tenant_member(tenant, owner_account, db_session_with_containers, role="owner")
+        TenantService.create_tenant_member(tenant, admin_account, db_session_with_containers, role="admin")
 
         # Check if tenant has owner role
         from models.account import TenantAccountRole
@@ -1648,7 +1648,7 @@ class TestTenantService:
         )
 
         # Add account to tenant with specific role
-        TenantService.create_tenant_member(tenant, account, role="editor")
+        TenantService.create_tenant_member(tenant, account, db_session_with_containers, role="editor")
 
         # Get user role
         user_role = TenantService.get_user_role(account, tenant)
@@ -1690,8 +1690,8 @@ class TestTenantService:
         )
 
         # Add members with different roles
-        TenantService.create_tenant_member(tenant, owner_account, role="owner")
-        TenantService.create_tenant_member(tenant, member_account, role="normal")
+        TenantService.create_tenant_member(tenant, owner_account, db_session_with_containers, role="owner")
+        TenantService.create_tenant_member(tenant, member_account, db_session_with_containers, role="normal")
 
         # Check owner permission to add member (should succeed)
         TenantService.check_member_permission(tenant, owner_account, member_account, "add")
@@ -1723,7 +1723,7 @@ class TestTenantService:
         )
 
         # Add account to tenant
-        TenantService.create_tenant_member(tenant, account, role="owner")
+        TenantService.create_tenant_member(tenant, account, db_session_with_containers, role="owner")
 
         # Try to check permission with invalid action
         with pytest.raises(Exception, match="Invalid action"):
@@ -1755,7 +1755,7 @@ class TestTenantService:
         )
 
         # Add account to tenant
-        TenantService.create_tenant_member(tenant, account, role="owner")
+        TenantService.create_tenant_member(tenant, account, db_session_with_containers, role="owner")
 
         # Try to check permission to operate self
         with pytest.raises(Exception, match="Cannot operate self"):
@@ -1796,8 +1796,8 @@ class TestTenantService:
         )
 
         # Add members with different roles
-        TenantService.create_tenant_member(tenant, owner_account, role="owner")
-        TenantService.create_tenant_member(tenant, member_account, role="normal")
+        TenantService.create_tenant_member(tenant, owner_account, db_session_with_containers, role="owner")
+        TenantService.create_tenant_member(tenant, member_account, db_session_with_containers, role="normal")
 
         app = App(
             tenant_id=tenant.id,
@@ -1876,7 +1876,7 @@ class TestTenantService:
         )
 
         # Add account to tenant
-        TenantService.create_tenant_member(tenant, account, role="owner")
+        TenantService.create_tenant_member(tenant, account, db_session_with_containers, role="owner")
 
         # Try to remove self
         with pytest.raises(Exception, match="Cannot operate self"):
@@ -1917,7 +1917,7 @@ class TestTenantService:
         )
 
         # Add only owner to tenant
-        TenantService.create_tenant_member(tenant, owner_account, role="owner")
+        TenantService.create_tenant_member(tenant, owner_account, db_session_with_containers, role="owner")
 
         # Try to remove non-member
         with pytest.raises(Exception, match="Member not in tenant"):
@@ -1956,8 +1956,8 @@ class TestTenantService:
         )
 
         # Add members with different roles
-        TenantService.create_tenant_member(tenant, owner_account, role="owner")
-        TenantService.create_tenant_member(tenant, member_account, role="normal")
+        TenantService.create_tenant_member(tenant, owner_account, db_session_with_containers, role="owner")
+        TenantService.create_tenant_member(tenant, member_account, db_session_with_containers, role="normal")
 
         # Update member role
         TenantService.update_member_role(tenant, member_account, "admin", owner_account)
@@ -2005,8 +2005,8 @@ class TestTenantService:
         )
 
         # Add members with different roles
-        TenantService.create_tenant_member(tenant, owner_account, role="owner")
-        TenantService.create_tenant_member(tenant, member_account, role="admin")
+        TenantService.create_tenant_member(tenant, owner_account, db_session_with_containers, role="owner")
+        TenantService.create_tenant_member(tenant, member_account, db_session_with_containers, role="admin")
 
         # Update member role to owner
         TenantService.update_member_role(tenant, member_account, "owner", owner_account)
@@ -2062,8 +2062,8 @@ class TestTenantService:
         )
 
         # Add members with different roles
-        TenantService.create_tenant_member(tenant, owner_account, role="owner")
-        TenantService.create_tenant_member(tenant, member_account, role="admin")
+        TenantService.create_tenant_member(tenant, owner_account, db_session_with_containers, role="owner")
+        TenantService.create_tenant_member(tenant, member_account, db_session_with_containers, role="admin")
 
         # Try to update member role to already assigned role
         with pytest.raises(Exception, match="The provided role is already assigned to the member"):
@@ -2160,7 +2160,7 @@ class TestTenantService:
             password=password,
         )
         existing_tenant = TenantService.create_tenant(name=existing_tenant_name)
-        TenantService.create_tenant_member(existing_tenant, account, role="owner")
+        TenantService.create_tenant_member(existing_tenant, account, db_session_with_containers, role="owner")
         account.current_tenant = existing_tenant
 
         db_session_with_containers.commit()
@@ -2243,9 +2243,9 @@ class TestTenantService:
         )
 
         # Add members with different roles
-        TenantService.create_tenant_member(tenant, owner_account, role="owner")
-        TenantService.create_tenant_member(tenant, admin_account, role="admin")
-        TenantService.create_tenant_member(tenant, normal_account, role="normal")
+        TenantService.create_tenant_member(tenant, owner_account, db_session_with_containers, role="owner")
+        TenantService.create_tenant_member(tenant, admin_account, db_session_with_containers, role="admin")
+        TenantService.create_tenant_member(tenant, normal_account, db_session_with_containers, role="normal")
 
         # Get tenant members
         members = TenantService.get_tenant_members(tenant)
@@ -2309,9 +2309,11 @@ class TestTenantService:
         )
 
         # Add members with different roles
-        TenantService.create_tenant_member(tenant, owner_account, role="owner")
-        TenantService.create_tenant_member(tenant, dataset_operator_account, role="dataset_operator")
-        TenantService.create_tenant_member(tenant, normal_account, role="normal")
+        TenantService.create_tenant_member(tenant, owner_account, db_session_with_containers, role="owner")
+        TenantService.create_tenant_member(
+            tenant, dataset_operator_account, db_session_with_containers, role="dataset_operator"
+        )
+        TenantService.create_tenant_member(tenant, normal_account, db_session_with_containers, role="normal")
 
         # Get dataset operator members
         dataset_operators = TenantService.get_dataset_operator_members(tenant)
@@ -2742,7 +2744,7 @@ class TestRegisterService:
             interface_language="en-US",
             password=inviter_password,
         )
-        TenantService.create_tenant_member(tenant, inviter, role="owner")
+        TenantService.create_tenant_member(tenant, inviter, db_session_with_containers, role="owner")
 
         # Mock the email task
         with patch("services.account_service.send_invite_member_mail_task") as mock_send_mail:
@@ -2808,7 +2810,7 @@ class TestRegisterService:
             interface_language="en-US",
             password=inviter_password,
         )
-        TenantService.create_tenant_member(tenant, inviter, role="owner")
+        TenantService.create_tenant_member(tenant, inviter, db_session_with_containers, role="owner")
 
         # Create existing account
         existing_account = AccountService.create_account(
@@ -2877,7 +2879,7 @@ class TestRegisterService:
             interface_language="en-US",
             password=inviter_password,
         )
-        TenantService.create_tenant_member(tenant, inviter, role="owner")
+        TenantService.create_tenant_member(tenant, inviter, db_session_with_containers, role="owner")
 
         # Create existing account with pending status
         existing_account = AccountService.create_account(
@@ -2891,7 +2893,7 @@ class TestRegisterService:
         db_session_with_containers.commit()
 
         # Add existing account to tenant
-        TenantService.create_tenant_member(tenant, existing_account, role="normal")
+        TenantService.create_tenant_member(tenant, existing_account, db_session_with_containers, role="normal")
 
         # Mock the email task
         with patch("services.account_service.send_invite_member_mail_task") as mock_send_mail:
@@ -2967,7 +2969,7 @@ class TestRegisterService:
             interface_language="en-US",
             password=inviter_password,
         )
-        TenantService.create_tenant_member(tenant, inviter, role="owner")
+        TenantService.create_tenant_member(tenant, inviter, db_session_with_containers, role="owner")
 
         # Create existing account with active status
         existing_account = AccountService.create_account(
@@ -2981,7 +2983,7 @@ class TestRegisterService:
         db_session_with_containers.commit()
 
         # Add existing account to tenant
-        TenantService.create_tenant_member(tenant, existing_account, role="normal")
+        TenantService.create_tenant_member(tenant, existing_account, db_session_with_containers, role="normal")
 
         # Execute invitation (should fail for active member)
         with pytest.raises(AccountAlreadyInTenantError, match="Account already in tenant."):
@@ -3193,7 +3195,7 @@ class TestRegisterService:
             interface_language="en-US",
             password=password,
         )
-        TenantService.create_tenant_member(tenant, account, role="normal")
+        TenantService.create_tenant_member(tenant, account, db_session_with_containers, role="normal")
 
         # Generate a real token
         token = RegisterService.generate_invite_token(tenant, account)
@@ -3313,7 +3315,7 @@ class TestRegisterService:
             interface_language="en-US",
             password=password,
         )
-        TenantService.create_tenant_member(tenant, account, role="normal")
+        TenantService.create_tenant_member(tenant, account, db_session_with_containers, role="normal")
 
         # Create a real token but with mismatched account ID
         from extensions.ext_redis import redis_client
@@ -3363,7 +3365,7 @@ class TestRegisterService:
             interface_language="en-US",
             password=password,
         )
-        TenantService.create_tenant_member(tenant, account, role="normal")
+        TenantService.create_tenant_member(tenant, account, db_session_with_containers, role="normal")
 
         # Change tenant status to non-normal
         tenant.status = TenantStatus.ARCHIVE
diff --git a/api/tests/test_containers_integration_tests/services/test_api_based_extension_service.py b/api/tests/test_containers_integration_tests/services/test_api_based_extension_service.py
index b8e022503fd..8bd4069639f 100644
--- a/api/tests/test_containers_integration_tests/services/test_api_based_extension_service.py
+++ b/api/tests/test_containers_integration_tests/services/test_api_based_extension_service.py
@@ -81,7 +81,7 @@ class TestAPIBasedExtensionService:
         )
 
         # Save extension
-        saved_extension = APIBasedExtensionService.save(extension_data)
+        saved_extension = APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
         # Verify extension was saved correctly
         assert saved_extension.id is not None
@@ -119,21 +119,21 @@ class TestAPIBasedExtensionService:
         )
 
         with pytest.raises(ValueError, match="name must not be empty"):
-            APIBasedExtensionService.save(extension_data)
+            APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
         # Test empty api_endpoint
         extension_data.name = fake.company()
         extension_data.api_endpoint = ""
 
         with pytest.raises(ValueError, match="api_endpoint must not be empty"):
-            APIBasedExtensionService.save(extension_data)
+            APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
         # Test empty api_key
         extension_data.api_endpoint = f"https://{fake.domain_name()}/api"
         extension_data.api_key = ""
 
         with pytest.raises(ValueError, match="api_key must not be empty"):
-            APIBasedExtensionService.save(extension_data)
+            APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
     def test_get_all_by_tenant_id_success(
         self, db_session_with_containers: Session, mock_external_service_dependencies
@@ -157,11 +157,11 @@ class TestAPIBasedExtensionService:
                 api_key=fake.password(length=20),
             )
 
-            saved_extension = APIBasedExtensionService.save(extension_data)
+            saved_extension = APIBasedExtensionService.save(db_session_with_containers, extension_data)
             extensions.append(saved_extension)
 
         # Get all extensions for tenant
-        extension_list = APIBasedExtensionService.get_all_by_tenant_id(tenant.id)
+        extension_list = APIBasedExtensionService.get_all_by_tenant_id(db_session_with_containers, tenant.id)
 
         # Verify results
         assert len(extension_list) == 3
@@ -191,10 +191,12 @@ class TestAPIBasedExtensionService:
             api_key=fake.password(length=20),
         )
 
-        created_extension = APIBasedExtensionService.save(extension_data)
+        created_extension = APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
         # Get extension by ID
-        retrieved_extension = APIBasedExtensionService.get_with_tenant_id(tenant.id, created_extension.id)
+        retrieved_extension = APIBasedExtensionService.get_with_tenant_id(
+            db_session_with_containers, tenant.id, created_extension.id
+        )
 
         # Verify extension was retrieved correctly
         assert retrieved_extension is not None
@@ -219,7 +221,9 @@ class TestAPIBasedExtensionService:
 
         # Try to get non-existent extension
         with pytest.raises(ValueError, match="API based extension is not found"):
-            APIBasedExtensionService.get_with_tenant_id(tenant.id, non_existent_extension_id)
+            APIBasedExtensionService.get_with_tenant_id(
+                db_session_with_containers, tenant.id, non_existent_extension_id
+            )
 
     def test_delete_extension_success(self, db_session_with_containers: Session, mock_external_service_dependencies):
         """
@@ -238,11 +242,11 @@ class TestAPIBasedExtensionService:
             api_key=fake.password(length=20),
         )
 
-        created_extension = APIBasedExtensionService.save(extension_data)
+        created_extension = APIBasedExtensionService.save(db_session_with_containers, extension_data)
         extension_id = created_extension.id
 
         # Delete the extension
-        APIBasedExtensionService.delete(created_extension)
+        APIBasedExtensionService.delete(db_session_with_containers, created_extension)
 
         # Verify extension was deleted
 
@@ -270,7 +274,7 @@ class TestAPIBasedExtensionService:
             api_key=fake.password(length=20),
         )
 
-        APIBasedExtensionService.save(extension_data1)
+        APIBasedExtensionService.save(db_session_with_containers, extension_data1)
         # Try to create second extension with same name
         extension_data2 = APIBasedExtension(
             tenant_id=tenant.id,
@@ -280,7 +284,7 @@ class TestAPIBasedExtensionService:
         )
 
         with pytest.raises(ValueError, match="name must be unique, it is already existed"):
-            APIBasedExtensionService.save(extension_data2)
+            APIBasedExtensionService.save(db_session_with_containers, extension_data2)
 
     def test_save_extension_update_existing(
         self, db_session_with_containers: Session, mock_external_service_dependencies
@@ -301,7 +305,7 @@ class TestAPIBasedExtensionService:
             api_key=fake.password(length=20),
         )
 
-        created_extension = APIBasedExtensionService.save(extension_data)
+        created_extension = APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
         # Save original values for later comparison
         original_name = created_extension.name
@@ -320,7 +324,7 @@ class TestAPIBasedExtensionService:
         created_extension.api_endpoint = new_endpoint
         created_extension.api_key = new_api_key
 
-        updated_extension = APIBasedExtensionService.save(created_extension)
+        updated_extension = APIBasedExtensionService.save(db_session_with_containers, created_extension)
 
         # Verify extension was updated correctly
         assert updated_extension.id == created_extension.id
@@ -336,7 +340,9 @@ class TestAPIBasedExtensionService:
         assert mock_external_service_dependencies["requestor_instance"].request.call_count == 2
 
         # Verify the update by retrieving the extension again
-        retrieved_extension = APIBasedExtensionService.get_with_tenant_id(tenant.id, created_extension.id)
+        retrieved_extension = APIBasedExtensionService.get_with_tenant_id(
+            db_session_with_containers, tenant.id, created_extension.id
+        )
         assert retrieved_extension.name == new_name
         assert retrieved_extension.api_endpoint == new_endpoint
         assert retrieved_extension.api_key == new_api_key  # Should be decrypted when retrieved
@@ -367,7 +373,7 @@ class TestAPIBasedExtensionService:
 
         # Try to save extension with connection error
         with pytest.raises(ValueError, match="connection error: request timeout"):
-            APIBasedExtensionService.save(extension_data)
+            APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
     def test_save_extension_invalid_api_key_length(
         self, db_session_with_containers: Session, mock_external_service_dependencies
@@ -390,7 +396,7 @@ class TestAPIBasedExtensionService:
 
         # Try to save extension with short API key
         with pytest.raises(ValueError, match="api_key must be at least 5 characters"):
-            APIBasedExtensionService.save(extension_data)
+            APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
     def test_save_extension_empty_fields(self, db_session_with_containers: Session, mock_external_service_dependencies):
         """
@@ -410,21 +416,21 @@ class TestAPIBasedExtensionService:
         )
 
         with pytest.raises(ValueError, match="name must not be empty"):
-            APIBasedExtensionService.save(extension_data)
+            APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
         # Test with None api_endpoint
         extension_data.name = fake.company()
         extension_data.api_endpoint = None
 
         with pytest.raises(ValueError, match="api_endpoint must not be empty"):
-            APIBasedExtensionService.save(extension_data)
+            APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
         # Test with None api_key
         extension_data.api_endpoint = f"https://{fake.domain_name()}/api"
         extension_data.api_key = None
 
         with pytest.raises(ValueError, match="api_key must not be empty"):
-            APIBasedExtensionService.save(extension_data)
+            APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
     def test_get_all_by_tenant_id_empty_list(
         self, db_session_with_containers: Session, mock_external_service_dependencies
@@ -438,7 +444,7 @@ class TestAPIBasedExtensionService:
         )
 
         # Get all extensions for tenant (none exist)
-        extension_list = APIBasedExtensionService.get_all_by_tenant_id(tenant.id)
+        extension_list = APIBasedExtensionService.get_all_by_tenant_id(db_session_with_containers, tenant.id)
 
         # Verify empty list is returned
         assert len(extension_list) == 0
@@ -468,7 +474,7 @@ class TestAPIBasedExtensionService:
 
         # Try to save extension with invalid ping response
         with pytest.raises(ValueError, match="{'result': 'invalid'}"):
-            APIBasedExtensionService.save(extension_data)
+            APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
     def test_save_extension_missing_ping_result(
         self, db_session_with_containers: Session, mock_external_service_dependencies
@@ -494,7 +500,7 @@ class TestAPIBasedExtensionService:
 
         # Try to save extension with missing ping result
         with pytest.raises(ValueError, match="{'status': 'ok'}"):
-            APIBasedExtensionService.save(extension_data)
+            APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
     def test_get_with_tenant_id_wrong_tenant(
         self, db_session_with_containers: Session, mock_external_service_dependencies
@@ -520,11 +526,11 @@ class TestAPIBasedExtensionService:
             api_key=fake.password(length=20),
         )
 
-        created_extension = APIBasedExtensionService.save(extension_data)
+        created_extension = APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
         # Try to get extension with wrong tenant ID
         with pytest.raises(ValueError, match="API based extension is not found"):
-            APIBasedExtensionService.get_with_tenant_id(tenant2.id, created_extension.id)
+            APIBasedExtensionService.get_with_tenant_id(db_session_with_containers, tenant2.id, created_extension.id)
 
     def test_save_extension_api_key_exactly_four_chars_rejected(
         self, db_session_with_containers: Session, mock_external_service_dependencies
@@ -544,7 +550,7 @@ class TestAPIBasedExtensionService:
         )
 
         with pytest.raises(ValueError, match="api_key must be at least 5 characters"):
-            APIBasedExtensionService.save(extension_data)
+            APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
     def test_save_extension_api_key_exactly_five_chars_accepted(
         self, db_session_with_containers: Session, mock_external_service_dependencies
@@ -563,7 +569,7 @@ class TestAPIBasedExtensionService:
             api_key="12345",
         )
 
-        saved = APIBasedExtensionService.save(extension_data)
+        saved = APIBasedExtensionService.save(db_session_with_containers, extension_data)
         assert saved.id is not None
 
     def test_save_extension_requestor_constructor_error(
@@ -586,7 +592,7 @@ class TestAPIBasedExtensionService:
         )
 
         with pytest.raises(ValueError, match="connection error: bad config"):
-            APIBasedExtensionService.save(extension_data)
+            APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
     def test_save_extension_network_exception(
         self, db_session_with_containers: Session, mock_external_service_dependencies
@@ -610,7 +616,7 @@ class TestAPIBasedExtensionService:
         )
 
         with pytest.raises(ValueError, match="connection error: network failure"):
-            APIBasedExtensionService.save(extension_data)
+            APIBasedExtensionService.save(db_session_with_containers, extension_data)
 
     def test_save_extension_update_duplicate_name_rejected(
         self, db_session_with_containers: Session, mock_external_service_dependencies
@@ -623,26 +629,28 @@ class TestAPIBasedExtensionService:
         assert tenant is not None
 
         ext1 = APIBasedExtensionService.save(
+            db_session_with_containers,
             APIBasedExtension(
                 tenant_id=tenant.id,
                 name="Extension Alpha",
                 api_endpoint=f"https://{fake.domain_name()}/api",
                 api_key=fake.password(length=20),
-            )
+            ),
         )
         ext2 = APIBasedExtensionService.save(
+            db_session_with_containers,
             APIBasedExtension(
                 tenant_id=tenant.id,
                 name="Extension Beta",
                 api_endpoint=f"https://{fake.domain_name()}/api",
                 api_key=fake.password(length=20),
-            )
+            ),
         )
 
         # Try to rename ext2 to ext1's name
         ext2.name = "Extension Alpha"
         with pytest.raises(ValueError, match="name must be unique, it is already existed"):
-            APIBasedExtensionService.save(ext2)
+            APIBasedExtensionService.save(db_session_with_containers, ext2)
 
     def test_get_all_returns_empty_for_different_tenant(
         self, db_session_with_containers: Session, mock_external_service_dependencies
@@ -658,14 +666,15 @@ class TestAPIBasedExtensionService:
         assert tenant1 is not None
 
         APIBasedExtensionService.save(
+            db_session_with_containers,
             APIBasedExtension(
                 tenant_id=tenant1.id,
                 name=fake.company(),
                 api_endpoint=f"https://{fake.domain_name()}/api",
                 api_key=fake.password(length=20),
-            )
+            ),
         )
 
         assert tenant2 is not None
-        result = APIBasedExtensionService.get_all_by_tenant_id(tenant2.id)
+        result = APIBasedExtensionService.get_all_by_tenant_id(db_session_with_containers, tenant2.id)
         assert result == []
diff --git a/api/tests/test_containers_integration_tests/services/test_delete_archived_workflow_run.py b/api/tests/test_containers_integration_tests/services/test_delete_archived_workflow_run.py
index 69c39b8bfbb..62d6dd489a5 100644
--- a/api/tests/test_containers_integration_tests/services/test_delete_archived_workflow_run.py
+++ b/api/tests/test_containers_integration_tests/services/test_delete_archived_workflow_run.py
@@ -2,17 +2,44 @@
 Testcontainers integration tests for archived workflow run deletion service.
 """
 
+import io
+import json
+import zipfile
 from datetime import UTC, datetime, timedelta
+from unittest.mock import MagicMock, patch
 from uuid import uuid4
 
 from sqlalchemy import select
 from sqlalchemy.orm import Session
 
 from graphon.enums import WorkflowExecutionStatus
+from libs.archive_storage import ArchiveStorage
 from models.enums import CreatorUserRole, WorkflowRunTriggeredFrom
 from models.workflow import WorkflowArchiveLog, WorkflowRun
+from services.retention.workflow_run.constants import ARCHIVE_BUNDLE_NAME, ARCHIVE_SCHEMA_VERSION
 from services.retention.workflow_run.delete_archived_workflow_run import ArchivedWorkflowRunDeletion
 
+ARCHIVED_TABLES = [
+    "workflow_runs",
+    "workflow_app_logs",
+    "workflow_node_executions",
+    "workflow_node_execution_offload",
+    "workflow_pauses",
+    "workflow_pause_reasons",
+    "workflow_trigger_logs",
+]
+
+
+class FakeArchiveStorage:
+    def __init__(self, objects: dict[str, bytes]):
+        self.objects = objects
+
+    def object_exists(self, key: str) -> bool:
+        return key in self.objects
+
+    def get_object(self, key: str) -> bytes:
+        return self.objects[key]
+
 
 class TestArchivedWorkflowRunDeletion:
     def _create_workflow_run(
@@ -47,7 +74,7 @@ class TestArchivedWorkflowRunDeletion:
         db_session_with_containers.commit()
         return run
 
-    def _create_archive_log(self, db_session_with_containers: Session, *, run: WorkflowRun) -> None:
+    def _create_archive_log(self, db_session_with_containers: Session, *, run: WorkflowRun) -> WorkflowArchiveLog:
         archive_log = WorkflowArchiveLog(
             tenant_id=run.tenant_id,
             app_id=run.app_id,
@@ -72,6 +99,59 @@ class TestArchivedWorkflowRunDeletion:
         )
         db_session_with_containers.add(archive_log)
         db_session_with_containers.commit()
+        return archive_log
+
+    def _archive_key(self, run: WorkflowRun) -> str:
+        return (
+            f"{run.tenant_id}/app_id={run.app_id}/year={run.created_at.strftime('%Y')}/"
+            f"month={run.created_at.strftime('%m')}/workflow_run_id={run.id}/{ARCHIVE_BUNDLE_NAME}"
+        )
+
+    def _archive_bundle(self, run: WorkflowRun, *, workflow_run_rows: int = 1) -> bytes:
+        table_payloads: dict[str, bytes] = {}
+        table_counts = {
+            "workflow_runs": workflow_run_rows,
+            "workflow_app_logs": 0,
+            "workflow_node_executions": 0,
+            "workflow_node_execution_offload": 0,
+            "workflow_pauses": 0,
+            "workflow_pause_reasons": 0,
+            "workflow_trigger_logs": 0,
+        }
+        for table_name in ARCHIVED_TABLES:
+            records = [{"id": run.id}] if table_name == "workflow_runs" and workflow_run_rows else []
+            table_payloads[table_name] = ArchiveStorage.serialize_to_jsonl(records)
+
+        manifest = {
+            "schema_version": ARCHIVE_SCHEMA_VERSION,
+            "workflow_run_id": run.id,
+            "tenant_id": run.tenant_id,
+            "app_id": run.app_id,
+            "workflow_id": run.workflow_id,
+            "created_at": run.created_at.isoformat(),
+            "archived_at": datetime.now(UTC).isoformat(),
+            "tables": {
+                table_name: {
+                    "row_count": table_counts[table_name],
+                    "checksum": ArchiveStorage.compute_checksum(payload),
+                    "size_bytes": len(payload),
+                }
+                for table_name, payload in table_payloads.items()
+            },
+        }
+        buffer = io.BytesIO()
+        with zipfile.ZipFile(buffer, mode="w", compression=zipfile.ZIP_DEFLATED) as archive:
+            archive.writestr("manifest.json", json.dumps(manifest).encode("utf-8"))
+            for table_name, payload in table_payloads.items():
+                archive.writestr(f"{table_name}.jsonl", payload)
+        return buffer.getvalue()
+
+    def _patch_storage(self, run: WorkflowRun):
+        storage = FakeArchiveStorage({self._archive_key(run): self._archive_bundle(run)})
+        return patch(
+            "services.retention.workflow_run.delete_archived_workflow_run.get_archive_storage",
+            return_value=storage,
+        )
 
     def test_delete_by_run_id_returns_error_when_run_missing(self, db_session_with_containers: Session):
         deleter = ArchivedWorkflowRunDeletion()
@@ -109,13 +189,23 @@ class TestArchivedWorkflowRunDeletion:
         self._create_archive_log(db_session_with_containers, run=run2)
         run_ids = [run1.id, run2.id]
 
-        deleter = ArchivedWorkflowRunDeletion()
-        results = deleter.delete_batch(
-            tenant_ids=[tenant_id],
-            start_date=base_time - timedelta(minutes=1),
-            end_date=base_time + timedelta(minutes=1),
-            limit=2,
+        storage = FakeArchiveStorage(
+            {
+                self._archive_key(run1): self._archive_bundle(run1),
+                self._archive_key(run2): self._archive_bundle(run2),
+            }
         )
+        deleter = ArchivedWorkflowRunDeletion()
+        with patch(
+            "services.retention.workflow_run.delete_archived_workflow_run.get_archive_storage",
+            return_value=storage,
+        ):
+            results = deleter.delete_batch(
+                tenant_ids=[tenant_id],
+                start_date=base_time - timedelta(minutes=1),
+                end_date=base_time + timedelta(minutes=1),
+                limit=2,
+            )
 
         assert len(results) == 2
         assert all(result.success for result in results)
@@ -133,9 +223,11 @@ class TestArchivedWorkflowRunDeletion:
             created_at=datetime.now(UTC),
         )
         run_id = run.id
+        archive_log = self._create_archive_log(db_session_with_containers, run=run)
         deleter = ArchivedWorkflowRunDeletion()
 
-        result = deleter._delete_run(run)
+        with self._patch_storage(run):
+            result = deleter._delete_run(run, archive_log)
 
         assert result.success is True
         assert result.deleted_counts["runs"] == 1
@@ -152,9 +244,11 @@ class TestArchivedWorkflowRunDeletion:
             created_at=datetime.now(UTC),
         )
         run_id = run.id
+        archive_log = self._create_archive_log(db_session_with_containers, run=run)
         deleter = ArchivedWorkflowRunDeletion(dry_run=True)
 
-        result = deleter._delete_run(run)
+        with self._patch_storage(run):
+            result = deleter._delete_run(run, archive_log)
 
         assert result.success is True
         assert result.run_id == run_id
@@ -164,22 +258,33 @@ class TestArchivedWorkflowRunDeletion:
 
     def test_delete_run_exception_returns_error(self, db_session_with_containers: Session):
         """Exception during deletion should return failure result."""
-        from unittest.mock import MagicMock, patch
-
         tenant_id = str(uuid4())
         run = self._create_workflow_run(
             db_session_with_containers,
             tenant_id=tenant_id,
             created_at=datetime.now(UTC),
         )
+        archive_log = self._create_archive_log(db_session_with_containers, run=run)
         deleter = ArchivedWorkflowRunDeletion(dry_run=False)
 
+        expected_counts = {
+            "runs": 1,
+            "node_executions": 0,
+            "offloads": 0,
+            "app_logs": 0,
+            "trigger_logs": 0,
+            "pauses": 0,
+            "pause_reasons": 0,
+        }
         with patch.object(deleter, "_get_workflow_run_repo") as mock_get_repo:
             mock_repo = MagicMock()
             mock_get_repo.return_value = mock_repo
+            mock_repo.get_archived_log_by_run_id.return_value = archive_log
+            mock_repo.count_runs_with_related.return_value = expected_counts
             mock_repo.delete_runs_with_related.side_effect = Exception("Database error")
 
-            result = deleter._delete_run(run)
+            with self._patch_storage(run):
+                result = deleter._delete_run(run, archive_log)
 
         assert result.success is False
         assert result.error == "Database error"
@@ -197,7 +302,8 @@ class TestArchivedWorkflowRunDeletion:
         run_id = run.id
 
         deleter = ArchivedWorkflowRunDeletion()
-        result = deleter.delete_by_run_id(run_id)
+        with self._patch_storage(run):
+            result = deleter.delete_by_run_id(run_id)
 
         assert result.success is True
         db_session_with_containers.expunge_all()
@@ -212,3 +318,48 @@ class TestArchivedWorkflowRunDeletion:
 
         assert repo1 is repo2
         assert deleter.workflow_run_repo is repo1
+
+    def test_delete_run_fails_when_archive_object_missing(self, db_session_with_containers: Session):
+        tenant_id = str(uuid4())
+        run = self._create_workflow_run(
+            db_session_with_containers,
+            tenant_id=tenant_id,
+            created_at=datetime.now(UTC),
+        )
+        archive_log = self._create_archive_log(db_session_with_containers, run=run)
+        deleter = ArchivedWorkflowRunDeletion()
+        storage = FakeArchiveStorage({})
+
+        with patch(
+            "services.retention.workflow_run.delete_archived_workflow_run.get_archive_storage",
+            return_value=storage,
+        ):
+            result = deleter._delete_run(run, archive_log)
+
+        assert result.success is False
+        assert result.error == f"Archive bundle not found: {self._archive_key(run)}"
+        db_session_with_containers.expire_all()
+        assert db_session_with_containers.get(WorkflowRun, run.id) is not None
+
+    def test_delete_run_fails_when_manifest_count_differs_from_live_rows(self, db_session_with_containers: Session):
+        tenant_id = str(uuid4())
+        run = self._create_workflow_run(
+            db_session_with_containers,
+            tenant_id=tenant_id,
+            created_at=datetime.now(UTC),
+        )
+        archive_log = self._create_archive_log(db_session_with_containers, run=run)
+        bundle = self._archive_bundle(run, workflow_run_rows=0)
+        storage = FakeArchiveStorage({self._archive_key(run): bundle})
+        deleter = ArchivedWorkflowRunDeletion()
+
+        with patch(
+            "services.retention.workflow_run.delete_archived_workflow_run.get_archive_storage",
+            return_value=storage,
+        ):
+            result = deleter._delete_run(run, archive_log)
+
+        assert result.success is False
+        assert "Archive row count mismatch before delete" in str(result.error)
+        db_session_with_containers.expire_all()
+        assert db_session_with_containers.get(WorkflowRun, run.id) is not None
diff --git a/api/tests/test_containers_integration_tests/services/test_feedback_service.py b/api/tests/test_containers_integration_tests/services/test_feedback_service.py
index a4663450d49..e4fd81b53e7 100644
--- a/api/tests/test_containers_integration_tests/services/test_feedback_service.py
+++ b/api/tests/test_containers_integration_tests/services/test_feedback_service.py
@@ -7,7 +7,6 @@ from unittest import mock
 
 import pytest
 
-from extensions.ext_database import db
 from models.enums import FeedbackFromSource, FeedbackRating
 from models.model import App, Conversation, Message
 from services.feedback_service import FeedbackService
@@ -23,11 +22,9 @@ class TestFeedbackService:
     """Test FeedbackService methods."""
 
     @pytest.fixture
-    def mock_db_session(self, monkeypatch: pytest.MonkeyPatch):
-        """Mock database session."""
-        mock_session = mock.Mock()
-        monkeypatch.setattr(db, "session", mock_session)
-        return mock_session
+    def mock_db_session(self):
+        """Mock database session passed explicitly to the service."""
+        return mock.Mock()
 
     @pytest.fixture
     def sample_data(self):
@@ -100,7 +97,7 @@ class TestFeedbackService:
         )
 
         # Test CSV export
-        result = FeedbackService.export_feedbacks(app_id=sample_data["app"].id, format_type="csv")
+        result = FeedbackService.export_feedbacks(mock_db_session, app_id=sample_data["app"].id, format_type="csv")
 
         # Verify response structure
         assert hasattr(result, "headers")
@@ -131,7 +128,7 @@ class TestFeedbackService:
         )
 
         # Test JSON export
-        result = FeedbackService.export_feedbacks(app_id=sample_data["app"].id, format_type="json")
+        result = FeedbackService.export_feedbacks(mock_db_session, app_id=sample_data["app"].id, format_type="json")
 
         # Verify response structure
         assert hasattr(result, "headers")
@@ -161,6 +158,7 @@ class TestFeedbackService:
 
         # Test with filters
         result = FeedbackService.export_feedbacks(
+            mock_db_session,
             app_id=sample_data["app"].id,
             from_source=FeedbackFromSource.ADMIN,
             rating=FeedbackRating.DISLIKE,
@@ -177,7 +175,7 @@ class TestFeedbackService:
         """Test exporting feedback when no data exists."""
         mock_db_session.execute.return_value = _execute_result([])
 
-        result = FeedbackService.export_feedbacks(app_id=sample_data["app"].id, format_type="csv")
+        result = FeedbackService.export_feedbacks(mock_db_session, app_id=sample_data["app"].id, format_type="csv")
 
         # Should return an empty CSV with headers only
         assert hasattr(result, "headers")
@@ -195,17 +193,22 @@ class TestFeedbackService:
 
         # Test with invalid start_date
         with pytest.raises(ValueError, match="Invalid start_date format"):
-            FeedbackService.export_feedbacks(app_id=sample_data["app"].id, start_date="invalid-date-format")
+            FeedbackService.export_feedbacks(
+                mock_db_session, app_id=sample_data["app"].id, start_date="invalid-date-format"
+            )
 
         # Test with invalid end_date
         with pytest.raises(ValueError, match="Invalid end_date format"):
-            FeedbackService.export_feedbacks(app_id=sample_data["app"].id, end_date="invalid-date-format")
+            FeedbackService.export_feedbacks(
+                mock_db_session, app_id=sample_data["app"].id, end_date="invalid-date-format"
+            )
 
     def test_export_feedbacks_invalid_format(self, mock_db_session, sample_data):
         """Test exporting feedback with unsupported format."""
 
         with pytest.raises(ValueError, match="Unsupported format"):
             FeedbackService.export_feedbacks(
+                mock_db_session,
                 app_id=sample_data["app"].id,
                 format_type="xml",  # Unsupported format
             )
@@ -236,7 +239,7 @@ class TestFeedbackService:
         )
 
         # Test export
-        result = FeedbackService.export_feedbacks(app_id=sample_data["app"].id, format_type="json")
+        result = FeedbackService.export_feedbacks(mock_db_session, app_id=sample_data["app"].id, format_type="json")
 
         # Check JSON content
         json_content = json.loads(result.get_data(as_text=True))
@@ -287,7 +290,7 @@ class TestFeedbackService:
         )
 
         # Test export
-        result = FeedbackService.export_feedbacks(app_id=sample_data["app"].id, format_type="csv")
+        result = FeedbackService.export_feedbacks(mock_db_session, app_id=sample_data["app"].id, format_type="csv")
 
         # Check that unicode content is preserved
         csv_content = result.get_data(as_text=True)
@@ -317,7 +320,7 @@ class TestFeedbackService:
         )
 
         # Test export
-        result = FeedbackService.export_feedbacks(app_id=sample_data["app"].id, format_type="json")
+        result = FeedbackService.export_feedbacks(mock_db_session, app_id=sample_data["app"].id, format_type="json")
 
         # Check JSON content for emoji ratings
         json_content = json.loads(result.get_data(as_text=True))
diff --git a/api/tests/test_containers_integration_tests/services/test_file_service_zip_and_lookup.py b/api/tests/test_containers_integration_tests/services/test_file_service_zip_and_lookup.py
index 1101d834a0d..5eb84f805aa 100644
--- a/api/tests/test_containers_integration_tests/services/test_file_service_zip_and_lookup.py
+++ b/api/tests/test_containers_integration_tests/services/test_file_service_zip_and_lookup.py
@@ -69,7 +69,7 @@ def test_build_upload_files_zip_tempfile_sanitizes_and_dedupes_names(monkeypatch
 
 def test_get_upload_files_by_ids_returns_empty_when_no_ids(db_session_with_containers: Session) -> None:
     """Ensure empty input returns an empty mapping without hitting the database."""
-    assert FileService.get_upload_files_by_ids(str(uuid4()), []) == {}
+    assert FileService.get_upload_files_by_ids(db_session_with_containers, str(uuid4()), []) == {}
 
 
 def test_get_upload_files_by_ids_returns_id_keyed_mapping(db_session_with_containers: Session) -> None:
@@ -78,7 +78,7 @@ def test_get_upload_files_by_ids_returns_id_keyed_mapping(db_session_with_contai
     file1 = _create_upload_file(db_session_with_containers, tenant_id=tenant_id, key="k1", name="file1.txt")
     file2 = _create_upload_file(db_session_with_containers, tenant_id=tenant_id, key="k2", name="file2.txt")
 
-    result = FileService.get_upload_files_by_ids(tenant_id, [file1.id, file1.id, file2.id])
+    result = FileService.get_upload_files_by_ids(db_session_with_containers, tenant_id, [file1.id, file1.id, file2.id])
 
     assert set(result.keys()) == {file1.id, file2.id}
     assert result[file1.id].id == file1.id
@@ -92,6 +92,6 @@ def test_get_upload_files_by_ids_filters_by_tenant(db_session_with_containers: S
     file_a = _create_upload_file(db_session_with_containers, tenant_id=tenant_a, key="ka", name="a.txt")
     _create_upload_file(db_session_with_containers, tenant_id=tenant_b, key="kb", name="b.txt")
 
-    result = FileService.get_upload_files_by_ids(tenant_a, [file_a.id])
+    result = FileService.get_upload_files_by_ids(db_session_with_containers, tenant_a, [file_a.id])
 
     assert set(result.keys()) == {file_a.id}
diff --git a/api/tests/test_containers_integration_tests/services/test_hit_testing_service.py b/api/tests/test_containers_integration_tests/services/test_hit_testing_service.py
index f332ba05ec2..fbf993f7d69 100644
--- a/api/tests/test_containers_integration_tests/services/test_hit_testing_service.py
+++ b/api/tests/test_containers_integration_tests/services/test_hit_testing_service.py
@@ -1,26 +1,79 @@
 from __future__ import annotations
 
 import json
-from typing import Any, cast
-from unittest.mock import ANY, MagicMock, patch
+from datetime import datetime
+from unittest.mock import MagicMock, patch
 from uuid import uuid4
 
 import pytest
+from pydantic import BaseModel, ConfigDict, TypeAdapter
 from sqlalchemy import func, select
 from sqlalchemy.orm import Session
 
+from core.rag.embedding.retrieval import RetrievalSegments
 from core.rag.models.document import Document
-from models.dataset import Dataset, DatasetQuery
+from core.rag.retrieval.retrieval_methods import RetrievalMethod
+from models.dataset import Dataset, DatasetQuery, DocumentSegment
+from models.dataset import Document as DatasetDocument
+from models.enums import DataSourceType, DocumentCreatedFrom, SegmentStatus
 from services.hit_testing_service import HitTestingService
 
 
-def _create_dataset(db_session: Session, *, provider: str = "vendor", **kwargs: Any) -> Dataset:
-    tenant_id = str(uuid4())
-    created_by = str(uuid4())
+class _QueryResponse(BaseModel):
+    content: str
+
+
+class _RetrieveRecordResponse(BaseModel):
+    content: str | None = None
+    title: str | None = None
+
+    model_config = ConfigDict(extra="allow")
+
+
+class _RetrieveResponse(BaseModel):
+    query: _QueryResponse
+    records: list[_RetrieveRecordResponse]
+
+
+class _DumpedDocumentResponse(BaseModel):
+    id: str
+    data_source_type: str
+    name: str
+    doc_type: str | None
+    doc_metadata: dict[str, object] | None
+
+
+class _DumpedSegmentResponse(BaseModel):
+    id: str
+    document_id: str
+    created_at: datetime | None = None
+    document: _DumpedDocumentResponse | None = None
+
+    model_config = ConfigDict(extra="allow")
+
+
+class _DumpedRetrievalRecordResponse(BaseModel):
+    segment: _DumpedSegmentResponse
+    score: float
+
+    model_config = ConfigDict(extra="allow")
+
+
+_DUMPED_RETRIEVAL_RECORDS = TypeAdapter(list[_DumpedRetrievalRecordResponse])
+
+
+def _create_dataset(
+    db_session: Session,
+    *,
+    provider: str = "vendor",
+    tenant_id: str | None = None,
+    created_by: str | None = None,
+    name: str = "test-dataset",
+) -> Dataset:
     ds = Dataset(
-        tenant_id=kwargs.get("tenant_id", tenant_id),
-        name=kwargs.get("name", "test-dataset"),
-        created_by=kwargs.get("created_by", created_by),
+        tenant_id=tenant_id or str(uuid4()),
+        name=name,
+        created_by=created_by or str(uuid4()),
         provider=provider,
     )
     db_session.add(ds)
@@ -29,36 +82,108 @@ def _create_dataset(db_session: Session, *, provider: str = "vendor", **kwargs:
     return ds
 
 
+def _create_dataset_document(
+    db_session: Session,
+    *,
+    name: str = "guide.md",
+    data_source_type: str = DataSourceType.UPLOAD_FILE,
+    doc_type: str | None = None,
+    doc_metadata: dict[str, object] | None = None,
+) -> DatasetDocument:
+    tenant_id = str(uuid4())
+    created_by = str(uuid4())
+    dataset = Dataset(
+        tenant_id=tenant_id,
+        name=f"dataset-{uuid4()}",
+        data_source_type=DataSourceType.UPLOAD_FILE,
+        created_by=created_by,
+    )
+    db_session.add(dataset)
+    db_session.flush()
+
+    document = DatasetDocument(
+        tenant_id=tenant_id,
+        dataset_id=dataset.id,
+        position=1,
+        data_source_type=data_source_type,
+        batch=f"batch-{uuid4()}",
+        name=name,
+        created_from=DocumentCreatedFrom.WEB,
+        created_by=created_by,
+        doc_type=doc_type,
+        doc_metadata=doc_metadata,
+    )
+    db_session.add(document)
+    db_session.commit()
+    db_session.refresh(document)
+    return document
+
+
+def _build_segment(
+    *,
+    document_id: str,
+    tenant_id: str | None = None,
+    dataset_id: str | None = None,
+    created_by: str | None = None,
+) -> DocumentSegment:
+    return DocumentSegment(
+        tenant_id=tenant_id or str(uuid4()),
+        dataset_id=dataset_id or str(uuid4()),
+        document_id=document_id,
+        created_by=created_by or str(uuid4()),
+        position=1,
+        content="segment content",
+        word_count=2,
+        tokens=2,
+        status=SegmentStatus.COMPLETED,
+    )
+
+
+def _create_segment(db_session: Session, *, document: DatasetDocument | None = None) -> DocumentSegment:
+    segment = _build_segment(
+        tenant_id=document.tenant_id if document else None,
+        dataset_id=document.dataset_id if document else None,
+        document_id=document.id if document else str(uuid4()),
+        created_by=document.created_by if document else None,
+    )
+    db_session.add(segment)
+    db_session.commit()
+    db_session.refresh(segment)
+    return segment
+
+
 class TestHitTestingService:
     # ── Utility methods (pure logic, no DB) ────────────────────────────
 
-    def test_escape_query_for_search_should_escape_double_quotes(self):
+    def test_escape_query_for_search_should_escape_double_quotes(self) -> None:
         query = 'test "query" with quotes'
         result = HitTestingService.escape_query_for_search(query)
         assert result == 'test \\"query\\" with quotes'
 
-    def test_hit_testing_args_check_should_pass_with_valid_query(self):
+    def test_hit_testing_args_check_should_pass_with_valid_query(self) -> None:
         HitTestingService.hit_testing_args_check({"query": "valid query"})
 
-    def test_hit_testing_args_check_should_pass_with_valid_attachments(self):
+    def test_hit_testing_args_check_should_pass_with_valid_attachments(self) -> None:
         HitTestingService.hit_testing_args_check({"attachment_ids": ["id1", "id2"]})
 
-    def test_hit_testing_args_check_should_raise_error_when_no_query_or_attachments(self):
+    def test_hit_testing_args_check_should_raise_error_when_no_query_or_attachments(self) -> None:
         with pytest.raises(ValueError, match="Query or attachment_ids is required"):
             HitTestingService.hit_testing_args_check({})
 
-    def test_hit_testing_args_check_should_raise_error_when_query_too_long(self):
+    def test_hit_testing_args_check_should_raise_error_when_query_too_long(self) -> None:
         with pytest.raises(ValueError, match="Query cannot exceed 250 characters"):
             HitTestingService.hit_testing_args_check({"query": "a" * 251})
 
-    def test_hit_testing_args_check_should_raise_error_when_attachments_not_list(self):
+    def test_hit_testing_args_check_should_raise_error_when_attachments_not_list(self) -> None:
         with pytest.raises(ValueError, match="Attachment_ids must be a list"):
             HitTestingService.hit_testing_args_check({"attachment_ids": "not a list"})
 
     # ── Response formatting ────────────────────────────────────────────
 
     @patch("core.rag.datasource.retrieval_service.RetrievalService.format_retrieval_documents")
-    def test_compact_retrieve_response_should_format_correctly(self, mock_format):
+    def test_compact_retrieve_response_should_format_correctly(
+        self, mock_format: MagicMock, db_session_with_containers: Session
+    ) -> None:
         query = "test query"
         mock_doc = MagicMock(spec=Document)
 
@@ -66,50 +191,51 @@ class TestHitTestingService:
         mock_record.model_dump.return_value = {"content": "formatted content"}
         mock_format.return_value = [mock_record]
 
-        result = cast(dict[str, Any], HitTestingService.compact_retrieve_response(query, [mock_doc]))
+        response = _RetrieveResponse.model_validate(
+            HitTestingService.compact_retrieve_response(db_session_with_containers, query, [mock_doc])
+        )
 
-        assert cast(dict[str, Any], result["query"])["content"] == query
-        assert len(result["records"]) == 1
-        assert cast(dict[str, Any], result["records"][0])["content"] == "formatted content"
+        assert response.query.content == query
+        assert len(response.records) == 1
+        assert response.records[0].content == "formatted content"
         mock_format.assert_called_once_with([mock_doc])
 
     def test_compact_external_retrieve_response_should_return_records_for_external_provider(
         self, db_session_with_containers: Session
-    ):
+    ) -> None:
         dataset = _create_dataset(db_session_with_containers, provider="external")
         documents = [
             {"content": "c1", "title": "t1", "score": 0.9, "metadata": {"m1": "v1"}},
             {"content": "c2", "title": "t2", "score": 0.8, "metadata": {"m2": "v2"}},
         ]
 
-        result = cast(
-            dict[str, Any], HitTestingService.compact_external_retrieve_response(dataset, "test query", documents)
+        response = _RetrieveResponse.model_validate(
+            HitTestingService.compact_external_retrieve_response(dataset, "test query", documents)
         )
 
-        assert cast(dict[str, Any], result["query"])["content"] == "test query"
-        assert len(result["records"]) == 2
-        assert cast(dict[str, Any], result["records"][0])["content"] == "c1"
-        assert cast(dict[str, Any], result["records"][1])["title"] == "t2"
+        assert response.query.content == "test query"
+        assert len(response.records) == 2
+        assert response.records[0].content == "c1"
+        assert response.records[1].title == "t2"
 
     def test_compact_external_retrieve_response_should_return_empty_for_non_external_provider(
         self, db_session_with_containers: Session
-    ):
+    ) -> None:
         dataset = _create_dataset(db_session_with_containers, provider="vendor")
 
-        result = cast(
-            dict[str, Any],
-            HitTestingService.compact_external_retrieve_response(dataset, "test query", [{"content": "c1"}]),
+        response = _RetrieveResponse.model_validate(
+            HitTestingService.compact_external_retrieve_response(dataset, "test query", [{"content": "c1"}])
         )
 
-        assert cast(dict[str, Any], result["query"])["content"] == "test query"
-        assert result["records"] == []
+        assert response.query.content == "test query"
+        assert response.records == []
 
     # ── External retrieve (real DB) ────────────────────────────────────
 
     @patch("core.rag.datasource.retrieval_service.RetrievalService.external_retrieve")
     def test_external_retrieve_should_succeed_for_external_provider(
-        self, mock_ext_retrieve, db_session_with_containers: Session
-    ):
+        self, mock_ext_retrieve: MagicMock, db_session_with_containers: Session
+    ) -> None:
         dataset = _create_dataset(db_session_with_containers, provider="external")
         account_id = str(uuid4())
         account = MagicMock()
@@ -118,19 +244,19 @@ class TestHitTestingService:
 
         before_count = db_session_with_containers.scalar(select(func.count()).select_from(DatasetQuery)) or 0
 
-        result = cast(
-            dict[str, Any],
+        response = _RetrieveResponse.model_validate(
             HitTestingService.external_retrieve(
+                db_session_with_containers,
                 dataset=dataset,
                 query='test "query"',
                 account=account,
                 external_retrieval_model={"model": "test"},
                 metadata_filtering_conditions={"key": "val"},
-            ),
+            )
         )
 
-        assert cast(dict[str, Any], result["query"])["content"] == 'test "query"'
-        assert cast(dict[str, Any], result["records"][0])["content"] == "ext content"
+        assert response.query.content == 'test "query"'
+        assert response.records[0].content == "ext content"
         mock_ext_retrieve.assert_called_once_with(
             dataset_id=dataset.id,
             query='test \\"query\\"',
@@ -142,37 +268,47 @@ class TestHitTestingService:
         after_count = db_session_with_containers.scalar(select(func.count()).select_from(DatasetQuery)) or 0
         assert after_count == before_count + 1
 
-    def test_external_retrieve_should_return_empty_for_non_external_provider(self, db_session_with_containers: Session):
+    def test_external_retrieve_should_return_empty_for_non_external_provider(
+        self, db_session_with_containers: Session
+    ) -> None:
         dataset = _create_dataset(db_session_with_containers, provider="vendor")
         account = MagicMock()
 
-        result = cast(dict[str, Any], HitTestingService.external_retrieve(dataset, "test query", account))
+        response = _RetrieveResponse.model_validate(
+            HitTestingService.external_retrieve(db_session_with_containers, dataset, "test query", account)
+        )
 
-        assert cast(dict[str, Any], result["query"])["content"] == "test query"
-        assert result["records"] == []
+        assert response.query.content == "test query"
+        assert response.records == []
 
     # ── Retrieve (real DB) ─────────────────────────────────────────────
 
     @patch("core.rag.datasource.retrieval_service.RetrievalService.retrieve")
     def test_retrieve_should_use_default_model_when_none_provided(
-        self, mock_retrieve, db_session_with_containers: Session
-    ):
+        self, mock_retrieve: MagicMock, db_session_with_containers: Session
+    ) -> None:
         dataset = _create_dataset(db_session_with_containers)
         dataset.retrieval_model = None
         account = MagicMock()
         account.id = str(uuid4())
-        mock_retrieve.return_value = []
+        retrieved_documents: list[Document] = []
+        mock_retrieve.return_value = retrieved_documents
+        external_retrieval_model: dict[str, object] = {}
 
         before_count = db_session_with_containers.scalar(select(func.count()).select_from(DatasetQuery)) or 0
 
-        result = cast(
-            dict[str, Any],
+        response = _RetrieveResponse.model_validate(
             HitTestingService.retrieve(
-                dataset=dataset, query="test query", account=account, retrieval_model=None, external_retrieval_model={}
-            ),
+                db_session_with_containers,
+                dataset=dataset,
+                query="test query",
+                account=account,
+                retrieval_model=None,
+                external_retrieval_model=external_retrieval_model,
+            )
         )
 
-        assert cast(dict[str, Any], result["query"])["content"] == "test query"
+        assert response.query.content == "test query"
         mock_retrieve.assert_called_once()
         assert mock_retrieve.call_args.kwargs["top_k"] == 4
 
@@ -183,28 +319,35 @@ class TestHitTestingService:
     @patch("core.rag.datasource.retrieval_service.RetrievalService.retrieve")
     @patch("core.rag.retrieval.dataset_retrieval.DatasetRetrieval.get_metadata_filter_condition")
     def test_retrieve_should_handle_metadata_filtering(
-        self, mock_get_meta, mock_retrieve, db_session_with_containers: Session
-    ):
+        self, mock_get_meta: MagicMock, mock_retrieve: MagicMock, db_session_with_containers: Session
+    ) -> None:
         dataset = _create_dataset(db_session_with_containers)
         account = MagicMock()
         account.id = str(uuid4())
+        external_retrieval_model: dict[str, object] = {}
 
         retrieval_model = {
             "search_method": "semantic_search",
-            "metadata_filtering_conditions": {"some": "condition"},
+            "metadata_filtering_conditions": {
+                "conditions": [
+                    {"name": "category", "comparison_operator": "is", "value": "test"},
+                ],
+            },
             "top_k": 5,
             "reranking_enable": False,
             "score_threshold_enabled": False,
         }
         mock_get_meta.return_value = ({dataset.id: ["doc_id1"]}, "condition_string")
-        mock_retrieve.return_value = []
+        retrieved_documents: list[Document] = []
+        mock_retrieve.return_value = retrieved_documents
 
         HitTestingService.retrieve(
+            db_session_with_containers,
             dataset=dataset,
             query="test query",
             account=account,
             retrieval_model=retrieval_model,
-            external_retrieval_model={},
+            external_retrieval_model=external_retrieval_model,
         )
 
         mock_get_meta.assert_called_once()
@@ -214,40 +357,49 @@ class TestHitTestingService:
     @patch("core.rag.datasource.retrieval_service.RetrievalService.retrieve")
     @patch("core.rag.retrieval.dataset_retrieval.DatasetRetrieval.get_metadata_filter_condition")
     def test_retrieve_should_return_empty_if_metadata_filtering_fails(
-        self, mock_get_meta, mock_retrieve, db_session_with_containers: Session
-    ):
+        self, mock_get_meta: MagicMock, mock_retrieve: MagicMock, db_session_with_containers: Session
+    ) -> None:
         dataset = _create_dataset(db_session_with_containers)
         account = MagicMock()
+        external_retrieval_model: dict[str, object] = {}
 
         retrieval_model = {
             "search_method": "semantic_search",
-            "metadata_filtering_conditions": {"some": "condition"},
+            "metadata_filtering_conditions": {
+                "conditions": [
+                    {"name": "category", "comparison_operator": "is", "value": "test"},
+                ],
+            },
             "top_k": 5,
             "reranking_enable": False,
             "score_threshold_enabled": False,
         }
-        mock_get_meta.return_value = ({}, "condition_string")
+        empty_document_ids: dict[str, list[str]] = {}
+        mock_get_meta.return_value = (empty_document_ids, "condition_string")
 
-        result = cast(
-            dict[str, Any],
+        response = _RetrieveResponse.model_validate(
             HitTestingService.retrieve(
+                db_session_with_containers,
                 dataset=dataset,
                 query="test query",
                 account=account,
                 retrieval_model=retrieval_model,
-                external_retrieval_model={},
-            ),
+                external_retrieval_model=external_retrieval_model,
+            )
         )
 
-        assert result["records"] == []
+        assert response.records == []
         mock_retrieve.assert_not_called()
 
     @patch("core.rag.datasource.retrieval_service.RetrievalService.retrieve")
-    def test_retrieve_should_handle_attachments(self, mock_retrieve, db_session_with_containers: Session):
+    def test_retrieve_should_handle_attachments(
+        self, mock_retrieve: MagicMock, db_session_with_containers: Session
+    ) -> None:
         dataset = _create_dataset(db_session_with_containers)
         account = MagicMock()
         account.id = str(uuid4())
         attachment_ids = ["att1", "att2"]
+        external_retrieval_model: dict[str, object] = {}
 
         retrieval_model = {
             "search_method": "semantic_search",
@@ -255,19 +407,21 @@ class TestHitTestingService:
             "reranking_enable": False,
             "score_threshold_enabled": False,
         }
-        mock_retrieve.return_value = []
+        retrieved_documents: list[Document] = []
+        mock_retrieve.return_value = retrieved_documents
 
         HitTestingService.retrieve(
+            db_session_with_containers,
             dataset=dataset,
             query="test query",
             account=account,
             retrieval_model=retrieval_model,
-            external_retrieval_model={},
+            external_retrieval_model=external_retrieval_model,
             attachment_ids=attachment_ids,
         )
 
         mock_retrieve.assert_called_once_with(
-            retrieval_method=ANY,
+            retrieval_method=RetrievalMethod.SEMANTIC_SEARCH,
             dataset_id=dataset.id,
             query="test query",
             attachment_ids=attachment_ids,
@@ -295,10 +449,13 @@ class TestHitTestingService:
         assert query_content[1]["content"] == "att1"
 
     @patch("core.rag.datasource.retrieval_service.RetrievalService.retrieve")
-    def test_retrieve_should_handle_reranking_and_threshold(self, mock_retrieve, db_session_with_containers: Session):
+    def test_retrieve_should_handle_reranking_and_threshold(
+        self, mock_retrieve: MagicMock, db_session_with_containers: Session
+    ) -> None:
         dataset = _create_dataset(db_session_with_containers)
         account = MagicMock()
         account.id = str(uuid4())
+        external_retrieval_model: dict[str, object] = {}
 
         retrieval_model = {
             "search_method": "hybrid_search",
@@ -310,14 +467,16 @@ class TestHitTestingService:
             "score_threshold": 0.5,
             "weights": {"vector": 0.5, "keyword": 0.5},
         }
-        mock_retrieve.return_value = []
+        retrieved_documents: list[Document] = []
+        mock_retrieve.return_value = retrieved_documents
 
         HitTestingService.retrieve(
+            db_session_with_containers,
             dataset=dataset,
             query="test query",
             account=account,
             retrieval_model=retrieval_model,
-            external_retrieval_model={},
+            external_retrieval_model=external_retrieval_model,
         )
 
         mock_retrieve.assert_called_once()
@@ -326,3 +485,63 @@ class TestHitTestingService:
         assert kwargs["reranking_model"] == {"provider": "test"}
         assert kwargs["reranking_mode"] == "weighted_sum"
         assert kwargs["weights"] == {"vector": 0.5, "keyword": 0.5}
+
+    def test_dump_dataset_document_returns_frontend_required_fields(self, db_session_with_containers: Session) -> None:
+        document = _create_dataset_document(db_session_with_containers, doc_metadata={"source": "manual"})
+
+        assert HitTestingService._dump_dataset_document(document) == {
+            "id": document.id,
+            "data_source_type": "upload_file",
+            "name": "guide.md",
+            "doc_type": None,
+            "doc_metadata": {"source": "manual"},
+        }
+
+    def test_dump_retrieval_records_returns_dumped_records_without_document_ids(
+        self, db_session_with_containers: Session
+    ) -> None:
+        segment = _build_segment(document_id="")
+        record = RetrievalSegments.model_validate({"segment": segment, "score": 0.95})
+
+        records = _DUMPED_RETRIEVAL_RECORDS.validate_python(
+            HitTestingService._dump_retrieval_records(db_session_with_containers, [record])
+        )
+
+        assert len(records) == 1
+        assert records[0].segment.id == segment.id
+        assert records[0].segment.document_id == ""
+        assert records[0].score == 0.95
+
+    def test_dump_retrieval_records_injects_documents(self, db_session_with_containers: Session) -> None:
+        document = _create_dataset_document(db_session_with_containers)
+        segment = _create_segment(db_session_with_containers, document=document)
+        record = RetrievalSegments.model_validate({"segment": segment, "score": 0.9})
+
+        records = _DUMPED_RETRIEVAL_RECORDS.validate_python(
+            HitTestingService._dump_retrieval_records(db_session_with_containers, [record])
+        )
+
+        assert len(records) == 1
+        dumped_segment = records[0].segment
+        assert dumped_segment.id == segment.id
+        assert dumped_segment.document_id == document.id
+        assert dumped_segment.created_at == segment.created_at
+        assert dumped_segment.document == _DumpedDocumentResponse(
+            id=document.id,
+            data_source_type="upload_file",
+            name="guide.md",
+            doc_type=None,
+            doc_metadata=None,
+        )
+        assert records[0].score == 0.9
+
+    def test_dump_retrieval_records_skips_records_with_missing_documents(
+        self, db_session_with_containers: Session, caplog: pytest.LogCaptureFixture
+    ) -> None:
+        segment = _create_segment(db_session_with_containers)
+        record = RetrievalSegments.model_validate({"segment": segment, "score": 0.95})
+
+        result = HitTestingService._dump_retrieval_records(db_session_with_containers, [record])
+
+        assert result == []
+        assert "Skipping hit-testing records with missing documents" in caplog.text
diff --git a/api/tests/test_containers_integration_tests/services/test_saved_message_service.py b/api/tests/test_containers_integration_tests/services/test_saved_message_service.py
index ac434021fc8..ad85ac67bc5 100644
--- a/api/tests/test_containers_integration_tests/services/test_saved_message_service.py
+++ b/api/tests/test_containers_integration_tests/services/test_saved_message_service.py
@@ -220,7 +220,9 @@ class TestSavedMessageService:
         mock_external_service_dependencies["message_service"].pagination_by_last_id.return_value = mock_pagination
 
         # Act: Execute the method under test
-        result = SavedMessageService.pagination_by_last_id(app_model=app, user=account, last_id=None, limit=10)
+        result = SavedMessageService.pagination_by_last_id(
+            db_session_with_containers, app_model=app, user=account, last_id=None, limit=10
+        )
 
         # Assert: Verify the expected outcomes
         assert result is not None
@@ -294,7 +296,7 @@ class TestSavedMessageService:
 
         # Act: Execute the method under test
         result = SavedMessageService.pagination_by_last_id(
-            app_model=app, user=end_user, last_id="test_last_id", limit=5
+            db_session_with_containers, app_model=app, user=end_user, last_id="test_last_id", limit=5
         )
 
         # Assert: Verify the expected outcomes
@@ -344,7 +346,7 @@ class TestSavedMessageService:
         mock_external_service_dependencies["message_service"].get_message.return_value = message
 
         # Act: Execute the method under test
-        SavedMessageService.save(app_model=app, user=account, message_id=message.id)
+        SavedMessageService.save(db_session_with_containers, app_model=app, user=account, message_id=message.id)
 
         # Assert: Verify the expected outcomes
         # Check if saved message was created in database
@@ -393,7 +395,9 @@ class TestSavedMessageService:
 
         # Act & Assert: Verify proper error handling
         with pytest.raises(ValueError) as exc_info:
-            SavedMessageService.pagination_by_last_id(app_model=app, user=None, last_id=None, limit=10)
+            SavedMessageService.pagination_by_last_id(
+                db_session_with_containers, app_model=app, user=None, last_id=None, limit=10
+            )
 
         assert "User is required" in str(exc_info.value)
 
@@ -412,7 +416,7 @@ class TestSavedMessageService:
         message = self._create_test_message(db_session_with_containers, app, account)
 
         # Act: Execute the method under test with None user
-        result = SavedMessageService.save(app_model=app, user=None, message_id=message.id)
+        result = SavedMessageService.save(db_session_with_containers, app_model=app, user=None, message_id=message.id)
 
         # Assert: Verify the expected outcomes
         assert result is None
@@ -471,7 +475,7 @@ class TestSavedMessageService:
         )
 
         # Act: Execute the method under test
-        SavedMessageService.delete(app_model=app, user=account, message_id=message.id)
+        SavedMessageService.delete(db_session_with_containers, app_model=app, user=account, message_id=message.id)
 
         # Assert: Verify the expected outcomes
         # Check if saved message was deleted from database
@@ -501,7 +505,7 @@ class TestSavedMessageService:
 
         mock_external_service_dependencies["message_service"].get_message.return_value = message
 
-        SavedMessageService.save(app_model=app, user=end_user, message_id=message.id)
+        SavedMessageService.save(db_session_with_containers, app_model=app, user=end_user, message_id=message.id)
 
         saved = (
             db_session_with_containers.query(SavedMessage)
@@ -522,9 +526,9 @@ class TestSavedMessageService:
         mock_external_service_dependencies["message_service"].get_message.return_value = message
 
         # Save once
-        SavedMessageService.save(app_model=app, user=account, message_id=message.id)
+        SavedMessageService.save(db_session_with_containers, app_model=app, user=account, message_id=message.id)
         # Save again
-        SavedMessageService.save(app_model=app, user=account, message_id=message.id)
+        SavedMessageService.save(db_session_with_containers, app_model=app, user=account, message_id=message.id)
 
         count = (
             db_session_with_containers.query(SavedMessage)
@@ -547,7 +551,7 @@ class TestSavedMessageService:
         db_session_with_containers.add(saved)
         db_session_with_containers.commit()
 
-        SavedMessageService.delete(app_model=app, user=None, message_id=message.id)
+        SavedMessageService.delete(db_session_with_containers, app_model=app, user=None, message_id=message.id)
 
         # Should still exist
         assert (
@@ -566,7 +570,7 @@ class TestSavedMessageService:
         # Should not raise — use a valid UUID that doesn't exist in DB
         from uuid import uuid4
 
-        SavedMessageService.delete(app_model=app, user=account, message_id=str(uuid4()))
+        SavedMessageService.delete(db_session_with_containers, app_model=app, user=account, message_id=str(uuid4()))
 
     def test_delete_for_end_user(self, db_session_with_containers: Session, mock_external_service_dependencies):
         """Test deleting a saved message for an EndUser."""
@@ -580,7 +584,7 @@ class TestSavedMessageService:
         db_session_with_containers.add(saved)
         db_session_with_containers.commit()
 
-        SavedMessageService.delete(app_model=app, user=end_user, message_id=message.id)
+        SavedMessageService.delete(db_session_with_containers, app_model=app, user=end_user, message_id=message.id)
 
         assert (
             db_session_with_containers.query(SavedMessage)
@@ -610,7 +614,7 @@ class TestSavedMessageService:
         db_session_with_containers.commit()
 
         # Delete only account1's saved message
-        SavedMessageService.delete(app_model=app, user=account1, message_id=message.id)
+        SavedMessageService.delete(db_session_with_containers, app_model=app, user=account1, message_id=message.id)
 
         # Account's saved message should be gone
         assert (
diff --git a/api/tests/unit_tests/clients/agent_backend/test_request_builder.py b/api/tests/unit_tests/clients/agent_backend/test_request_builder.py
index c0b308a5cb5..c91d0fd3e8a 100644
--- a/api/tests/unit_tests/clients/agent_backend/test_request_builder.py
+++ b/api/tests/unit_tests/clients/agent_backend/test_request_builder.py
@@ -14,6 +14,7 @@ from dify_agent.layers.dify_plugin import (
     DifyPluginToolConfig,
     DifyPluginToolsLayerConfig,
 )
+from dify_agent.layers.drive import DifyDriveLayerConfig
 from dify_agent.layers.execution_context import DIFY_EXECUTION_CONTEXT_LAYER_TYPE_ID, DifyExecutionContextLayerConfig
 from dify_agent.layers.knowledge import DIFY_KNOWLEDGE_BASE_LAYER_TYPE_ID, DifyKnowledgeBaseLayerConfig
 from dify_agent.layers.output import DIFY_OUTPUT_LAYER_TYPE_ID
@@ -42,7 +43,7 @@ from clients.agent_backend import (
     extract_runtime_layer_specs,
     redact_for_agent_backend_log,
 )
-from clients.agent_backend.request_builder import DIFY_SHELL_LAYER_ID
+from clients.agent_backend.request_builder import DIFY_DRIVE_LAYER_ID, DIFY_SHELL_LAYER_ID
 
 
 def _run_input() -> AgentBackendWorkflowNodeRunInput:
@@ -331,6 +332,22 @@ def test_workflow_request_builder_adds_shell_layer_when_include_shell():
     assert shell_config.env[0].name == "PROJECT_NAME"
 
 
+def test_workflow_request_builder_binds_shell_to_drive_when_configured():
+    run_input = _run_input()
+    run_input.include_shell = True
+    run_input.drive_config = DifyDriveLayerConfig(drive_ref="agent-agent-1")
+
+    request = AgentBackendRunRequestBuilder().build_for_workflow_node(run_input)
+    layers = {layer.name: layer for layer in request.composition.layers}
+    layer_names = [layer.name for layer in request.composition.layers]
+
+    assert layers[DIFY_SHELL_LAYER_ID].deps == {
+        "execution_context": DIFY_EXECUTION_CONTEXT_LAYER_ID,
+        "drive": DIFY_DRIVE_LAYER_ID,
+    }
+    assert layer_names.index(DIFY_DRIVE_LAYER_ID) < layer_names.index(DIFY_SHELL_LAYER_ID)
+
+
 def test_agent_app_request_builder_omits_shell_layer_by_default():
     request = AgentBackendRunRequestBuilder().build_for_agent_app(_agent_app_input())
     assert DIFY_SHELL_LAYER_ID not in {layer.name for layer in request.composition.layers}
@@ -350,6 +367,21 @@ def test_agent_app_request_builder_adds_shell_layer_when_include_shell():
     assert shell_config.env[0].name == "APP_ENV"
 
 
+def test_agent_app_request_builder_binds_shell_to_drive_when_configured():
+    run_input = _agent_app_input(include_shell=True)
+    run_input.drive_config = DifyDriveLayerConfig(drive_ref="agent-agent-1")
+
+    request = AgentBackendRunRequestBuilder().build_for_agent_app(run_input)
+    layers = {layer.name: layer for layer in request.composition.layers}
+    layer_names = [layer.name for layer in request.composition.layers]
+
+    assert layers[DIFY_SHELL_LAYER_ID].deps == {
+        "execution_context": DIFY_EXECUTION_CONTEXT_LAYER_ID,
+        "drive": DIFY_DRIVE_LAYER_ID,
+    }
+    assert layer_names.index(DIFY_DRIVE_LAYER_ID) < layer_names.index(DIFY_SHELL_LAYER_ID)
+
+
 def test_agent_app_request_builder_adds_knowledge_layer_when_configured():
     run_input = _agent_app_input()
     run_input.knowledge = DifyKnowledgeBaseLayerConfig.model_validate(
diff --git a/api/tests/unit_tests/controllers/common/test_app_access.py b/api/tests/unit_tests/controllers/common/test_app_access.py
new file mode 100644
index 00000000000..d070cc6e0fc
--- /dev/null
+++ b/api/tests/unit_tests/controllers/common/test_app_access.py
@@ -0,0 +1,161 @@
+"""Unit tests for controllers.common.app_access RBAC app-id access filtering."""
+
+from __future__ import annotations
+
+import pytest
+
+from controllers.common.app_access import (
+    APP_LIST_PERMISSION_KEYS,
+    AppAccessFilter,
+    has_app_list_permission,
+    resolve_app_access_filter,
+)
+from services.app_service import AppListParams
+from services.enterprise.rbac_service import (
+    MyPermissionsResponse,
+    ResourcePermissionKeys,
+    ResourcePermissionSnapshot,
+    ResourceWhitelistResources,
+    WorkspacePermissionSnapshot,
+)
+
+_RBAC_MODULE = "controllers.common.app_access.enterprise_rbac_service"
+
+
+def _permissions(
+    *,
+    workspace_keys: list[str] | None = None,
+    app_default_keys: list[str] | None = None,
+    app_overrides: list[ResourcePermissionKeys] | None = None,
+) -> MyPermissionsResponse:
+    return MyPermissionsResponse(
+        workspace=WorkspacePermissionSnapshot(permission_keys=workspace_keys or []),
+        app=ResourcePermissionSnapshot(
+            default_permission_keys=app_default_keys or [],
+            overrides=app_overrides or [],
+        ),
+    )
+
+
+class TestHasAppListPermission:
+    def test_matches_known_preview_keys(self):
+        for key in APP_LIST_PERMISSION_KEYS:
+            assert has_app_list_permission([key])
+
+    def test_rejects_unknown_keys(self):
+        assert not has_app_list_permission(["app.export", "app.delete"])
+        assert not has_app_list_permission([])
+
+
+class TestAppAccessFilterIsAppAccessible:
+    def test_unrestricted_sees_everything(self):
+        flt = AppAccessFilter.unrestricted()
+        assert flt.is_app_accessible("app-1", maintainer="someone", account_id="acc-1")
+
+    def test_whitelisted_app_is_visible(self):
+        flt = AppAccessFilter(accessible_app_ids={"app-1"}, can_manage_own_apps=False)
+        assert flt.is_app_accessible("app-1", maintainer=None, account_id="acc-1")
+        assert not flt.is_app_accessible("app-2", maintainer=None, account_id="acc-1")
+
+    def test_own_app_visible_only_with_manage_permission(self):
+        own = AppAccessFilter(accessible_app_ids=set(), can_manage_own_apps=True)
+        assert own.is_app_accessible("app-1", maintainer="acc-1", account_id="acc-1")
+        assert not own.is_app_accessible("app-1", maintainer="acc-2", account_id="acc-1")
+
+        no_manage = AppAccessFilter(accessible_app_ids=set(), can_manage_own_apps=False)
+        assert not no_manage.is_app_accessible("app-1", maintainer="acc-1", account_id="acc-1")
+
+
+class TestAppAccessFilterApplyToParams:
+    def test_unrestricted_leaves_params_untouched(self):
+        params = AppListParams()
+        AppAccessFilter.unrestricted().apply_to_params(params)
+        assert params.accessible_app_ids is None
+        assert params.include_own_apps is False
+        assert params.is_created_by_me is None
+
+    def test_whitelisted_ids_are_sorted_with_own_apps_flag(self):
+        params = AppListParams()
+        AppAccessFilter(accessible_app_ids={"b", "a"}, can_manage_own_apps=True).apply_to_params(params)
+        assert params.accessible_app_ids == ["a", "b"]
+        assert params.include_own_apps is True
+
+    def test_empty_set_with_manage_falls_back_to_maintained_apps(self):
+        # Own-app fallback must use maintainer (include_own_apps), consistent
+        # with is_app_accessible — not created_by (is_created_by_me).
+        params = AppListParams()
+        AppAccessFilter(accessible_app_ids=set(), can_manage_own_apps=True).apply_to_params(params)
+        assert params.accessible_app_ids == []
+        assert params.include_own_apps is True
+        assert params.is_created_by_me is None
+
+    def test_empty_set_without_manage_sees_nothing(self):
+        params = AppListParams()
+        AppAccessFilter(accessible_app_ids=set(), can_manage_own_apps=False).apply_to_params(params)
+        assert params.accessible_app_ids == []
+        assert params.include_own_apps is False
+        assert params.is_created_by_me is None
+
+
+class TestResolveAppAccessFilter:
+    def _patch_whitelist(self, monkeypatch: pytest.MonkeyPatch, whitelist: ResourceWhitelistResources) -> None:
+        monkeypatch.setattr(
+            f"{_RBAC_MODULE}.RBACService.AppAccess.whitelist_resources",
+            lambda tenant_id, account_id: whitelist,
+        )
+
+    def test_default_preview_is_unrestricted(self, monkeypatch: pytest.MonkeyPatch):
+        self._patch_whitelist(monkeypatch, ResourceWhitelistResources(unrestricted=True))
+        permissions = _permissions(app_default_keys=["app.preview"])
+
+        flt = resolve_app_access_filter("tenant-1", "acc-1", permissions=permissions)
+
+        assert flt.accessible_app_ids is None
+        assert flt.can_manage_own_apps is False
+
+    def test_default_preview_overrides_whitelist_restriction(self, monkeypatch: pytest.MonkeyPatch):
+        self._patch_whitelist(monkeypatch, ResourceWhitelistResources(unrestricted=False, resource_ids=["app-9"]))
+        permissions = _permissions(
+            workspace_keys=["app.full_access", "app.create_and_management"],
+        )
+
+        flt = resolve_app_access_filter("tenant-1", "acc-1", permissions=permissions)
+
+        # Workspace-level preview grant defeats the whitelist restriction.
+        assert flt.accessible_app_ids is None
+        assert flt.can_manage_own_apps is True
+
+    def test_override_apps_collected_without_default_preview(self, monkeypatch: pytest.MonkeyPatch):
+        self._patch_whitelist(monkeypatch, ResourceWhitelistResources(unrestricted=True))
+        permissions = _permissions(
+            app_overrides=[
+                ResourcePermissionKeys(resource_id="app-1", permission_keys=["app.preview"]),
+                ResourcePermissionKeys(resource_id="app-2", permission_keys=["app.export"]),
+            ],
+        )
+
+        flt = resolve_app_access_filter("tenant-1", "acc-1", permissions=permissions)
+
+        assert flt.accessible_app_ids == {"app-1"}
+
+    def test_whitelist_union_with_override_apps(self, monkeypatch: pytest.MonkeyPatch):
+        self._patch_whitelist(monkeypatch, ResourceWhitelistResources(unrestricted=False, resource_ids=["app-5"]))
+        permissions = _permissions(
+            app_overrides=[ResourcePermissionKeys(resource_id="app-1", permission_keys=["app.acl.preview"])],
+        )
+
+        flt = resolve_app_access_filter("tenant-1", "acc-1", permissions=permissions)
+
+        assert flt.accessible_app_ids == {"app-1", "app-5"}
+
+    def test_fetches_permissions_when_not_supplied(self, monkeypatch: pytest.MonkeyPatch):
+        self._patch_whitelist(monkeypatch, ResourceWhitelistResources(unrestricted=False, resource_ids=[]))
+        monkeypatch.setattr(
+            f"{_RBAC_MODULE}.RBACService.MyPermissions.get",
+            lambda tenant_id, account_id: _permissions(workspace_keys=["app.create_and_management"]),
+        )
+
+        flt = resolve_app_access_filter("tenant-1", "acc-1")
+
+        assert flt.accessible_app_ids == set()
+        assert flt.can_manage_own_apps is True
diff --git a/api/tests/unit_tests/controllers/console/agent/test_agent_controllers.py b/api/tests/unit_tests/controllers/console/agent/test_agent_controllers.py
index 8b77772a36d..27bb75e21f8 100644
--- a/api/tests/unit_tests/controllers/console/agent/test_agent_controllers.py
+++ b/api/tests/unit_tests/controllers/console/agent/test_agent_controllers.py
@@ -20,14 +20,20 @@ from controllers.console.agent.composer import (
     WorkflowAgentComposerValidateApi,
 )
 from controllers.console.agent.roster import (
+    AgentApiAccessApi,
+    AgentApiKeyApi,
+    AgentApiKeyListApi,
+    AgentApiStatusApi,
     AgentAppApi,
     AgentAppCopyApi,
     AgentAppListApi,
+    AgentDebugConversationRefreshApi,
     AgentInviteOptionsApi,
     AgentLogMessagesApi,
     AgentLogsApi,
     AgentLogSourcesApi,
     AgentRosterVersionDetailApi,
+    AgentRosterVersionRestoreApi,
     AgentRosterVersionsApi,
     AgentStatisticsSummaryApi,
 )
@@ -149,6 +155,11 @@ def test_agent_v2_console_routes_are_agent_id_first() -> None:
         "/agent/<uuid:agent_id>/sandbox/files",
         "/agent/<uuid:agent_id>/skills/upload",
         "/agent/<uuid:agent_id>/files",
+        "/agent/<uuid:agent_id>/api-access",
+        "/agent/<uuid:agent_id>/api-enable",
+        "/agent/<uuid:agent_id>/api-keys",
+        "/agent/<uuid:agent_id>/api-keys/<uuid:api_key_id>",
+        "/agent/<uuid:agent_id>/debug-conversation/refresh",
         "/agent/<uuid:agent_id>/chat-messages",
         "/agent/<uuid:agent_id>/chat-messages/<string:task_id>/stop",
         "/agent/<uuid:agent_id>/feedbacks",
@@ -158,6 +169,9 @@ def test_agent_v2_console_routes_are_agent_id_first() -> None:
         "/agent/<uuid:agent_id>/logs/<uuid:conversation_id>/messages",
         "/agent/<uuid:agent_id>/log-sources",
         "/agent/<uuid:agent_id>/statistics/summary",
+        "/agent/<uuid:agent_id>/versions",
+        "/agent/<uuid:agent_id>/versions/<uuid:version_id>",
+        "/agent/<uuid:agent_id>/versions/<uuid:version_id>/restore",
         "/agent/invite-options",
     ):
         assert route in paths
@@ -173,6 +187,7 @@ def test_agent_v2_console_routes_are_agent_id_first() -> None:
         "/apps/<uuid:app_id>/agent-features",
         "/apps/<uuid:app_id>/agent-referencing-workflows",
         "/apps/<uuid:app_id>/agent-sandbox/files",
+        "/apps/<uuid:agent_id>/api-access",
     ):
         assert route not in paths
 
@@ -215,16 +230,34 @@ def test_agent_app_list_and_create_use_agent_route(
         roster_controller.AgentRosterService,
         "load_app_backing_agents_by_app_id",
         lambda _self, **kwargs: {
-            "app-list": SimpleNamespace(id="agent-list", role="List role", active_config_snapshot_id=None)
+            "app-list": SimpleNamespace(
+                id="agent-list",
+                role="List role",
+                debug_conversation_id="debug-conversation-list",
+                active_config_snapshot_id=None,
+            )
         },
     )
     monkeypatch.setattr(
         roster_controller.AgentRosterService,
         "get_app_backing_agent",
         lambda _self, **kwargs: SimpleNamespace(
-            id="agent-created", role="Created role", active_config_snapshot_id=None
+            id="agent-created",
+            role="Created role",
+            debug_conversation_id="debug-conversation-created",
+            active_config_snapshot_id=None,
         ),
     )
+    monkeypatch.setattr(
+        roster_controller.AgentRosterService,
+        "get_or_create_agent_app_debug_conversation_id",
+        lambda _self, **kwargs: "debug-conversation-detail",
+    )
+    monkeypatch.setattr(
+        roster_controller.AgentRosterService,
+        "get_or_create_agent_app_debug_conversation_id",
+        lambda _self, **kwargs: "debug-conversation-detail",
+    )
     monkeypatch.setattr(
         roster_controller.AgentRosterService,
         "load_published_references_by_agent_id",
@@ -245,6 +278,16 @@ def test_agent_app_list_and_create_use_agent_route(
             ]
         },
     )
+    monkeypatch.setattr(
+        roster_controller.AgentRosterService,
+        "load_or_create_agent_app_debug_conversation_ids_by_agent_id",
+        lambda _self, **kwargs: {"agent-list": "debug-conversation-list"},
+    )
+    monkeypatch.setattr(
+        roster_controller.AgentRosterService,
+        "get_or_create_agent_app_debug_conversation_id",
+        lambda _self, **kwargs: "debug-conversation-created",
+    )
     monkeypatch.setattr(
         roster_controller.FeatureService,
         "get_system_features",
@@ -259,6 +302,7 @@ def test_agent_app_list_and_create_use_agent_route(
     assert listed["total"] == 1
     assert listed["data"][0]["id"] == "agent-list"
     assert listed["data"][0]["app_id"] == "app-list"
+    assert listed["data"][0]["debug_conversation_id"] == "debug-conversation-list"
     assert listed["data"][0]["role"] == "List role"
     assert listed["data"][0]["active_config_is_published"] is False
     assert listed["data"][0]["published_reference_count"] == 1
@@ -292,6 +336,7 @@ def test_agent_app_list_and_create_use_agent_route(
     assert status == 201
     assert created["id"] == "agent-created"
     assert created["app_id"] == "app-created"
+    assert created["debug_conversation_id"] == "debug-conversation-created"
     assert created["role"] == "Created role"
     assert created["active_config_is_published"] is False
     assert "bound_agent_id" not in created
@@ -332,7 +377,17 @@ def test_agent_app_detail_update_delete_resolve_app_from_agent_id(
     monkeypatch.setattr(
         roster_controller.AgentRosterService,
         "get_app_backing_agent",
-        lambda _self, **kwargs: SimpleNamespace(id=agent_id, role="Resolved role", active_config_snapshot_id=None),
+        lambda _self, **kwargs: SimpleNamespace(
+            id=agent_id,
+            role="Resolved role",
+            debug_conversation_id="debug-conversation-detail",
+            active_config_snapshot_id=None,
+        ),
+    )
+    monkeypatch.setattr(
+        roster_controller.AgentRosterService,
+        "get_or_create_agent_app_debug_conversation_id",
+        lambda _self, **kwargs: "debug-conversation-detail",
     )
     monkeypatch.setattr(
         roster_controller.FeatureService,
@@ -354,9 +409,10 @@ def test_agent_app_detail_update_delete_resolve_app_from_agent_id(
 
     monkeypatch.setattr(roster_controller, "AppService", FakeAppService)
 
-    detail = unwrap(AgentAppApi.get)(AgentAppApi(), "tenant-1", agent_id)
+    detail = unwrap(AgentAppApi.get)(AgentAppApi(), "tenant-1", SimpleNamespace(id=account_id), agent_id)
     assert detail["id"] == agent_id
     assert detail["app_id"] == "app-1"
+    assert detail["debug_conversation_id"] == "debug-conversation-detail"
     assert detail["role"] == "Resolved role"
     assert detail["active_config_is_published"] is False
     assert "bound_agent_id" not in detail
@@ -365,11 +421,12 @@ def test_agent_app_detail_update_delete_resolve_app_from_agent_id(
         "/console/api/agent/00000000-0000-0000-0000-000000000001",
         json={"name": "Renamed", "description": "", "role": "Reviewer", "icon_type": "emoji", "icon": "R"},
     ):
-        updated = unwrap(AgentAppApi.put)(AgentAppApi(), "tenant-1", agent_id)
+        updated = unwrap(AgentAppApi.put)(AgentAppApi(), "tenant-1", SimpleNamespace(id=account_id), agent_id)
 
     assert updated["name"] == "Renamed"
     assert updated["id"] == agent_id
     assert updated["app_id"] == "app-1"
+    assert updated["debug_conversation_id"] == "debug-conversation-detail"
     assert updated["role"] == "Resolved role"
     assert updated["active_config_is_published"] is False
     assert "bound_agent_id" not in updated
@@ -399,7 +456,7 @@ def test_agent_app_copy_uses_agent_id_and_returns_agent_detail(
     monkeypatch.setattr(
         roster_controller,
         "_serialize_agent_app_detail",
-        lambda app_model: {"id": "copied-agent", "app_id": app_model.id, "name": app_model.name},
+        lambda app_model, **_kwargs: {"id": "copied-agent", "app_id": app_model.id, "name": app_model.name},
     )
 
     with app.test_request_context(
@@ -407,6 +464,7 @@ def test_agent_app_copy_uses_agent_id_and_returns_agent_detail(
         json={
             "name": "Iris copy",
             "description": "Copied",
+            "role": "Copied role",
             "icon_type": "emoji",
             "icon": "sparkles",
             "icon_background": "#fff",
@@ -422,12 +480,166 @@ def test_agent_app_copy_uses_agent_id_and_returns_agent_detail(
         "account": current_user,
         "name": "Iris copy",
         "description": "Copied",
+        "role": "Copied role",
         "icon_type": "emoji",
         "icon": "sparkles",
         "icon_background": "#fff",
     }
 
 
+def test_agent_debug_conversation_refresh_uses_current_user(
+    app: Flask, monkeypatch: pytest.MonkeyPatch, account_id: str
+) -> None:
+    agent_id = "00000000-0000-0000-0000-000000000001"
+    captured: dict[str, object] = {}
+
+    class FakeRosterService:
+        def refresh_agent_app_debug_conversation_id(self, **kwargs: object) -> str:
+            captured.update(kwargs)
+            return "new-debug-conversation-id"
+
+    monkeypatch.setattr(roster_controller, "_agent_roster_service", lambda: FakeRosterService())
+
+    with app.test_request_context(
+        "/console/api/agent/00000000-0000-0000-0000-000000000001/debug-conversation/refresh",
+        method="POST",
+    ):
+        response = unwrap(AgentDebugConversationRefreshApi.post)(
+            AgentDebugConversationRefreshApi(),
+            "tenant-1",
+            SimpleNamespace(id=account_id),
+            agent_id,
+        )
+
+    assert response == {"debug_conversation_id": "new-debug-conversation-id"}
+    assert captured == {
+        "tenant_id": "tenant-1",
+        "agent_id": agent_id,
+        "account_id": account_id,
+    }
+
+
+def test_agent_api_access_uses_agent_id_and_returns_service_api_metadata(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    agent_id = "00000000-0000-0000-0000-000000000001"
+    app_model = SimpleNamespace(
+        id="app-1",
+        enable_api=True,
+        api_base_url="https://api.example.test/v1",
+        api_rpm=60,
+        api_rph=600,
+    )
+    monkeypatch.setattr(roster_controller, "_resolve_agent_app_model", lambda **kwargs: app_model)
+    monkeypatch.setattr(roster_controller, "_agent_api_key_count", lambda app_id: 2)
+
+    response = unwrap(AgentApiAccessApi.get)(AgentApiAccessApi(), "tenant-1", agent_id)
+
+    assert response == {
+        "enabled": True,
+        "service_api_base_url": "https://api.example.test/v1",
+        "streaming_only": True,
+        "chat_endpoint": "https://api.example.test/v1/chat-messages",
+        "stop_endpoint": "https://api.example.test/v1/chat-messages/{task_id}/stop",
+        "conversations_endpoint": "https://api.example.test/v1/conversations",
+        "messages_endpoint": "https://api.example.test/v1/messages",
+        "files_upload_endpoint": "https://api.example.test/v1/files/upload",
+        "parameters_endpoint": "https://api.example.test/v1/parameters",
+        "info_endpoint": "https://api.example.test/v1/info",
+        "meta_endpoint": "https://api.example.test/v1/meta",
+        "api_rpm": 60,
+        "api_rph": 600,
+        "api_key_count": 2,
+    }
+
+
+def test_agent_api_status_and_key_routes_resolve_backing_app(
+    app: Flask,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    agent_id = "00000000-0000-0000-0000-000000000001"
+    api_key_id = "00000000-0000-0000-0000-000000000002"
+    app_model = SimpleNamespace(
+        id="app-1",
+        enable_api=False,
+        api_base_url="https://api.example.test/v1",
+        api_rpm=0,
+        api_rph=0,
+    )
+    captured: dict[str, object] = {}
+
+    monkeypatch.setattr(roster_controller, "_resolve_agent_app_model", lambda **kwargs: app_model)
+    monkeypatch.setattr(roster_controller, "_agent_api_key_count", lambda app_id: 1)
+
+    class FakeAppService:
+        def update_app_api_status(self, app_obj: object, enable_api: bool) -> object:
+            captured["enable"] = {"app": app_obj, "enable_api": enable_api}
+            app_model.enable_api = enable_api
+            return app_model
+
+    monkeypatch.setattr(roster_controller, "AppService", FakeAppService)
+
+    def fake_get_api_key_list(self, resource_id: str, tenant_id: str):
+        captured["list_keys"] = {"resource_id": resource_id, "tenant_id": tenant_id}
+        return roster_controller.ApiKeyList(data=[])
+
+    def fake_create_api_key(self, resource_id: str, tenant_id: str):
+        captured["create_key"] = {"resource_id": resource_id, "tenant_id": tenant_id}
+        return SimpleNamespace(
+            id=api_key_id,
+            type="app",
+            token="app-test-token",
+            last_used_at=None,
+            created_at=None,
+        )
+
+    def fake_delete_api_key(self, resource_id: str, key_id: str, tenant_id: str, current_user: object) -> None:
+        captured["delete_key"] = {
+            "resource_id": resource_id,
+            "api_key_id": key_id,
+            "tenant_id": tenant_id,
+            "current_user": current_user,
+        }
+
+    monkeypatch.setattr(AgentApiKeyListApi, "_get_api_key_list", fake_get_api_key_list)
+    monkeypatch.setattr(AgentApiKeyListApi, "_create_api_key", fake_create_api_key)
+    monkeypatch.setattr(AgentApiKeyApi, "_delete_api_key", fake_delete_api_key)
+
+    with app.test_request_context(
+        "/console/api/agent/00000000-0000-0000-0000-000000000001/api-enable",
+        json={"enable_api": True},
+    ):
+        enabled = unwrap(AgentApiStatusApi.post)(AgentApiStatusApi(), "tenant-1", agent_id)
+    assert enabled["enabled"] is True
+    assert captured["enable"] == {"app": app_model, "enable_api": True}
+
+    keys = unwrap(AgentApiKeyListApi.get)(AgentApiKeyListApi(), "tenant-1", agent_id)
+    assert keys == {"data": []}
+    assert captured["list_keys"] == {"resource_id": "app-1", "tenant_id": "tenant-1"}
+
+    created, status = unwrap(AgentApiKeyListApi.post)(AgentApiKeyListApi(), "tenant-1", agent_id)
+    assert status == 201
+    assert created["id"] == api_key_id
+    assert created["token"] == "app-test-token"
+    assert captured["create_key"] == {"resource_id": "app-1", "tenant_id": "tenant-1"}
+
+    current_user = SimpleNamespace(id="account-1", is_admin_or_owner=True)
+    deleted, delete_status = unwrap(AgentApiKeyApi.delete)(
+        AgentApiKeyApi(),
+        "tenant-1",
+        current_user,
+        agent_id,
+        api_key_id,
+    )
+    assert (deleted, delete_status) == ("", 204)
+    assert captured["delete_key"] == {
+        "resource_id": "app-1",
+        "api_key_id": api_key_id,
+        "tenant_id": "tenant-1",
+        "current_user": current_user,
+    }
+
+
 def test_agent_app_update_rejects_empty_role(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     agent_id = "00000000-0000-0000-0000-000000000001"
     app_model = _app_detail_obj(id="app-1", bound_agent_id=agent_id)
@@ -441,7 +653,12 @@ def test_agent_app_update_rejects_empty_role(app: Flask, monkeypatch: pytest.Mon
     monkeypatch.setattr(
         roster_controller.AgentRosterService,
         "get_app_backing_agent",
-        lambda _self, **kwargs: SimpleNamespace(id=agent_id, role="", active_config_snapshot_id=None),
+        lambda _self, **kwargs: SimpleNamespace(
+            id=agent_id,
+            role="",
+            debug_conversation_id="debug-conversation-detail",
+            active_config_snapshot_id=None,
+        ),
     )
     monkeypatch.setattr(
         roster_controller.FeatureService,
@@ -464,7 +681,7 @@ def test_agent_app_update_rejects_empty_role(app: Flask, monkeypatch: pytest.Mon
         json={"name": "Renamed", "description": "", "role": "", "icon_type": "emoji", "icon": "R"},
     ):
         with pytest.raises(ValueError, match="String should have at least 1 character"):
-            unwrap(AgentAppApi.put)(AgentAppApi(), "tenant-1", agent_id)
+            unwrap(AgentAppApi.put)(AgentAppApi(), "tenant-1", SimpleNamespace(id="account-1"), agent_id)
 
 
 def test_invite_options_get_parses_app_id(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
@@ -513,6 +730,13 @@ def test_agent_versions_call_services(app: Flask, monkeypatch: pytest.MonkeyPatc
             ],
         },
     )
+    captured_restore: dict[str, object] = {}
+
+    def restore_agent_version(_self, **kwargs):
+        captured_restore.update(kwargs)
+        return {"result": "success", "active_config_snapshot_id": kwargs["version_id"]}
+
+    monkeypatch.setattr(roster_controller.AgentRosterService, "restore_agent_version", restore_agent_version)
 
     assert (
         unwrap(AgentRosterVersionsApi.get)(AgentRosterVersionsApi(), "tenant-1", agent_id)["data"][0]["id"]
@@ -523,6 +747,16 @@ def test_agent_versions_call_services(app: Flask, monkeypatch: pytest.MonkeyPatc
     )
     assert version_detail["id"] == version_id
     assert version_detail["agent_id"] == agent_id
+    restored = unwrap(AgentRosterVersionRestoreApi.post)(
+        AgentRosterVersionRestoreApi(), "tenant-1", SimpleNamespace(id="account-1"), agent_id, version_id
+    )
+    assert restored == {"result": "success", "active_config_snapshot_id": version_id}
+    assert captured_restore == {
+        "tenant_id": "tenant-1",
+        "agent_id": agent_id,
+        "version_id": version_id,
+        "account_id": "account-1",
+    }
 
 
 def test_agent_observability_routes_resolve_app_from_agent_id(
@@ -738,7 +972,7 @@ def test_workflow_composer_get_put_validate_candidates_impact_and_save(
         "save_workflow_composer",
         lambda **kwargs: _workflow_composer_response(save_options=[kwargs["payload"].save_strategy.value]),
     )
-    monkeypatch.setattr(composer_controller.ComposerConfigValidator, "validate_save_payload", lambda payload: None)
+    monkeypatch.setattr(composer_controller.ComposerConfigValidator, "validate_publish_payload", lambda payload: None)
     monkeypatch.setattr(
         composer_controller.AgentComposerService, "resolve_workflow_node_agent_id", lambda **kwargs: None
     )
@@ -833,7 +1067,7 @@ def test_agent_composer_routes_resolve_app_from_agent_id(
         "save_agent_app_composer",
         save_agent_app_composer,
     )
-    monkeypatch.setattr(composer_controller.ComposerConfigValidator, "validate_save_payload", lambda payload: None)
+    monkeypatch.setattr(composer_controller.ComposerConfigValidator, "validate_publish_payload", lambda payload: None)
     monkeypatch.setattr(
         composer_controller.AgentComposerService,
         "collect_validation_findings",
@@ -870,7 +1104,7 @@ def test_agent_chat_generate_and_stop_routes_resolve_app_from_agent_id(
     app: Flask, monkeypatch: pytest.MonkeyPatch, account_id: str
 ) -> None:
     agent_id = "00000000-0000-0000-0000-000000000001"
-    app_model = SimpleNamespace(id="app-1", mode="agent")
+    app_model = SimpleNamespace(id="app-1", tenant_id="tenant-1", mode="agent")
     captured: dict[str, object] = {}
 
     def resolve_agent_app_model(**kwargs: object) -> object:
@@ -909,7 +1143,7 @@ def test_agent_chat_generate_and_stop_routes_resolve_app_from_agent_id(
 def test_agent_chat_helper_forces_agent_streaming_and_external_trace(
     app: Flask, monkeypatch: pytest.MonkeyPatch, account_id: str
 ) -> None:
-    app_model = SimpleNamespace(id="app-1", mode="agent")
+    app_model = SimpleNamespace(id="app-1", tenant_id="tenant-1", mode="agent")
     current_user = SimpleNamespace(id=account_id)
     captured: dict[str, object] = {}
 
@@ -918,6 +1152,11 @@ def test_agent_chat_helper_forces_agent_streaming_and_external_trace(
         return {"answer": "ok"}
 
     monkeypatch.setattr(completion_controller.AppGenerateService, "generate", generate)
+    monkeypatch.setattr(
+        completion_controller,
+        "_resolve_current_user_agent_debug_conversation_id",
+        lambda **kwargs: "debug-conversation-1",
+    )
     monkeypatch.setattr(
         completion_controller.helper,
         "compact_generate_response",
@@ -936,10 +1175,83 @@ def test_agent_chat_helper_forces_agent_streaming_and_external_trace(
     assert captured["streaming"] is True
     args = cast(dict[str, object], captured["args"])
     assert args["response_mode"] == "streaming"
+    assert args["conversation_id"] == "debug-conversation-1"
     assert args["auto_generate_name"] is False
     assert args["external_trace_id"] == "trace-1"
 
 
+def test_agent_chat_helper_rejects_foreign_debug_conversation(
+    app: Flask,
+    monkeypatch: pytest.MonkeyPatch,
+    account_id: str,
+) -> None:
+    app_model = SimpleNamespace(id="app-1", tenant_id="tenant-1", mode="agent")
+
+    monkeypatch.setattr(
+        completion_controller,
+        "_resolve_current_user_agent_debug_conversation_id",
+        lambda **kwargs: "owned-conversation",
+    )
+
+    with app.test_request_context(
+        json={
+            "inputs": {},
+            "query": "hello",
+            "response_mode": "streaming",
+            "conversation_id": "00000000-0000-0000-0000-000000000001",
+        }
+    ):
+        with pytest.raises(NotFound):
+            completion_controller._create_chat_message(
+                current_tenant_id="tenant-1",
+                current_user=SimpleNamespace(id=account_id),
+                app_model=app_model,
+                agent_id="agent-1",
+            )
+
+
+def test_resolve_current_user_agent_debug_conversation_uses_agent_or_backing_app(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    calls: list[dict[str, object]] = []
+
+    class FakeRosterService:
+        def __init__(self, session: object) -> None:
+            calls.append({"session": session})
+
+        def get_or_create_agent_app_debug_conversation_id(self, **kwargs: object) -> str:
+            calls.append({"get_or_create": kwargs})
+            return f"debug-{kwargs['agent_id']}"
+
+        def get_app_backing_agent(self, **kwargs: object) -> object:
+            calls.append({"get_app_backing_agent": kwargs})
+            return SimpleNamespace(id="backing-agent")
+
+    monkeypatch.setattr(completion_controller, "AgentRosterService", FakeRosterService)
+    monkeypatch.setattr(completion_controller, "db", SimpleNamespace(session="session-1"))
+
+    explicit_id = completion_controller._resolve_current_user_agent_debug_conversation_id(
+        current_tenant_id="tenant-1",
+        current_user=SimpleNamespace(id="account-1"),
+        app_model=SimpleNamespace(id="app-1"),
+        agent_id="agent-1",
+    )
+    fallback_id = completion_controller._resolve_current_user_agent_debug_conversation_id(
+        current_tenant_id="tenant-1",
+        current_user=SimpleNamespace(id="account-1"),
+        app_model=SimpleNamespace(id="app-1"),
+        agent_id=None,
+    )
+
+    assert explicit_id == "debug-agent-1"
+    assert fallback_id == "debug-backing-agent"
+    assert calls[1] == {"get_or_create": {"tenant_id": "tenant-1", "agent_id": "agent-1", "account_id": "account-1"}}
+    assert calls[3] == {"get_app_backing_agent": {"tenant_id": "tenant-1", "app_id": "app-1"}}
+    assert calls[4] == {
+        "get_or_create": {"tenant_id": "tenant-1", "agent_id": "backing-agent", "account_id": "account-1"}
+    }
+
+
 @pytest.mark.parametrize(
     ("error", "expected"),
     [
@@ -986,7 +1298,7 @@ def test_agent_chat_helper_maps_generation_errors(
 def test_agent_chat_message_routes_resolve_app_from_agent_id(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     agent_id = "00000000-0000-0000-0000-000000000001"
     message_id = "00000000-0000-0000-0000-000000000002"
-    app_model = SimpleNamespace(id="app-1")
+    app_model = SimpleNamespace(id="app-1", mode="agent")
     current_user = SimpleNamespace(id="account-1")
     captured: dict[str, object] = {}
 
@@ -1016,7 +1328,9 @@ def test_agent_chat_message_routes_resolve_app_from_agent_id(app: Flask, monkeyp
     monkeypatch.setattr(message_controller, "_get_message_suggested_questions", get_message_suggested_questions)
     monkeypatch.setattr(message_controller, "_get_message_detail", get_message_detail)
 
-    assert unwrap(AgentChatMessageListApi.get)(AgentChatMessageListApi(), "tenant-1", agent_id) == {"data": []}
+    assert unwrap(AgentChatMessageListApi.get)(AgentChatMessageListApi(), "tenant-1", current_user, agent_id) == {
+        "data": []
+    }
     assert cast(dict[str, object], captured["list"])["app_model"] is app_model
 
     with app.test_request_context(json={"message_id": message_id, "rating": "like"}):
@@ -1073,11 +1387,73 @@ def test_list_chat_messages_supports_first_id_pagination(app: Flask, monkeypatch
         "/console/api/agent/agent-1/chat-messages"
         f"?conversation_id={conversation_id}&first_id={first_message_id}&limit=1"
     ):
-        result = message_controller._list_chat_messages(app_model=SimpleNamespace(id="app-1"))
+        result = message_controller._list_chat_messages(app_model=SimpleNamespace(id="app-1", mode="chat"))
 
     assert result == {"data": [older_message_id], "limit": 1, "has_more": True}
 
 
+def test_list_agent_chat_messages_uses_current_user_conversation(
+    app: Flask,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    conversation_id = "00000000-0000-0000-0000-000000000010"
+    message_id = "00000000-0000-0000-0000-000000000011"
+    conversation = SimpleNamespace(id=conversation_id)
+    message = SimpleNamespace(id=message_id, created_at=1)
+    current_user = SimpleNamespace(id="account-1")
+    app_model = SimpleNamespace(id="app-1", mode="agent")
+    captured: dict[str, object] = {}
+    session = SimpleNamespace(
+        scalar=lambda _stmt: False,
+        scalars=lambda _stmt: SimpleNamespace(all=lambda: [message]),
+    )
+
+    class FakeMessagePaginationResponse:
+        @classmethod
+        def model_validate(cls, pagination: object, from_attributes: bool = False) -> object:
+            return SimpleNamespace(
+                model_dump=lambda mode: {
+                    "data": [item.id for item in pagination.data],
+                    "limit": pagination.limit,
+                    "has_more": pagination.has_more,
+                }
+            )
+
+    def get_conversation(**kwargs: object) -> object:
+        captured.update(kwargs)
+        return conversation
+
+    monkeypatch.setattr(message_controller.ConversationService, "get_conversation", get_conversation)
+    monkeypatch.setattr(message_controller, "db", SimpleNamespace(session=session))
+    monkeypatch.setattr(message_controller, "attach_message_extra_contents", lambda messages: None)
+    monkeypatch.setattr(message_controller, "MessageInfiniteScrollPaginationResponse", FakeMessagePaginationResponse)
+
+    with app.test_request_context(f"/console/api/agent/agent-1/chat-messages?conversation_id={conversation_id}"):
+        result = message_controller._list_chat_messages(app_model=app_model, current_user=current_user)
+
+    assert result == {"data": [message_id], "limit": 20, "has_more": False}
+    assert captured == {"app_model": app_model, "conversation_id": conversation_id, "user": current_user}
+
+
+def test_list_agent_chat_messages_rejects_foreign_conversation(
+    app: Flask,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    conversation_id = "00000000-0000-0000-0000-000000000010"
+    monkeypatch.setattr(
+        message_controller.ConversationService,
+        "get_conversation",
+        lambda **kwargs: (_ for _ in ()).throw(message_controller.ConversationNotExistsError()),
+    )
+
+    with app.test_request_context(f"/console/api/agent/agent-1/chat-messages?conversation_id={conversation_id}"):
+        with pytest.raises(NotFound):
+            message_controller._list_chat_messages(
+                app_model=SimpleNamespace(id="app-1", mode="agent"),
+                current_user=SimpleNamespace(id="account-1"),
+            )
+
+
 def test_update_message_feedback_rejects_empty_rating_without_existing_feedback(
     app: Flask, monkeypatch: pytest.MonkeyPatch
 ) -> None:
diff --git a/api/tests/unit_tests/controllers/console/app/test_agent_drive_inspector.py b/api/tests/unit_tests/controllers/console/app/test_agent_drive_inspector.py
index 9d1b6c4c0e9..81f6fcf36bf 100644
--- a/api/tests/unit_tests/controllers/console/app/test_agent_drive_inspector.py
+++ b/api/tests/unit_tests/controllers/console/app/test_agent_drive_inspector.py
@@ -20,6 +20,10 @@ from controllers.console.app.agent_drive_inspector import (
     AgentDriveListByAgentApi,
     AgentDrivePreviewApi,
     AgentDrivePreviewByAgentApi,
+    AgentDriveSkillInspectApi,
+    AgentDriveSkillInspectByAgentApi,
+    AgentDriveSkillListApi,
+    AgentDriveSkillListByAgentApi,
 )
 from services.agent_drive_service import AgentDriveError
 
@@ -97,6 +101,124 @@ def test_list_resolves_workflow_node_binding_agent():
     assert composer.resolve_workflow_node_agent_id.call_args.kwargs["node_id"] == "agent-node-1"
 
 
+def test_skill_list_by_agent_calls_service():
+    raw = _raw(AgentDriveSkillListByAgentApi.get)
+    with app.test_request_context("/"):
+        with (
+            patch(f"{_MOD}.resolve_agent_app_model", return_value=_APP) as resolve_app,
+            patch(f"{_MOD}.AgentDriveService") as drive,
+        ):
+            drive.return_value.list_skills.return_value = [
+                {
+                    "path": "pdf-toolkit",
+                    "skill_md_key": "pdf-toolkit/SKILL.md",
+                    "archive_key": "pdf-toolkit/.DIFY-SKILL-FULL.zip",
+                    "name": "PDF Toolkit",
+                    "description": "Work with PDFs.",
+                    "size": 5,
+                    "mime_type": "text/markdown",
+                    "hash": None,
+                    "created_at": 1718000000,
+                }
+            ]
+            body = raw(AgentDriveSkillListByAgentApi(), "tenant-1", "agent-1")
+
+    assert body["items"][0]["path"] == "pdf-toolkit"
+    resolve_app.assert_called_once_with(tenant_id="tenant-1", agent_id="agent-1")
+    assert drive.return_value.list_skills.call_args.kwargs["agent_id"] == "agent-1"
+
+
+def test_skill_list_resolves_workflow_node_binding_agent():
+    raw = _raw(AgentDriveSkillListApi.get)
+    with app.test_request_context("/?node_id=agent-node-1"):
+        with (
+            patch(f"{_MOD}.AgentComposerService") as composer,
+            patch(f"{_MOD}.AgentDriveService") as drive,
+        ):
+            composer.resolve_workflow_node_agent_id.return_value = "wf-agent-9"
+            drive.return_value.list_skills.return_value = []
+            body = raw(AgentDriveSkillListApi(), _APP)
+
+    assert body == {"items": []}
+    assert drive.return_value.list_skills.call_args.kwargs["agent_id"] == "wf-agent-9"
+
+
+def test_skill_inspect_by_agent_returns_strict_json_response():
+    raw = _raw(AgentDriveSkillInspectByAgentApi.get)
+    payload = {
+        "path": "pdf-toolkit",
+        "skill_md_key": "pdf-toolkit/SKILL.md",
+        "archive_key": "pdf-toolkit/.DIFY-SKILL-FULL.zip",
+        "name": "PDF Toolkit",
+        "description": "Work with PDFs.",
+        "size": 5,
+        "mime_type": "text/markdown",
+        "hash": None,
+        "created_at": 1718000000,
+        "source": "skill_md",
+        "files": [
+            {
+                "path": "SKILL.md",
+                "name": "SKILL.md",
+                "type": "file",
+                "drive_key": "pdf-toolkit/SKILL.md",
+                "available_in_drive": True,
+            }
+        ],
+        "file_tree": [],
+        "skill_md": {
+            "key": "pdf-toolkit/SKILL.md",
+            "size": 5,
+            "truncated": False,
+            "binary": False,
+            "text": "# PDF Toolkit\nUse it.\n",
+        },
+        "warnings": [],
+    }
+    with app.test_request_context("/"):
+        with (
+            patch(f"{_MOD}.resolve_agent_app_model", return_value=_APP),
+            patch(f"{_MOD}.AgentDriveService") as drive,
+        ):
+            drive.return_value.inspect_skill.return_value = payload
+            response = raw(AgentDriveSkillInspectByAgentApi(), "tenant-1", "agent-1", "pdf-toolkit")
+
+    assert response.status_code == 200
+    assert response.get_json()["skill_md"]["text"] == "# PDF Toolkit\nUse it.\n"
+    assert b"# PDF Toolkit\\nUse it.\\n" in response.get_data()
+
+
+def test_skill_inspect_resolves_workflow_node_binding_agent():
+    raw = _raw(AgentDriveSkillInspectApi.get)
+    payload = {
+        "path": "pdf-toolkit",
+        "skill_md_key": "pdf-toolkit/SKILL.md",
+        "archive_key": None,
+        "name": "PDF Toolkit",
+        "description": "",
+        "size": 5,
+        "mime_type": "text/markdown",
+        "hash": None,
+        "created_at": None,
+        "source": "skill_md",
+        "files": [],
+        "file_tree": [],
+        "skill_md": {"key": "pdf-toolkit/SKILL.md", "size": 5, "truncated": False, "binary": False, "text": "# hi"},
+        "warnings": [],
+    }
+    with app.test_request_context("/?node_id=agent-node-1"):
+        with (
+            patch(f"{_MOD}.AgentComposerService") as composer,
+            patch(f"{_MOD}.AgentDriveService") as drive,
+        ):
+            composer.resolve_workflow_node_agent_id.return_value = "wf-agent-9"
+            drive.return_value.inspect_skill.return_value = payload
+            response = raw(AgentDriveSkillInspectApi(), _APP, "pdf-toolkit")
+
+    assert response.get_json()["path"] == "pdf-toolkit"
+    assert drive.return_value.inspect_skill.call_args.kwargs["agent_id"] == "wf-agent-9"
+
+
 def test_list_400_when_no_agent_bound():
     raw = _raw(AgentDriveListApi.get)
     app_without_agent = SimpleNamespace(id="app-1", tenant_id="tenant-1", bound_agent_id=None)
diff --git a/api/tests/unit_tests/controllers/console/app/test_agent_skills.py b/api/tests/unit_tests/controllers/console/app/test_agent_skills.py
index e94536aa012..bafdc3b46ac 100644
--- a/api/tests/unit_tests/controllers/console/app/test_agent_skills.py
+++ b/api/tests/unit_tests/controllers/console/app/test_agent_skills.py
@@ -12,6 +12,7 @@ import io
 from types import SimpleNamespace
 from unittest.mock import patch
 
+import pytest
 from flask import Flask
 
 from controllers.console.app.agent import (
@@ -152,27 +153,20 @@ def test_files_commit_validates_upload_and_returns_drive_ref():
             patch(f"{_MOD}.console_ns") as ns,
             patch(f"{_MOD}.db") as db_mock,
             patch(f"{_MOD}.AgentDriveService") as drive,
-            patch(f"{_MOD}.AgentComposerService") as composer,
         ):
             ns.payload = {"upload_file_id": "0fa6f9bc-3416-4476-8857-a13129704dd9"}
             db_mock.session.scalar.return_value = upload
             drive.return_value.commit.return_value = [
                 {"key": "files/sample qna.pdf", "size": 5, "mime_type": "application/pdf"}
             ]
-            composer.add_drive_file_ref.return_value = "ver-2"
             body, status = raw(AgentDriveFilesApi(), _USER, _APP)
 
     assert status == 201
     assert body["file"]["drive_key"] == "files/sample qna.pdf"
     assert body["file"]["file_id"] == "uf-1"
-    assert body["config_version_id"] == "ver-2"
     item = drive.return_value.commit.call_args.kwargs["items"][0]
     assert item.value_owned_by_drive is True
     assert item.file_ref.kind == "upload_file"
-    file_ref = composer.add_drive_file_ref.call_args.kwargs["file_ref"]
-    assert file_ref.drive_key == "files/sample qna.pdf"
-    assert file_ref.name == "sample qna.pdf"
-    assert composer.add_drive_file_ref.call_args.kwargs["app_id"] == "app-1"
 
 
 def test_files_by_agent_commit_uses_agent_route_and_ignores_node_id():
@@ -184,20 +178,16 @@ def test_files_by_agent_commit_uses_agent_route_and_ignores_node_id():
             patch(f"{_MOD}.console_ns") as ns,
             patch(f"{_MOD}.db") as db_mock,
             patch(f"{_MOD}.AgentDriveService") as drive,
-            patch(f"{_MOD}.AgentComposerService") as composer,
         ):
             ns.payload = {"upload_file_id": "0fa6f9bc-3416-4476-8857-a13129704dd9"}
             db_mock.session.scalar.return_value = upload
             drive.return_value.commit.return_value = [
                 {"key": "files/sample.pdf", "size": 5, "mime_type": "application/pdf"}
             ]
-            composer.add_drive_file_ref.return_value = "ver-2"
             body, status = raw(AgentDriveFilesByAgentApi(), "tenant-1", _USER, "agent-1")
 
     assert status == 201
-    assert body["config_version_id"] == "ver-2"
     resolve_app.assert_called_once_with(tenant_id="tenant-1", agent_id="agent-1")
-    assert composer.add_drive_file_ref.call_args.kwargs["node_id"] is None
 
 
 def test_files_commit_404_when_upload_not_in_tenant():
@@ -234,13 +224,10 @@ def test_files_commit_resolves_workflow_node_agent():
             drive.return_value.commit.return_value = [
                 {"key": "files/sample.pdf", "size": 5, "mime_type": "application/pdf"}
             ]
-            composer.add_drive_file_ref.return_value = "ver-2"
             body, status = raw(AgentDriveFilesApi(), _USER, _WORKFLOW_APP)
 
     assert status == 201
-    assert body["config_version_id"] == "ver-2"
     assert drive.return_value.commit.call_args.kwargs["agent_id"] == "wf-agent-1"
-    assert composer.add_drive_file_ref.call_args.kwargs["node_id"] == "agent-node-1"
 
 
 def test_files_delete_updates_soul_then_drive():
@@ -250,17 +237,15 @@ def test_files_delete_updates_soul_then_drive():
     calls: list[str] = []
     with _json_ctx(method="DELETE", query_string="key=files/sample.pdf"):
         with (
-            patch(f"{_MOD}.AgentComposerService") as composer,
             patch(f"{_MOD}.AgentDriveService") as drive,
         ):
-            composer.remove_drive_refs.side_effect = lambda **kw: calls.append("soul") or "ver-2"
-            drive.return_value.delete.side_effect = lambda **kw: calls.append("drive") or ["files/sample.pdf"]
+            drive.return_value.commit.side_effect = lambda **kw: (
+                calls.append("drive") or [{"key": "files/sample.pdf", "removed": True}]
+            )
             body = raw(AgentDriveFilesApi(), _USER, _APP)
 
-    assert calls == ["soul", "drive"]  # soul-first ordering
-    assert body == {"result": "success", "removed_keys": ["files/sample.pdf"], "config_version_id": "ver-2"}
-    assert composer.remove_drive_refs.call_args.kwargs["file_key"] == "files/sample.pdf"
-    assert composer.remove_drive_refs.call_args.kwargs["app_id"] == "app-1"
+    assert calls == ["drive"]
+    assert body == {"result": "success", "removed_keys": ["files/sample.pdf"]}
 
 
 def test_files_by_agent_delete_uses_agent_route_and_ignores_node_id():
@@ -268,16 +253,13 @@ def test_files_by_agent_delete_uses_agent_route_and_ignores_node_id():
     with _json_ctx(method="DELETE", query_string="key=files/sample.pdf&node_id=ignored"):
         with (
             patch(f"{_MOD}.resolve_agent_app_model", return_value=_APP) as resolve_app,
-            patch(f"{_MOD}.AgentComposerService") as composer,
             patch(f"{_MOD}.AgentDriveService") as drive,
         ):
-            composer.remove_drive_refs.return_value = "ver-2"
-            drive.return_value.delete.return_value = ["files/sample.pdf"]
+            drive.return_value.commit.return_value = [{"key": "files/sample.pdf", "removed": True}]
             body = raw(AgentDriveFilesByAgentApi(), "tenant-1", _USER, "agent-1")
 
-    assert body["config_version_id"] == "ver-2"
+    assert body == {"result": "success", "removed_keys": ["files/sample.pdf"]}
     resolve_app.assert_called_once_with(tenant_id="tenant-1", agent_id="agent-1")
-    assert composer.remove_drive_refs.call_args.kwargs["node_id"] is None
 
 
 def test_files_delete_resolves_workflow_node_agent():
@@ -290,13 +272,11 @@ def test_files_delete_resolves_workflow_node_agent():
             patch(f"{_MOD}.AgentDriveService") as drive,
         ):
             composer.resolve_workflow_node_agent_id.return_value = "wf-agent-1"
-            composer.remove_drive_refs.return_value = "ver-2"
-            drive.return_value.delete.return_value = ["files/sample.pdf"]
+            drive.return_value.commit.return_value = [{"key": "files/sample.pdf", "removed": True}]
             body = raw(AgentDriveFilesApi(), _USER, _WORKFLOW_APP)
 
-    assert body["config_version_id"] == "ver-2"
-    assert drive.return_value.delete.call_args.kwargs["agent_id"] == "wf-agent-1"
-    assert composer.remove_drive_refs.call_args.kwargs["node_id"] == "agent-node-1"
+    assert body == {"result": "success", "removed_keys": ["files/sample.pdf"]}
+    assert drive.return_value.commit.call_args.kwargs["agent_id"] == "wf-agent-1"
 
 
 def test_files_delete_survives_drive_failure():
@@ -305,14 +285,11 @@ def test_files_delete_survives_drive_failure():
     raw = _raw(AgentDriveFilesApi.delete)
     with _json_ctx(method="DELETE", query_string="key=files/sample.pdf"):
         with (
-            patch(f"{_MOD}.AgentComposerService") as composer,
             patch(f"{_MOD}.AgentDriveService") as drive,
         ):
-            composer.remove_drive_refs.return_value = "ver-2"
-            drive.return_value.delete.side_effect = RuntimeError("storage down")
-            body = raw(AgentDriveFilesApi(), _USER, _APP)
-    # soul already updated; drive cleanup is best-effort and retryable
-    assert body == {"result": "success", "removed_keys": [], "config_version_id": "ver-2"}
+            drive.return_value.commit.side_effect = RuntimeError("storage down")
+            with pytest.raises(RuntimeError, match="storage down"):
+                raw(AgentDriveFilesApi(), _USER, _APP)
 
 
 def test_skill_delete_uses_slug_prefix_and_is_idempotent():
@@ -321,17 +298,18 @@ def test_skill_delete_uses_slug_prefix_and_is_idempotent():
     raw = _raw(AgentSkillApi.delete)
     with _json_ctx(method="DELETE"):
         with (
-            patch(f"{_MOD}.AgentComposerService") as composer,
             patch(f"{_MOD}.AgentDriveService") as drive,
         ):
-            composer.remove_drive_refs.return_value = None  # ref already gone
-            drive.return_value.delete.return_value = []
+            drive.return_value.commit.return_value = [
+                {"key": "tender-analyzer/SKILL.md", "removed": True},
+                {"key": "tender-analyzer/.DIFY-SKILL-FULL.zip", "removed": True},
+            ]
             body = raw(AgentSkillApi(), _USER, _APP, "tender-analyzer")
 
-    assert body == {"result": "success", "removed_keys": [], "config_version_id": None}
-    assert drive.return_value.delete.call_args.kwargs["prefix"] == "tender-analyzer/"
-    assert composer.remove_drive_refs.call_args.kwargs["skill_slug"] == "tender-analyzer"
-    assert composer.remove_drive_refs.call_args.kwargs["app_id"] == "app-1"
+    assert body == {
+        "result": "success",
+        "removed_keys": ["tender-analyzer/SKILL.md", "tender-analyzer/.DIFY-SKILL-FULL.zip"],
+    }
 
 
 def test_skill_delete_by_agent_uses_agent_route():
@@ -339,16 +317,13 @@ def test_skill_delete_by_agent_uses_agent_route():
     with _json_ctx(method="DELETE", query_string="node_id=ignored"):
         with (
             patch(f"{_MOD}.resolve_agent_app_model", return_value=_APP) as resolve_app,
-            patch(f"{_MOD}.AgentComposerService") as composer,
             patch(f"{_MOD}.AgentDriveService") as drive,
         ):
-            composer.remove_drive_refs.return_value = "ver-2"
-            drive.return_value.delete.return_value = ["tender-analyzer/SKILL.md"]
+            drive.return_value.commit.return_value = [{"key": "tender-analyzer/SKILL.md", "removed": True}]
             body = raw(AgentSkillByAgentApi(), "tenant-1", _USER, "agent-1", "tender-analyzer")
 
-    assert body["config_version_id"] == "ver-2"
+    assert body == {"result": "success", "removed_keys": ["tender-analyzer/SKILL.md"]}
     resolve_app.assert_called_once_with(tenant_id="tenant-1", agent_id="agent-1")
-    assert composer.remove_drive_refs.call_args.kwargs["node_id"] is None
 
 
 def test_skill_delete_rejects_path_like_slug():
diff --git a/api/tests/unit_tests/controllers/console/auth/test_account_activation.py b/api/tests/unit_tests/controllers/console/auth/test_account_activation.py
index 1422afd7524..6ef7f442591 100644
--- a/api/tests/unit_tests/controllers/console/auth/test_account_activation.py
+++ b/api/tests/unit_tests/controllers/console/auth/test_account_activation.py
@@ -15,7 +15,7 @@ from flask import Flask
 
 from controllers.console.auth.activate import ActivateApi, ActivateCheckApi
 from controllers.console.error import AccountInFreezeError, AlreadyActivateError
-from models.account import AccountStatus
+from models.account import AccountStatus, TenantAccountRole
 
 
 class TestActivateCheckApi:
@@ -201,11 +201,11 @@ class TestActivateApi:
     @patch("controllers.console.auth.activate.db")
     def test_successful_account_activation(
         self,
-        mock_db,
-        mock_revoke_token,
-        mock_get_invitation,
+        mock_db: MagicMock,
+        mock_revoke_token: MagicMock,
+        mock_get_invitation: MagicMock,
         app: Flask,
-        mock_invitation,
+        mock_invitation: MagicMock,
         mock_account,
     ):
         """
@@ -448,11 +448,11 @@ class TestActivateApi:
     @patch("controllers.console.auth.activate.db")
     def test_activation_returns_success_response(
         self,
-        mock_db,
-        mock_revoke_token,
-        mock_get_invitation,
+        mock_db: MagicMock,
+        mock_revoke_token: MagicMock,
+        mock_get_invitation: MagicMock,
         app: Flask,
-        mock_invitation,
+        mock_invitation: MagicMock,
     ):
         """
         Test that activation returns a success response without authentication tokens.
@@ -488,11 +488,11 @@ class TestActivateApi:
     @patch("controllers.console.auth.activate.db")
     def test_activation_without_workspace_id(
         self,
-        mock_db,
-        mock_revoke_token,
-        mock_get_invitation,
+        mock_db: MagicMock,
+        mock_revoke_token: MagicMock,
+        mock_get_invitation: MagicMock,
         app: Flask,
-        mock_invitation,
+        mock_invitation: MagicMock,
     ):
         """
         Test account activation without workspace_id.
@@ -528,12 +528,12 @@ class TestActivateApi:
     @patch("controllers.console.auth.activate.db")
     def test_activation_normalizes_email_before_lookup(
         self,
-        mock_db,
-        mock_revoke_token,
-        mock_get_invitation,
+        mock_db: MagicMock,
+        mock_revoke_token: MagicMock,
+        mock_get_invitation: MagicMock,
         app: Flask,
-        mock_invitation,
-        mock_account,
+        mock_invitation: MagicMock,
+        mock_account: MagicMock,
     ):
         """Ensure uppercase emails are normalized before lookup and revocation."""
         mock_get_invitation.return_value = mock_invitation
@@ -563,14 +563,14 @@ class TestActivateApi:
     @patch("controllers.console.auth.activate.db")
     def test_activation_for_existing_active_account_creates_membership_on_acceptance(
         self,
-        mock_db,
-        mock_revoke_token,
-        mock_get_invitation,
-        mock_create_tenant_member,
+        mock_db: MagicMock,
+        mock_revoke_token: MagicMock,
+        mock_get_invitation: MagicMock,
+        mock_create_tenant_member: MagicMock,
         app: Flask,
-        mock_invitation,
-        mock_account,
-        mock_switch_tenant,
+        mock_invitation: MagicMock,
+        mock_account: MagicMock,
+        mock_switch_tenant: MagicMock,
     ):
         mock_account.status = AccountStatus.ACTIVE
         mock_invitation["data"]["role"] = "admin"
@@ -590,7 +590,9 @@ class TestActivateApi:
             response = ActivateApi().post()
 
         assert response["result"] == "success"
-        mock_create_tenant_member.assert_called_once_with(mock_invitation["tenant"], mock_account, "admin")
+        mock_create_tenant_member.assert_called_once_with(
+            mock_invitation["tenant"], mock_account, mock_db.session, role=TenantAccountRole.ADMIN
+        )
         mock_switch_tenant.assert_called_once_with(mock_account, mock_invitation["tenant"].id)
         mock_revoke_token.assert_called_once_with("workspace-123", "invitee@example.com", "valid_token")
 
@@ -600,14 +602,14 @@ class TestActivateApi:
     @patch("controllers.console.auth.activate.db")
     def test_activation_legacy_active_member_invitation_does_not_require_setup(
         self,
-        mock_db,
-        mock_revoke_token,
-        mock_get_invitation,
-        mock_create_tenant_member,
+        mock_db: MagicMock,
+        mock_revoke_token: MagicMock,
+        mock_get_invitation: MagicMock,
+        mock_create_tenant_member: MagicMock,
         app: Flask,
-        mock_invitation,
-        mock_account,
-        mock_switch_tenant,
+        mock_invitation: MagicMock,
+        mock_account: MagicMock,
+        mock_switch_tenant: MagicMock,
     ):
         mock_account.status = AccountStatus.ACTIVE
         mock_get_invitation.return_value = mock_invitation
diff --git a/api/tests/unit_tests/controllers/console/explore/test_saved_message.py b/api/tests/unit_tests/controllers/console/explore/test_saved_message.py
index f210d0d5d04..ae05b8f6a0e 100644
--- a/api/tests/unit_tests/controllers/console/explore/test_saved_message.py
+++ b/api/tests/unit_tests/controllers/console/explore/test_saved_message.py
@@ -63,7 +63,7 @@ class TestSavedMessageListApi:
             result = method(api, current_user, installed_app)
 
         pagination_mock.assert_called_once()
-        assert pagination_mock.call_args.args[1] is current_user
+        assert pagination_mock.call_args.args[2] is current_user
         assert result["limit"] == 20
         assert result["has_more"] is False
         assert len(result["data"]) == 2
@@ -96,7 +96,7 @@ class TestSavedMessageListApi:
             result = method(api, current_user, installed_app)
 
         save_mock.assert_called_once()
-        assert save_mock.call_args.args[1] is current_user
+        assert save_mock.call_args.args[2] is current_user
         assert result == {"result": "success"}
 
     def test_post_message_not_exists(self, app: Flask, payload_patch):
@@ -136,7 +136,7 @@ class TestSavedMessageApi:
             result, status = method(api, current_user, installed_app, str(uuid4()))
 
         delete_mock.assert_called_once()
-        assert delete_mock.call_args.args[1] is current_user
+        assert delete_mock.call_args.args[2] is current_user
         assert status == 204
         assert result == ""
 
diff --git a/api/tests/unit_tests/controllers/console/snippets/test_snippet_workflow.py b/api/tests/unit_tests/controllers/console/snippets/test_snippet_workflow.py
index 11916c87b68..b20dd3e30a7 100644
--- a/api/tests/unit_tests/controllers/console/snippets/test_snippet_workflow.py
+++ b/api/tests/unit_tests/controllers/console/snippets/test_snippet_workflow.py
@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import json
 from datetime import datetime
 from inspect import unwrap
 from types import SimpleNamespace
@@ -199,6 +200,54 @@ def test_default_block_configs_delegates_to_service(app: Flask, monkeypatch: pyt
     get_default_block_configs.assert_called_once()
 
 
+def test_list_published_snippet_workflows_includes_input_fields(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
+    workflow = SimpleNamespace(
+        id="workflow-1",
+        graph_dict={"nodes": [], "edges": []},
+        features_dict={},
+        unique_hash="hash-1",
+        version="2024-01-01 00:00:00",
+        marked_name="",
+        marked_comment="",
+        created_by_account=None,
+        created_at=datetime(2024, 1, 1),
+        updated_by_account=None,
+        updated_at=datetime(2024, 1, 1),
+        tool_published=False,
+        environment_variables=[],
+        conversation_variables=[],
+        rag_pipeline_variables=[],
+    )
+    input_fields = [{"variable": "query", "type": "text"}]
+    snippet = _snippet(input_fields=json.dumps(input_fields))
+
+    class SessionContext:
+        def __init__(self, engine):
+            self.engine = engine
+
+        def __enter__(self):
+            return Mock()
+
+        def __exit__(self, exc_type, exc, tb):
+            return False
+
+    monkeypatch.setattr(snippet_workflow_module, "Session", SessionContext)
+    monkeypatch.setattr(snippet_workflow_module, "db", SimpleNamespace(engine=object()))
+    monkeypatch.setattr(
+        snippet_workflow_module,
+        "SnippetService",
+        lambda: SimpleNamespace(get_all_published_workflows=Mock(return_value=([workflow], False))),
+    )
+
+    api = snippet_workflow_module.SnippetPublishedAllWorkflowApi()
+    handler = unwrap(api.get)
+
+    with app.test_request_context("/snippets/snippet-1/workflows?page=1&limit=20"):
+        response = handler(api, snippet=snippet)
+
+    assert response["items"][0]["input_fields"] == input_fields
+
+
 def test_restore_published_snippet_workflow_to_draft_success(app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
     workflow = SimpleNamespace(
         unique_hash="restored-hash",
diff --git a/api/tests/unit_tests/controllers/console/test_extension.py b/api/tests/unit_tests/controllers/console/test_extension.py
index 487cf8f54fd..bab825ca6f0 100644
--- a/api/tests/unit_tests/controllers/console/test_extension.py
+++ b/api/tests/unit_tests/controllers/console/test_extension.py
@@ -3,7 +3,7 @@ from __future__ import annotations
 import builtins
 import uuid
 from datetime import UTC, datetime
-from unittest.mock import MagicMock
+from unittest.mock import ANY, MagicMock
 
 import pytest
 from flask import Flask
@@ -114,7 +114,7 @@ def test_api_based_extension_get_returns_tenant_extensions(app: Flask, monkeypat
     assert response[0]["name"] == "Weather API"
     assert response[0]["api_endpoint"] == extension.api_endpoint
     assert response[0]["api_key"].startswith(extension.api_key[:3])
-    service_mock.assert_called_once_with("tenant-123")
+    service_mock.assert_called_once_with(ANY, "tenant-123")
 
 
 def test_api_based_extension_post_creates_extension(app: Flask, monkeypatch: pytest.MonkeyPatch):
@@ -132,7 +132,7 @@ def test_api_based_extension_post_creates_extension(app: Flask, monkeypatch: pyt
         response, status = APIBasedExtensionAPI().post()
 
     args, _ = save_mock.call_args
-    created_extension: APIBasedExtension = args[0]
+    created_extension: APIBasedExtension = args[1]
     assert created_extension.tenant_id == "tenant-123"
     assert created_extension.name == payload["name"]
     assert created_extension.api_endpoint == payload["api_endpoint"]
@@ -157,7 +157,7 @@ def test_api_based_extension_detail_get_fetches_extension(app: Flask, monkeypatc
 
     assert response["id"] == extension.id
     assert response["name"] == extension.name
-    service_mock.assert_called_once_with("tenant-123", str(extension_id))
+    service_mock.assert_called_once_with(ANY, "tenant-123", str(extension_id))
 
 
 def test_api_based_extension_detail_post_keeps_hidden_api_key(app: Flask, monkeypatch: pytest.MonkeyPatch):
@@ -187,7 +187,7 @@ def test_api_based_extension_detail_post_keeps_hidden_api_key(app: Flask, monkey
     assert existing_extension.name == payload["name"]
     assert existing_extension.api_endpoint == payload["api_endpoint"]
     assert existing_extension.api_key == "keep-me"
-    save_mock.assert_called_once_with(existing_extension)
+    save_mock.assert_called_once_with(ANY, existing_extension)
     assert response["name"] == payload["name"]
     assert response["api_key"] == _masked_api_key("keep-me")
 
@@ -217,7 +217,7 @@ def test_api_based_extension_detail_post_updates_api_key_when_provided(app: Flas
         response = APIBasedExtensionDetailAPI().post(extension_id)
 
     assert existing_extension.api_key == "new-secret"
-    save_mock.assert_called_once_with(existing_extension)
+    save_mock.assert_called_once_with(ANY, existing_extension)
     assert response["name"] == payload["name"]
     assert response["api_key"] == _masked_api_key(payload["api_key"])
 
@@ -239,6 +239,6 @@ def test_api_based_extension_detail_delete_removes_extension(app: Flask, monkeyp
     ):
         response, status = APIBasedExtensionDetailAPI().delete(extension_id)
 
-    delete_mock.assert_called_once_with(existing_extension)
+    delete_mock.assert_called_once_with(ANY, existing_extension)
     assert status == 204
     assert response == ""
diff --git a/api/tests/unit_tests/controllers/console/workspace/test_rbac.py b/api/tests/unit_tests/controllers/console/workspace/test_rbac.py
index 1ad9637b7bb..d78bc1fc6dd 100644
--- a/api/tests/unit_tests/controllers/console/workspace/test_rbac.py
+++ b/api/tests/unit_tests/controllers/console/workspace/test_rbac.py
@@ -185,7 +185,7 @@ class TestPaginationMapping:
                 "name": "owner",
                 "description": "",
                 "is_builtin": True,
-                "permission_keys": list(rbac_mod._LEGACY_ROLE_PERMISSION_KEYS["owner"]),
+                "permission_keys": list(dict.fromkeys(rbac_mod._LEGACY_ROLE_PERMISSION_KEYS["owner"])),
                 "role_tag": "owner",
             },
             {
@@ -196,7 +196,7 @@ class TestPaginationMapping:
                 "name": "admin",
                 "description": "",
                 "is_builtin": True,
-                "permission_keys": list(rbac_mod._LEGACY_ROLE_PERMISSION_KEYS["admin"]),
+                "permission_keys": list(dict.fromkeys(rbac_mod._LEGACY_ROLE_PERMISSION_KEYS["admin"])),
                 "role_tag": "",
             },
         ]
@@ -336,23 +336,6 @@ class TestResourceAccessScopeBindings:
 
 
 class TestPaginationForwarding:
-    def test_role_members_get_forwards_outer_pagination_params(self, app):
-        with (
-            app.test_request_context("/workspaces/current/rbac/roles/role-1/members?page=2&limit=50&reverse=true"),
-            patch("controllers.console.workspace.rbac._current_ids", return_value=("tenant-1", "acct-1")),
-            patch("controllers.console.workspace.rbac.svc.RBACService.Roles.members") as mock_members,
-            patch("controllers.console.workspace.rbac._dump", return_value={}),
-        ):
-            inspect.unwrap(rbac_mod.RBACRoleMembersApi.get)(rbac_mod.RBACRoleMembersApi(), "role-1")
-
-        _, _, role_id = mock_members.call_args.args
-        _, kwargs = mock_members.call_args
-        assert role_id == "role-1"
-        options = kwargs["options"]
-        assert options.page_number == 2
-        assert options.results_per_page == 50
-        assert options.reverse is True
-
     def test_access_policies_get_forwards_outer_pagination_params(self, app):
         with (
             app.test_request_context(
diff --git a/api/tests/unit_tests/controllers/inner_api/plugin/test_agent_drive.py b/api/tests/unit_tests/controllers/inner_api/plugin/test_agent_drive.py
index b8ad86017eb..8c38564b3d0 100644
--- a/api/tests/unit_tests/controllers/inner_api/plugin/test_agent_drive.py
+++ b/api/tests/unit_tests/controllers/inner_api/plugin/test_agent_drive.py
@@ -8,12 +8,13 @@ controller's request parsing + error mapping, not auth (tested separately).
 from __future__ import annotations
 
 import inspect
+from types import SimpleNamespace
 from unittest.mock import patch
 
 import pytest
 from flask import Flask
 
-from controllers.inner_api.plugin.agent_drive import AgentDriveCommitApi, AgentDriveManifestApi
+from controllers.inner_api.plugin.agent_drive import AgentDriveCommitApi, AgentDriveManifestApi, AgentDriveSkillsApi
 from services.agent_drive_service import AgentDriveError
 
 _MOD = "controllers.inner_api.plugin.agent_drive"
@@ -52,6 +53,41 @@ def test_manifest_bad_drive_ref_is_400():
     assert body["code"] == "invalid_drive_ref"
 
 
+def test_skills_requires_tenant_id_and_returns_items():
+    raw = _raw(AgentDriveSkillsApi.get)
+
+    with app.test_request_context("/"):
+        body, status = raw(AgentDriveSkillsApi(), "agent-agent-1")
+    assert status == 400
+    assert body["code"] == "missing_tenant_id"
+
+    with app.test_request_context("/?tenant_id=tenant-1"):
+        with patch(f"{_MOD}.AgentDriveService") as svc:
+            svc.return_value.list_skills.return_value = [
+                {
+                    "path": "tender-analyzer",
+                    "skill_md_key": "tender-analyzer/SKILL.md",
+                    "archive_key": None,
+                    "name": "Tender Analyzer",
+                    "description": "Parses RFPs.",
+                }
+            ]
+            result = raw(AgentDriveSkillsApi(), "agent-agent-1")
+
+    assert result == {
+        "items": [
+            {
+                "path": "tender-analyzer",
+                "skill_md_key": "tender-analyzer/SKILL.md",
+                "archive_key": None,
+                "name": "Tender Analyzer",
+                "description": "Parses RFPs.",
+            }
+        ]
+    }
+    assert svc.return_value.list_skills.call_args.kwargs == {"tenant_id": "tenant-1", "agent_id": "agent-1"}
+
+
 def test_commit_parses_body_and_returns_items():
     raw = _raw(AgentDriveCommitApi.post)
     payload = {
@@ -60,11 +96,35 @@ def test_commit_parses_body_and_returns_items():
         "items": [{"key": "a.txt", "file_ref": {"kind": "tool_file", "id": "tf-1"}}],
     }
     with app.test_request_context("/", method="POST", json=payload):
-        with patch(f"{_MOD}.AgentDriveService") as svc:
+        with (
+            patch(f"{_MOD}.get_user", return_value=SimpleNamespace(id="user-1")) as get_user,
+            patch(f"{_MOD}.AgentDriveService") as svc,
+        ):
             svc.return_value.commit.return_value = [{"key": "a.txt"}]
             result = raw(AgentDriveCommitApi(), "agent-agent-1")
     assert result == {"items": [{"key": "a.txt"}]}
+    assert get_user.call_args.args == ("tenant-1", "user-1")
     assert svc.return_value.commit.call_args.kwargs["agent_id"] == "agent-1"
+    assert svc.return_value.commit.call_args.kwargs["user_id"] == "user-1"
+
+
+def test_commit_canonicalizes_user_before_service_call():
+    raw = _raw(AgentDriveCommitApi.post)
+    payload = {
+        "tenant_id": "tenant-1",
+        "user_id": "session-1",
+        "items": [{"key": "a.txt", "file_ref": {"kind": "tool_file", "id": "tf-1"}}],
+    }
+    with app.test_request_context("/", method="POST", json=payload):
+        with (
+            patch(f"{_MOD}.get_user", return_value=SimpleNamespace(id="end-user-1")),
+            patch(f"{_MOD}.AgentDriveService") as svc,
+        ):
+            svc.return_value.commit.return_value = [{"key": "a.txt"}]
+            result = raw(AgentDriveCommitApi(), "agent-agent-1")
+
+    assert result == {"items": [{"key": "a.txt"}]}
+    assert svc.return_value.commit.call_args.kwargs["user_id"] == "end-user-1"
 
 
 def test_commit_invalid_body_is_400():
@@ -83,13 +143,16 @@ def test_commit_maps_service_error():
         "items": [{"key": "a.txt", "file_ref": {"kind": "tool_file", "id": "tf-1"}}],
     }
     with app.test_request_context("/", method="POST", json=payload):
-        with patch(f"{_MOD}.AgentDriveService") as svc:
+        with (
+            patch(f"{_MOD}.get_user", return_value=SimpleNamespace(id="user-1")),
+            patch(f"{_MOD}.AgentDriveService") as svc,
+        ):
             svc.return_value.commit.side_effect = AgentDriveError("source_not_found", "nope", status_code=404)
             body, status = raw(AgentDriveCommitApi(), "agent-agent-1")
     assert status == 404
     assert body["code"] == "source_not_found"
 
 
-@pytest.mark.parametrize("api_cls", [AgentDriveManifestApi, AgentDriveCommitApi])
+@pytest.mark.parametrize("api_cls", [AgentDriveManifestApi, AgentDriveSkillsApi, AgentDriveCommitApi])
 def test_endpoints_have_handlers(api_cls):
     assert callable(getattr(api_cls(), "get", None) or getattr(api_cls(), "post", None))
diff --git a/api/tests/unit_tests/controllers/inner_api/test_knowledge_retrieval.py b/api/tests/unit_tests/controllers/inner_api/test_knowledge_retrieval.py
index fa648e0335c..00eab81cbe6 100644
--- a/api/tests/unit_tests/controllers/inner_api/test_knowledge_retrieval.py
+++ b/api/tests/unit_tests/controllers/inner_api/test_knowledge_retrieval.py
@@ -1,5 +1,7 @@
-"""Unit tests for the inner knowledge retrieval controller."""
+"""Unit tests for the plugin inner knowledge retrieval controller."""
 
+from collections.abc import Iterator
+from contextlib import contextmanager
 from unittest.mock import patch
 
 import pytest
@@ -53,31 +55,38 @@ def _payload() -> dict[str, object]:
     }
 
 
+@contextmanager
+def _plugin_inner_auth() -> Iterator[None]:
+    with (
+        patch("configs.dify_config.PLUGIN_DAEMON_KEY", "plugin-daemon-key"),
+        patch("configs.dify_config.INNER_API_KEY_FOR_PLUGIN", "inner-key"),
+    ):
+        yield
+
+
 class TestInnerKnowledgeRetrieveApi:
-    def test_post_returns_401_when_api_key_missing(self, inner_api_app: Flask):
-        with patch("configs.dify_config.INNER_API", True):
+    def test_post_returns_404_when_api_key_missing(self, inner_api_app: Flask):
+        with _plugin_inner_auth():
             response = inner_api_app.test_client().post(
                 "/inner/api/knowledge/retrieve",
                 json=_payload(),
                 headers=_headers(api_key=None),
             )
 
-        assert response.status_code == 401
-        assert response.get_json()["code"] == "inner_api_unauthorized"
+        assert response.status_code == 404
 
-    def test_post_returns_401_when_api_key_invalid(self, inner_api_app: Flask):
-        with patch("configs.dify_config.INNER_API", True), patch("configs.dify_config.INNER_API_KEY", "inner-key"):
+    def test_post_returns_404_when_api_key_invalid(self, inner_api_app: Flask):
+        with _plugin_inner_auth():
             response = inner_api_app.test_client().post(
                 "/inner/api/knowledge/retrieve",
                 json=_payload(),
                 headers=_headers(api_key="wrong-key"),
             )
 
-        assert response.status_code == 401
-        assert response.get_json()["code"] == "inner_api_unauthorized"
+        assert response.status_code == 404
 
     def test_post_returns_400_for_invalid_body(self, inner_api_app: Flask):
-        with patch("configs.dify_config.INNER_API", True), patch("configs.dify_config.INNER_API_KEY", "inner-key"):
+        with _plugin_inner_auth():
             response = inner_api_app.test_client().post(
                 "/inner/api/knowledge/retrieve",
                 json={"caller": {"tenant_id": "tenant-1"}},
@@ -91,7 +100,7 @@ class TestInnerKnowledgeRetrieveApi:
     def test_post_returns_404_for_service_not_found_error(self, mock_retrieve, inner_api_app: Flask):
         mock_retrieve.side_effect = InnerKnowledgeRetrieveAppNotFoundError("app missing")
 
-        with patch("configs.dify_config.INNER_API", True), patch("configs.dify_config.INNER_API_KEY", "inner-key"):
+        with _plugin_inner_auth():
             response = inner_api_app.test_client().post(
                 "/inner/api/knowledge/retrieve",
                 json=_payload(),
@@ -105,7 +114,7 @@ class TestInnerKnowledgeRetrieveApi:
     def test_post_returns_403_for_service_forbidden_error(self, mock_retrieve, inner_api_app: Flask):
         mock_retrieve.side_effect = InnerKnowledgeRetrieveDatasetTenantMismatchError("wrong tenant")
 
-        with patch("configs.dify_config.INNER_API", True), patch("configs.dify_config.INNER_API_KEY", "inner-key"):
+        with _plugin_inner_auth():
             response = inner_api_app.test_client().post(
                 "/inner/api/knowledge/retrieve",
                 json=_payload(),
@@ -119,7 +128,7 @@ class TestInnerKnowledgeRetrieveApi:
     def test_post_returns_422_for_retrieval_config_value_error(self, mock_retrieve, inner_api_app: Flask):
         mock_retrieve.side_effect = ValueError("invalid reranking config")
 
-        with patch("configs.dify_config.INNER_API", True), patch("configs.dify_config.INNER_API_KEY", "inner-key"):
+        with _plugin_inner_auth():
             response = inner_api_app.test_client().post(
                 "/inner/api/knowledge/retrieve",
                 json=_payload(),
@@ -133,7 +142,7 @@ class TestInnerKnowledgeRetrieveApi:
     def test_post_returns_429_for_rate_limit_error(self, mock_retrieve, inner_api_app: Flask):
         mock_retrieve.side_effect = RateLimitExceededError("knowledge rate limited")
 
-        with patch("configs.dify_config.INNER_API", True), patch("configs.dify_config.INNER_API_KEY", "inner-key"):
+        with _plugin_inner_auth():
             response = inner_api_app.test_client().post(
                 "/inner/api/knowledge/retrieve",
                 json=_payload(),
@@ -147,7 +156,7 @@ class TestInnerKnowledgeRetrieveApi:
         payload = _payload()
         payload["metadata_filtering"] = {"mode": "manual"}
 
-        with patch("configs.dify_config.INNER_API", True), patch("configs.dify_config.INNER_API_KEY", "inner-key"):
+        with _plugin_inner_auth():
             response = inner_api_app.test_client().post(
                 "/inner/api/knowledge/retrieve",
                 json=payload,
@@ -161,7 +170,7 @@ class TestInnerKnowledgeRetrieveApi:
         payload = _payload()
         payload["metadata_filtering"] = {"mode": "automatic"}
 
-        with patch("configs.dify_config.INNER_API", True), patch("configs.dify_config.INNER_API_KEY", "inner-key"):
+        with _plugin_inner_auth():
             response = inner_api_app.test_client().post(
                 "/inner/api/knowledge/retrieve",
                 json=payload,
@@ -175,7 +184,7 @@ class TestInnerKnowledgeRetrieveApi:
     def test_post_returns_502_for_external_knowledge_failure(self, mock_retrieve, inner_api_app: Flask):
         mock_retrieve.side_effect = ExternalKnowledgeRetrievalError("upstream failed")
 
-        with patch("configs.dify_config.INNER_API", True), patch("configs.dify_config.INNER_API_KEY", "inner-key"):
+        with _plugin_inner_auth():
             response = inner_api_app.test_client().post(
                 "/inner/api/knowledge/retrieve",
                 json=_payload(),
@@ -219,7 +228,7 @@ class TestInnerKnowledgeRetrieveApi:
             ),
         )
 
-        with patch("configs.dify_config.INNER_API", True), patch("configs.dify_config.INNER_API_KEY", "inner-key"):
+        with _plugin_inner_auth():
             response = inner_api_app.test_client().post(
                 "/inner/api/knowledge/retrieve",
                 json=_payload(),
diff --git a/api/tests/unit_tests/controllers/inner_api/workspace/test_workspace.py b/api/tests/unit_tests/controllers/inner_api/workspace/test_workspace.py
index 7d2193adc69..25ae0778d4b 100644
--- a/api/tests/unit_tests/controllers/inner_api/workspace/test_workspace.py
+++ b/api/tests/unit_tests/controllers/inner_api/workspace/test_workspace.py
@@ -116,7 +116,9 @@ class TestEnterpriseWorkspace:
         assert result["tenant"]["id"] == "tenant-id"
         assert result["tenant"]["name"] == "My Workspace"
         mock_tenant_svc.create_tenant.assert_called_once_with("My Workspace", is_from_dashboard=True)
-        mock_tenant_svc.create_tenant_member.assert_called_once_with(mock_tenant, mock_account, role="owner")
+        mock_tenant_svc.create_tenant_member.assert_called_once_with(
+            mock_tenant, mock_account, mock_db.session, role="owner"
+        )
         mock_event.send.assert_called_once_with(mock_tenant)
 
     @patch("controllers.inner_api.workspace.workspace.db")
diff --git a/api/tests/unit_tests/controllers/openapi/_mode_constants.py b/api/tests/unit_tests/controllers/openapi/_mode_constants.py
new file mode 100644
index 00000000000..2a8e477c754
--- /dev/null
+++ b/api/tests/unit_tests/controllers/openapi/_mode_constants.py
@@ -0,0 +1,10 @@
+"""Shared mode lists for the openapi app-list query tests.
+
+Single source so adding/removing a listable app type is a one-line change
+across every query-validator test.
+"""
+
+from __future__ import annotations
+
+LISTABLE_MODES = ["completion", "chat", "advanced-chat", "workflow", "agent-chat"]
+NON_LISTABLE_MODES = ["rag-pipeline", "channel", "agent"]
diff --git a/api/tests/unit_tests/controllers/openapi/auth/test_composition.py b/api/tests/unit_tests/controllers/openapi/auth/test_composition.py
index 6c4a38b5d29..11cd1aa1380 100644
--- a/api/tests/unit_tests/controllers/openapi/auth/test_composition.py
+++ b/api/tests/unit_tests/controllers/openapi/auth/test_composition.py
@@ -1,16 +1,21 @@
 import uuid
 
 from controllers.openapi.auth.composition import account_pipeline, auth_router, external_sso_pipeline
-from controllers.openapi.auth.data import RequestContext
+from controllers.openapi.auth.data import RBACRequirement, RequestContext
 from controllers.openapi.auth.flow import When
 from controllers.openapi.auth.pipeline import AuthPipeline, PipelineRoute, PipelineRouter
 from controllers.openapi.auth.verify import (
+    check_acl,
+    check_private_app_permission,
+    check_rbac_permission,
     check_workspace_member,
     check_workspace_mismatch,
     check_workspace_role,
 )
-from libs.oauth_bearer import TokenType
+from core.rbac import RBACPermission, RBACResourceScope
+from libs.oauth_bearer import Scope, TokenType
 from models.account import TenantAccountRole
+from services.enterprise.enterprise_service import WebAppAccessMode
 
 
 def test_account_pipeline_is_auth_pipeline():
@@ -29,8 +34,8 @@ def test_account_pipeline_prepare_has_six_entries():
     assert len(account_pipeline._prepare) == 6
 
 
-def test_account_auth_list_has_seven_entries():
-    assert len(account_pipeline._auth) == 7
+def test_account_auth_list_has_eight_entries():
+    assert len(account_pipeline._auth) == 8
 
 
 def test_external_sso_pipeline_prepare_has_four_entries():
@@ -132,3 +137,89 @@ def test_app_path_selects_workspace_mismatch_check():
 def test_workspace_path_skips_workspace_mismatch_check():
     steps = _selected_auth_steps(app_id=False, workspace_membership=True, allowed_roles=None)
     assert check_workspace_mismatch not in steps
+
+
+def _selected_webapp_steps(*, scope, app_access_mode):
+    """Select auth steps for an EE, webapp-auth-enabled, app-scoped request.
+
+    Patches the config-backed conditions (edition + webapp_auth) so the gating
+    reduces to PATH_HAS_APP_ID, LOADED_APP_IS_PRIVATE, and the request scope.
+    """
+    from unittest.mock import MagicMock, patch
+
+    from controllers.openapi.auth.data import AuthData, Edition
+
+    ctx = RequestContext(
+        token_type=TokenType.OAUTH_ACCOUNT,
+        scope=scope,
+        path_params={"app_id": str(uuid.uuid4())},
+    )
+    data = AuthData(
+        token_type=TokenType.OAUTH_ACCOUNT,
+        token_hash="x",
+        scopes=frozenset({scope}) if scope is not None else frozenset(),
+        app_access_mode=app_access_mode,
+    )
+    features = MagicMock()
+    features.webapp_auth.enabled = True
+    selected = []
+    with (
+        patch("controllers.openapi.auth.conditions.current_edition", return_value=Edition.EE),
+        patch("controllers.openapi.auth.conditions.FeatureService.get_system_features", return_value=features),
+    ):
+        for step in account_pipeline._auth:
+            if isinstance(step, When):
+                if step.applies(ctx, data):
+                    selected.append(step._step)
+            else:
+                selected.append(step)
+    return selected
+
+
+def test_apps_run_scope_selects_webapp_checks():
+    steps = _selected_webapp_steps(scope=Scope.APPS_RUN, app_access_mode=WebAppAccessMode.PRIVATE)
+    assert check_acl in steps
+    assert check_private_app_permission in steps
+
+
+def test_management_scope_skips_webapp_checks_on_private_app():
+    # Export DSL et al. carry an app_id but use a management scope; the webapp
+    # end-user ACL / private-app gate must not block workspace members.
+    steps = _selected_webapp_steps(scope=Scope.APPS_READ, app_access_mode=WebAppAccessMode.PRIVATE)
+    assert check_acl not in steps
+    assert check_private_app_permission not in steps
+
+
+def _selected_auth_steps_with_rbac(rbac):
+    ctx = RequestContext(
+        token_type=TokenType.OAUTH_ACCOUNT,
+        scope=Scope.APPS_READ,
+        path_params={"app_id": str(uuid.uuid4())},
+        rbac=rbac,
+    )
+    selected = []
+    for step in account_pipeline._auth:
+        if isinstance(step, When):
+            if step.applies(ctx, None):
+                selected.append(step._step)
+        else:
+            selected.append(step)
+    return selected
+
+
+def test_account_pipeline_selects_rbac_step_when_required():
+    rbac = RBACRequirement(resource_type=RBACResourceScope.APP, scene=RBACPermission.APP_VIEW_LAYOUT)
+    assert check_rbac_permission in _selected_auth_steps_with_rbac(rbac)
+
+
+def test_account_pipeline_skips_rbac_step_without_requirement():
+    assert check_rbac_permission not in _selected_auth_steps_with_rbac(None)
+
+
+def test_external_sso_pipeline_never_enforces_rbac():
+    # RBAC is a console (account) concern; external SSO callers are scope-gated.
+    rbac_steps = [
+        s._step for s in external_sso_pipeline._auth if isinstance(s, When) and s._step is check_rbac_permission
+    ]
+    assert rbac_steps == []
+    assert check_rbac_permission not in external_sso_pipeline._auth
diff --git a/api/tests/unit_tests/controllers/openapi/auth/test_conditions.py b/api/tests/unit_tests/controllers/openapi/auth/test_conditions.py
index 159e5b42169..fa882ca96c4 100644
--- a/api/tests/unit_tests/controllers/openapi/auth/test_conditions.py
+++ b/api/tests/unit_tests/controllers/openapi/auth/test_conditions.py
@@ -5,19 +5,22 @@ from controllers.openapi.auth.conditions import (
     EDITION_EE,
     EDITION_SAAS,
     HAS_ALLOWED_ROLES,
+    HAS_RBAC,
     LOADED_APP_IS_PRIVATE,
     PATH_HAS_APP_ID,
     TOKEN_IS_OAUTH_ACCOUNT,
     TOKEN_IS_OAUTH_EXTERNAL_SSO,
     WEBAPP_AUTH_ENABLED,
+    WEBAPP_RUN_SCOPED,
     WORKSPACE_MEMBERSHIP_REQUIRED,
     Cond,
     config_cond,
     data_cond,
     request_cond,
 )
-from controllers.openapi.auth.data import AuthData, Edition, RequestContext
-from libs.oauth_bearer import TokenType
+from controllers.openapi.auth.data import AuthData, Edition, RBACRequirement, RequestContext
+from core.rbac import RBACPermission, RBACResourceScope
+from libs.oauth_bearer import Scope, TokenType
 from models.account import TenantAccountRole
 from services.enterprise.enterprise_service import WebAppAccessMode
 
@@ -137,6 +140,34 @@ def test_webapp_auth_enabled():
         assert WEBAPP_AUTH_ENABLED(_ctx()) is True
 
 
+def test_webapp_run_scoped_true_for_apps_run():
+    assert WEBAPP_RUN_SCOPED(_ctx(scope=Scope.APPS_RUN)) is True
+
+
+def test_webapp_run_scoped_false_for_management_scope():
+    assert WEBAPP_RUN_SCOPED(_ctx(scope=Scope.APPS_READ)) is False
+
+
+def test_webapp_run_scoped_false_when_scope_none():
+    assert WEBAPP_RUN_SCOPED(_ctx()) is False
+
+
+def _rbac_req():
+    return RBACRequirement(resource_type=RBACResourceScope.APP, scene=RBACPermission.APP_TEST_AND_RUN)
+
+
+def test_has_rbac_true():
+    assert HAS_RBAC(_ctx(rbac=_rbac_req())) is True
+
+
+def test_has_rbac_false():
+    assert HAS_RBAC(_ctx(rbac=None)) is False
+
+
+def test_has_rbac_default():
+    assert HAS_RBAC(_ctx()) is False
+
+
 def test_loaded_app_is_private():
     data_private = _data(app_access_mode=WebAppAccessMode.PRIVATE)
     data_public = _data(app_access_mode=WebAppAccessMode.PUBLIC)
diff --git a/api/tests/unit_tests/controllers/openapi/auth/test_verify.py b/api/tests/unit_tests/controllers/openapi/auth/test_verify.py
index 96de1a2eda3..012b9880a12 100644
--- a/api/tests/unit_tests/controllers/openapi/auth/test_verify.py
+++ b/api/tests/unit_tests/controllers/openapi/auth/test_verify.py
@@ -5,17 +5,19 @@ import pytest
 from flask import Flask
 from werkzeug.exceptions import Forbidden, NotFound
 
-from controllers.openapi.auth.data import AuthData
+from controllers.openapi.auth.data import AuthData, RBACRequirement
 from controllers.openapi.auth.verify import (
     check_acl,
     check_app_access,
     check_app_api_enabled,
     check_private_app_permission,
+    check_rbac_permission,
     check_scope,
     check_workspace_member,
     check_workspace_mismatch,
     check_workspace_role,
 )
+from core.rbac import RBACPermission, RBACResourceScope
 from libs.oauth_bearer import Scope, TokenType
 from models.account import Tenant, TenantAccountRole
 from models.model import App
@@ -75,6 +77,67 @@ def test_check_app_access_raises_when_not_member():
             check_app_access(data)
 
 
+# --- check_rbac_permission ---
+
+_RBAC_REQ = RBACRequirement(resource_type=RBACResourceScope.APP, scene=RBACPermission.APP_VIEW_LAYOUT)
+
+
+def test_check_rbac_noop_when_no_requirement():
+    with patch("controllers.openapi.auth.verify.enforce_rbac_access") as mock_enforce:
+        check_rbac_permission(_data(rbac=None, caller_kind="account"))
+    mock_enforce.assert_not_called()
+
+
+def test_check_rbac_noop_when_rbac_disabled():
+    with (
+        patch("controllers.openapi.auth.verify.dify_config.RBAC_ENABLED", False),
+        patch("controllers.openapi.auth.verify.enforce_rbac_access") as mock_enforce,
+    ):
+        check_rbac_permission(_data(rbac=_RBAC_REQ, caller_kind="account"))
+    mock_enforce.assert_not_called()
+
+
+def test_check_rbac_skips_end_user_caller():
+    with (
+        patch("controllers.openapi.auth.verify.dify_config.RBAC_ENABLED", True),
+        patch("controllers.openapi.auth.verify.enforce_rbac_access") as mock_enforce,
+    ):
+        check_rbac_permission(_data(rbac=_RBAC_REQ, caller_kind="end_user"))
+    mock_enforce.assert_not_called()
+
+
+def test_check_rbac_raises_when_context_missing():
+    with patch("controllers.openapi.auth.verify.dify_config.RBAC_ENABLED", True):
+        with pytest.raises(Forbidden, match="rbac context missing"):
+            check_rbac_permission(_data(rbac=_RBAC_REQ, caller_kind="account", account_id=None, tenant=None))
+
+
+def test_check_rbac_enforces_for_account_caller():
+    tenant = MagicMock(spec=Tenant)
+    tenant.id = "t1"
+    account_id = uuid.uuid4()
+    data = _data(
+        rbac=_RBAC_REQ,
+        caller_kind="account",
+        account_id=account_id,
+        tenant=tenant,
+        path_params={"app_id": "app-1"},
+    )
+    with (
+        patch("controllers.openapi.auth.verify.dify_config.RBAC_ENABLED", True),
+        patch("controllers.openapi.auth.verify.enforce_rbac_access") as mock_enforce,
+    ):
+        check_rbac_permission(data)
+    mock_enforce.assert_called_once_with(
+        tenant_id="t1",
+        account_id=str(account_id),
+        resource_type=RBACResourceScope.APP,
+        scene=RBACPermission.APP_VIEW_LAYOUT,
+        resource_required=True,
+        path_args={"app_id": "app-1"},
+    )
+
+
 def test_check_acl_raises_when_app_or_mode_missing():
     with pytest.raises(Forbidden):
         check_acl(_data(app=None, app_access_mode=None))
diff --git a/api/tests/unit_tests/controllers/openapi/conftest.py b/api/tests/unit_tests/controllers/openapi/conftest.py
index d79b5bd642c..3a900011f54 100644
--- a/api/tests/unit_tests/controllers/openapi/conftest.py
+++ b/api/tests/unit_tests/controllers/openapi/conftest.py
@@ -20,6 +20,7 @@ def _stub_execute(
     edition=None,
     workspace_membership=False,
     allowed_roles=None,
+    rbac=None,
 ):
     """Bypass all auth logic; inject minimal AuthData and call the view directly."""
     kwargs["auth_data"] = AuthData(
@@ -30,6 +31,7 @@ def _stub_execute(
         scopes=frozenset({Scope.FULL}),
         required_scope=scope,
         allowed_roles=allowed_roles,
+        rbac=rbac,
     )
     return view(*args, **kwargs)
 
diff --git a/api/tests/unit_tests/controllers/openapi/test_app_describe_builder.py b/api/tests/unit_tests/controllers/openapi/test_app_describe_builder.py
new file mode 100644
index 00000000000..708a0e59865
--- /dev/null
+++ b/api/tests/unit_tests/controllers/openapi/test_app_describe_builder.py
@@ -0,0 +1,73 @@
+from types import SimpleNamespace
+
+from controllers.openapi._input_schema import EMPTY_INPUT_SCHEMA
+from controllers.openapi.apps import _EMPTY_PARAMETERS, build_app_describe_response
+from controllers.service_api.app.error import AppUnavailableError
+
+
+class _FakeApp(SimpleNamespace):
+    pass
+
+
+def _app() -> _FakeApp:
+    from datetime import datetime
+
+    return _FakeApp(
+        id="11111111-1111-1111-1111-111111111111",
+        name="Demo",
+        mode="chat",
+        description="d",
+        tags=[],
+        author_name="me",
+        updated_at=datetime(2026, 1, 1),
+        enable_api=True,
+    )
+
+
+def test_fields_none_returns_all_blocks(monkeypatch):
+    monkeypatch.setattr("controllers.openapi.apps.parameters_payload", lambda app: {"k": "v"})
+    monkeypatch.setattr("controllers.openapi.apps.build_input_schema", lambda app: {"s": 1})
+    resp = build_app_describe_response(_app(), None)
+    assert resp.info is not None
+    assert resp.info.name == "Demo"
+    assert resp.parameters == {"k": "v"}
+    assert resp.input_schema == {"s": 1}
+
+
+def test_fields_subset_limits_blocks(monkeypatch):
+    monkeypatch.setattr("controllers.openapi.apps.parameters_payload", lambda app: {"k": "v"})
+    monkeypatch.setattr("controllers.openapi.apps.build_input_schema", lambda app: {"s": 1})
+    resp = build_app_describe_response(_app(), ["info"])
+    assert resp.info is not None
+    assert resp.parameters is None
+    assert resp.input_schema is None
+
+
+def test_info_omits_author_and_tags(monkeypatch):
+    monkeypatch.setattr("controllers.openapi.apps.parameters_payload", lambda app: {})
+    monkeypatch.setattr("controllers.openapi.apps.build_input_schema", lambda app: {})
+    resp = build_app_describe_response(_app(), ["info"])
+    assert resp.info is not None
+    # Usage-face describe must not expose creator identity or tags (cross-tenant leak).
+    assert not hasattr(resp.info, "author")
+    assert not hasattr(resp.info, "tags")
+
+
+def test_parameters_fallback_on_app_unavailable(monkeypatch):
+    def _raise(app):
+        raise AppUnavailableError()
+
+    monkeypatch.setattr("controllers.openapi.apps.parameters_payload", _raise)
+    monkeypatch.setattr("controllers.openapi.apps.build_input_schema", lambda app: {"s": 1})
+    resp = build_app_describe_response(_app(), ["parameters"])
+    assert resp.parameters == dict(_EMPTY_PARAMETERS)
+
+
+def test_input_schema_fallback_on_app_unavailable(monkeypatch):
+    def _raise(app):
+        raise AppUnavailableError()
+
+    monkeypatch.setattr("controllers.openapi.apps.parameters_payload", lambda app: {"k": "v"})
+    monkeypatch.setattr("controllers.openapi.apps.build_input_schema", _raise)
+    resp = build_app_describe_response(_app(), ["input_schema"])
+    assert resp.input_schema == dict(EMPTY_INPUT_SCHEMA)
diff --git a/api/tests/unit_tests/controllers/openapi/test_app_list_query.py b/api/tests/unit_tests/controllers/openapi/test_app_list_query.py
index 9d207b1930a..7cc2149baff 100644
--- a/api/tests/unit_tests/controllers/openapi/test_app_list_query.py
+++ b/api/tests/unit_tests/controllers/openapi/test_app_list_query.py
@@ -4,8 +4,8 @@ Runs against the model directly, not the HTTP layer. Pins:
 - defaults match the plan (page=1, limit=20).
 - workspace_id is required.
 - numeric bounds enforced (page >= 1, limit in [1, MAX_PAGE_LIMIT]).
-- mode validates against the AppMode enum.
-- name and tag have length caps.
+- mode validates against the SupportedAppType enum (listable app types only).
+- name has a length cap.
 """
 
 from __future__ import annotations
@@ -16,15 +16,18 @@ from pydantic import ValidationError
 from controllers.openapi._models import MAX_PAGE_LIMIT
 from controllers.openapi.apps import AppListQuery
 
+from ._mode_constants import LISTABLE_MODES, NON_LISTABLE_MODES
+
+WS_ID = "00000000-0000-0000-0000-000000000001"
+
 
 def test_defaults():
-    q = AppListQuery.model_validate({"workspace_id": "00000000-0000-0000-0000-000000000001"})
-    assert q.workspace_id == "00000000-0000-0000-0000-000000000001"
+    q = AppListQuery.model_validate({"workspace_id": WS_ID})
+    assert q.workspace_id == WS_ID
     assert q.page == 1
     assert q.limit == 20
     assert q.mode is None
     assert q.name is None
-    assert q.tag is None
 
 
 def test_workspace_id_required():
@@ -34,74 +37,73 @@ def test_workspace_id_required():
 
 def test_page_must_be_positive():
     with pytest.raises(ValidationError):
-        AppListQuery.model_validate({"workspace_id": "00000000-0000-0000-0000-000000000001", "page": 0})
+        AppListQuery.model_validate({"workspace_id": WS_ID, "page": 0})
     with pytest.raises(ValidationError):
-        AppListQuery.model_validate({"workspace_id": "00000000-0000-0000-0000-000000000001", "page": -1})
+        AppListQuery.model_validate({"workspace_id": WS_ID, "page": -1})
 
 
 def test_page_rejects_non_integer_string():
     with pytest.raises(ValidationError):
-        AppListQuery.model_validate({"workspace_id": "00000000-0000-0000-0000-000000000001", "page": "abc"})
+        AppListQuery.model_validate({"workspace_id": WS_ID, "page": "abc"})
 
 
 def test_limit_must_be_positive():
     with pytest.raises(ValidationError):
-        AppListQuery.model_validate({"workspace_id": "00000000-0000-0000-0000-000000000001", "limit": 0})
+        AppListQuery.model_validate({"workspace_id": WS_ID, "limit": 0})
     with pytest.raises(ValidationError):
-        AppListQuery.model_validate({"workspace_id": "00000000-0000-0000-0000-000000000001", "limit": -1})
+        AppListQuery.model_validate({"workspace_id": WS_ID, "limit": -1})
 
 
 def test_limit_caps_at_max_page_limit():
     # Boundary accepts.
-    q = AppListQuery.model_validate({"workspace_id": "00000000-0000-0000-0000-000000000001", "limit": MAX_PAGE_LIMIT})
+    q = AppListQuery.model_validate({"workspace_id": WS_ID, "limit": MAX_PAGE_LIMIT})
     assert q.limit == MAX_PAGE_LIMIT
 
     # Just over rejects.
     with pytest.raises(ValidationError):
-        AppListQuery.model_validate(
-            {"workspace_id": "00000000-0000-0000-0000-000000000001", "limit": MAX_PAGE_LIMIT + 1}
-        )
+        AppListQuery.model_validate({"workspace_id": WS_ID, "limit": MAX_PAGE_LIMIT + 1})
 
 
-def test_mode_whitelisted_against_app_mode():
-    # Valid mode passes.
-    q = AppListQuery.model_validate({"workspace_id": "00000000-0000-0000-0000-000000000001", "mode": "chat"})
+@pytest.mark.parametrize("mode", LISTABLE_MODES)
+def test_mode_accepts_listable_app_types(mode: str):
+    q = AppListQuery.model_validate({"workspace_id": WS_ID, "mode": mode})
     assert q.mode is not None
-    assert q.mode.value == "chat"
+    assert q.mode.value == mode
 
-    # Invalid mode rejects.
+
+def test_mode_rejects_unknown_value():
     with pytest.raises(ValidationError):
-        AppListQuery.model_validate({"workspace_id": "00000000-0000-0000-0000-000000000001", "mode": "not-a-mode"})
+        AppListQuery.model_validate({"workspace_id": WS_ID, "mode": "not-a-mode"})
+
+
+@pytest.mark.parametrize("mode", NON_LISTABLE_MODES)
+def test_mode_rejects_non_listable_app_modes(mode: str):
+    """rag-pipeline (a knowledge Pipeline), channel (unused) and agent (roster-owned)
+    are AppMode members but not standalone listable apps — the `app` face rejects them."""
+    with pytest.raises(ValidationError):
+        AppListQuery.model_validate({"workspace_id": WS_ID, "mode": mode})
 
 
 def test_name_length_capped():
-    AppListQuery.model_validate({"workspace_id": "00000000-0000-0000-0000-000000000001", "name": "x" * 200})
+    AppListQuery.model_validate({"workspace_id": WS_ID, "name": "x" * 200})
     with pytest.raises(ValidationError):
-        AppListQuery.model_validate({"workspace_id": "00000000-0000-0000-0000-000000000001", "name": "x" * 201})
-
-
-def test_tag_length_capped():
-    AppListQuery.model_validate({"workspace_id": "00000000-0000-0000-0000-000000000001", "tag": "x" * 100})
-    with pytest.raises(ValidationError):
-        AppListQuery.model_validate({"workspace_id": "00000000-0000-0000-0000-000000000001", "tag": "x" * 101})
+        AppListQuery.model_validate({"workspace_id": WS_ID, "name": "x" * 201})
 
 
 def test_all_fields_accept_valid_values():
     """Pin the happy-path acceptance for every field in one place."""
     q = AppListQuery.model_validate(
         {
-            "workspace_id": "00000000-0000-0000-0000-000000000001",
+            "workspace_id": WS_ID,
             "page": 5,
             "limit": 50,
             "mode": "workflow",
             "name": "search",
-            "tag": "prod",
         }
     )
-    assert q.workspace_id == "00000000-0000-0000-0000-000000000001"
+    assert q.workspace_id == WS_ID
     assert q.page == 5
     assert q.limit == 50
     assert q.mode is not None
     assert q.mode.value == "workflow"
     assert q.name == "search"
-    assert q.tag == "prod"
diff --git a/api/tests/unit_tests/controllers/openapi/test_app_payloads.py b/api/tests/unit_tests/controllers/openapi/test_app_payloads.py
index 64cdc382500..12bf4c696f2 100644
--- a/api/tests/unit_tests/controllers/openapi/test_app_payloads.py
+++ b/api/tests/unit_tests/controllers/openapi/test_app_payloads.py
@@ -10,9 +10,11 @@ import pytest
 
 from controllers.openapi.apps import (  # pyright: ignore[reportPrivateUsage]
     _EMPTY_PARAMETERS,
+    _is_listable,
     parameters_payload,
 )
 from controllers.service_api.app.error import AppUnavailableError
+from models.model import AppMode
 
 
 def _fake_app(**overrides):
@@ -53,3 +55,16 @@ def test_empty_parameters_constant_matches_describe_fallback_shape():
     assert _EMPTY_PARAMETERS["opening_statement"] is None
     assert _EMPTY_PARAMETERS["file_upload"] is None
     assert _EMPTY_PARAMETERS["system_parameters"] == {}
+
+
+@pytest.mark.parametrize(
+    "mode",
+    [AppMode.COMPLETION, AppMode.CHAT, AppMode.ADVANCED_CHAT, AppMode.WORKFLOW, AppMode.AGENT_CHAT],
+)
+def test_is_listable_accepts_supported_app_types(mode):
+    assert _is_listable(_fake_app(mode=mode)) is True
+
+
+@pytest.mark.parametrize("mode", [AppMode.AGENT, AppMode.CHANNEL, AppMode.RAG_PIPELINE])
+def test_is_listable_hides_non_app_modes(mode):
+    assert _is_listable(_fake_app(mode=mode)) is False
diff --git a/api/tests/unit_tests/controllers/openapi/test_apps_permitted_external_query.py b/api/tests/unit_tests/controllers/openapi/test_apps_permitted_external_query.py
index 96873b04f46..0f530e3c3c7 100644
--- a/api/tests/unit_tests/controllers/openapi/test_apps_permitted_external_query.py
+++ b/api/tests/unit_tests/controllers/openapi/test_apps_permitted_external_query.py
@@ -13,6 +13,8 @@ from pydantic import ValidationError
 
 from controllers.openapi.apps_permitted_external import PermittedExternalAppsListQuery
 
+from ._mode_constants import NON_LISTABLE_MODES
+
 
 def test_query_defaults_match_apps_list():
     q = PermittedExternalAppsListQuery.model_validate({})
@@ -36,11 +38,18 @@ def test_query_rejects_tag():
         PermittedExternalAppsListQuery.model_validate({"tag": "prod"})
 
 
-def test_query_validates_mode_against_app_mode():
+def test_query_validates_mode_against_supported_app_type():
     with pytest.raises(ValidationError):
         PermittedExternalAppsListQuery.model_validate({"mode": "not-a-mode"})
 
 
+@pytest.mark.parametrize("mode", NON_LISTABLE_MODES)
+def test_query_rejects_non_listable_app_modes(mode: str):
+    """Non-app runtime modes and roster-owned agent are not listable here."""
+    with pytest.raises(ValidationError):
+        PermittedExternalAppsListQuery.model_validate({"mode": mode})
+
+
 def test_query_clamps_limit_at_max():
     with pytest.raises(ValidationError):
         PermittedExternalAppsListQuery.model_validate({"limit": 500})
diff --git a/api/tests/unit_tests/controllers/openapi/test_error_contract.py b/api/tests/unit_tests/controllers/openapi/test_error_contract.py
index 45a577443b7..788a7215ed2 100644
--- a/api/tests/unit_tests/controllers/openapi/test_error_contract.py
+++ b/api/tests/unit_tests/controllers/openapi/test_error_contract.py
@@ -26,11 +26,13 @@ from controllers.openapi._errors import (
     ErrorBody,
     ErrorDetail,
     FilenameNotExists,
+    HumanInputFormNotFound,
     MemberLicenseExceeded,
     MemberLimitExceeded,
     OpenApiError,
     OpenApiErrorCode,
     OpenApiErrorFormatter,
+    RecipientSurfaceMismatch,
 )
 from controllers.service_api.app.error import (
     AppUnavailableError,
@@ -319,6 +321,8 @@ ERROR_MATRIX = [
     (BlockedFileExtensionError(), 400, "file_extension_blocked"),
     (MemberLimitExceeded(), 403, "member_limit_exceeded"),
     (MemberLicenseExceeded(), 403, "member_license_exceeded"),
+    (HumanInputFormNotFound(), 404, "form_not_found"),
+    (RecipientSurfaceMismatch(), 403, "recipient_surface_mismatch"),
 ]
 
 
diff --git a/api/tests/unit_tests/controllers/openapi/test_human_input_form.py b/api/tests/unit_tests/controllers/openapi/test_human_input_form.py
index f8d296deb3e..5659cd6eeff 100644
--- a/api/tests/unit_tests/controllers/openapi/test_human_input_form.py
+++ b/api/tests/unit_tests/controllers/openapi/test_human_input_form.py
@@ -11,8 +11,9 @@ from unittest.mock import Mock
 
 import pytest
 from flask import Flask
-from werkzeug.exceptions import NotFound, UnprocessableEntity
+from werkzeug.exceptions import UnprocessableEntity
 
+from controllers.openapi._errors import HumanInputFormNotFound, RecipientSurfaceMismatch
 from controllers.openapi.auth.data import AuthData
 from libs.oauth_bearer import Scope, TokenType
 from models.human_input import RecipientType
@@ -89,7 +90,7 @@ class TestOpenApiHumanInputFormGet:
         caller = SimpleNamespace(id="acct-1")
 
         with app.test_request_context("/openapi/v1/apps/app-1/form/human_input/bad"):
-            with pytest.raises(NotFound):
+            with pytest.raises(HumanInputFormNotFound):
                 api.get.__wrapped__(
                     api,
                     app_id="app-1",
@@ -101,7 +102,10 @@ class TestOpenApiHumanInputFormGet:
         from controllers.openapi.human_input_form import OpenApiWorkflowHumanInputFormApi
 
         form = SimpleNamespace(
-            app_id="other-app", tenant_id="tenant-1", expiration_time=datetime(2099, 1, 1, tzinfo=UTC)
+            app_id="other-app",
+            tenant_id="tenant-1",
+            recipient_type=RecipientType.STANDALONE_WEB_APP,
+            expiration_time=datetime(2099, 1, 1, tzinfo=UTC),
         )
         service_mock = Mock()
         service_mock.get_form_by_token.return_value = form
@@ -114,7 +118,7 @@ class TestOpenApiHumanInputFormGet:
         caller = SimpleNamespace(id="acct-1")
 
         with app.test_request_context("/openapi/v1/apps/app-1/form/human_input/tok-1"):
-            with pytest.raises(NotFound):
+            with pytest.raises(HumanInputFormNotFound):
                 api.get.__wrapped__(
                     api,
                     app_id="app-1",
@@ -142,7 +146,7 @@ class TestOpenApiHumanInputFormGet:
         caller = SimpleNamespace(id="acct-1")
 
         with app.test_request_context("/openapi/v1/apps/app-1/form/human_input/tok-1"):
-            with pytest.raises(NotFound):
+            with pytest.raises(RecipientSurfaceMismatch):
                 api.get.__wrapped__(
                     api,
                     app_id="app-1",
@@ -234,6 +238,38 @@ class TestOpenApiHumanInputFormPost:
         )
         assert result == ({}, 200)
 
+    def test_post_standalone_web_app_recipient_submits(
+        self, app: Flask, bypass_pipeline, monkeypatch: pytest.MonkeyPatch
+    ):
+        from controllers.openapi.human_input_form import OpenApiWorkflowHumanInputFormApi
+
+        form = self._make_form(recipient_type=RecipientType.STANDALONE_WEB_APP)
+        service_mock = Mock()
+        service_mock.get_form_by_token.return_value = form
+
+        module = sys.modules["controllers.openapi.human_input_form"]
+        monkeypatch.setattr(module, "HumanInputService", lambda _engine: service_mock)
+        monkeypatch.setattr(module, "db", SimpleNamespace(engine=object()))
+
+        api = OpenApiWorkflowHumanInputFormApi()
+        app_model = SimpleNamespace(id="app-1", tenant_id="tenant-1")
+        caller = SimpleNamespace(id="anyone")
+
+        with app.test_request_context(
+            "/openapi/v1/apps/app-1/form/human_input/tok-1",
+            method="POST",
+            json={"action": "approve", "inputs": {}},
+        ):
+            result = api.post.__wrapped__(
+                api,
+                app_id="app-1",
+                form_token="tok-1",
+                auth_data=_make_auth_data(app_model, caller, "end_user"),
+            )
+
+        service_mock.submit_form_by_token.assert_called_once()
+        assert result == ({}, 200)
+
     def test_post_rejects_invalid_body_with_422(self, app: Flask, bypass_pipeline):
         """Malformed body → 422 via @accepts (was an unmapped pydantic error → 500)."""
         from controllers.openapi.human_input_form import OpenApiWorkflowHumanInputFormApi
diff --git a/api/tests/unit_tests/controllers/openapi/test_pagination_envelope.py b/api/tests/unit_tests/controllers/openapi/test_pagination_envelope.py
index 930647608fa..7b84911d788 100644
--- a/api/tests/unit_tests/controllers/openapi/test_pagination_envelope.py
+++ b/api/tests/unit_tests/controllers/openapi/test_pagination_envelope.py
@@ -63,23 +63,19 @@ def test_envelope_uses_pep695_generics():
 
 
 def test_app_info_response_dump_matches_spec():
-    from controllers.openapi._models import AppInfoResponse
+    from controllers.openapi._models import AppInfo
 
-    obj = AppInfoResponse(
+    obj = AppInfo(
         id="app1",
         name="X",
         description="d",
         mode="chat",
-        author="alice",
-        tags=[{"name": "prod"}],
     )
     assert obj.model_dump(mode="json") == {
         "id": "app1",
         "name": "X",
         "description": "d",
         "mode": "chat",
-        "author": "alice",
-        "tags": [{"name": "prod"}],
     }
 
 
@@ -91,8 +87,6 @@ def test_app_describe_response_nests_info_and_parameters():
         name="X",
         mode="chat",
         description=None,
-        tags=[],
-        author=None,
         updated_at="2026-05-05T00:00:00+00:00",
         service_api_enabled=True,
     )
diff --git a/api/tests/unit_tests/controllers/openapi/test_supported_app_type.py b/api/tests/unit_tests/controllers/openapi/test_supported_app_type.py
new file mode 100644
index 00000000000..3af1c148644
--- /dev/null
+++ b/api/tests/unit_tests/controllers/openapi/test_supported_app_type.py
@@ -0,0 +1,24 @@
+"""Unit tests for SupportedAppType — the listable subset of AppMode that the
+openapi `app` face (`get app`) exposes and the CLI `--mode` whitelist derives from.
+"""
+
+from __future__ import annotations
+
+from controllers.openapi._models import SUPPORTED_APP_TYPES, SupportedAppType
+from models.model import AppMode
+
+
+def test_supported_app_type_is_the_listable_subset_of_app_mode():
+    """SupportedAppType (and the derived SUPPORTED_APP_TYPES tuple) is exactly the
+    curated, listable subset of AppMode; non-app/runtime modes stay out."""
+    assert {t.value for t in SupportedAppType} == {
+        "completion",
+        "chat",
+        "advanced-chat",
+        "workflow",
+        "agent-chat",
+    }
+    assert set(SUPPORTED_APP_TYPES) <= set(AppMode)
+    assert AppMode.AGENT not in SUPPORTED_APP_TYPES
+    assert AppMode.RAG_PIPELINE not in SUPPORTED_APP_TYPES
+    assert AppMode.CHANNEL not in SUPPORTED_APP_TYPES
diff --git a/api/tests/unit_tests/controllers/service_api/app/test_app.py b/api/tests/unit_tests/controllers/service_api/app/test_app.py
index 437bed9be48..9bc020b8b8f 100644
--- a/api/tests/unit_tests/controllers/service_api/app/test_app.py
+++ b/api/tests/unit_tests/controllers/service_api/app/test_app.py
@@ -136,6 +136,55 @@ class TestAppParameterApi:
         assert "user_input_form" in response
         assert "opening_statement" in response
 
+    @patch("controllers.service_api.wraps.user_logged_in")
+    @patch("controllers.service_api.wraps.current_app")
+    @patch("controllers.service_api.wraps.validate_and_get_api_token")
+    @patch("controllers.service_api.wraps.db")
+    @patch("controllers.service_api.app.app._get_agent_app_feature_dict_and_user_input_form")
+    def test_get_parameters_for_agent_app(
+        self,
+        mock_get_agent_parameters,
+        mock_db,
+        mock_validate_token,
+        mock_current_app,
+        mock_user_logged_in,
+        app: Flask,
+        mock_app_model,
+    ):
+        """Test retrieving parameters for an Agent App from Agent Soul app variables."""
+        _configure_current_app_mock(mock_current_app)
+
+        mock_app_model.mode = AppMode.AGENT
+        mock_app_model.app_model_config = None
+        mock_app_model.workflow = None
+        mock_get_agent_parameters.return_value = (
+            {"opening_statement": "Hi from Agent"},
+            [{"text-input": {"label": "topic", "variable": "topic", "required": True}}],
+        )
+
+        mock_api_token = Mock()
+        mock_api_token.app_id = mock_app_model.id
+        mock_api_token.tenant_id = mock_app_model.tenant_id
+        mock_validate_token.return_value = mock_api_token
+
+        mock_tenant = Mock()
+        mock_tenant.status = TenantStatus.NORMAL
+        mock_db.session.get.side_effect = [mock_app_model, mock_tenant]
+
+        mock_account = Mock()
+        mock_account.current_tenant = mock_tenant
+        setup_mock_tenant_owner_execute_result(mock_db, mock_tenant, mock_account)
+
+        with app.test_request_context("/parameters", method="GET", headers={"Authorization": "Bearer test_token"}):
+            api = AppParameterApi()
+            response = api.get()
+
+        assert response["opening_statement"] == "Hi from Agent"
+        assert response["user_input_form"] == [
+            {"text-input": {"label": "topic", "variable": "topic", "required": True}}
+        ]
+        mock_get_agent_parameters.assert_called_once_with(mock_app_model)
+
     @patch("controllers.service_api.wraps.user_logged_in")
     @patch("controllers.service_api.wraps.current_app")
     @patch("controllers.service_api.wraps.validate_and_get_api_token")
diff --git a/api/tests/unit_tests/controllers/service_api/app/test_hitl_service_api.py b/api/tests/unit_tests/controllers/service_api/app/test_hitl_service_api.py
index 8686f49a4a8..576b95110a0 100644
--- a/api/tests/unit_tests/controllers/service_api/app/test_hitl_service_api.py
+++ b/api/tests/unit_tests/controllers/service_api/app/test_hitl_service_api.py
@@ -29,7 +29,7 @@ from core.app.entities.task_entities import (
     WorkflowPauseStreamResponse,
 )
 from core.app.layers.pause_state_persist_layer import WorkflowResumptionContext, _WorkflowGenerateEntityWrapper
-from core.workflow.human_input_policy import HumanInputSurface
+from core.workflow.human_input_policy import FormDisposition, HumanInputSurface
 from core.workflow.system_variables import build_system_variables
 from graphon.entities import WorkflowStartReason
 from graphon.entities.pause_reason import HumanInputRequired, PauseReasonType
@@ -592,8 +592,10 @@ class TestHitlServiceApi:
         monkeypatch.setattr(workflow_response_converter, "db", SimpleNamespace(engine=object()))
         monkeypatch.setattr(
             workflow_response_converter,
-            "load_form_tokens_by_form_id",
-            lambda form_ids, session=None, surface=None: {"form-1": "token"},
+            "load_form_dispositions_by_form_id",
+            lambda form_ids, session=None, surface=None: {
+                "form-1": FormDisposition(form_token="token", approval_channels=[])
+            },
         )
 
         reason = HumanInputRequired(
@@ -652,8 +654,10 @@ class TestHitlServiceApi:
         snapshot = _build_snapshot(WorkflowNodeExecutionStatus.PAUSED)
         resumption_context = _build_resumption_context("task-ctx")
         monkeypatch.setattr(
-            "services.workflow_event_snapshot_service.load_form_tokens_by_form_id",
-            lambda form_ids, session=None, surface=None: {"form-1": "wtok"},
+            "services.workflow_event_snapshot_service.load_form_dispositions_by_form_id",
+            lambda form_ids, session=None, surface=None: {
+                "form-1": FormDisposition(form_token="wtok", approval_channels=[])
+            },
         )
 
         class _SessionContext:
diff --git a/api/tests/unit_tests/core/app/app_config/easy_ui_based_app/test_dataset_manager.py b/api/tests/unit_tests/core/app/app_config/easy_ui_based_app/test_dataset_manager.py
index d5305d2fc0b..e4e4f99c6d4 100644
--- a/api/tests/unit_tests/core/app/app_config/easy_ui_based_app/test_dataset_manager.py
+++ b/api/tests/unit_tests/core/app/app_config/easy_ui_based_app/test_dataset_manager.py
@@ -318,3 +318,26 @@ class TestIsDatasetExists:
             return_value=mock_dataset,
         )
         assert not DatasetConfigManager.is_dataset_exists("tenant1", valid_uuid)
+
+
+# ==============================
+# extract_dataset_config_for_legacy_compatibility tests
+# ==============================
+
+
+class TestExtractDatasetConfigForLegacyCompatibility:
+    def test_skips_empty_tool_entry(self):
+        # A malformed empty tool dict in agent_mode.tools must be skipped, not
+        # crash with `IndexError` on `list(tool.keys())[0]`. The sibling
+        # convert() already guards this with `if len(tool) == 1`.
+        config = {
+            "agent_mode": {
+                "enabled": True,
+                "strategy": PlanningStrategy.ROUTER,
+                "tools": [{}],
+            }
+        }
+
+        result = DatasetConfigManager.extract_dataset_config_for_legacy_compatibility("tenant1", AppMode.CHAT, config)
+
+        assert result["agent_mode"]["tools"] == [{}]
diff --git a/api/tests/unit_tests/core/app/apps/advanced_chat/test_app_runner_conversation_variables.py b/api/tests/unit_tests/core/app/apps/advanced_chat/test_app_runner_conversation_variables.py
index ac9eddb680f..1970e5c1522 100644
--- a/api/tests/unit_tests/core/app/apps/advanced_chat/test_app_runner_conversation_variables.py
+++ b/api/tests/unit_tests/core/app/apps/advanced_chat/test_app_runner_conversation_variables.py
@@ -25,6 +25,15 @@ MINIMAL_GRAPH = {
 }
 
 
+def _patch_create_session(mock_session: MagicMock):
+    session_context = MagicMock()
+    session_context.__enter__.return_value = mock_session
+    session_context.__exit__.return_value = False
+    mock_session.begin.return_value.__enter__.return_value = mock_session
+    mock_session.begin.return_value.__exit__.return_value = False
+    return patch("core.app.apps.advanced_chat.app_runner.create_session", return_value=session_context)
+
+
 class TestAdvancedChatAppRunnerConversationVariables:
     """Test that AdvancedChatAppRunner correctly handles conversation variables."""
 
@@ -135,10 +144,8 @@ class TestAdvancedChatAppRunnerConversationVariables:
 
         # Patch the necessary components
         with (
-            patch("core.app.apps.advanced_chat.app_runner.sessionmaker") as mock_sessionmaker,
-            patch("core.app.apps.advanced_chat.app_runner.Session") as mock_session_class,
+            _patch_create_session(mock_session),
             patch("core.app.apps.advanced_chat.app_runner.select") as mock_select,
-            patch("core.app.apps.advanced_chat.app_runner.db") as mock_db,
             patch.object(runner, "_init_graph") as mock_init_graph,
             patch.object(
                 runner,
@@ -151,12 +158,6 @@ class TestAdvancedChatAppRunnerConversationVariables:
             patch("core.app.apps.advanced_chat.app_runner.redis_client") as mock_redis_client,
             patch("core.app.apps.advanced_chat.app_runner.RedisChannel") as mock_redis_channel_class,
         ):
-            # Setup mocks
-            mock_sessionmaker.return_value.begin.return_value.__enter__.return_value = mock_session
-            mock_sessionmaker.return_value.begin.return_value.__exit__ = MagicMock(return_value=False)
-            mock_session_class.return_value.__enter__.return_value = MagicMock()
-            mock_db.engine = MagicMock()
-
             # Mock GraphRuntimeState to accept the variable pool
             mock_graph_runtime_state_class.return_value = MagicMock()
 
@@ -281,10 +282,8 @@ class TestAdvancedChatAppRunnerConversationVariables:
 
         # Patch the necessary components
         with (
-            patch("core.app.apps.advanced_chat.app_runner.sessionmaker") as mock_sessionmaker,
-            patch("core.app.apps.advanced_chat.app_runner.Session") as mock_session_class,
+            _patch_create_session(mock_session),
             patch("core.app.apps.advanced_chat.app_runner.select") as mock_select,
-            patch("core.app.apps.advanced_chat.app_runner.db") as mock_db,
             patch.object(runner, "_init_graph") as mock_init_graph,
             patch.object(
                 runner,
@@ -298,12 +297,6 @@ class TestAdvancedChatAppRunnerConversationVariables:
             patch("core.app.apps.advanced_chat.app_runner.redis_client") as mock_redis_client,
             patch("core.app.apps.advanced_chat.app_runner.RedisChannel") as mock_redis_channel_class,
         ):
-            # Setup mocks
-            mock_sessionmaker.return_value.begin.return_value.__enter__.return_value = mock_session
-            mock_sessionmaker.return_value.begin.return_value.__exit__ = MagicMock(return_value=False)
-            mock_session_class.return_value.__enter__.return_value = MagicMock()
-            mock_db.engine = MagicMock()
-
             # Mock ConversationVariable.from_variable to return mock objects
             mock_conv_vars = []
             for var in workflow_vars:
@@ -434,10 +427,8 @@ class TestAdvancedChatAppRunnerConversationVariables:
 
         # Patch the necessary components
         with (
-            patch("core.app.apps.advanced_chat.app_runner.sessionmaker") as mock_sessionmaker,
-            patch("core.app.apps.advanced_chat.app_runner.Session") as mock_session_class,
+            _patch_create_session(mock_session),
             patch("core.app.apps.advanced_chat.app_runner.select") as mock_select,
-            patch("core.app.apps.advanced_chat.app_runner.db") as mock_db,
             patch.object(runner, "_init_graph") as mock_init_graph,
             patch.object(
                 runner,
@@ -450,12 +441,6 @@ class TestAdvancedChatAppRunnerConversationVariables:
             patch("core.app.apps.advanced_chat.app_runner.redis_client") as mock_redis_client,
             patch("core.app.apps.advanced_chat.app_runner.RedisChannel") as mock_redis_channel_class,
         ):
-            # Setup mocks
-            mock_sessionmaker.return_value.begin.return_value.__enter__.return_value = mock_session
-            mock_sessionmaker.return_value.begin.return_value.__exit__ = MagicMock(return_value=False)
-            mock_session_class.return_value.__enter__.return_value = MagicMock()
-            mock_db.engine = MagicMock()
-
             # Mock GraphRuntimeState to accept the variable pool
             mock_graph_runtime_state_class.return_value = MagicMock()
 
diff --git a/api/tests/unit_tests/core/app/apps/advanced_chat/test_app_runner_input_moderation.py b/api/tests/unit_tests/core/app/apps/advanced_chat/test_app_runner_input_moderation.py
index 2076e42e9f9..2e3f7645c73 100644
--- a/api/tests/unit_tests/core/app/apps/advanced_chat/test_app_runner_input_moderation.py
+++ b/api/tests/unit_tests/core/app/apps/advanced_chat/test_app_runner_input_moderation.py
@@ -3,6 +3,7 @@ from uuid import uuid4
 
 import pytest
 
+import core.app.apps.advanced_chat.app_runner as module
 from core.app.apps.advanced_chat.app_runner import AdvancedChatAppRunner
 from core.app.entities.app_invoke_entities import AdvancedChatAppGenerateEntity, InvokeFrom
 from core.app.entities.queue_entities import QueueStopEvent
@@ -85,27 +86,24 @@ def build_runner():
 
 def _patch_common_run_deps(runner: AdvancedChatAppRunner):
     """Context manager that patches common heavy deps used by run()."""
+    # create_session() returns a context manager whose body yields a session that
+    # supports both scalar() (app record lookup) and begin()/scalars().all()
+    # (conversation variable initialization).
+    mock_session = MagicMock()
+    mock_session.scalar.return_value = MagicMock()
+    mock_session.scalars.return_value.all.return_value = []
+
+    session_context = MagicMock()
+    session_context.__enter__.return_value = mock_session
+    session_context.__exit__.return_value = False
+    mock_session.begin.return_value.__enter__.return_value = mock_session
+    mock_session.begin.return_value.__exit__.return_value = False
+
     return patch.multiple(
         "core.app.apps.advanced_chat.app_runner",
-        Session=MagicMock(
-            return_value=MagicMock(
-                __enter__=lambda s: s,
-                __exit__=lambda *a, **k: False,
-                scalar=lambda *a, **k: MagicMock(),
-            ),
-        ),
-        sessionmaker=MagicMock(
-            return_value=MagicMock(
-                begin=MagicMock(
-                    return_value=MagicMock(
-                        __enter__=lambda s: MagicMock(scalars=MagicMock(return_value=MagicMock(all=lambda: []))),
-                        __exit__=lambda *a, **k: False,
-                    ),
-                ),
-            ),
-        ),
+        create_session=MagicMock(return_value=session_context),
         select=MagicMock(),
-        db=MagicMock(engine=MagicMock()),
+        session_factory=MagicMock(get_session_maker=MagicMock(return_value=MagicMock())),
         RedisChannel=MagicMock(),
         redis_client=MagicMock(),
         WorkflowEntry=MagicMock(**{"return_value.run.return_value": iter([])}),
@@ -192,3 +190,42 @@ def test_run_returns_early_when_direct_output_via_handle_input_moderation(build_
         # Ensure no further steps executed
         mock_anno.assert_not_called()
         mock_init_graph.assert_not_called()
+
+
+def test_run_closes_scoped_session_before_workflow_run(build_runner):
+    runner = build_runner
+    events = []
+
+    mock_session = MagicMock()
+    mock_session.scalar.return_value = MagicMock()
+    session_context = MagicMock()
+    session_context.__enter__.return_value = mock_session
+    session_context.__exit__.return_value = False
+
+    workflow_entry = MagicMock()
+
+    def run_workflow():
+        events.append("run")
+        return iter([])
+
+    workflow_entry.run.side_effect = run_workflow
+
+    with (
+        patch.object(module, "create_session", return_value=session_context),
+        patch.object(module, "session_factory", MagicMock(get_session_maker=MagicMock(return_value=MagicMock()))),
+        patch.object(module, "RedisChannel"),
+        patch.object(module, "redis_client"),
+        patch.object(module, "WorkflowEntry", return_value=workflow_entry),
+        patch.object(module.db.session, "close", side_effect=lambda: events.append("close")),
+        patch.object(
+            runner,
+            "handle_input_moderation",
+            return_value=(False, runner.application_generate_entity.inputs, runner.application_generate_entity.query),
+        ),
+        patch.object(runner, "handle_annotation_reply", return_value=False),
+        patch.object(runner, "_initialize_conversation_variables", return_value=[]),
+        patch.object(runner, "_init_graph", return_value=MagicMock()),
+    ):
+        runner.run()
+
+    assert events == ["close", "run"]
diff --git a/api/tests/unit_tests/core/app/apps/advanced_chat/test_generate_task_pipeline_core.py b/api/tests/unit_tests/core/app/apps/advanced_chat/test_generate_task_pipeline_core.py
index b75f6d44943..28f416ac27f 100644
--- a/api/tests/unit_tests/core/app/apps/advanced_chat/test_generate_task_pipeline_core.py
+++ b/api/tests/unit_tests/core/app/apps/advanced_chat/test_generate_task_pipeline_core.py
@@ -175,6 +175,7 @@ class TestAdvancedChatGenerateTaskPipeline:
                 "actions": [{"id": "approve", "title": "Approve", "button_style": "default"}],
                 "display_in_ui": True,
                 "form_token": "token-1",
+                "approval_channels": [],
                 "resolved_default_values": {},
                 "expiration_time": 123,
             }
diff --git a/api/tests/unit_tests/core/app/apps/agent_app/test_app_config_manager.py b/api/tests/unit_tests/core/app/apps/agent_app/test_app_config_manager.py
index 6edcaca5a64..c2a49d1b3a6 100644
--- a/api/tests/unit_tests/core/app/apps/agent_app/test_app_config_manager.py
+++ b/api/tests/unit_tests/core/app/apps/agent_app/test_app_config_manager.py
@@ -19,6 +19,10 @@ def _soul() -> AgentSoulConfig:
                 "model_settings": {"temperature": 0.2},
             },
             "prompt": {"system_prompt": "You are Iris."},
+            "app_variables": [
+                {"name": "topic", "type": "string", "required": True},
+                {"name": "count", "type": "number", "default": 3},
+            ],
         }
     )
 
@@ -32,7 +36,10 @@ def test_model_and_prompt_come_from_soul():
         "completion_params": {"temperature": 0.2},
     }
     assert d["pre_prompt"] == "You are Iris."
-    assert d["user_input_form"] == []
+    assert d["user_input_form"] == [
+        {"text-input": {"label": "topic", "variable": "topic", "required": True}},
+        {"number": {"label": "count", "variable": "count", "required": False, "default": 3}},
+    ]
 
 
 def test_feature_flags_come_from_app_model_config_when_present():
diff --git a/api/tests/unit_tests/core/app/apps/agent_app/test_runtime_request_builder.py b/api/tests/unit_tests/core/app/apps/agent_app/test_runtime_request_builder.py
index 85a2423f6b1..0d1483e1b79 100644
--- a/api/tests/unit_tests/core/app/apps/agent_app/test_runtime_request_builder.py
+++ b/api/tests/unit_tests/core/app/apps/agent_app/test_runtime_request_builder.py
@@ -226,19 +226,8 @@ class TestAgentAppRuntimeRequestBuilder:
 
 
 def _soul_with_model_and_skill() -> AgentSoulConfig:
-    from models.agent_config_entities import AgentSkillRefConfig
-
     soul = _soul_with_model()
-    soul.skills_files.skills = [
-        AgentSkillRefConfig.model_validate(
-            {
-                "id": "abc",
-                "name": "Tender Analyzer",
-                "description": "Parses RFPs.",
-                "skill_md_key": "tender-analyzer/SKILL.md",
-            }
-        )
-    ]
+    soul.prompt.system_prompt = "Use [§skill:tender-analyzer%2FSKILL.md:Tender Analyzer§]"
     return soul
 
 
@@ -247,6 +236,28 @@ class TestAgentAppDriveLayer:
         monkeypatch.setattr(
             "core.app.apps.agent_app.runtime_request_builder.dify_config.AGENT_DRIVE_MANIFEST_ENABLED", True
         )
+        monkeypatch.setattr(
+            "core.workflow.nodes.agent_v2.runtime_request_builder.AgentDriveService.list_skills",
+            lambda self, *, tenant_id, agent_id: [
+                {
+                    "path": "tender-analyzer",
+                    "skill_md_key": "tender-analyzer/SKILL.md",
+                    "archive_key": None,
+                    "name": "Tender Analyzer",
+                    "description": "Parses RFPs.",
+                    "size": 1,
+                    "mime_type": "text/markdown",
+                    "hash": None,
+                    "created_at": 1,
+                }
+            ],
+        )
+        monkeypatch.setattr(
+            "core.workflow.nodes.agent_v2.runtime_request_builder.AgentDriveService.manifest",
+            lambda self, *, tenant_id, agent_id, prefix="", include_download_url=False: [
+                {"key": "tender-analyzer/SKILL.md", "is_skill": True}
+            ],
+        )
         builder = AgentAppRuntimeRequestBuilder(
             credentials_provider=_FakeCredentialsProvider(),
             plugin_tools_builder=_NoToolsBuilder(),  # type: ignore[arg-type]
@@ -256,12 +267,42 @@ class TestAgentAppDriveLayer:
 
         drive = next(layer for layer in result.request.composition.layers if layer.name == "drive")
         assert drive.type == "dify.drive"
+        assert drive.deps == {"execution_context": "execution_context"}
         assert drive.config.drive_ref == "agent-agent-1"
         assert [skill.skill_md_key for skill in drive.config.skills] == ["tender-analyzer/SKILL.md"]
+        assert drive.config.mentioned_skill_keys == ["tender-analyzer/SKILL.md"]
         # injected right after execution_context, mirroring the workflow surface
         names = [layer.name for layer in result.request.composition.layers]
         assert names.index("drive") == names.index("execution_context") + 1
 
+    def test_drive_layer_injected_with_empty_catalog_and_shell_depends_on_it(self, monkeypatch: pytest.MonkeyPatch):
+        monkeypatch.setattr(
+            "core.app.apps.agent_app.runtime_request_builder.dify_config.AGENT_DRIVE_MANIFEST_ENABLED", True
+        )
+        monkeypatch.setattr("core.app.apps.agent_app.runtime_request_builder.dify_config.AGENT_SHELL_ENABLED", True)
+        monkeypatch.setattr(
+            "core.workflow.nodes.agent_v2.runtime_request_builder.AgentDriveService.list_skills",
+            lambda self, *, tenant_id, agent_id: [],
+        )
+        monkeypatch.setattr(
+            "core.workflow.nodes.agent_v2.runtime_request_builder.AgentDriveService.manifest",
+            lambda self, *, tenant_id, agent_id, prefix="", include_download_url=False: [],
+        )
+        builder = AgentAppRuntimeRequestBuilder(
+            credentials_provider=_FakeCredentialsProvider(),
+            plugin_tools_builder=_NoToolsBuilder(),  # type: ignore[arg-type]
+        )
+
+        result = builder.build(_ctx(_soul_with_model()))
+
+        layers = {layer.name: layer for layer in result.request.composition.layers}
+        assert layers["drive"].config.drive_ref == "agent-agent-1"
+        assert layers["drive"].config.skills == []
+        assert layers[DIFY_SHELL_LAYER_ID].deps == {
+            "execution_context": "execution_context",
+            "drive": "drive",
+        }
+
     def test_no_drive_layer_when_flag_disabled(self):
         builder = AgentAppRuntimeRequestBuilder(
             credentials_provider=_FakeCredentialsProvider(),
@@ -269,3 +310,152 @@ class TestAgentAppDriveLayer:
         )
         result = builder.build(_ctx(_soul_with_model_and_skill()))
         assert all(layer.name != "drive" for layer in result.request.composition.layers)
+
+    def test_agent_app_runtime_expands_skill_and_file_mentions_in_agent_soul_prompt(
+        self,
+        monkeypatch: pytest.MonkeyPatch,
+    ):
+        monkeypatch.setattr(
+            "core.app.apps.agent_app.runtime_request_builder.dify_config.AGENT_DRIVE_MANIFEST_ENABLED", True
+        )
+        monkeypatch.setattr(
+            "core.workflow.nodes.agent_v2.runtime_request_builder.AgentDriveService.list_skills",
+            lambda self, *, tenant_id, agent_id: [
+                {
+                    "path": "tender-analyzer",
+                    "skill_md_key": "tender-analyzer/SKILL.md",
+                    "archive_key": None,
+                    "name": "Tender Analyzer",
+                    "description": "Parses RFPs.",
+                    "size": 1,
+                    "mime_type": "text/markdown",
+                    "hash": None,
+                    "created_at": 1,
+                }
+            ],
+        )
+        monkeypatch.setattr(
+            "core.workflow.nodes.agent_v2.runtime_request_builder.AgentDriveService.manifest",
+            lambda self, *, tenant_id, agent_id, prefix="", include_download_url=False: [
+                {"key": "tender-analyzer/SKILL.md", "is_skill": True},
+                {"key": "files/sample.pdf", "is_skill": False},
+            ],
+        )
+        soul = _soul_with_model()
+        soul.prompt.system_prompt = (
+            "Use [§skill:tender-analyzer%2FSKILL.md:Tender Analyzer§] and [§file:files%2Fsample.pdf:sample.pdf§]."
+        )
+        builder = AgentAppRuntimeRequestBuilder(
+            credentials_provider=_FakeCredentialsProvider(),
+            plugin_tools_builder=_NoToolsBuilder(),  # type: ignore[arg-type]
+        )
+
+        result = builder.build(_ctx(soul))
+
+        prompt_layer = next(layer for layer in result.request.composition.layers if layer.name == "agent_soul_prompt")
+        assert prompt_layer.config.prefix == "Use Tender Analyzer and sample.pdf."
+        assert "[§" not in prompt_layer.config.prefix
+
+    def test_agent_app_runtime_missing_drive_mentions_fall_back_to_label_then_decoded_key(
+        self,
+        monkeypatch: pytest.MonkeyPatch,
+    ):
+        monkeypatch.setattr(
+            "core.app.apps.agent_app.runtime_request_builder.dify_config.AGENT_DRIVE_MANIFEST_ENABLED", True
+        )
+        monkeypatch.setattr(
+            "core.workflow.nodes.agent_v2.runtime_request_builder.AgentDriveService.list_skills",
+            lambda self, *, tenant_id, agent_id: [],
+        )
+        monkeypatch.setattr(
+            "core.workflow.nodes.agent_v2.runtime_request_builder.AgentDriveService.manifest",
+            lambda self, *, tenant_id, agent_id, prefix="", include_download_url=False: [],
+        )
+        soul = _soul_with_model()
+        soul.prompt.system_prompt = (
+            "Use [§skill:ghost%2FSKILL.md:Ghost Skill§], [§file:files%2Fghost.txt:Ghost File§], "
+            "and [§file:files%2Fmissing.txt§]."
+        )
+        builder = AgentAppRuntimeRequestBuilder(
+            credentials_provider=_FakeCredentialsProvider(),
+            plugin_tools_builder=_NoToolsBuilder(),  # type: ignore[arg-type]
+        )
+
+        result = builder.build(_ctx(soul))
+
+        prompt_layer = next(layer for layer in result.request.composition.layers if layer.name == "agent_soul_prompt")
+        assert prompt_layer.config.prefix == "Use Ghost Skill, Ghost File, and files/missing.txt."
+        assert "[§" not in prompt_layer.config.prefix
+
+    def test_agent_app_runtime_expands_drive_mentions_in_agent_soul_prompt(self, monkeypatch: pytest.MonkeyPatch):
+        monkeypatch.setattr(
+            "core.app.apps.agent_app.runtime_request_builder.dify_config.AGENT_DRIVE_MANIFEST_ENABLED", True
+        )
+        monkeypatch.setattr(
+            "core.workflow.nodes.agent_v2.runtime_request_builder.AgentDriveService.list_skills",
+            lambda self, *, tenant_id, agent_id: [
+                {
+                    "path": "tender-analyzer",
+                    "skill_md_key": "tender-analyzer/SKILL.md",
+                    "archive_key": None,
+                    "name": "Tender Analyzer",
+                    "description": "Parses RFPs.",
+                    "size": 1,
+                    "mime_type": "text/markdown",
+                    "hash": None,
+                    "created_at": 1,
+                }
+            ],
+        )
+        monkeypatch.setattr(
+            "core.workflow.nodes.agent_v2.runtime_request_builder.AgentDriveService.manifest",
+            lambda self, *, tenant_id, agent_id, prefix="", include_download_url=False: [
+                {"key": "tender-analyzer/SKILL.md", "is_skill": True},
+                {"key": "files/sample.pdf", "is_skill": False},
+            ],
+        )
+        soul = _soul_with_model()
+        soul.prompt.system_prompt = (
+            "Use [§skill:tender-analyzer%2FSKILL.md:Tender Analyzer§] and [§file:files%2Fsample.pdf:sample.pdf§]"
+        )
+        builder = AgentAppRuntimeRequestBuilder(
+            credentials_provider=_FakeCredentialsProvider(),
+            plugin_tools_builder=_NoToolsBuilder(),  # type: ignore[arg-type]
+        )
+
+        result = builder.build(_ctx(soul))
+
+        prompt_layer = next(layer for layer in result.request.composition.layers if layer.name == "agent_soul_prompt")
+        assert prompt_layer.config.prefix == "Use Tender Analyzer and sample.pdf"
+        assert "[§" not in prompt_layer.config.prefix
+
+    def test_agent_app_runtime_missing_drive_mentions_fall_back_without_marker_leak(
+        self,
+        monkeypatch: pytest.MonkeyPatch,
+    ):
+        monkeypatch.setattr(
+            "core.app.apps.agent_app.runtime_request_builder.dify_config.AGENT_DRIVE_MANIFEST_ENABLED", True
+        )
+        monkeypatch.setattr(
+            "core.workflow.nodes.agent_v2.runtime_request_builder.AgentDriveService.list_skills",
+            lambda self, *, tenant_id, agent_id: [],
+        )
+        monkeypatch.setattr(
+            "core.workflow.nodes.agent_v2.runtime_request_builder.AgentDriveService.manifest",
+            lambda self, *, tenant_id, agent_id, prefix="", include_download_url=False: [],
+        )
+        soul = _soul_with_model()
+        soul.prompt.system_prompt = (
+            "Use [§skill:ghost%2FSKILL.md:Ghost Skill§], [§file:files%2Fghost.txt:Ghost File§], "
+            "and [§file:files%2Fno-label.txt§]."
+        )
+        builder = AgentAppRuntimeRequestBuilder(
+            credentials_provider=_FakeCredentialsProvider(),
+            plugin_tools_builder=_NoToolsBuilder(),  # type: ignore[arg-type]
+        )
+
+        result = builder.build(_ctx(soul))
+
+        prompt_layer = next(layer for layer in result.request.composition.layers if layer.name == "agent_soul_prompt")
+        assert prompt_layer.config.prefix == "Use Ghost Skill, Ghost File, and files/no-label.txt."
+        assert "[§" not in prompt_layer.config.prefix
diff --git a/api/tests/unit_tests/core/app/apps/agent_chat/test_agent_chat_app_runner.py b/api/tests/unit_tests/core/app/apps/agent_chat/test_agent_chat_app_runner.py
index d7988cbf74d..af2fb22ec78 100644
--- a/api/tests/unit_tests/core/app/apps/agent_chat/test_agent_chat_app_runner.py
+++ b/api/tests/unit_tests/core/app/apps/agent_chat/test_agent_chat_app_runner.py
@@ -13,12 +13,24 @@ def runner():
     return AgentChatAppRunner()
 
 
+def patch_create_session(mocker: MockerFixture, *, return_value=None, side_effect=None):
+    session = mocker.MagicMock()
+    if side_effect is not None:
+        session.scalar.side_effect = side_effect
+    else:
+        session.scalar.return_value = return_value
+    session_context = mocker.MagicMock()
+    session_context.__enter__.return_value = session
+    mocker.patch("core.app.apps.agent_chat.app_runner.create_session", return_value=session_context)
+    return session
+
+
 class TestAgentChatAppRunnerRun:
     def test_run_app_not_found(self, runner: AgentChatAppRunner, mocker: MockerFixture):
         app_config = mocker.MagicMock(app_id="app1", tenant_id="tenant", agent=mocker.MagicMock())
         generate_entity = mocker.MagicMock(app_config=app_config, inputs={}, query="q", files=[], stream=True)
 
-        mocker.patch("core.app.apps.agent_chat.app_runner.db.session.scalar", return_value=None)
+        patch_create_session(mocker, return_value=None)
 
         with pytest.raises(ValueError):
             runner.run(generate_entity, mocker.MagicMock(), mocker.MagicMock(), mocker.MagicMock())
@@ -37,7 +49,7 @@ class TestAgentChatAppRunnerRun:
             conversation_id=None,
         )
 
-        mocker.patch("core.app.apps.agent_chat.app_runner.db.session.scalar", return_value=app_record)
+        patch_create_session(mocker, return_value=app_record)
         mocker.patch.object(runner, "organize_prompt_messages", return_value=([], None))
         mocker.patch.object(runner, "moderation_for_inputs", side_effect=ModerationError("bad"))
         mocker.patch.object(runner, "direct_output")
@@ -62,7 +74,7 @@ class TestAgentChatAppRunnerRun:
             invoke_from=mocker.MagicMock(),
         )
 
-        mocker.patch("core.app.apps.agent_chat.app_runner.db.session.scalar", return_value=app_record)
+        patch_create_session(mocker, return_value=app_record)
         mocker.patch.object(runner, "organize_prompt_messages", return_value=([], None))
         mocker.patch.object(runner, "moderation_for_inputs", return_value=(None, {}, "q"))
         annotation = mocker.MagicMock(id="anno", content="answer")
@@ -91,7 +103,7 @@ class TestAgentChatAppRunnerRun:
             user_id="user",
         )
 
-        mocker.patch("core.app.apps.agent_chat.app_runner.db.session.scalar", return_value=app_record)
+        patch_create_session(mocker, return_value=app_record)
         mocker.patch.object(runner, "organize_prompt_messages", return_value=([], None))
         mocker.patch.object(runner, "moderation_for_inputs", return_value=(None, {}, "q"))
         mocker.patch.object(runner, "query_app_annotations_to_reply", return_value=None)
@@ -121,7 +133,7 @@ class TestAgentChatAppRunnerRun:
             user_id="user",
         )
 
-        mocker.patch("core.app.apps.agent_chat.app_runner.db.session.scalar", return_value=app_record)
+        patch_create_session(mocker, return_value=app_record)
         mocker.patch.object(runner, "organize_prompt_messages", return_value=([], None))
         mocker.patch.object(runner, "moderation_for_inputs", return_value=(None, {}, "q"))
         mocker.patch.object(runner, "query_app_annotations_to_reply", return_value=None)
@@ -163,7 +175,7 @@ class TestAgentChatAppRunnerRun:
             user_id="user",
         )
 
-        mocker.patch("core.app.apps.agent_chat.app_runner.db.session.scalar", return_value=app_record)
+        patch_create_session(mocker, return_value=app_record)
         mocker.patch.object(runner, "organize_prompt_messages", return_value=([], None))
         mocker.patch.object(runner, "moderation_for_inputs", return_value=(None, {}, "q"))
         mocker.patch.object(runner, "query_app_annotations_to_reply", return_value=None)
@@ -179,10 +191,7 @@ class TestAgentChatAppRunnerRun:
 
         conversation = mocker.MagicMock(id="conv")
         message = mocker.MagicMock(id="msg")
-        mocker.patch(
-            "core.app.apps.agent_chat.app_runner.db.session.scalar",
-            side_effect=[app_record, conversation, message],
-        )
+        patch_create_session(mocker, side_effect=[app_record, conversation, message])
 
         runner_cls = mocker.MagicMock()
         mocker.patch(f"core.app.apps.agent_chat.app_runner.{expected_runner}", runner_cls)
@@ -219,7 +228,7 @@ class TestAgentChatAppRunnerRun:
             user_id="user",
         )
 
-        mocker.patch("core.app.apps.agent_chat.app_runner.db.session.scalar", return_value=app_record)
+        patch_create_session(mocker, return_value=app_record)
         mocker.patch.object(runner, "organize_prompt_messages", return_value=([], None))
         mocker.patch.object(runner, "moderation_for_inputs", return_value=(None, {}, "q"))
         mocker.patch.object(runner, "query_app_annotations_to_reply", return_value=None)
@@ -235,10 +244,7 @@ class TestAgentChatAppRunnerRun:
 
         conversation = mocker.MagicMock(id="conv")
         message = mocker.MagicMock(id="msg")
-        mocker.patch(
-            "core.app.apps.agent_chat.app_runner.db.session.scalar",
-            side_effect=[app_record, conversation, message],
-        )
+        patch_create_session(mocker, side_effect=[app_record, conversation, message])
 
         with pytest.raises(ValueError):
             runner.run(generate_entity, mocker.MagicMock(), conversation, message)
@@ -267,7 +273,7 @@ class TestAgentChatAppRunnerRun:
             user_id="user",
         )
 
-        mocker.patch("core.app.apps.agent_chat.app_runner.db.session.scalar", return_value=app_record)
+        patch_create_session(mocker, return_value=app_record)
         mocker.patch.object(runner, "organize_prompt_messages", return_value=([], None))
         mocker.patch.object(runner, "moderation_for_inputs", return_value=(None, {}, "q"))
         mocker.patch.object(runner, "query_app_annotations_to_reply", return_value=None)
@@ -283,10 +289,7 @@ class TestAgentChatAppRunnerRun:
 
         conversation = mocker.MagicMock(id="conv")
         message = mocker.MagicMock(id="msg")
-        mocker.patch(
-            "core.app.apps.agent_chat.app_runner.db.session.scalar",
-            side_effect=[app_record, conversation, message],
-        )
+        patch_create_session(mocker, side_effect=[app_record, conversation, message])
 
         runner_cls = mocker.MagicMock()
         mocker.patch("core.app.apps.agent_chat.app_runner.FunctionCallAgentRunner", runner_cls)
@@ -323,10 +326,7 @@ class TestAgentChatAppRunnerRun:
             user_id="user",
         )
 
-        mocker.patch(
-            "core.app.apps.agent_chat.app_runner.db.session.scalar",
-            side_effect=[app_record, None],
-        )
+        patch_create_session(mocker, side_effect=[app_record, None])
         mocker.patch.object(runner, "organize_prompt_messages", return_value=([], None))
         mocker.patch.object(runner, "moderation_for_inputs", return_value=(None, {}, "q"))
         mocker.patch.object(runner, "query_app_annotations_to_reply", return_value=None)
@@ -357,10 +357,7 @@ class TestAgentChatAppRunnerRun:
             user_id="user",
         )
 
-        mocker.patch(
-            "core.app.apps.agent_chat.app_runner.db.session.scalar",
-            side_effect=[app_record, mocker.MagicMock(id="conv"), None],
-        )
+        patch_create_session(mocker, side_effect=[app_record, mocker.MagicMock(id="conv"), None])
         mocker.patch.object(runner, "organize_prompt_messages", return_value=([], None))
         mocker.patch.object(runner, "moderation_for_inputs", return_value=(None, {}, "q"))
         mocker.patch.object(runner, "query_app_annotations_to_reply", return_value=None)
@@ -391,7 +388,7 @@ class TestAgentChatAppRunnerRun:
             user_id="user",
         )
 
-        mocker.patch("core.app.apps.agent_chat.app_runner.db.session.scalar", return_value=app_record)
+        patch_create_session(mocker, return_value=app_record)
         mocker.patch.object(runner, "organize_prompt_messages", return_value=([], None))
         mocker.patch.object(runner, "moderation_for_inputs", return_value=(None, {}, "q"))
         mocker.patch.object(runner, "query_app_annotations_to_reply", return_value=None)
@@ -407,10 +404,7 @@ class TestAgentChatAppRunnerRun:
 
         conversation = mocker.MagicMock(id="conv")
         message = mocker.MagicMock(id="msg")
-        mocker.patch(
-            "core.app.apps.agent_chat.app_runner.db.session.scalar",
-            side_effect=[app_record, conversation, message],
-        )
+        patch_create_session(mocker, side_effect=[app_record, conversation, message])
 
         with pytest.raises(ValueError):
             runner.run(generate_entity, mocker.MagicMock(), conversation, message)
diff --git a/api/tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py b/api/tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py
index 6f104a5eaa1..23334dbe67c 100644
--- a/api/tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py
+++ b/api/tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py
@@ -1,5 +1,6 @@
+from contextlib import contextmanager
 from types import SimpleNamespace
-from unittest.mock import Mock, patch
+from unittest.mock import ANY, MagicMock, Mock, patch
 
 import pytest
 
@@ -29,6 +30,19 @@ class DummyQueueManager:
         self.published.append((event, pub_from))
 
 
+@contextmanager
+def patched_create_session(*, return_value=None, side_effect=None):
+    session = MagicMock()
+    if side_effect is not None:
+        session.scalar.side_effect = side_effect
+    else:
+        session.scalar.return_value = return_value
+    session_context = MagicMock()
+    session_context.__enter__.return_value = session
+    with patch("core.app.apps.chat.app_runner.create_session", return_value=session_context):
+        yield session
+
+
 class TestChatAppGenerator:
     def test_generate_requires_query(self):
         generator = ChatAppGenerator()
@@ -167,7 +181,7 @@ class TestChatAppRunner:
             invoke_from=InvokeFrom.SERVICE_API,
         )
 
-        with patch("core.app.apps.chat.app_runner.db.session.scalar", return_value=None):
+        with patched_create_session(return_value=None):
             with pytest.raises(ValueError):
                 runner.run(app_generate_entity, DummyQueueManager(), SimpleNamespace(), SimpleNamespace(id="m1"))
 
@@ -195,10 +209,7 @@ class TestChatAppRunner:
         )
 
         with (
-            patch(
-                "core.app.apps.chat.app_runner.db.session.scalar",
-                return_value=SimpleNamespace(id="app-1", tenant_id="tenant-1"),
-            ),
+            patched_create_session(return_value=SimpleNamespace(id="app-1", tenant_id="tenant-1")),
             patch.object(ChatAppRunner, "organize_prompt_messages", return_value=([], [])),
             patch.object(ChatAppRunner, "moderation_for_inputs", side_effect=ModerationError("blocked")),
             patch.object(ChatAppRunner, "direct_output") as mock_direct,
@@ -233,10 +244,7 @@ class TestChatAppRunner:
         annotation = SimpleNamespace(id="ann-1", content="answer")
 
         with (
-            patch(
-                "core.app.apps.chat.app_runner.db.session.scalar",
-                return_value=SimpleNamespace(id="app-1", tenant_id="tenant-1"),
-            ),
+            patched_create_session(return_value=SimpleNamespace(id="app-1", tenant_id="tenant-1")),
             patch.object(ChatAppRunner, "organize_prompt_messages", return_value=([], [])),
             patch.object(ChatAppRunner, "moderation_for_inputs", return_value=(None, {}, "hi")),
             patch.object(ChatAppRunner, "query_app_annotations_to_reply", return_value=annotation),
@@ -272,13 +280,73 @@ class TestChatAppRunner:
         )
 
         with (
-            patch(
-                "core.app.apps.chat.app_runner.db.session.scalar",
-                return_value=SimpleNamespace(id="app-1", tenant_id="tenant-1"),
-            ),
+            patched_create_session(return_value=SimpleNamespace(id="app-1", tenant_id="tenant-1")),
             patch.object(ChatAppRunner, "organize_prompt_messages", return_value=([], [])),
             patch.object(ChatAppRunner, "moderation_for_inputs", return_value=(None, {}, "hi")),
             patch.object(ChatAppRunner, "query_app_annotations_to_reply", return_value=None),
             patch.object(ChatAppRunner, "check_hosting_moderation", return_value=True),
         ):
             runner.run(app_generate_entity, DummyQueueManager(), SimpleNamespace(), SimpleNamespace(id="m1"))
+
+    def test_run_closes_scoped_session_before_stream_consumption(self):
+        runner = ChatAppRunner()
+        app_config = SimpleNamespace(
+            app_id="app-1",
+            tenant_id="tenant-1",
+            prompt_template=None,
+            external_data_variables=[],
+            dataset=None,
+            additional_features=None,
+        )
+        app_generate_entity = DummyGenerateEntity(
+            app_config=app_config,
+            model_conf=SimpleNamespace(provider_model_bundle=None, model="model-1", parameters={}),
+            inputs={},
+            query="hi",
+            files=[],
+            file_upload_config=None,
+            conversation_id=None,
+            stream=True,
+            user_id="user-1",
+            invoke_from=InvokeFrom.SERVICE_API,
+        )
+
+        events = []
+        queue_manager = DummyQueueManager()
+        model_instance = MagicMock()
+
+        def invoke_stream():
+            events.append("first-chunk")
+            yield "chunk"
+
+        def invoke_llm(**kwargs):
+            events.append("invoke")
+            return invoke_stream()
+
+        with (
+            patched_create_session(return_value=SimpleNamespace(id="app-1", tenant_id="tenant-1")),
+            patch.object(ChatAppRunner, "organize_prompt_messages", return_value=([], [])),
+            patch.object(ChatAppRunner, "moderation_for_inputs", return_value=(None, {}, "hi")),
+            patch.object(ChatAppRunner, "query_app_annotations_to_reply", return_value=None),
+            patch.object(ChatAppRunner, "check_hosting_moderation", return_value=False),
+            patch.object(ChatAppRunner, "recalc_llm_max_tokens"),
+            patch.object(
+                ChatAppRunner,
+                "_handle_invoke_result",
+                side_effect=lambda invoke_result, **kwargs: list(invoke_result),
+            ) as mock_handle,
+            patch("core.app.apps.chat.app_runner.ModelInstance", return_value=model_instance),
+            patch("core.app.apps.chat.app_runner.db.session.close", side_effect=lambda: events.append("close")),
+        ):
+            model_instance.invoke_llm.side_effect = invoke_llm
+            runner.run(app_generate_entity, queue_manager, SimpleNamespace(), SimpleNamespace(id="m1"))
+
+        assert events == ["close", "invoke", "first-chunk"]
+        mock_handle.assert_called_once_with(
+            invoke_result=ANY,
+            queue_manager=queue_manager,
+            stream=True,
+            message_id="m1",
+            user_id="user-1",
+            tenant_id="tenant-1",
+        )
diff --git a/api/tests/unit_tests/core/app/apps/completion/test_app_runner.py b/api/tests/unit_tests/core/app/apps/completion/test_app_runner.py
index 8dcf6e91935..2fdb197852a 100644
--- a/api/tests/unit_tests/core/app/apps/completion/test_app_runner.py
+++ b/api/tests/unit_tests/core/app/apps/completion/test_app_runner.py
@@ -1,5 +1,6 @@
+from contextlib import contextmanager
 from types import SimpleNamespace
-from unittest.mock import MagicMock
+from unittest.mock import ANY, MagicMock, patch
 
 import pytest
 from pytest_mock import MockerFixture
@@ -47,25 +48,28 @@ def _build_generate_entity(app_config, file_upload_config=None):
     )
 
 
+@contextmanager
+def patched_create_session(*, return_value=None):
+    session = MagicMock()
+    session.scalar.return_value = return_value
+    session_context = MagicMock()
+    session_context.__enter__.return_value = session
+    with patch.object(module, "create_session", return_value=session_context):
+        yield session
+
+
 class TestCompletionAppRunner:
     def test_run_app_not_found(self, runner, mocker: MockerFixture):
-        session = mocker.MagicMock()
-        session.scalar.return_value = None
-        mocker.patch.object(module.db, "session", session)
-
         app_config = _build_app_config()
         app_generate_entity = _build_generate_entity(app_config)
 
-        with pytest.raises(ValueError):
-            runner.run(app_generate_entity, MagicMock(), MagicMock())
+        with patched_create_session(return_value=None):
+            with pytest.raises(ValueError):
+                runner.run(app_generate_entity, MagicMock(), MagicMock())
 
     def test_run_moderation_error_outputs_direct(self, runner, mocker: MockerFixture):
         app_record = MagicMock(id="app1", tenant_id="tenant")
 
-        session = mocker.MagicMock()
-        session.scalar.return_value = app_record
-        mocker.patch.object(module.db, "session", session)
-
         app_config = _build_app_config()
         app_generate_entity = _build_generate_entity(app_config)
 
@@ -74,7 +78,8 @@ class TestCompletionAppRunner:
         runner.direct_output = MagicMock()
         runner._handle_invoke_result = MagicMock()
 
-        runner.run(app_generate_entity, MagicMock(), MagicMock(id="msg"))
+        with patched_create_session(return_value=app_record):
+            runner.run(app_generate_entity, MagicMock(), MagicMock(id="msg"))
 
         runner.direct_output.assert_called_once()
         runner._handle_invoke_result.assert_not_called()
@@ -82,10 +87,6 @@ class TestCompletionAppRunner:
     def test_run_hosting_moderation_stops(self, runner, mocker: MockerFixture):
         app_record = MagicMock(id="app1", tenant_id="tenant")
 
-        session = mocker.MagicMock()
-        session.scalar.return_value = app_record
-        mocker.patch.object(module.db, "session", session)
-
         app_config = _build_app_config()
         app_generate_entity = _build_generate_entity(app_config)
 
@@ -94,18 +95,14 @@ class TestCompletionAppRunner:
         runner.check_hosting_moderation = MagicMock(return_value=True)
         runner._handle_invoke_result = MagicMock()
 
-        runner.run(app_generate_entity, MagicMock(), MagicMock(id="msg"))
+        with patched_create_session(return_value=app_record):
+            runner.run(app_generate_entity, MagicMock(), MagicMock(id="msg"))
 
         runner._handle_invoke_result.assert_not_called()
 
     def test_run_dataset_and_external_tools_flow(self, runner, mocker: MockerFixture):
         app_record = MagicMock(id="app1", tenant_id="tenant")
 
-        session = mocker.MagicMock()
-        session.scalar.return_value = app_record
-        session.close = MagicMock()
-        mocker.patch.object(module.db, "session", session)
-
         retrieve_config = MagicMock(query_variable="qvar")
         dataset_config = MagicMock(dataset_ids=["ds"], retrieve_config=retrieve_config)
         additional_features = MagicMock(show_retrieve_source=True)
@@ -135,19 +132,56 @@ class TestCompletionAppRunner:
         model_instance.invoke_llm.return_value = "invoke_result"
         mocker.patch.object(module, "ModelInstance", return_value=model_instance)
 
-        runner.run(app_generate_entity, MagicMock(), MagicMock(id="msg", tenant_id="tenant"))
+        with patched_create_session(return_value=app_record):
+            runner.run(app_generate_entity, MagicMock(), MagicMock(id="msg", tenant_id="tenant"))
 
         dataset_retrieval.retrieve.assert_called_once()
         assert dataset_retrieval.retrieve.call_args.kwargs["query"] == "query_from_input"
         runner._handle_invoke_result.assert_called_once()
 
+    def test_run_closes_scoped_session_before_stream_consumption(self, runner, mocker: MockerFixture):
+        app_record = MagicMock(id="app1", tenant_id="tenant")
+        app_config = _build_app_config()
+        app_generate_entity = _build_generate_entity(app_config)
+        queue_manager = MagicMock()
+
+        events = []
+        runner.organize_prompt_messages = MagicMock(return_value=([], None))
+        runner.moderation_for_inputs = MagicMock(return_value=(None, app_generate_entity.inputs, "query"))
+        runner.check_hosting_moderation = MagicMock(return_value=False)
+        runner.recalc_llm_max_tokens = MagicMock()
+        runner._handle_invoke_result = MagicMock(side_effect=lambda invoke_result, **kwargs: list(invoke_result))
+
+        model_instance = MagicMock()
+
+        def invoke_stream():
+            events.append("first-chunk")
+            yield "chunk"
+
+        def invoke_llm(**kwargs):
+            events.append("invoke")
+            return invoke_stream()
+
+        model_instance.invoke_llm.side_effect = invoke_llm
+        mocker.patch.object(module, "ModelInstance", return_value=model_instance)
+        mocker.patch.object(module.db.session, "close", side_effect=lambda: events.append("close"))
+
+        with patched_create_session(return_value=app_record):
+            runner.run(app_generate_entity, queue_manager, MagicMock(id="msg"))
+
+        assert events == ["close", "invoke", "first-chunk"]
+        runner._handle_invoke_result.assert_called_once_with(
+            invoke_result=ANY,
+            queue_manager=queue_manager,
+            stream=True,
+            message_id="msg",
+            user_id="user",
+            tenant_id="tenant",
+        )
+
     def test_run_uses_low_image_detail_default(self, runner, mocker: MockerFixture):
         app_record = MagicMock(id="app1", tenant_id="tenant")
 
-        session = mocker.MagicMock()
-        session.scalar.return_value = app_record
-        mocker.patch.object(module.db, "session", session)
-
         app_config = _build_app_config()
         app_generate_entity = _build_generate_entity(app_config, file_upload_config=None)
 
@@ -155,7 +189,8 @@ class TestCompletionAppRunner:
         runner.moderation_for_inputs = MagicMock(return_value=(None, app_generate_entity.inputs, "query"))
         runner.check_hosting_moderation = MagicMock(return_value=True)
 
-        runner.run(app_generate_entity, MagicMock(), MagicMock(id="msg"))
+        with patched_create_session(return_value=app_record):
+            runner.run(app_generate_entity, MagicMock(), MagicMock(id="msg"))
 
         assert (
             runner.organize_prompt_messages.call_args.kwargs["image_detail_config"]
diff --git a/api/tests/unit_tests/core/app/apps/pipeline/test_pipeline_runner.py b/api/tests/unit_tests/core/app/apps/pipeline/test_pipeline_runner.py
index 1eed76cf843..f24f799464f 100644
--- a/api/tests/unit_tests/core/app/apps/pipeline/test_pipeline_runner.py
+++ b/api/tests/unit_tests/core/app/apps/pipeline/test_pipeline_runner.py
@@ -53,6 +53,32 @@ def _build_app_generate_entity() -> SimpleNamespace:
     )
 
 
+def _patch_create_session(mocker: MockerFixture, session: MagicMock, *, events: list[str] | None = None):
+    """Patch create_session() to yield ``session`` inside its ``with`` body and ``begin()`` block.
+
+    The runner now obtains short-lived sessions via ``create_session()`` instead of the
+    Flask scoped ``db.session``, so tests patch the module-level ``create_session`` and
+    hand back a context manager that yields the mock session.
+    """
+    session_context = MagicMock()
+
+    def enter_session():
+        if events is not None:
+            events.append("session_enter")
+        return session
+
+    def exit_session(*args):
+        if events is not None:
+            events.append("session_exit")
+        return False
+
+    session_context.__enter__.side_effect = enter_session
+    session_context.__exit__.side_effect = exit_session
+    session.begin.return_value.__enter__.return_value = session
+    session.begin.return_value.__exit__.return_value = False
+    return mocker.patch.object(module, "create_session", return_value=session_context)
+
+
 @pytest.fixture
 def runner():
     app_generate_entity = _build_app_generate_entity()
@@ -77,13 +103,14 @@ def test_get_app_id(runner):
     assert runner._get_app_id() == "pipe"
 
 
-def test_get_workflow_returns_workflow(mocker, runner):
+def test_get_workflow_returns_workflow(runner):
     pipeline = MagicMock(tenant_id="tenant", id="pipe")
     workflow = MagicMock(id="wf")
 
-    mocker.patch.object(module.db, "session", MagicMock(scalar=MagicMock(return_value=workflow)))
+    session = MagicMock()
+    session.scalar.return_value = workflow
 
-    result = runner.get_workflow(pipeline=pipeline, workflow_id="wf")
+    result = runner.get_workflow(session=session, pipeline=pipeline, workflow_id="wf")
 
     assert result == workflow
 
@@ -116,7 +143,7 @@ def test_update_document_status_on_failure(mocker, runner):
 
     session = MagicMock()
     session.scalar.return_value = document
-    mocker.patch.object(module.db, "session", session)
+    _patch_create_session(mocker, session)
 
     event = GraphRunFailedEvent(error="boom")
 
@@ -124,7 +151,10 @@ def test_update_document_status_on_failure(mocker, runner):
 
     assert document.indexing_status == "error"
     assert document.error == "boom"
-    session.commit.assert_called_once()
+    session.add.assert_called_once_with(document)
+    session.begin.assert_called_once()
+    session.begin.return_value.__enter__.assert_called_once()
+    session.begin.return_value.__exit__.assert_called_once()
 
 
 def test_run_pipeline_not_found(mocker: MockerFixture):
@@ -135,7 +165,7 @@ def test_run_pipeline_not_found(mocker: MockerFixture):
 
     session = MagicMock()
     session.get.side_effect = [None, None]
-    mocker.patch.object(module.db, "session", session)
+    _patch_create_session(mocker, session)
 
     runner = PipelineRunner(
         application_generate_entity=app_generate_entity,
@@ -158,7 +188,7 @@ def test_run_workflow_not_initialized(mocker: MockerFixture):
 
     session = MagicMock()
     session.get.side_effect = [None, pipeline]
-    mocker.patch.object(module.db, "session", session)
+    _patch_create_session(mocker, session)
 
     runner = PipelineRunner(
         application_generate_entity=app_generate_entity,
@@ -184,7 +214,7 @@ def test_run_single_iteration_path(mocker: MockerFixture):
 
     session = MagicMock()
     session.get.side_effect = [end_user, pipeline]
-    mocker.patch.object(module.db, "session", session)
+    _patch_create_session(mocker, session)
 
     runner = PipelineRunner(
         application_generate_entity=app_generate_entity,
@@ -229,10 +259,11 @@ def test_run_normal_path_builds_graph(mocker: MockerFixture):
 
     pipeline = MagicMock(id="pipe")
     end_user = MagicMock(session_id="sess")
+    events = []
 
     session = MagicMock()
     session.get.side_effect = [end_user, pipeline]
-    mocker.patch.object(module.db, "session", session)
+    _patch_create_session(mocker, session, events=events)
 
     workflow = MagicMock(
         id="wf",
@@ -276,10 +307,11 @@ def test_run_normal_path_builds_graph(mocker: MockerFixture):
 
     workflow_entry = MagicMock()
     workflow_entry.graph_engine = MagicMock()
-    workflow_entry.run.return_value = []
+    workflow_entry.run.side_effect = lambda: events.append("workflow_run") or []
     mocker.patch.object(module, "WorkflowEntry", return_value=workflow_entry)
     mocker.patch.object(module, "WorkflowPersistenceLayer", return_value=MagicMock())
 
     runner.run()
 
+    assert events == ["session_enter", "session_exit", "workflow_run"]
     runner._init_rag_pipeline_graph.assert_called_once()
diff --git a/api/tests/unit_tests/core/app/apps/test_legacy_stop_graphengine_lifecycle.py b/api/tests/unit_tests/core/app/apps/test_legacy_stop_graphengine_lifecycle.py
new file mode 100644
index 00000000000..a9aafd5949d
--- /dev/null
+++ b/api/tests/unit_tests/core/app/apps/test_legacy_stop_graphengine_lifecycle.py
@@ -0,0 +1,59 @@
+from unittest.mock import patch
+
+import pytest
+
+from core.app.apps.base_app_queue_manager import PublishFrom
+from core.app.apps.exc import GenerateTaskStoppedError
+from core.app.apps.message_based_app_queue_manager import MessageBasedAppQueueManager
+from core.app.apps.workflow.app_queue_manager import WorkflowAppQueueManager
+from core.app.entities.app_invoke_entities import InvokeFrom
+from core.app.entities.queue_entities import QueueTextChunkEvent
+from models.model import AppMode
+
+
+def _message_queue_manager(app_mode: str) -> MessageBasedAppQueueManager:
+    with patch("core.app.apps.base_app_queue_manager.redis_client") as mock_redis:
+        mock_redis.setex.return_value = True
+        return MessageBasedAppQueueManager(
+            task_id="task-1",
+            user_id="user-1",
+            invoke_from=InvokeFrom.DEBUGGER,
+            conversation_id="conversation-1",
+            app_mode=app_mode,
+            message_id="message-1",
+        )
+
+
+def _workflow_queue_manager(app_mode: str) -> WorkflowAppQueueManager:
+    with patch("core.app.apps.base_app_queue_manager.redis_client") as mock_redis:
+        mock_redis.setex.return_value = True
+        return WorkflowAppQueueManager(
+            task_id="task-1",
+            user_id="user-1",
+            invoke_from=InvokeFrom.DEBUGGER,
+            app_mode=app_mode,
+        )
+
+
+def test_message_queue_does_not_raise_legacy_stop_for_advanced_chat() -> None:
+    manager = _message_queue_manager(AppMode.ADVANCED_CHAT.value)
+
+    with patch.object(manager, "_is_stopped", return_value=True):
+        manager.publish(QueueTextChunkEvent(text="chunk"), PublishFrom.APPLICATION_MANAGER)
+
+
+def test_workflow_queue_does_not_read_legacy_stop_flag() -> None:
+    manager = _workflow_queue_manager(AppMode.WORKFLOW.value)
+
+    with patch.object(manager, "_is_stopped", return_value=True) as is_stopped:
+        manager.publish(QueueTextChunkEvent(text="chunk"), PublishFrom.APPLICATION_MANAGER)
+
+    is_stopped.assert_not_called()
+
+
+def test_message_queue_keeps_legacy_stop_for_non_graphengine_chat() -> None:
+    manager = _message_queue_manager(AppMode.CHAT.value)
+
+    with patch.object(manager, "_is_stopped", return_value=True):
+        with pytest.raises(GenerateTaskStoppedError):
+            manager.publish(QueueTextChunkEvent(text="chunk"), PublishFrom.APPLICATION_MANAGER)
diff --git a/api/tests/unit_tests/core/app/apps/test_workflow_pause_events.py b/api/tests/unit_tests/core/app/apps/test_workflow_pause_events.py
index 319e603b351..098a63a8f91 100644
--- a/api/tests/unit_tests/core/app/apps/test_workflow_pause_events.py
+++ b/api/tests/unit_tests/core/app/apps/test_workflow_pause_events.py
@@ -26,6 +26,26 @@ from models.account import Account
 from models.human_input import RecipientType
 
 
+class _FakeSession:
+    """Stub session: `execute` feeds the form-expiration query, `scalars` the recipients."""
+
+    def __init__(self, *, execute_rows=(), scalars_rows=()):
+        self._execute_rows = execute_rows
+        self._scalars_rows = scalars_rows
+
+    def execute(self, _stmt):
+        return list(self._execute_rows)
+
+    def scalars(self, _stmt):
+        return list(self._scalars_rows)
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, exc_type, exc, tb):
+        return False
+
+
 class _RecordingWorkflowAppRunner(WorkflowAppRunner):
     def __init__(self, **kwargs):
         super().__init__(**kwargs)
@@ -97,11 +117,11 @@ def test_graph_run_paused_event_emits_queue_pause_event():
     assert queue_event.paused_nodes == ["node-pause-1"]
 
 
-def _build_converter():
+def _build_converter(*, invoke_from: InvokeFrom = InvokeFrom.SERVICE_API):
     application_generate_entity = SimpleNamespace(
         inputs={},
         files=[],
-        invoke_from=InvokeFrom.SERVICE_API,
+        invoke_from=invoke_from,
         app_config=SimpleNamespace(app_id="app-id", tenant_id="tenant-id"),
     )
     system_variables = build_system_variables(
@@ -131,32 +151,15 @@ def test_queue_workflow_paused_event_to_stream_responses(monkeypatch: pytest.Mon
     )
 
     expiration_time = datetime(2024, 1, 1, tzinfo=UTC)
+    session = _FakeSession(
+        execute_rows=[("form-1", expiration_time, '{"display_in_ui": true}')],
+        scalars_rows=[
+            SimpleNamespace(form_id="form-1", recipient_type=RecipientType.CONSOLE, access_token="console-token"),
+            SimpleNamespace(form_id="form-1", recipient_type=RecipientType.BACKSTAGE, access_token="backstage-token"),
+        ],
+    )
 
-    class _FakeSession:
-        def execute(self, _stmt):
-            return [("form-1", expiration_time, '{"display_in_ui": true}')]
-
-        def scalars(self, _stmt):
-            return [
-                SimpleNamespace(
-                    form_id="form-1",
-                    recipient_type=RecipientType.CONSOLE,
-                    access_token="console-token",
-                ),
-                SimpleNamespace(
-                    form_id="form-1",
-                    recipient_type=RecipientType.BACKSTAGE,
-                    access_token="backstage-token",
-                ),
-            ]
-
-        def __enter__(self):
-            return self
-
-        def __exit__(self, exc_type, exc, tb):
-            return False
-
-    monkeypatch.setattr(workflow_response_converter, "Session", lambda **_: _FakeSession())
+    monkeypatch.setattr(workflow_response_converter, "Session", lambda **_: session)
     monkeypatch.setattr(workflow_response_converter, "db", SimpleNamespace(engine=object()))
 
     reason = HumanInputRequired(
@@ -195,10 +198,92 @@ def test_queue_workflow_paused_event_to_stream_responses(monkeypatch: pytest.Mon
     assert hi_resp.data.inputs[0].output_variable_name == "field"
     assert hi_resp.data.actions[0].id == "approve"
     assert hi_resp.data.display_in_ui is True
-    assert hi_resp.data.form_token == "backstage-token"
+    assert hi_resp.data.form_token is None
+    assert hi_resp.data.approval_channels == ["console"]
     assert hi_resp.data.expiration_time == int(expiration_time.timestamp())
 
 
+def _build_paused_human_input_response(monkeypatch, recipients):
+    """Drive the live OPENAPI pause path with the given recipients via a fake session."""
+    converter = _build_converter(invoke_from=InvokeFrom.OPENAPI)
+    converter.workflow_start_to_stream_response(
+        task_id="task",
+        workflow_run_id="run-id",
+        workflow_id="workflow-id",
+        reason=WorkflowStartReason.INITIAL,
+    )
+
+    expiration_time = datetime(2024, 1, 1, tzinfo=UTC)
+    session = _FakeSession(
+        execute_rows=[("form-1", expiration_time, '{"display_in_ui": true}')],
+        scalars_rows=list(recipients),
+    )
+
+    monkeypatch.setattr(workflow_response_converter, "Session", lambda **_: session)
+    monkeypatch.setattr(workflow_response_converter, "db", SimpleNamespace(engine=object()))
+
+    reason = HumanInputRequired(
+        form_id="form-1",
+        form_content="Rendered",
+        inputs=[ParagraphInputConfig(output_variable_name="field")],
+        actions=[UserActionConfig(id="approve", title="Approve")],
+        node_id="node-id",
+        node_title="Human Step",
+    )
+    queue_event = QueueWorkflowPausedEvent(
+        reasons=[reason],
+        outputs={},
+        paused_nodes=["node-id"],
+    )
+
+    runtime_state = GraphRuntimeState(variable_pool=VariablePool(), start_at=0.0)
+    responses = converter.workflow_pause_to_stream_response(
+        event=queue_event,
+        task_id="task",
+        graph_runtime_state=runtime_state,
+    )
+    assert isinstance(responses[0], HumanInputRequiredResponse)
+    return responses
+
+
+def test_openapi_pause_without_web_app_recipient_emits_approval_channels(monkeypatch: pytest.MonkeyPatch):
+    responses = _build_paused_human_input_response(
+        monkeypatch,
+        recipients=[
+            SimpleNamespace(form_id="form-1", recipient_type=RecipientType.EMAIL_MEMBER, access_token="email-token"),
+            SimpleNamespace(form_id="form-1", recipient_type=RecipientType.BACKSTAGE, access_token="backstage-token"),
+        ],
+    )
+
+    hi_resp = responses[0]
+    assert hi_resp.data.form_token is None
+    assert hi_resp.data.approval_channels == ["console", "email"]
+
+    pause_resp = responses[-1]
+    assert pause_resp.data.reasons[0]["approval_channels"] == ["console", "email"]
+
+
+def test_openapi_pause_with_web_app_recipient_sets_token_and_channels(monkeypatch: pytest.MonkeyPatch):
+    responses = _build_paused_human_input_response(
+        monkeypatch,
+        recipients=[
+            SimpleNamespace(
+                form_id="form-1",
+                recipient_type=RecipientType.STANDALONE_WEB_APP,
+                access_token="web-app-token",
+            ),
+            SimpleNamespace(form_id="form-1", recipient_type=RecipientType.BACKSTAGE, access_token="backstage-token"),
+        ],
+    )
+
+    hi_resp = responses[0]
+    assert hi_resp.data.form_token == "web-app-token"
+    assert hi_resp.data.approval_channels == ["console"]
+
+    pause_resp = responses[-1]
+    assert pause_resp.data.reasons[0]["approval_channels"] == ["console"]
+
+
 def test_queue_workflow_paused_event_resolves_variable_select_options(monkeypatch: pytest.MonkeyPatch):
     converter = _build_converter()
     converter.workflow_start_to_stream_response(
@@ -209,21 +294,9 @@ def test_queue_workflow_paused_event_resolves_variable_select_options(monkeypatc
     )
 
     expiration_time = datetime(2024, 1, 1, tzinfo=UTC)
+    session = _FakeSession(execute_rows=[("form-1", expiration_time, '{"display_in_ui": true}')])
 
-    class _FakeSession:
-        def execute(self, _stmt):
-            return [("form-1", expiration_time, '{"display_in_ui": true}')]
-
-        def scalars(self, _stmt):
-            return []
-
-        def __enter__(self):
-            return self
-
-        def __exit__(self, exc_type, exc, tb):
-            return False
-
-    monkeypatch.setattr(workflow_response_converter, "Session", lambda **_: _FakeSession())
+    monkeypatch.setattr(workflow_response_converter, "Session", lambda **_: session)
     monkeypatch.setattr(workflow_response_converter, "db", SimpleNamespace(engine=object()))
 
     reason = HumanInputRequired(
diff --git a/api/tests/unit_tests/core/app/apps/workflow/test_app_queue_manager.py b/api/tests/unit_tests/core/app/apps/workflow/test_app_queue_manager.py
index 6133be98676..e3b86530098 100644
--- a/api/tests/unit_tests/core/app/apps/workflow/test_app_queue_manager.py
+++ b/api/tests/unit_tests/core/app/apps/workflow/test_app_queue_manager.py
@@ -1,9 +1,8 @@
 from __future__ import annotations
 
-import pytest
+from unittest.mock import patch
 
 from core.app.apps.base_app_queue_manager import PublishFrom
-from core.app.apps.exc import GenerateTaskStoppedError
 from core.app.apps.workflow.app_queue_manager import WorkflowAppQueueManager
 from core.app.entities.app_invoke_entities import InvokeFrom
 from core.app.entities.queue_entities import QueueMessageEndEvent, QueuePingEvent
@@ -17,11 +16,16 @@ class TestWorkflowAppQueueManager:
             invoke_from=InvokeFrom.DEBUGGER,
             app_mode="workflow",
         )
-        manager._is_stopped = lambda: True
 
-        with pytest.raises(GenerateTaskStoppedError):
+        with (
+            patch.object(manager, "_is_stopped", return_value=True) as is_stopped,
+            patch.object(manager, "stop_listen") as stop_listen,
+        ):
             manager._publish(QueueMessageEndEvent(llm_result=None), PublishFrom.APPLICATION_MANAGER)
 
+        stop_listen.assert_called_once()
+        is_stopped.assert_not_called()
+
     def test_publish_non_stop_event_does_not_raise(self):
         manager = WorkflowAppQueueManager(
             task_id="task",
diff --git a/api/tests/unit_tests/core/app/apps/workflow/test_generate_task_pipeline_core.py b/api/tests/unit_tests/core/app/apps/workflow/test_generate_task_pipeline_core.py
index ea21a1cc1a6..0aaee900e37 100644
--- a/api/tests/unit_tests/core/app/apps/workflow/test_generate_task_pipeline_core.py
+++ b/api/tests/unit_tests/core/app/apps/workflow/test_generate_task_pipeline_core.py
@@ -134,6 +134,7 @@ class TestWorkflowGenerateTaskPipeline:
                 "actions": [],
                 "display_in_ui": False,
                 "form_token": None,
+                "approval_channels": [],
                 "resolved_default_values": {},
                 "expiration_time": 1,
             }
diff --git a/api/tests/unit_tests/core/plugin/test_backwards_invocation_app.py b/api/tests/unit_tests/core/plugin/test_backwards_invocation_app.py
index 2ed7c70ed94..e95ca8a7bf8 100644
--- a/api/tests/unit_tests/core/plugin/test_backwards_invocation_app.py
+++ b/api/tests/unit_tests/core/plugin/test_backwards_invocation_app.py
@@ -5,6 +5,7 @@ from unittest.mock import MagicMock
 import pytest
 from pydantic import BaseModel
 from pytest_mock import MockerFixture
+from sqlalchemy.dialects import postgresql
 
 from core.app.layers.pause_state_persist_layer import PauseStateLayerConfig
 from core.plugin.backwards_invocation.app import PluginAppBackwardsInvocation
@@ -16,6 +17,16 @@ class _Chunk(BaseModel):
     value: int
 
 
+def _build_app_model_config(result: dict | None = None):
+    app_model_config = MagicMock()
+    app_model_config.app_id = "app-1"
+    app_model_config.to_dict.return_value = result or {
+        "user_input_form": [{"name": "bar"}],
+        "annotation_reply": {"enabled": False},
+    }
+    return app_model_config
+
+
 class TestBaseBackwardsInvocation:
     def test_convert_to_event_stream_with_generator_and_error(self):
         def _stream():
@@ -42,12 +53,25 @@ class TestBaseBackwardsInvocation:
 
 
 class TestPluginAppBackwardsInvocation:
+    def patch_create_session(self, mocker: MockerFixture, *, return_value=None, side_effect=None):
+        session = MagicMock()
+        if side_effect is not None:
+            session.scalar.side_effect = side_effect
+        else:
+            session.scalar.return_value = return_value
+        session_ctx = MagicMock()
+        session_ctx.__enter__.return_value = session
+        session_ctx.__exit__.return_value = None
+        mocker.patch("core.plugin.backwards_invocation.app.create_session", return_value=session_ctx)
+        return session
+
     def test_fetch_app_info_workflow_path(self, mocker: MockerFixture):
         workflow = MagicMock()
         workflow.features_dict = {"feature": "v"}
         workflow.user_input_form.return_value = [{"name": "foo"}]
-        app = MagicMock(mode=AppMode.WORKFLOW, workflow=workflow)
+        app = MagicMock(mode=AppMode.WORKFLOW)
         mocker.patch.object(PluginAppBackwardsInvocation, "_get_app", return_value=app)
+        mocker.patch.object(PluginAppBackwardsInvocation, "_get_workflow", return_value=workflow)
         mapper = mocker.patch(
             "core.plugin.backwards_invocation.app.get_parameters_from_feature_dict",
             return_value={"mapped": True},
@@ -59,10 +83,10 @@ class TestPluginAppBackwardsInvocation:
         mapper.assert_called_once_with(features_dict={"feature": "v"}, user_input_form=[{"name": "foo"}])
 
     def test_fetch_app_info_model_config_path(self, mocker: MockerFixture):
-        model_config = MagicMock()
-        model_config.to_dict.return_value = {"user_input_form": [{"name": "bar"}], "k": "v"}
-        app = MagicMock(mode=AppMode.COMPLETION, app_model_config=model_config)
+        model_config_dict = {"user_input_form": [{"name": "bar"}], "k": "v"}
+        app = MagicMock(mode=AppMode.COMPLETION)
         mocker.patch.object(PluginAppBackwardsInvocation, "_get_app", return_value=app)
+        mocker.patch.object(PluginAppBackwardsInvocation, "_get_app_model_config_dict", return_value=model_config_dict)
         mocker.patch(
             "core.plugin.backwards_invocation.app.get_parameters_from_feature_dict",
             return_value={"mapped": True},
@@ -85,8 +109,10 @@ class TestPluginAppBackwardsInvocation:
     def test_invoke_app_routes_by_mode(self, mocker: MockerFixture, mode, route_method):
         app = MagicMock(mode=mode)
         user = MagicMock()
+        workflow = MagicMock()
         mocker.patch.object(PluginAppBackwardsInvocation, "_get_app", return_value=app)
         mocker.patch.object(PluginAppBackwardsInvocation, "_get_user", return_value=user)
+        mocker.patch.object(PluginAppBackwardsInvocation, "_get_workflow", return_value=workflow)
         route = mocker.patch.object(PluginAppBackwardsInvocation, route_method, return_value={"routed": True})
 
         result = PluginAppBackwardsInvocation.invoke_app(
@@ -106,7 +132,9 @@ class TestPluginAppBackwardsInvocation:
     def test_invoke_app_uses_end_user_when_user_id_missing(self, mocker: MockerFixture):
         app = MagicMock(mode=AppMode.WORKFLOW)
         end_user = MagicMock()
+        workflow = MagicMock()
         mocker.patch.object(PluginAppBackwardsInvocation, "_get_app", return_value=app)
+        mocker.patch.object(PluginAppBackwardsInvocation, "_get_workflow", return_value=workflow)
         get_or_create = mocker.patch(
             "core.plugin.backwards_invocation.app.EndUserService.get_or_create_end_user",
             return_value=end_user,
@@ -126,7 +154,8 @@ class TestPluginAppBackwardsInvocation:
 
         assert result == {"ok": True}
         get_or_create.assert_called_once_with(app)
-        assert route.call_args.args[1] is end_user
+        assert route.call_args.args[1] is workflow
+        assert route.call_args.args[2] is end_user
 
     def test_invoke_app_missing_query_for_chat_raises(self, mocker: MockerFixture):
         mocker.patch.object(PluginAppBackwardsInvocation, "_get_app", return_value=MagicMock(mode=AppMode.CHAT))
@@ -190,7 +219,7 @@ class TestPluginAppBackwardsInvocation:
 
         app = MagicMock()
         app.mode = AppMode.ADVANCED_CHAT
-        app.workflow = workflow
+        mocker.patch.object(PluginAppBackwardsInvocation, "_get_workflow", return_value=workflow)
 
         mocker.patch(
             "core.plugin.backwards_invocation.app.db",
@@ -217,8 +246,9 @@ class TestPluginAppBackwardsInvocation:
         assert isinstance(pause_state_config, PauseStateLayerConfig)
         assert pause_state_config.state_owner_user_id == "owner-id"
 
-    def test_invoke_chat_app_advanced_chat_without_workflow_raises(self):
-        app = MagicMock(mode=AppMode.ADVANCED_CHAT, workflow=None)
+    def test_invoke_chat_app_advanced_chat_without_workflow_raises(self, mocker: MockerFixture):
+        app = MagicMock(mode=AppMode.ADVANCED_CHAT)
+        mocker.patch.object(PluginAppBackwardsInvocation, "_get_workflow", return_value=None)
         with pytest.raises(ValueError, match="unexpected app type"):
             PluginAppBackwardsInvocation.invoke_chat_app(
                 app=app,
@@ -249,7 +279,6 @@ class TestPluginAppBackwardsInvocation:
 
         app = MagicMock()
         app.mode = AppMode.WORKFLOW
-        app.workflow = workflow
 
         mocker.patch(
             "core.plugin.backwards_invocation.app.db",
@@ -262,6 +291,7 @@ class TestPluginAppBackwardsInvocation:
 
         result = PluginAppBackwardsInvocation.invoke_workflow_app(
             app=app,
+            workflow=workflow,
             user=MagicMock(),
             stream=False,
             inputs={"k": "v"},
@@ -274,12 +304,18 @@ class TestPluginAppBackwardsInvocation:
         assert isinstance(pause_state_config, PauseStateLayerConfig)
         assert pause_state_config.state_owner_user_id == "owner-id"
 
-    def test_invoke_workflow_app_without_workflow_raises(self):
-        app = MagicMock(mode=AppMode.WORKFLOW, workflow=None)
+    def test_invoke_app_workflow_without_workflow_raises(self, mocker: MockerFixture):
+        app = MagicMock(mode=AppMode.WORKFLOW)
+        mocker.patch.object(PluginAppBackwardsInvocation, "_get_app", return_value=app)
+        mocker.patch.object(PluginAppBackwardsInvocation, "_get_user", return_value=MagicMock())
+        mocker.patch.object(PluginAppBackwardsInvocation, "_get_workflow", return_value=None)
         with pytest.raises(ValueError, match="unexpected app type"):
-            PluginAppBackwardsInvocation.invoke_workflow_app(
-                app=app,
-                user=MagicMock(),
+            PluginAppBackwardsInvocation.invoke_app(
+                app_id="app",
+                user_id="user",
+                tenant_id="tenant",
+                conversation_id=None,
+                query=None,
                 stream=False,
                 inputs={},
                 files=[],
@@ -297,58 +333,97 @@ class TestPluginAppBackwardsInvocation:
         assert spy.call_count == 1
 
     def test_get_user_returns_end_user(self, mocker: MockerFixture):
-        session = MagicMock()
-        session.scalar.side_effect = [MagicMock(id="end-user")]
-        session_ctx = MagicMock()
-        session_ctx.__enter__.return_value = session
-        session_ctx.__exit__.return_value = None
-        mocker.patch("core.plugin.backwards_invocation.app.Session", return_value=session_ctx)
-        mocker.patch("core.plugin.backwards_invocation.app.db", SimpleNamespace(engine=MagicMock()))
+        session = self.patch_create_session(mocker, side_effect=[MagicMock(id="end-user")])
+        app = SimpleNamespace(id="app-1", tenant_id="tenant-1")
+
+        user = PluginAppBackwardsInvocation._get_user("uid", app)
 
-        user = PluginAppBackwardsInvocation._get_user("uid")
         assert user.id == "end-user"
+        stmt = session.scalar.call_args_list[0].args[0]
+        compiled = str(stmt.compile(dialect=postgresql.dialect()))
+        assert "end_users.id" in compiled
+        assert "end_users.tenant_id" in compiled
+        assert "end_users.app_id" in compiled
+        assert stmt.compile().params == {"id_1": "uid", "tenant_id_1": "tenant-1", "app_id_1": "app-1"}
 
     def test_get_user_falls_back_to_account_user(self, mocker: MockerFixture):
-        session = MagicMock()
-        session.scalar.side_effect = [None, MagicMock(id="account-user")]
-        session_ctx = MagicMock()
-        session_ctx.__enter__.return_value = session
-        session_ctx.__exit__.return_value = None
-        mocker.patch("core.plugin.backwards_invocation.app.Session", return_value=session_ctx)
-        mocker.patch("core.plugin.backwards_invocation.app.db", SimpleNamespace(engine=MagicMock()))
+        session = self.patch_create_session(mocker, side_effect=[None, MagicMock(id="account-user")])
+        app = SimpleNamespace(id="app-1", tenant_id="tenant-1")
+
+        user = PluginAppBackwardsInvocation._get_user("uid", app)
 
-        user = PluginAppBackwardsInvocation._get_user("uid")
         assert user.id == "account-user"
+        stmt = session.scalar.call_args_list[1].args[0]
+        compiled = str(stmt.compile(dialect=postgresql.dialect()))
+        assert "accounts.id" in compiled
+        assert "tenant_account_joins.account_id" in compiled
+        assert "tenant_account_joins.tenant_id" in compiled
+        assert stmt.compile().params == {"id_1": "uid", "tenant_id_1": "tenant-1"}
 
     def test_get_user_raises_when_user_not_found(self, mocker: MockerFixture):
-        session = MagicMock()
-        session.scalar.side_effect = [None, None]
-        session_ctx = MagicMock()
-        session_ctx.__enter__.return_value = session
-        session_ctx.__exit__.return_value = None
-        mocker.patch("core.plugin.backwards_invocation.app.Session", return_value=session_ctx)
-        mocker.patch("core.plugin.backwards_invocation.app.db", SimpleNamespace(engine=MagicMock()))
+        self.patch_create_session(mocker, side_effect=[None, None])
+        app = SimpleNamespace(id="app-1", tenant_id="tenant-1")
 
         with pytest.raises(ValueError, match="user not found"):
-            PluginAppBackwardsInvocation._get_user("uid")
+            PluginAppBackwardsInvocation._get_user("uid", app)
 
     def test_get_app_returns_app(self, mocker: MockerFixture):
         app_obj = MagicMock(id="app")
-        db = SimpleNamespace(session=MagicMock(scalar=MagicMock(return_value=app_obj)))
-        mocker.patch("core.plugin.backwards_invocation.app.db", db)
+        self.patch_create_session(mocker, return_value=app_obj)
 
         assert PluginAppBackwardsInvocation._get_app("app", "tenant") is app_obj
 
     def test_get_app_raises_when_missing(self, mocker: MockerFixture):
-        db = SimpleNamespace(session=MagicMock(scalar=MagicMock(return_value=None)))
-        mocker.patch("core.plugin.backwards_invocation.app.db", db)
+        self.patch_create_session(mocker, return_value=None)
 
         with pytest.raises(ValueError, match="app not found"):
             PluginAppBackwardsInvocation._get_app("app", "tenant")
 
     def test_get_app_raises_when_query_fails(self, mocker: MockerFixture):
-        db = SimpleNamespace(session=MagicMock(scalar=MagicMock(side_effect=RuntimeError("db down"))))
-        mocker.patch("core.plugin.backwards_invocation.app.db", db)
+        self.patch_create_session(mocker, side_effect=RuntimeError("db down"))
 
         with pytest.raises(ValueError, match="app not found"):
             PluginAppBackwardsInvocation._get_app("app", "tenant")
+
+    def test_get_workflow_stays_inside_app_boundary(self, mocker: MockerFixture):
+        workflow = MagicMock(id="workflow")
+        session = self.patch_create_session(mocker, return_value=workflow)
+        app = SimpleNamespace(id="app-1", tenant_id="tenant-1", workflow_id="workflow-1")
+
+        assert PluginAppBackwardsInvocation._get_workflow(app) is workflow
+
+        stmt = session.scalar.call_args.args[0]
+        compiled = str(stmt.compile(dialect=postgresql.dialect()))
+        assert "workflows.id" in compiled
+        assert "workflows.tenant_id" in compiled
+        assert "workflows.app_id" in compiled
+        assert stmt.compile().params == {
+            "id_1": "workflow-1",
+            "tenant_id_1": "tenant-1",
+            "app_id_1": "app-1",
+            "param_1": 1,
+        }
+
+    def test_get_app_model_config_dict_uses_explicit_session_for_annotation_reply(self, mocker: MockerFixture):
+        annotation_reply = {"enabled": False}
+        app_model_config = _build_app_model_config()
+        session = self.patch_create_session(mocker, return_value=app_model_config)
+        load_annotation_reply_config = mocker.patch(
+            "core.plugin.backwards_invocation.app.load_annotation_reply_config",
+            return_value=annotation_reply,
+        )
+        app = SimpleNamespace(id="app-1", app_model_config_id="config-1")
+
+        result = PluginAppBackwardsInvocation._get_app_model_config_dict(app)
+
+        assert result is not None
+        assert result["user_input_form"] == [{"name": "bar"}]
+        assert result["annotation_reply"] == annotation_reply
+        load_annotation_reply_config.assert_called_once_with(session, "app-1")
+        app_model_config.to_dict.assert_called_once_with(annotation_reply=annotation_reply)
+
+        stmt = session.scalar.call_args.args[0]
+        compiled = str(stmt.compile(dialect=postgresql.dialect()))
+        assert "app_model_configs.id" in compiled
+        assert "app_model_configs.app_id" in compiled
+        assert stmt.compile().params == {"id_1": "config-1", "app_id_1": "app-1", "param_1": 1}
diff --git a/api/tests/unit_tests/core/rag/embedding/test_embedding_service.py b/api/tests/unit_tests/core/rag/embedding/test_embedding_service.py
index 4b8175b0b42..42d5ea4a393 100644
--- a/api/tests/unit_tests/core/rag/embedding/test_embedding_service.py
+++ b/api/tests/unit_tests/core/rag/embedding/test_embedding_service.py
@@ -44,6 +44,7 @@ Tests follow the Arrange-Act-Assert pattern for clarity.
 """
 
 import base64
+import logging
 from decimal import Decimal
 from unittest.mock import Mock, patch
 
@@ -406,7 +407,7 @@ class TestCacheEmbeddingDocuments:
             assert len(calls[1].kwargs["texts"]) == 10
             assert len(calls[2].kwargs["texts"]) == 5
 
-    def test_embed_documents_nan_handling(self, mock_model_instance):
+    def test_embed_documents_nan_handling(self, mock_model_instance, caplog):
         """Test handling of NaN values in embeddings.
 
         Verifies:
@@ -446,7 +447,7 @@ class TestCacheEmbeddingDocuments:
             mock_session.scalar.return_value = None
             mock_model_instance.invoke_text_embedding.return_value = embedding_result
 
-            with patch("core.rag.embedding.cached_embedding.logger") as mock_logger:
+            with caplog.at_level(logging.WARNING, logger="core.rag.embedding.cached_embedding"):
                 # Act
                 result = cache_embedding.embed_documents(texts)
 
@@ -461,8 +462,8 @@ class TestCacheEmbeddingDocuments:
                 assert result[1] is None
 
                 # Verify warning was logged
-                mock_logger.warning.assert_called_once()
-                assert "Normalized embedding is nan" in str(mock_logger.warning.call_args)
+                assert sum(1 for r in caplog.records if r.levelno == logging.WARNING) >= 1
+                assert any("Normalized embedding is nan" in record.message for record in caplog.records)
 
     def test_embed_documents_api_connection_error(self, mock_model_instance):
         """Test handling of API connection errors during embedding.
diff --git a/api/tests/unit_tests/core/rag/extractor/watercrawl/test_watercrawl.py b/api/tests/unit_tests/core/rag/extractor/watercrawl/test_watercrawl.py
index 35e581ccc15..673f1e41c5d 100644
--- a/api/tests/unit_tests/core/rag/extractor/watercrawl/test_watercrawl.py
+++ b/api/tests/unit_tests/core/rag/extractor/watercrawl/test_watercrawl.py
@@ -73,6 +73,18 @@ class TestBaseAPIClient:
         assert client.session == "session"
         assert captured["headers"]["X-API-Key"] == "k"
         assert captured["headers"]["User-Agent"] == "WaterCrawl-Plugin"
+        assert captured["timeout"] is not None
+        assert captured["timeout"].connect is not None
+        assert captured["timeout"].read is not None
+
+    def test_init_session_uses_bounded_default_timeout(self):
+        # Regression: the session was built with timeout=None, which disables
+        # httpx's timeouts entirely, so a stalled WaterCrawl endpoint would hang
+        # the calling worker forever. Regular requests must keep a bounded timeout.
+        session = BaseAPIClient(api_key="k", base_url="https://watercrawl.dev").session
+
+        assert session._timeout.connect is not None
+        assert session._timeout.read is not None
 
     def test_request_stream_and_non_stream_paths(self, monkeypatch: pytest.MonkeyPatch):
         class FakeSession:
@@ -85,8 +97,8 @@ class TestBaseAPIClient:
                 self.request_calls.append((method, url, params, json, kwargs))
                 return "non-stream-response"
 
-            def build_request(self, method, url, params=None, json=None):
-                req = (method, url, params, json)
+            def build_request(self, method, url, params=None, json=None, timeout=None):
+                req = (method, url, params, json, timeout)
                 self.build_calls.append(req)
                 return req
 
@@ -105,6 +117,11 @@ class TestBaseAPIClient:
         assert client._request("GET", "/v1/items", stream=True) == "stream-response"
         assert fake_session.build_calls
         assert fake_session.send_calls[0][1] is True
+        # the streaming request keeps an unbounded read (the SSE status stream can
+        # stay open for the whole crawl) while still capping the connection
+        stream_timeout = fake_session.build_calls[0][4]
+        assert stream_timeout.read is None
+        assert stream_timeout.connect is not None
 
     def test_http_method_helpers_delegate_to_request(self, monkeypatch: pytest.MonkeyPatch):
         monkeypatch.setattr(BaseAPIClient, "init_session", lambda self: MagicMock())
diff --git a/api/tests/unit_tests/core/rag/indexing/processor/test_paragraph_index_processor.py b/api/tests/unit_tests/core/rag/indexing/processor/test_paragraph_index_processor.py
index 182930b19d1..d2154f138a7 100644
--- a/api/tests/unit_tests/core/rag/indexing/processor/test_paragraph_index_processor.py
+++ b/api/tests/unit_tests/core/rag/indexing/processor/test_paragraph_index_processor.py
@@ -1,3 +1,4 @@
+import logging
 from types import SimpleNamespace
 from typing import Any
 from unittest.mock import Mock, patch
@@ -384,7 +385,7 @@ class TestParagraphIndexProcessor:
         with pytest.raises(ValueError, match="model_name and model_provider_name"):
             ParagraphIndexProcessor.generate_summary("tenant-1", "text", {"enable": True})
 
-    def test_generate_summary_text_only_flow(self) -> None:
+    def test_generate_summary_text_only_flow(self, caplog) -> None:
         model_instance = Mock()
         model_instance.credentials = {"k": "v"}
         model_instance.model_type_instance.get_model_schema.return_value = SimpleNamespace(features=[])
@@ -402,19 +403,22 @@ class TestParagraphIndexProcessor:
                 "core.rag.index_processor.processor.paragraph_index_processor.deduct_llm_quota",
                 side_effect=RuntimeError("quota"),
             ),
-            patch("core.rag.index_processor.processor.paragraph_index_processor.logger") as mock_logger,
         ):
             mock_provider_manager.return_value.get_provider_model_bundle.return_value = Mock()
-            summary, usage = ParagraphIndexProcessor.generate_summary(
-                "tenant-1",
-                "text content",
-                {"enable": True, "model_name": "model-a", "model_provider_name": "provider-a"},
-                document_language="English",
-            )
+            with caplog.at_level(
+                logging.WARNING, logger="core.rag.index_processor.processor.paragraph_index_processor"
+            ):
+                summary, usage = ParagraphIndexProcessor.generate_summary(
+                    "tenant-1",
+                    "text content",
+                    {"enable": True, "model_name": "model-a", "model_provider_name": "provider-a"},
+                    document_language="English",
+                )
 
         assert summary == "text summary"
         assert isinstance(usage, LLMUsage)
-        mock_logger.warning.assert_called_with("Failed to deduct quota for summary generation: %s", "quota")
+        assert sum(1 for r in caplog.records if r.levelno == logging.WARNING) == 1
+        assert any("Failed to deduct quota for summary generation" in record.message for record in caplog.records)
 
     def test_generate_summary_handles_vision_and_image_conversion(self) -> None:
         model_instance = Mock()
@@ -455,7 +459,7 @@ class TestParagraphIndexProcessor:
         assert summary == "vision summary"
         mock_extract_text.assert_not_called()
 
-    def test_generate_summary_fallbacks_for_prompt_and_result_types(self) -> None:
+    def test_generate_summary_fallbacks_for_prompt_and_result_types(self, caplog) -> None:
         model_instance = Mock()
         model_instance.credentials = {"k": "v"}
         model_instance.model_type_instance.get_model_schema.return_value = SimpleNamespace(
@@ -482,21 +486,24 @@ class TestParagraphIndexProcessor:
                 "core.rag.index_processor.processor.paragraph_index_processor.file_manager.to_prompt_message_content",
                 side_effect=RuntimeError("bad image"),
             ),
-            patch("core.rag.index_processor.processor.paragraph_index_processor.logger") as mock_logger,
         ):
             mock_provider_manager.return_value.get_provider_model_bundle.return_value = Mock()
             with pytest.raises(ValueError, match="Expected LLMResult"):
-                ParagraphIndexProcessor.generate_summary(
-                    "tenant-1",
-                    "text content",
-                    {"enable": True, "model_name": "model-a", "model_provider_name": "provider-a"},
-                )
+                with caplog.at_level(
+                    logging.WARNING, logger="core.rag.index_processor.processor.paragraph_index_processor"
+                ):
+                    ParagraphIndexProcessor.generate_summary(
+                        "tenant-1",
+                        "text content",
+                        {"enable": True, "model_name": "model-a", "model_provider_name": "provider-a"},
+                    )
 
-        mock_logger.warning.assert_called_with(
-            "Failed to convert image file to prompt message content: %s", "bad image"
+        assert sum(1 for r in caplog.records if r.levelno == logging.WARNING) == 1
+        assert any(
+            "Failed to convert image file to prompt message content" in record.message for record in caplog.records
         )
 
-    def test_extract_images_from_text_handles_patterns_and_build_errors(self) -> None:
+    def test_extract_images_from_text_handles_patterns_and_build_errors(self, caplog) -> None:
         text = (
             "![img](/files/11111111-1111-1111-1111-111111111111/image-preview) "
             "![img2](/files/22222222-2222-2222-2222-222222222222/file-preview) "
@@ -532,13 +539,13 @@ class TestParagraphIndexProcessor:
                 "core.rag.index_processor.processor.paragraph_index_processor.build_from_mapping",
                 return_value=SimpleNamespace(id="file-1"),
             ) as mock_builder,
-            patch("core.rag.index_processor.processor.paragraph_index_processor.logger") as mock_logger,
+            caplog.at_level(logging.WARNING, logger="core.rag.index_processor.processor.paragraph_index_processor"),
         ):
             files = ParagraphIndexProcessor._extract_images_from_text("tenant-1", text, session)
 
         assert len(files) == 1
         assert mock_builder.call_count == 1
-        mock_logger.warning.assert_not_called()
+        assert not any(record.levelno == logging.WARNING for record in caplog.records)
 
     def test_extract_images_from_text_returns_empty_when_no_matches(self) -> None:
         scalars_result = Mock()
@@ -547,7 +554,7 @@ class TestParagraphIndexProcessor:
         session.scalars.return_value = scalars_result
         assert ParagraphIndexProcessor._extract_images_from_text("tenant-1", "no images here", session) == []
 
-    def test_extract_images_from_text_logs_when_build_fails(self) -> None:
+    def test_extract_images_from_text_logs_when_build_fails(self, caplog) -> None:
         text = "![img](/files/11111111-1111-1111-1111-111111111111/image-preview)"
         image_upload = SimpleNamespace(
             id="11111111-1111-1111-1111-111111111111",
@@ -569,14 +576,14 @@ class TestParagraphIndexProcessor:
                 "core.rag.index_processor.processor.paragraph_index_processor.build_from_mapping",
                 side_effect=RuntimeError("build failed"),
             ),
-            patch("core.rag.index_processor.processor.paragraph_index_processor.logger") as mock_logger,
+            caplog.at_level(logging.WARNING, logger="core.rag.index_processor.processor.paragraph_index_processor"),
         ):
             files = ParagraphIndexProcessor._extract_images_from_text("tenant-1", text, session)
 
         assert files == []
-        mock_logger.warning.assert_called_once()
+        assert sum(1 for r in caplog.records if r.levelno == logging.WARNING) == 1
 
-    def test_extract_images_from_segment_attachments(self) -> None:
+    def test_extract_images_from_segment_attachments(self, caplog) -> None:
         image_upload = SimpleNamespace(
             id="file-1",
             name="image",
@@ -609,13 +616,11 @@ class TestParagraphIndexProcessor:
         session = Mock()
         session.execute.return_value = execute_result
 
-        with (
-            patch("core.rag.index_processor.processor.paragraph_index_processor.logger") as mock_logger,
-        ):
+        with caplog.at_level(logging.WARNING, logger="core.rag.index_processor.processor.paragraph_index_processor"):
             files = ParagraphIndexProcessor._extract_images_from_segment_attachments("tenant-1", "seg-1", session)
 
         assert len(files) == 1
-        mock_logger.warning.assert_called_once()
+        assert sum(1 for r in caplog.records if r.levelno == logging.WARNING) == 1
 
     def test_extract_images_from_segment_attachments_empty(self) -> None:
         execute_result = Mock()
diff --git a/api/tests/unit_tests/core/rag/indexing/processor/test_qa_index_processor.py b/api/tests/unit_tests/core/rag/indexing/processor/test_qa_index_processor.py
index 30600e64651..4ffd0a76433 100644
--- a/api/tests/unit_tests/core/rag/indexing/processor/test_qa_index_processor.py
+++ b/api/tests/unit_tests/core/rag/indexing/processor/test_qa_index_processor.py
@@ -1,3 +1,4 @@
+import logging
 from types import SimpleNamespace
 from typing import Any
 from unittest.mock import MagicMock, Mock, patch
@@ -350,7 +351,7 @@ class TestQAIndexProcessor:
         assert all_qa_documents[0].metadata["answer"] == "A test."
         assert all_qa_documents[1].metadata["answer"] == "Coverage."
 
-    def test_format_qa_document_logs_errors(self, processor: QAIndexProcessor, fake_flask_app) -> None:
+    def test_format_qa_document_logs_errors(self, processor: QAIndexProcessor, fake_flask_app, caplog) -> None:
         all_qa_documents: list[Document] = []
         source_document = Document(page_content="source text", metadata={"origin": "doc-1"})
 
@@ -359,12 +360,14 @@ class TestQAIndexProcessor:
                 "core.rag.index_processor.processor.qa_index_processor.LLMGenerator.generate_qa_document",
                 side_effect=RuntimeError("llm failure"),
             ),
-            patch("core.rag.index_processor.processor.qa_index_processor.logger") as mock_logger,
+            caplog.at_level(logging.ERROR, logger="core.rag.index_processor.processor.qa_index_processor"),
         ):
             processor._format_qa_document(fake_flask_app, "tenant-1", source_document, all_qa_documents, "English")
 
         assert all_qa_documents == []
-        mock_logger.exception.assert_called_once_with("Failed to format qa document")
+        assert len(caplog.records) == 1
+        assert caplog.records[0].levelname == "ERROR"
+        assert "Failed to format qa document" in caplog.records[0].message
 
     def test_format_split_text_extracts_question_answer_pairs(self, processor: QAIndexProcessor) -> None:
         parsed = processor._format_split_text("Q1: First?\nA1: One.\nQ2: Second?\nA2: Two.\n")
diff --git a/api/tests/unit_tests/core/repositories/test_human_input_form_repository_impl.py b/api/tests/unit_tests/core/repositories/test_human_input_form_repository_impl.py
index 5bd35e6d3c2..27c32d47ee2 100644
--- a/api/tests/unit_tests/core/repositories/test_human_input_form_repository_impl.py
+++ b/api/tests/unit_tests/core/repositories/test_human_input_form_repository_impl.py
@@ -32,6 +32,7 @@ from models.human_input import (
     EmailMemberRecipientPayload,
     HumanInputFormRecipient,
     RecipientType,
+    StandaloneWebAppRecipientPayload,
 )
 
 
@@ -307,6 +308,9 @@ class _DummyRecipient:
     recipient_type: RecipientType
     access_token: str
     form: _DummyForm | None = None
+    recipient_payload: str = dataclasses.field(
+        default_factory=lambda: StandaloneWebAppRecipientPayload().model_dump_json()
+    )
 
 
 class _FakeScalarResult:
diff --git a/api/tests/unit_tests/core/workflow/nodes/agent_v2/test_runtime_request_builder.py b/api/tests/unit_tests/core/workflow/nodes/agent_v2/test_runtime_request_builder.py
index 9313aea51e6..78e49769159 100644
--- a/api/tests/unit_tests/core/workflow/nodes/agent_v2/test_runtime_request_builder.py
+++ b/api/tests/unit_tests/core/workflow/nodes/agent_v2/test_runtime_request_builder.py
@@ -834,57 +834,116 @@ def test_mentions_expand_in_soul_and_job_prompts_without_token_leak():
 
 def _soul_with_drive_skill() -> AgentSoulConfig:
     return AgentSoulConfig(
-        prompt={"system_prompt": "You are careful."},
-        model=AgentSoulModelConfig(plugin_id="langgenius/openai", model_provider="openai", model="gpt-test"),
-        skills_files={
-            "skills": [
-                {
-                    "id": "abc123",
-                    "name": "Tender Analyzer",
-                    "description": "Parses RFPs.",
-                    "skill_md_key": "tender-analyzer/SKILL.md",
-                    "full_archive_key": "tender-analyzer/.DIFY-SKILL-FULL.zip",
-                },
-                {"id": "legacy", "name": "Legacy Skill"},  # pre-standardization: no drive key
-            ],
-            "files": [
-                {"name": "sample.pdf", "drive_key": "files/sample.pdf", "type": "application/pdf"},
-                {"name": "plain-upload.pdf", "file_id": "upload-1"},  # not drive-backed
-            ],
+        prompt={
+            "system_prompt": (
+                "You are careful. Use [§skill:tender-analyzer%2FSKILL.md:Tender Analyzer§] "
+                "and [§file:files%2Fsample.pdf:sample.pdf§]."
+            )
         },
+        model=AgentSoulModelConfig(plugin_id="langgenius/openai", model_provider="openai", model="gpt-test"),
     )
 
 
-def test_build_drive_layer_config_catalogs_only_drive_backed_refs():
+def _mock_drive_catalog(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(
+        "core.workflow.nodes.agent_v2.runtime_request_builder.AgentDriveService.list_skills",
+        lambda self, *, tenant_id, agent_id: [
+            {
+                "path": "tender-analyzer",
+                "skill_md_key": "tender-analyzer/SKILL.md",
+                "archive_key": "tender-analyzer/.DIFY-SKILL-FULL.zip",
+                "name": "Tender Analyzer",
+                "description": "Parses RFPs.",
+                "size": 123,
+                "mime_type": "text/markdown",
+                "hash": "hash-1",
+                "created_at": 1,
+            }
+        ],
+    )
+    monkeypatch.setattr(
+        "core.workflow.nodes.agent_v2.runtime_request_builder.AgentDriveService.manifest",
+        lambda self, *, tenant_id, agent_id, prefix="", include_download_url=False: [
+            {"key": "tender-analyzer/SKILL.md", "is_skill": True},
+            {"key": "tender-analyzer/.DIFY-SKILL-FULL.zip", "is_skill": False},
+            {"key": "files/sample.pdf", "is_skill": False},
+        ],
+    )
+
+
+def _mock_empty_drive_catalog(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(
+        "core.workflow.nodes.agent_v2.runtime_request_builder.AgentDriveService.list_skills",
+        lambda self, *, tenant_id, agent_id: [],
+    )
+    monkeypatch.setattr(
+        "core.workflow.nodes.agent_v2.runtime_request_builder.AgentDriveService.manifest",
+        lambda self, *, tenant_id, agent_id, prefix="", include_download_url=False: [],
+    )
+
+
+def test_build_drive_layer_config_catalogs_drive_skills_and_mentions(monkeypatch: pytest.MonkeyPatch):
     from core.workflow.nodes.agent_v2.runtime_request_builder import build_drive_layer_config
 
-    config, warnings = build_drive_layer_config(_soul_with_drive_skill(), agent_id="agent-1")
+    _mock_drive_catalog(monkeypatch)
+    config, warnings = build_drive_layer_config(_soul_with_drive_skill(), tenant_id="tenant-1", agent_id="agent-1")
 
     assert config is not None
     assert config.drive_ref == "agent-agent-1"
     assert [skill.skill_md_key for skill in config.skills] == ["tender-analyzer/SKILL.md"]
     assert config.skills[0].archive_key == "tender-analyzer/.DIFY-SKILL-FULL.zip"
-    assert [file.key for file in config.files] == ["files/sample.pdf"]
-    assert [w["code"] for w in warnings] == ["skill_ref_dangling"]
-    assert "Legacy Skill" in warnings[0]["message"]
+    assert config.mentioned_skill_keys == ["tender-analyzer/SKILL.md"]
+    assert config.mentioned_file_keys == ["files/sample.pdf"]
+    assert warnings == []
 
 
-def test_build_drive_layer_config_skips_when_nothing_configured():
+def test_build_drive_layer_config_emits_drive_ref_when_catalog_is_empty(monkeypatch: pytest.MonkeyPatch):
     from core.workflow.nodes.agent_v2.runtime_request_builder import build_drive_layer_config
 
+    _mock_empty_drive_catalog(monkeypatch)
     soul = AgentSoulConfig(
         model=AgentSoulModelConfig(plugin_id="langgenius/openai", model_provider="openai", model="gpt-test")
     )
-    assert build_drive_layer_config(soul, agent_id="agent-1") == (None, [])
+    config, warnings = build_drive_layer_config(soul, tenant_id="tenant-1", agent_id="agent-1")
+
+    assert config is not None
+    assert config.drive_ref == "agent-agent-1"
+    assert config.skills == []
+    assert config.mentioned_skill_keys == []
+    assert config.mentioned_file_keys == []
+    assert warnings == []
+
+
+def test_workflow_run_request_contains_drive_layer_with_empty_catalog(monkeypatch: pytest.MonkeyPatch):
+    monkeypatch.setattr(
+        "core.workflow.nodes.agent_v2.runtime_request_builder.dify_config.AGENT_DRIVE_MANIFEST_ENABLED", True
+    )
+    monkeypatch.setattr("core.workflow.nodes.agent_v2.runtime_request_builder.dify_config.AGENT_SHELL_ENABLED", True)
+    _mock_empty_drive_catalog(monkeypatch)
+
+    result = WorkflowAgentRuntimeRequestBuilder(credentials_provider=FakeCredentialsProvider()).build(_context())
+
+    dumped = result.request.model_dump(mode="json")
+    layers = {layer["name"]: layer for layer in dumped["composition"]["layers"]}
+    assert layers["drive"]["config"] == {
+        "drive_ref": "agent-agent-1",
+        "skills": [],
+        "mentioned_skill_keys": [],
+        "mentioned_file_keys": [],
+    }
+    assert layers[DIFY_SHELL_LAYER_ID]["deps"] == {
+        "execution_context": DIFY_EXECUTION_CONTEXT_LAYER_ID,
+        "drive": "drive",
+    }
 
 
 def test_build_drive_layer_config_requires_agent_identity():
     from core.workflow.nodes.agent_v2.runtime_request_builder import build_drive_layer_config
 
-    config, warnings = build_drive_layer_config(_soul_with_drive_skill(), agent_id=None)
+    config, warnings = build_drive_layer_config(_soul_with_drive_skill(), tenant_id="tenant-1", agent_id=None)
 
     assert config is None
-    assert [w["code"] for w in warnings] == ["skill_ref_dangling"]
+    assert [w["code"] for w in warnings] == ["drive_ref_dangling"]
 
 
 def test_workflow_run_request_contains_drive_layer_when_flag_enabled(monkeypatch: pytest.MonkeyPatch):
@@ -892,6 +951,7 @@ def test_workflow_run_request_contains_drive_layer_when_flag_enabled(monkeypatch
     monkeypatch.setattr(
         "core.workflow.nodes.agent_v2.runtime_request_builder.dify_config.AGENT_DRIVE_MANIFEST_ENABLED", True
     )
+    _mock_drive_catalog(monkeypatch)
     context = _context()
     context.snapshot.config_snapshot = _soul_with_drive_skill()
 
@@ -904,21 +964,21 @@ def test_workflow_run_request_contains_drive_layer_when_flag_enabled(monkeypatch
     assert layer_names.index("drive") == layer_names.index("execution_context") + 1
     drive = next(layer for layer in dumped["composition"]["layers"] if layer["name"] == "drive")
     assert drive["type"] == "dify.drive"
+    assert drive["deps"] == {"execution_context": "execution_context"}
     assert drive["config"]["drive_ref"] == "agent-agent-1"
     assert drive["config"]["skills"] == [
         {
+            "path": "tender-analyzer",
             "name": "Tender Analyzer",
             "description": "Parses RFPs.",
             "skill_md_key": "tender-analyzer/SKILL.md",
             "archive_key": "tender-analyzer/.DIFY-SKILL-FULL.zip",
         }
     ]
-    assert drive["config"]["files"] == [
-        {"name": "sample.pdf", "key": "files/sample.pdf", "size": None, "mime_type": "application/pdf"}
-    ]
-    # the dangling legacy ref degraded to a warning instead of failing the run
+    assert drive["config"]["mentioned_skill_keys"] == ["tender-analyzer/SKILL.md"]
+    assert drive["config"]["mentioned_file_keys"] == ["files/sample.pdf"]
     warnings = result.metadata["runtime_support"]["unsupported_runtime_warnings"]
-    assert any(w["code"] == "skill_ref_dangling" for w in warnings)
+    assert warnings == []
     # the drive layer is non-sensitive and must survive into persistable specs
     from dify_agent.protocol import extract_runtime_layer_specs
 
@@ -926,6 +986,51 @@ def test_workflow_run_request_contains_drive_layer_when_flag_enabled(monkeypatch
     assert any(spec.name == "drive" and spec.type == "dify.drive" for spec in specs)
 
 
+def test_workflow_runtime_expands_drive_mentions_in_agent_soul_prompt(monkeypatch: pytest.MonkeyPatch):
+    monkeypatch.setattr(
+        "core.workflow.nodes.agent_v2.runtime_request_builder.dify_config.AGENT_DRIVE_MANIFEST_ENABLED", True
+    )
+    _mock_drive_catalog(monkeypatch)
+    context = _context()
+    context.snapshot.config_snapshot = _soul_with_drive_skill()
+
+    result = WorkflowAgentRuntimeRequestBuilder(credentials_provider=FakeCredentialsProvider()).build(context)
+
+    soul_prompt = next(layer for layer in result.request.composition.layers if layer.name == "agent_soul_prompt")
+    assert soul_prompt.config.prefix == "You are careful. Use Tender Analyzer and sample.pdf."
+    assert "[§" not in soul_prompt.config.prefix
+
+
+def test_workflow_runtime_missing_drive_mentions_fall_back_to_label_then_decoded_key(monkeypatch: pytest.MonkeyPatch):
+    monkeypatch.setattr(
+        "core.workflow.nodes.agent_v2.runtime_request_builder.dify_config.AGENT_DRIVE_MANIFEST_ENABLED", True
+    )
+    monkeypatch.setattr(
+        "core.workflow.nodes.agent_v2.runtime_request_builder.AgentDriveService.list_skills",
+        lambda self, *, tenant_id, agent_id: [],
+    )
+    monkeypatch.setattr(
+        "core.workflow.nodes.agent_v2.runtime_request_builder.AgentDriveService.manifest",
+        lambda self, *, tenant_id, agent_id, prefix="", include_download_url=False: [],
+    )
+    context = _context()
+    context.snapshot.config_snapshot = AgentSoulConfig(
+        prompt={
+            "system_prompt": (
+                "Use [§skill:ghost%2FSKILL.md:Ghost Skill§], [§file:files%2Fghost.txt:Ghost File§], "
+                "and [§file:files%2Fno-label.txt§]."
+            )
+        },
+        model=AgentSoulModelConfig(plugin_id="langgenius/openai", model_provider="openai", model="gpt-test"),
+    )
+
+    result = WorkflowAgentRuntimeRequestBuilder(credentials_provider=FakeCredentialsProvider()).build(context)
+
+    soul_prompt = next(layer for layer in result.request.composition.layers if layer.name == "agent_soul_prompt")
+    assert soul_prompt.config.prefix == "Use Ghost Skill, Ghost File, and files/no-label.txt."
+    assert "[§" not in soul_prompt.config.prefix
+
+
 def test_workflow_run_request_has_no_drive_layer_when_flag_disabled():
     context = _context()
     context.snapshot.config_snapshot = _soul_with_drive_skill()
@@ -934,20 +1039,20 @@ def test_workflow_run_request_has_no_drive_layer_when_flag_disabled():
 
     dumped = result.request.model_dump(mode="json")
     assert all(layer["name"] != "drive" for layer in dumped["composition"]["layers"])
-    warnings = result.metadata["runtime_support"]["unsupported_runtime_warnings"]
-    assert any(w["code"] == "drive_manifest_disabled" for w in warnings)
+    assert result.metadata["runtime_support"]["unsupported_runtime_warnings"] == []
 
 
-def test_build_drive_layer_config_all_refs_dangling_yields_no_config():
+def test_build_drive_layer_config_missing_mentions_warn_but_keep_skill_catalog(monkeypatch: pytest.MonkeyPatch):
     from core.workflow.nodes.agent_v2.runtime_request_builder import build_drive_layer_config
 
+    _mock_drive_catalog(monkeypatch)
     soul = AgentSoulConfig(
         model=AgentSoulModelConfig(plugin_id="langgenius/openai", model_provider="openai", model="gpt-test"),
-        skills_files={"skills": [{"id": "legacy", "name": "Legacy"}], "files": [{"name": "u.pdf", "file_id": "u1"}]},
+        prompt={"system_prompt": "Use [§skill:ghost%2FSKILL.md:Ghost§]"},
     )
-    config, warnings = build_drive_layer_config(soul, agent_id="agent-1")
-    assert config is None
-    assert [w["code"] for w in warnings] == ["skill_ref_dangling"]
+    config, warnings = build_drive_layer_config(soul, tenant_id="tenant-1", agent_id="agent-1")
+    assert config is not None
+    assert [w["code"] for w in warnings] == ["mention_target_missing"]
 
 
 # ── ENG-635: ask_human layer gating + feature manifest ───────────────────────
diff --git a/api/tests/unit_tests/core/workflow/test_enrich_pause_reasons.py b/api/tests/unit_tests/core/workflow/test_enrich_pause_reasons.py
new file mode 100644
index 00000000000..f53a8eba734
--- /dev/null
+++ b/api/tests/unit_tests/core/workflow/test_enrich_pause_reasons.py
@@ -0,0 +1,63 @@
+import pytest
+
+from core.workflow.human_input_policy import FormDisposition, enrich_human_input_pause_reasons
+from graphon.entities.pause_reason import PauseReasonType
+
+_HUMAN_INPUT_REASON = {"TYPE": PauseReasonType.HUMAN_INPUT_REQUIRED, "form_id": "f1"}
+
+
+@pytest.mark.parametrize(
+    ("dispositions", "expected_token", "expected_channels"),
+    [
+        ({"f1": FormDisposition(form_token=None, approval_channels=["console", "email"])}, None, ["console", "email"]),
+        ({"f1": FormDisposition(form_token="tok", approval_channels=[])}, "tok", []),
+        # form_id absent from the map (no recipient rows) falls back to no token, no channels.
+        ({}, None, []),
+    ],
+)
+def test_enrich_projects_disposition_onto_reason(dispositions, expected_token, expected_channels):
+    out = enrich_human_input_pause_reasons(
+        [dict(_HUMAN_INPUT_REASON)],
+        dispositions_by_form_id=dispositions,
+        expiration_times_by_form_id={},
+    )
+
+    assert out[0]["form_token"] == expected_token
+    assert out[0]["approval_channels"] == expected_channels
+
+
+def test_enrich_leaves_non_human_input_reasons_untouched():
+    reason = {"TYPE": "something_else", "form_id": "f1"}
+
+    out = enrich_human_input_pause_reasons(
+        [reason],
+        dispositions_by_form_id={"f1": FormDisposition(form_token="tok", approval_channels=["email"])},
+        expiration_times_by_form_id={},
+    )
+
+    assert out[0] == reason
+    assert "form_token" not in out[0]
+    assert "approval_channels" not in out[0]
+
+
+def test_pause_reason_payload_carries_approval_channels_through_factory():
+    # from_response_data maps fields by hand; this guards approval_channels/form_token
+    # (the fields this feature added) against being dropped in that mapping.
+    from core.app.entities.task_entities import (
+        HumanInputRequiredPauseReasonPayload,
+        HumanInputRequiredResponse,
+    )
+
+    data = HumanInputRequiredResponse.Data(
+        form_id="f",
+        node_id="n",
+        node_title="t",
+        form_content="c",
+        expiration_time=123,
+        form_token=None,
+        approval_channels=["console"],
+    )
+    payload = HumanInputRequiredPauseReasonPayload.from_response_data(data)
+
+    assert payload.approval_channels == ["console"]
+    assert payload.form_token is None
diff --git a/api/tests/unit_tests/core/workflow/test_human_input_forms.py b/api/tests/unit_tests/core/workflow/test_human_input_forms.py
index e508815b35e..c84c7d578be 100644
--- a/api/tests/unit_tests/core/workflow/test_human_input_forms.py
+++ b/api/tests/unit_tests/core/workflow/test_human_input_forms.py
@@ -1,7 +1,16 @@
 from types import SimpleNamespace
 
-from core.workflow.human_input_forms import _load_form_tokens_by_form_id, load_form_tokens_by_form_id
-from core.workflow.human_input_policy import HumanInputSurface
+import pytest
+
+from core.workflow.human_input_forms import (
+    load_form_dispositions_by_form_id,
+    load_form_tokens_by_form_id,
+)
+from core.workflow.human_input_policy import (
+    FormDisposition,
+    HumanInputSurface,
+    disposition_for_surface,
+)
 from models.human_input import RecipientType
 
 
@@ -13,91 +22,100 @@ class _FakeSession:
         return self._recipients
 
 
-def test_load_form_tokens_by_form_id_prefers_backstage_token() -> None:
+def _recipient(form_id: str, recipient_type: RecipientType, access_token: str | None) -> SimpleNamespace:
+    return SimpleNamespace(form_id=form_id, recipient_type=recipient_type, access_token=access_token)
+
+
+@pytest.mark.parametrize(
+    ("surface", "expected_token"),
+    [
+        # Unfiltered (no surface) picks the highest-priority recipient: backstage.
+        (None, "backstage-token"),
+        # SERVICE_API may only act on the web-app recipient.
+        (HumanInputSurface.SERVICE_API, "web-token"),
+    ],
+)
+def test_load_form_tokens_picks_token_for_surface(surface, expected_token) -> None:
     session = _FakeSession(
-        recipients=[
-            SimpleNamespace(
-                form_id="form-1",
-                recipient_type=RecipientType.STANDALONE_WEB_APP,
-                access_token="web-token",
-            ),
-            SimpleNamespace(
-                form_id="form-1",
-                recipient_type=RecipientType.CONSOLE,
-                access_token="console-token",
-            ),
-            SimpleNamespace(
-                form_id="form-1",
-                recipient_type=RecipientType.BACKSTAGE,
-                access_token="backstage-token",
-            ),
+        [
+            _recipient("form-1", RecipientType.STANDALONE_WEB_APP, "web-token"),
+            _recipient("form-1", RecipientType.CONSOLE, "console-token"),
+            _recipient("form-1", RecipientType.BACKSTAGE, "backstage-token"),
         ]
     )
 
-    assert load_form_tokens_by_form_id(["form-1"], session=session) == {"form-1": "backstage-token"}
+    assert load_form_tokens_by_form_id(["form-1"], session=session, surface=surface) == {"form-1": expected_token}
 
 
-def test_load_form_tokens_by_form_id_ignores_unsupported_recipients() -> None:
+def test_load_form_tokens_drops_forms_without_actionable_token() -> None:
     session = _FakeSession(
-        recipients=[
-            SimpleNamespace(
-                form_id="form-1",
-                recipient_type=RecipientType.EMAIL_MEMBER,
-                access_token="email-token",
-            ),
-            SimpleNamespace(
-                form_id="form-1",
-                recipient_type=RecipientType.CONSOLE,
-                access_token=None,
-            ),
+        [
+            _recipient("form-1", RecipientType.EMAIL_MEMBER, "email-token"),
+            _recipient("form-1", RecipientType.CONSOLE, None),
         ]
     )
 
     assert load_form_tokens_by_form_id(["form-1"], session=session) == {}
 
 
-def test_load_form_tokens_by_form_id_uses_shared_priority() -> None:
+def test_load_form_tokens_service_api_surface_uses_web_token() -> None:
     session = _FakeSession(
-        recipients=[
-            SimpleNamespace(
-                form_id="form-1",
-                recipient_type=RecipientType.STANDALONE_WEB_APP,
-                access_token="web-token",
-            ),
-            SimpleNamespace(
-                form_id="form-1",
-                recipient_type=RecipientType.CONSOLE,
-                access_token="console-token",
-            ),
+        [
+            _recipient("form-1", RecipientType.STANDALONE_WEB_APP, "web-token"),
+            _recipient("form-1", RecipientType.CONSOLE, "console-token"),
+            _recipient("form-1", RecipientType.BACKSTAGE, "backstage-token"),
         ]
     )
 
-    assert _load_form_tokens_by_form_id(session, ["form-1"]) == {"form-1": "console-token"}
+    assert load_form_tokens_by_form_id(["form-1"], session=session, surface=HumanInputSurface.SERVICE_API) == {
+        "form-1": "web-token"
+    }
 
 
-def test_load_form_tokens_by_form_id_uses_web_token_for_service_api_surface() -> None:
+def test_load_dispositions_openapi_webapp_form_is_resumable() -> None:
     session = _FakeSession(
-        recipients=[
-            SimpleNamespace(
-                form_id="form-1",
-                recipient_type=RecipientType.STANDALONE_WEB_APP,
-                access_token="web-token",
-            ),
-            SimpleNamespace(
-                form_id="form-1",
-                recipient_type=RecipientType.CONSOLE,
-                access_token="console-token",
-            ),
-            SimpleNamespace(
-                form_id="form-1",
-                recipient_type=RecipientType.BACKSTAGE,
-                access_token="backstage-token",
-            ),
+        [
+            _recipient("form-1", RecipientType.STANDALONE_WEB_APP, "web-token"),
+            _recipient("form-1", RecipientType.BACKSTAGE, "backstage-token"),
         ]
     )
 
-    assert load_form_tokens_by_form_id(
-        ["form-1"],
-        session=session,
-        surface=HumanInputSurface.SERVICE_API,
-    ) == {"form-1": "web-token"}
+    assert load_form_dispositions_by_form_id(["form-1"], session=session, surface=HumanInputSurface.OPENAPI) == {
+        "form-1": FormDisposition(form_token="web-token", approval_channels=["console"])
+    }
+
+
+def test_load_dispositions_openapi_backstage_only_form_yields_channels_not_token() -> None:
+    session = _FakeSession([_recipient("form-1", RecipientType.BACKSTAGE, "backstage-token")])
+
+    assert load_form_dispositions_by_form_id(["form-1"], session=session, surface=HumanInputSurface.OPENAPI) == {
+        "form-1": FormDisposition(form_token=None, approval_channels=["console"])
+    }
+
+
+# disposition_for_surface partitions recipients into a surface-actionable resume
+# token plus the approval channels of the recipients the surface may NOT act on.
+_WEB = (RecipientType.STANDALONE_WEB_APP, "tok_web")
+_BACKSTAGE = (RecipientType.BACKSTAGE, "tok_b")
+_CONSOLE = (RecipientType.CONSOLE, "tok_c")
+_EMAIL_MEMBER = (RecipientType.EMAIL_MEMBER, "t1")
+_EMAIL_EXTERNAL = (RecipientType.EMAIL_EXTERNAL, "t2")
+
+
+@pytest.mark.parametrize(
+    ("recipients", "surface", "expected"),
+    [
+        # Token surface acts on the web-app recipient; blocked recipients become channels.
+        ([_BACKSTAGE, _WEB], HumanInputSurface.OPENAPI, FormDisposition("tok_web", ["console"])),
+        ([_EMAIL_MEMBER, _EMAIL_EXTERNAL], HumanInputSurface.OPENAPI, FormDisposition(None, ["email"])),
+        ([_EMAIL_MEMBER, _BACKSTAGE], HumanInputSurface.OPENAPI, FormDisposition(None, ["console", "email"])),
+        # CONSOLE acts on console/backstage; a web-app recipient is blocked → web_app channel.
+        ([_CONSOLE, _WEB], HumanInputSurface.CONSOLE, FormDisposition("tok_c", ["web_app"])),
+        ([_WEB], HumanInputSurface.CONSOLE, FormDisposition(None, ["web_app"])),
+        # No surface: unfiltered priority token, channels never populated.
+        ([_BACKSTAGE], None, FormDisposition("tok_b", [])),
+        ([_WEB, _EMAIL_MEMBER], None, FormDisposition("tok_web", [])),
+    ],
+)
+def test_disposition_for_surface_partitions_token_and_channels(recipients, surface, expected) -> None:
+    assert disposition_for_surface(recipients, surface=surface) == expected
diff --git a/api/tests/unit_tests/core/workflow/test_human_input_policy.py b/api/tests/unit_tests/core/workflow/test_human_input_policy.py
index 651b69216ae..a1c6fee98cf 100644
--- a/api/tests/unit_tests/core/workflow/test_human_input_policy.py
+++ b/api/tests/unit_tests/core/workflow/test_human_input_policy.py
@@ -12,38 +12,28 @@ from graphon.runtime import VariablePool
 from models.human_input import RecipientType
 
 
-def test_service_api_only_allows_public_webapp_forms() -> None:
-    assert is_recipient_type_allowed_for_surface(
-        RecipientType.STANDALONE_WEB_APP,
-        HumanInputSurface.SERVICE_API,
-    )
-    assert not is_recipient_type_allowed_for_surface(
-        RecipientType.CONSOLE,
-        HumanInputSurface.SERVICE_API,
-    )
-    assert not is_recipient_type_allowed_for_surface(
-        RecipientType.BACKSTAGE,
-        HumanInputSurface.SERVICE_API,
-    )
-    assert not is_recipient_type_allowed_for_surface(
-        RecipientType.EMAIL_MEMBER,
-        HumanInputSurface.SERVICE_API,
-    )
-
-
-def test_console_only_allows_internal_console_surfaces() -> None:
-    assert is_recipient_type_allowed_for_surface(
-        RecipientType.CONSOLE,
-        HumanInputSurface.CONSOLE,
-    )
-    assert is_recipient_type_allowed_for_surface(
-        RecipientType.BACKSTAGE,
-        HumanInputSurface.CONSOLE,
-    )
-    assert not is_recipient_type_allowed_for_surface(
-        RecipientType.STANDALONE_WEB_APP,
-        HumanInputSurface.CONSOLE,
-    )
+# Token surfaces (SERVICE_API, OPENAPI) may act only on public web-app forms;
+# CONSOLE may act on internal console/backstage forms. OPENAPI mirrors SERVICE_API
+# today but is pinned independently because the two are expected to diverge.
+@pytest.mark.parametrize(
+    ("recipient_type", "surface", "allowed"),
+    [
+        (RecipientType.STANDALONE_WEB_APP, HumanInputSurface.SERVICE_API, True),
+        (RecipientType.CONSOLE, HumanInputSurface.SERVICE_API, False),
+        (RecipientType.BACKSTAGE, HumanInputSurface.SERVICE_API, False),
+        (RecipientType.EMAIL_MEMBER, HumanInputSurface.SERVICE_API, False),
+        (RecipientType.STANDALONE_WEB_APP, HumanInputSurface.OPENAPI, True),
+        (RecipientType.CONSOLE, HumanInputSurface.OPENAPI, False),
+        (RecipientType.BACKSTAGE, HumanInputSurface.OPENAPI, False),
+        (RecipientType.CONSOLE, HumanInputSurface.CONSOLE, True),
+        (RecipientType.BACKSTAGE, HumanInputSurface.CONSOLE, True),
+        (RecipientType.STANDALONE_WEB_APP, HumanInputSurface.CONSOLE, False),
+    ],
+)
+def test_recipient_type_allowed_per_surface(
+    recipient_type: RecipientType, surface: HumanInputSurface, allowed: bool
+) -> None:
+    assert is_recipient_type_allowed_for_surface(recipient_type, surface) is allowed
 
 
 def test_preferred_form_token_uses_shared_priority_order() -> None:
@@ -56,6 +46,17 @@ def test_preferred_form_token_uses_shared_priority_order() -> None:
     assert get_preferred_form_token(recipients) == "backstage-token"
 
 
+def test_preferred_form_token_skips_prioritized_type_with_empty_token() -> None:
+    # An empty token is not actionable: the highest-priority recipient that
+    # actually carries a token wins, not the highest-priority type.
+    recipients = [
+        (RecipientType.BACKSTAGE, ""),
+        (RecipientType.CONSOLE, "console-token"),
+    ]
+
+    assert get_preferred_form_token(recipients) == "console-token"
+
+
 def test_resolve_variable_select_input_options_uses_runtime_values() -> None:
     variable_pool = VariablePool()
     variable_pool.add(("start", "options"), ["approve", "reject"])
diff --git a/api/tests/unit_tests/core/workflow/test_human_input_policy_openapi.py b/api/tests/unit_tests/core/workflow/test_human_input_policy_openapi.py
deleted file mode 100644
index b78e821237d..00000000000
--- a/api/tests/unit_tests/core/workflow/test_human_input_policy_openapi.py
+++ /dev/null
@@ -1,34 +0,0 @@
-"""Tests for OPENAPI surface in HumanInputPolicy and human_input_forms."""
-
-from __future__ import annotations
-
-from core.workflow.human_input_policy import HumanInputSurface, is_recipient_type_allowed_for_surface
-from models.human_input import RecipientType
-
-
-def test_openapi_surface_exists():
-    assert HumanInputSurface.OPENAPI == "openapi"
-
-
-def test_openapi_allows_standalone_web_app():
-    assert is_recipient_type_allowed_for_surface(RecipientType.STANDALONE_WEB_APP, HumanInputSurface.OPENAPI)
-
-
-def test_openapi_rejects_console_recipient():
-    assert not is_recipient_type_allowed_for_surface(RecipientType.CONSOLE, HumanInputSurface.OPENAPI)
-
-
-def test_openapi_rejects_backstage_recipient():
-    assert not is_recipient_type_allowed_for_surface(RecipientType.BACKSTAGE, HumanInputSurface.OPENAPI)
-
-
-def test_get_surface_form_token_openapi_picks_standalone_web_app():
-    """OPENAPI surface should pick STANDALONE_WEB_APP token, same as SERVICE_API."""
-    from core.workflow.human_input_forms import _get_surface_form_token
-
-    recipients = [
-        (RecipientType.BACKSTAGE, "backstage-token"),
-        (RecipientType.STANDALONE_WEB_APP, "web-token"),
-    ]
-    token = _get_surface_form_token(recipients, surface=HumanInputSurface.OPENAPI)
-    assert token == "web-token"
diff --git a/api/tests/unit_tests/extensions/test_pubsub_channel.py b/api/tests/unit_tests/extensions/test_pubsub_channel.py
index 24bbf55cb3a..2884509d22b 100644
--- a/api/tests/unit_tests/extensions/test_pubsub_channel.py
+++ b/api/tests/unit_tests/extensions/test_pubsub_channel.py
@@ -2,7 +2,7 @@ import pytest
 
 from configs import dify_config
 from extensions import ext_redis
-from libs.broadcast_channel.redis.channel import BroadcastChannel as RedisBroadcastChannel
+from libs.broadcast_channel.redis.pubsub_channel import BroadcastChannel as RedisBroadcastChannel
 from libs.broadcast_channel.redis.sharded_channel import ShardedRedisBroadcastChannel
 
 
diff --git a/api/tests/unit_tests/libs/broadcast_channel/redis/test_channel_unit_tests.py b/api/tests/unit_tests/libs/broadcast_channel/redis/test_channel_unit_tests.py
index 7c7f20374ee..b74d494134b 100644
--- a/api/tests/unit_tests/libs/broadcast_channel/redis/test_channel_unit_tests.py
+++ b/api/tests/unit_tests/libs/broadcast_channel/redis/test_channel_unit_tests.py
@@ -17,14 +17,11 @@ from unittest.mock import MagicMock, patch
 
 import pytest
 
-from libs.broadcast_channel.exc import BroadcastChannelError, SubscriptionClosedError
-from libs.broadcast_channel.redis.channel import (
+from libs.broadcast_channel.exc import SubscriptionClosedError
+from libs.broadcast_channel.redis.pubsub_channel import (
     BroadcastChannel as RedisBroadcastChannel,
 )
-from libs.broadcast_channel.redis.channel import (
-    Topic,
-    _RedisSubscription,
-)
+from libs.broadcast_channel.redis.pubsub_channel import Topic, _RedisSubscription
 from libs.broadcast_channel.redis.sharded_channel import (
     ShardedRedisBroadcastChannel,
     ShardedTopic,
@@ -398,11 +395,10 @@ class TestRedisSubscription:
         assert received_messages == test_messages
 
     def test_message_iterator_when_closed(self, subscription: _RedisSubscription):
-        """Test that iterator raises error when subscription is closed."""
+        """Test that iterator stops when subscription is closed."""
         subscription.close()
 
-        with pytest.raises(BroadcastChannelError, match="The Redis regular subscription is closed"):
-            iter(subscription)
+        assert list(subscription) == []
 
     # ==================== Message Enqueue Tests ====================
 
@@ -619,8 +615,15 @@ class TestRedisSubscription:
         """Test iterator behavior after close."""
         subscription.close()
 
-        with pytest.raises(SubscriptionClosedError, match="The Redis regular subscription is closed"):
-            iter(subscription)
+        assert list(subscription) == []
+
+    def test_close_does_not_join_unstarted_listener_thread(self, subscription: _RedisSubscription):
+        """close() should tolerate a listener object that has not been started yet."""
+        subscription._listener_thread = threading.Thread(target=lambda: None)
+
+        subscription.close()
+
+        assert subscription._listener_thread is None
 
     def test_start_after_close(self, subscription: _RedisSubscription):
         """Test start attempts after close."""
@@ -821,11 +824,10 @@ class TestRedisShardedSubscription:
         assert received_messages == test_messages
 
     def test_message_iterator_when_closed(self, sharded_subscription: _RedisShardedSubscription):
-        """Test that iterator raises error when sharded subscription is closed."""
+        """Test that iterator stops when sharded subscription is closed."""
         sharded_subscription.close()
 
-        with pytest.raises(SubscriptionClosedError, match="The Redis sharded subscription is closed"):
-            iter(sharded_subscription)
+        assert list(sharded_subscription) == []
 
     # ==================== Message Enqueue Tests ====================
 
@@ -1096,8 +1098,7 @@ class TestRedisShardedSubscription:
         """Test iterator behavior after close for sharded subscription."""
         sharded_subscription.close()
 
-        with pytest.raises(SubscriptionClosedError, match="The Redis sharded subscription is closed"):
-            iter(sharded_subscription)
+        assert list(sharded_subscription) == []
 
     def test_start_after_close(self, sharded_subscription: _RedisShardedSubscription):
         """Test start attempts after close for sharded subscription."""
@@ -1315,12 +1316,10 @@ class TestRedisSubscriptionCommon:
         assert received_messages == test_messages
 
     def test_message_iterator_when_closed(self, subscription, subscription_params):
-        """Test that iterator raises error when subscription is closed."""
-        subscription_type, _ = subscription_params
+        """Test that iterator stops when subscription is closed."""
         subscription.close()
 
-        with pytest.raises(SubscriptionClosedError, match=f"The Redis {subscription_type} subscription is closed"):
-            iter(subscription)
+        assert list(subscription) == []
 
     # ==================== Message Enqueue Tests ====================
 
@@ -1393,11 +1392,9 @@ class TestRedisSubscriptionCommon:
 
     def test_iterator_after_close(self, subscription, subscription_params):
         """Test iterator behavior after close."""
-        subscription_type, _ = subscription_params
         subscription.close()
 
-        with pytest.raises(SubscriptionClosedError, match=f"The Redis {subscription_type} subscription is closed"):
-            iter(subscription)
+        assert list(subscription) == []
 
     def test_start_after_close(self, subscription, subscription_params):
         """Test start attempts after close."""
diff --git a/api/tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py b/api/tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py
index 95085eaf673..9a8cb861abf 100644
--- a/api/tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py
+++ b/api/tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py
@@ -77,11 +77,28 @@ class FailExpireRedis(FakeStreamsRedis):
 
 
 class BlockingRedis:
+    """A Redis mock whose xread blocks until a control event is xadd-ed."""
+
     def __init__(self) -> None:
         self._release = threading.Event()
+        self._store: dict[str, list[tuple[str, dict]]] = {}
+        self._next_id: dict[str, int] = {}
+
+    def xadd(self, key: str, fields: dict[str, Any], *, maxlen: int | None = None) -> str:
+        n = self._next_id.get(key, 0) + 1
+        self._next_id[key] = n
+        entry_id = f"{n}-0"
+        self._store.setdefault(key, []).append((entry_id, fields))
+        self._release.set()  # Wake up any blocked xread
+        return entry_id
 
     def xread(self, streams: dict[str, Any], block: int | None = None, count: int | None = None):
         self._release.wait(timeout=block / 1000.0 if block else None)
+        key = next(iter(streams))
+        entries = self._store.get(key, [])
+        if entries:
+            self._store[key] = []  # Consume entries
+            return [(key, entries)]
         return []
 
     def release(self) -> None:
@@ -176,48 +193,6 @@ class TestStreamsBroadcastChannel:
         assert topic.as_producer() is topic
         assert topic.as_subscriber() is topic
 
-    def test_join_timeout_ms_propagates_from_channel_to_subscription(self, fake_redis: FakeStreamsRedis):
-        channel = StreamsBroadcastChannel(fake_redis, retention_seconds=60, join_timeout_ms=150)
-        topic = channel.topic("join-timeout-prop")
-
-        assert topic._join_timeout_ms == 150
-
-        sub = topic.subscribe()
-        try:
-            assert sub._join_timeout_ms == 150
-        finally:
-            sub.close()
-
-    def test_join_timeout_ms_defaults_to_2000(self, fake_redis: FakeStreamsRedis):
-        channel = StreamsBroadcastChannel(fake_redis, retention_seconds=60)
-        topic = channel.topic("join-timeout-default")
-
-        assert topic._join_timeout_ms == 2000
-
-    def test_small_join_timeout_makes_close_return_promptly(self, fake_redis: FakeStreamsRedis):
-        """close() should respect the configured join timeout.
-
-        Regression test for SSE close tail latency: when an idle listener is
-        blocked on its poll cycle, close() with a small join_timeout_ms must
-        not wait for the full poll window. The orphaned daemon listener
-        cleans itself up later.
-        """
-        channel = StreamsBroadcastChannel(fake_redis, retention_seconds=60, join_timeout_ms=50)
-        topic = channel.topic("join-timeout-prompt-close")
-        sub = topic.subscribe()
-
-        # Drive listener startup so the thread is actually blocked in xread.
-        assert sub.receive(timeout=0.05) is None
-        time.sleep(0.05)
-
-        started = time.monotonic()
-        sub.close()
-        elapsed = time.monotonic() - started
-
-        # 50ms timeout + scheduling slack; pick a ceiling well under the
-        # default poll window (1000ms) to make the regression meaningful.
-        assert elapsed < 0.5, f"close() took {elapsed:.3f}s; expected prompt return"
-
     def test_publish_logs_warning_when_expire_fails(self, caplog: pytest.LogCaptureFixture):
         channel = StreamsBroadcastChannel(FailExpireRedis(), retention_seconds=60)
         topic = channel.topic("expire-warning")
@@ -384,40 +359,32 @@ class TestStreamsSubscription:
 
         assert next(iter(subscription)) == b"event"
 
-    def test_close_logs_debug_when_listener_does_not_stop_in_time(
-        self,
-        caplog: pytest.LogCaptureFixture,
-    ):
-        """When a low join_timeout elapses with the listener still alive,
-        close() should log at DEBUG (not WARNING) - with a deliberately small
-        timeout this is expected, not anomalous; the orphaned daemon thread
-        cleans itself up on the next poll boundary.
+    def test_control_event_unblocks_listener_for_prompt_close(self):
+        """close() returns promptly because the control event (xadd) unblocks
+        the listener from its blocking xread call.
         """
-        import logging
-
         blocking_redis = BlockingRedis()
-        subscription = _StreamsSubscription(blocking_redis, "stream:slow-close")
+        subscription = _StreamsSubscription(blocking_redis, "stream:prompt-close")
 
+        # Drive listener startup so the thread is blocked in xread.
         subscription._start_if_needed()
         listener = subscription._listener
         assert listener is not None
+        assert listener.is_alive()
 
-        original_join = listener.join
-        original_is_alive = listener.is_alive
+        started = time.monotonic()
+        subscription.close()
+        elapsed = time.monotonic() - started
 
-        def delayed_join(timeout: float | None = None) -> None:
-            original_join(0.01)
+        # The control event (xadd) wakes up xread immediately, so close()
+        # should return well under 1s (the xread BLOCK timeout).
+        assert elapsed < 0.5, f"close() took {elapsed:.3f}s; expected prompt return via control event"
 
-        listener.join = delayed_join  # type: ignore[method-assign]
-        listener.is_alive = lambda: True  # type: ignore[method-assign]
+    def test_control_event_not_sent_when_listener_not_started(self):
+        """close() should not fail when the listener was never started."""
+        subscription = _StreamsSubscription(FakeStreamsRedis(), "stream:no-listener")
+        subscription.close()
 
-        try:
-            with caplog.at_level(logging.DEBUG, logger="libs.broadcast_channel.redis.streams_channel"):
-                subscription.close()
-            assert "did not stop within" in caplog.text
-            assert "daemon thread will exit on its own" in caplog.text
-        finally:
-            listener.join = original_join  # type: ignore[method-assign]
-            listener.is_alive = original_is_alive  # type: ignore[method-assign]
-            blocking_redis.release()
-            original_join(timeout=1)
+        assert subscription._listener is None
+        with pytest.raises(SubscriptionClosedError):
+            subscription.receive(timeout=0.01)
diff --git a/api/tests/unit_tests/libs/test_password.py b/api/tests/unit_tests/libs/test_password.py
index 79fc792cc5f..3cdf22e8051 100644
--- a/api/tests/unit_tests/libs/test_password.py
+++ b/api/tests/unit_tests/libs/test_password.py
@@ -35,6 +35,13 @@ class TestValidPassword:
         with pytest.raises(ValueError):
             valid_password("")
 
+    def test_should_reject_password_shorter_than_minimum_length(self):
+        """A 7-character password with letters and numbers is rejected for length."""
+        with pytest.raises(ValueError) as exc_info:
+            valid_password("abc1234")
+
+        assert "at least 8" in str(exc_info.value)
+
 
 class TestPasswordHashing:
     """Test password hashing and comparison"""
diff --git a/api/tests/unit_tests/migrations/test_agent_drive_skill_metadata_refactor.py b/api/tests/unit_tests/migrations/test_agent_drive_skill_metadata_refactor.py
new file mode 100644
index 00000000000..cd97559725e
--- /dev/null
+++ b/api/tests/unit_tests/migrations/test_agent_drive_skill_metadata_refactor.py
@@ -0,0 +1,122 @@
+from __future__ import annotations
+
+import importlib.util
+import json
+from pathlib import Path
+
+import sqlalchemy as sa
+from alembic.migration import MigrationContext
+from alembic.operations import Operations
+
+_MIGRATION_PATH = (
+    Path(__file__).resolve().parents[3]
+    / "migrations/versions/2026_06_18_2300-b2515f9d4c2a_agent_drive_skill_metadata_refactor.py"
+)
+
+
+def _load_migration_module():
+    spec = importlib.util.spec_from_file_location("agent_drive_skill_metadata_refactor", _MIGRATION_PATH)
+    if spec is None or spec.loader is None:
+        raise RuntimeError("failed to load migration module")
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def _create_pre_upgrade_schema(engine: sa.Engine) -> None:
+    metadata = sa.MetaData()
+    sa.Table(
+        "agent_drive_files",
+        metadata,
+        sa.Column("tenant_id", sa.String(36), nullable=False),
+        sa.Column("agent_id", sa.String(36), nullable=False),
+        sa.Column("key", sa.String(512), nullable=False),
+        sa.Column("file_kind", sa.String(32), nullable=False),
+        sa.Column("file_id", sa.String(36), nullable=False),
+        sa.Column("value_owned_by_drive", sa.Boolean(), nullable=False, server_default=sa.text("false")),
+        sa.Column("size", sa.BigInteger(), nullable=True),
+        sa.Column("hash", sa.String(255), nullable=True),
+        sa.Column("mime_type", sa.String(255), nullable=True),
+        sa.Column("created_by", sa.String(36), nullable=True),
+        sa.Column("id", sa.String(36), primary_key=True),
+        sa.Column("created_at", sa.DateTime(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(), nullable=False),
+        sa.UniqueConstraint("tenant_id", "agent_id", "key", name="agent_drive_file_scope_key_unique"),
+    )
+    sa.Table(
+        "agent_config_snapshots",
+        metadata,
+        sa.Column("id", sa.String(36), primary_key=True),
+        sa.Column("config_snapshot", sa.Text(), nullable=False),
+    )
+    metadata.create_all(engine)
+
+
+def _run_migration_step(module: object, engine: sa.Engine, step_name: str) -> None:
+    with engine.begin() as connection:
+        context = MigrationContext.configure(connection)
+        operations = Operations(context)
+        original_op = module.op
+        module.op = operations
+        try:
+            getattr(module, step_name)()
+        finally:
+            module.op = original_op
+
+
+def test_upgrade_adds_skill_columns_and_index_and_strips_snapshot_data() -> None:
+    engine = sa.create_engine("sqlite:///:memory:")
+    _create_pre_upgrade_schema(engine)
+    snapshot = {
+        "prompt": {"system_prompt": "Use [§skill:legacy:Legacy§]"},
+        "skills_files": {"skills": [{"name": "Legacy"}], "files": [{"name": "u.pdf"}]},
+    }
+    with engine.begin() as connection:
+        connection.execute(
+            sa.text("INSERT INTO agent_config_snapshots (id, config_snapshot) VALUES (:id, :config_snapshot)"),
+            {"id": "snap-1", "config_snapshot": json.dumps(snapshot)},
+        )
+
+    module = _load_migration_module()
+    _run_migration_step(module, engine, "upgrade")
+
+    inspector = sa.inspect(engine)
+    columns = {column["name"] for column in inspector.get_columns("agent_drive_files")}
+    assert {"is_skill", "skill_metadata"}.issubset(columns)
+    indexes = {index["name"] for index in inspector.get_indexes("agent_drive_files")}
+    assert "agent_drive_files_tenant_agent_is_skill_key_idx" in indexes
+
+    with engine.begin() as connection:
+        stored_snapshot = connection.execute(
+            sa.text("SELECT config_snapshot FROM agent_config_snapshots WHERE id = :id"),
+            {"id": "snap-1"},
+        ).scalar_one()
+    assert "skills_files" not in json.loads(stored_snapshot)
+
+
+def test_downgrade_drops_skill_columns_and_index_without_reconstructing_legacy_data() -> None:
+    engine = sa.create_engine("sqlite:///:memory:")
+    _create_pre_upgrade_schema(engine)
+    with engine.begin() as connection:
+        connection.execute(
+            sa.text("INSERT INTO agent_config_snapshots (id, config_snapshot) VALUES (:id, :config_snapshot)"),
+            {"id": "snap-1", "config_snapshot": json.dumps({"prompt": {"system_prompt": "hello"}})},
+        )
+
+    module = _load_migration_module()
+    _run_migration_step(module, engine, "upgrade")
+    _run_migration_step(module, engine, "downgrade")
+
+    inspector = sa.inspect(engine)
+    columns = {column["name"] for column in inspector.get_columns("agent_drive_files")}
+    assert "is_skill" not in columns
+    assert "skill_metadata" not in columns
+    indexes = {index["name"] for index in inspector.get_indexes("agent_drive_files")}
+    assert "agent_drive_files_tenant_agent_is_skill_key_idx" not in indexes
+
+    with engine.begin() as connection:
+        stored_snapshot = connection.execute(
+            sa.text("SELECT config_snapshot FROM agent_config_snapshots WHERE id = :id"),
+            {"id": "snap-1"},
+        ).scalar_one()
+    assert "skills_files" not in json.loads(stored_snapshot)
diff --git a/api/tests/unit_tests/models/test_agent.py b/api/tests/unit_tests/models/test_agent.py
index aabbd4df300..422a3218eaa 100644
--- a/api/tests/unit_tests/models/test_agent.py
+++ b/api/tests/unit_tests/models/test_agent.py
@@ -33,6 +33,7 @@ def test_agent_enums_match_prd_boundaries():
     assert AgentStatus.ACTIVE.value == "active"
     assert AgentStatus.ARCHIVED.value == "archived"
     assert AgentConfigRevisionOperation.SAVE_CURRENT_VERSION.value == "save_current_version"
+    assert AgentConfigRevisionOperation.RESTORE_VERSION.value == "restore_version"
     assert WorkflowAgentBindingType.ROSTER_AGENT.value == "roster_agent"
     assert WorkflowAgentBindingType.INLINE_AGENT.value == "inline_agent"
 
diff --git a/api/tests/unit_tests/models/test_app_models.py b/api/tests/unit_tests/models/test_app_models.py
index d3d0c5dce00..684d7f9fa8e 100644
--- a/api/tests/unit_tests/models/test_app_models.py
+++ b/api/tests/unit_tests/models/test_app_models.py
@@ -12,10 +12,11 @@ import json
 from datetime import UTC, datetime
 from decimal import Decimal
 from types import SimpleNamespace
-from unittest.mock import MagicMock, patch
+from unittest.mock import MagicMock, PropertyMock, patch
 from uuid import uuid4
 
 import pytest
+from sqlalchemy.dialects import postgresql
 
 from models.enums import ConversationFromSource
 from models.model import (
@@ -29,6 +30,7 @@ from models.model import (
     Message,
     MessageAnnotation,
     Site,
+    load_annotation_reply_config,
 )
 
 
@@ -342,6 +344,70 @@ class TestAppModelConfig:
         # Assert
         assert result == questions
 
+    def test_to_dict_uses_injected_annotation_reply(self):
+        config = AppModelConfig(app_id=str(uuid4()))
+        annotation_reply = {"enabled": False}
+
+        with patch.object(
+            AppModelConfig,
+            "annotation_reply_dict",
+            new_callable=PropertyMock,
+            side_effect=AssertionError("annotation_reply_dict should not be accessed"),
+        ):
+            result = config.to_dict(annotation_reply=annotation_reply)
+
+        assert result["annotation_reply"] == annotation_reply
+
+
+class TestAnnotationReplyConfigLoader:
+    def test_load_annotation_reply_config_returns_disabled_when_setting_missing(self):
+        session = MagicMock()
+        session.scalar.return_value = None
+
+        result = load_annotation_reply_config(session, "app-1")
+
+        assert result == {"enabled": False}
+        session.scalar.assert_called_once()
+        stmt = session.scalar.call_args.args[0]
+        compiled = str(stmt.compile(dialect=postgresql.dialect()))
+        assert "app_annotation_settings.app_id" in compiled
+        assert stmt.compile().params == {"app_id_1": "app-1"}
+
+    def test_load_annotation_reply_config_returns_embedding_model(self):
+        session = MagicMock()
+        annotation_setting = SimpleNamespace(
+            id="annotation-1",
+            score_threshold=0.7,
+            collection_binding_id="binding-1",
+        )
+        collection_binding = SimpleNamespace(provider_name="provider", model_name="embedding")
+        session.scalar.side_effect = [annotation_setting, collection_binding]
+
+        result = load_annotation_reply_config(session, "app-1")
+
+        assert result == {
+            "id": "annotation-1",
+            "enabled": True,
+            "score_threshold": 0.7,
+            "embedding_model": {
+                "embedding_provider_name": "provider",
+                "embedding_model_name": "embedding",
+            },
+        }
+        assert session.scalar.call_count == 2
+        stmt = session.scalar.call_args_list[1].args[0]
+        compiled = str(stmt.compile(dialect=postgresql.dialect()))
+        assert "dataset_collection_bindings.id" in compiled
+        assert stmt.compile().params == {"id_1": "binding-1"}
+
+    def test_load_annotation_reply_config_raises_when_binding_missing(self):
+        session = MagicMock()
+        annotation_setting = SimpleNamespace(collection_binding_id="binding-1")
+        session.scalar.side_effect = [annotation_setting, None]
+
+        with pytest.raises(ValueError, match="Collection binding detail not found"):
+            load_annotation_reply_config(session, "app-1")
+
 
 class TestConversationModel:
     """Test suite for Conversation model integrity."""
diff --git a/api/tests/unit_tests/models/test_recipient_type_label.py b/api/tests/unit_tests/models/test_recipient_type_label.py
new file mode 100644
index 00000000000..3e98c17ca99
--- /dev/null
+++ b/api/tests/unit_tests/models/test_recipient_type_label.py
@@ -0,0 +1,21 @@
+import pytest
+
+from models.human_input import ApprovalChannel, RecipientType
+
+
+@pytest.mark.parametrize(
+    ("recipient_type", "expected_channel"),
+    [
+        (RecipientType.EMAIL_MEMBER, ApprovalChannel.EMAIL),
+        (RecipientType.EMAIL_EXTERNAL, ApprovalChannel.EMAIL),
+        (RecipientType.CONSOLE, ApprovalChannel.CONSOLE),
+        (RecipientType.BACKSTAGE, ApprovalChannel.CONSOLE),
+        (RecipientType.STANDALONE_WEB_APP, ApprovalChannel.WEB_APP),
+    ],
+)
+def test_approval_channel_collapses_delivery_types(
+    recipient_type: RecipientType, expected_channel: ApprovalChannel
+) -> None:
+    # Both email types collapse to EMAIL and console/backstage to CONSOLE:
+    # the user-facing approval channel, not the internal recipient type.
+    assert recipient_type.approval_channel == expected_channel
diff --git a/api/tests/unit_tests/services/agent/test_agent_composer_entities.py b/api/tests/unit_tests/services/agent/test_agent_composer_entities.py
index 089a5c74f3a..e82ba92029b 100644
--- a/api/tests/unit_tests/services/agent/test_agent_composer_entities.py
+++ b/api/tests/unit_tests/services/agent/test_agent_composer_entities.py
@@ -3,7 +3,7 @@ import pytest
 from models.agent_config_entities import AgentKnowledgeQueryMode, AgentSoulModelConfig, DeclaredOutputType
 from services.agent.composer_service import AgentComposerService
 from services.agent.composer_validator import ComposerConfigValidator
-from services.agent.errors import AgentSoulLockedError, PlaintextSecretNotAllowedError
+from services.agent.errors import AgentSoulLockedError, InvalidComposerConfigError, PlaintextSecretNotAllowedError
 from services.entities.agent_entities import (
     AgentSoulConfig,
     ComposerSavePayload,
@@ -64,6 +64,24 @@ def test_locked_workflow_node_job_only_allows_inline_soul_payload():
     ComposerConfigValidator.validate_save_payload(payload)
 
 
+def test_draft_save_payload_skips_publish_only_agent_soul_validation():
+    payload = ComposerSavePayload.model_validate(
+        {
+            "variant": ComposerVariant.AGENT_APP,
+            "save_strategy": ComposerSaveStrategy.SAVE_TO_CURRENT_VERSION,
+            "agent_soul": {
+                "prompt": {"system_prompt": "no human reference yet"},
+                "human": {"contacts": [{"id": "human-1", "name": "Reviewer"}]},
+                "env": {"variables": [{"name": "bad-name"}]},
+            },
+        }
+    )
+
+    ComposerConfigValidator.validate_draft_save_payload(payload)
+    with pytest.raises(InvalidComposerConfigError):
+        ComposerConfigValidator.validate_publish_payload(payload)
+
+
 def test_agent_app_soul_allows_app_features_and_variables():
     payload = ComposerSavePayload.model_validate(
         {
diff --git a/api/tests/unit_tests/services/agent/test_agent_services.py b/api/tests/unit_tests/services/agent/test_agent_services.py
index 2c077e20b46..9ba62d60375 100644
--- a/api/tests/unit_tests/services/agent/test_agent_services.py
+++ b/api/tests/unit_tests/services/agent/test_agent_services.py
@@ -4,10 +4,12 @@ from types import SimpleNamespace
 
 import pytest
 
+from core.workflow.nodes.agent_v2.validators import WorkflowAgentNodeValidationError
 from models.agent import (
     Agent,
     AgentConfigRevisionOperation,
     AgentConfigSnapshot,
+    AgentDebugConversation,
     AgentKind,
     AgentScope,
     AgentSource,
@@ -16,14 +18,14 @@ from models.agent import (
     WorkflowAgentNodeBinding,
 )
 from models.agent_config_entities import (
-    AgentFileRefConfig,
     DeclaredArrayItem,
     DeclaredOutputChildConfig,
     DeclaredOutputConfig,
     DeclaredOutputType,
     WorkflowNodeJobConfig,
 )
-from models.model import IconType
+from models.enums import ConversationFromSource, ConversationStatus
+from models.model import Conversation, IconType
 from models.workflow import Workflow
 from services.agent import composer_service, roster_service
 from services.agent.agent_soul_state import agent_soul_has_model
@@ -167,7 +169,7 @@ def test_save_workflow_composer_dispatches_save_strategy(monkeypatch, strategy,
     calls = []
 
     monkeypatch.setattr(composer_service.db, "session", fake_session)
-    monkeypatch.setattr(composer_service.ComposerConfigValidator, "validate_save_payload", lambda payload: None)
+    monkeypatch.setattr(composer_service.ComposerConfigValidator, "validate_draft_save_payload", lambda payload: None)
     monkeypatch.setattr(AgentComposerService, "_get_draft_workflow", lambda **kwargs: SimpleNamespace(id="workflow-1"))
     monkeypatch.setattr(AgentComposerService, "_get_workflow_binding", lambda **kwargs: None)
     monkeypatch.setattr(
@@ -220,12 +222,52 @@ def test_save_workflow_composer_rejects_agent_app_variant():
         )
 
 
+def _duplicate_env_secret_payload(strategy: ComposerSaveStrategy) -> ComposerSavePayload:
+    return ComposerSavePayload.model_validate(
+        {
+            "variant": ComposerVariant.AGENT_APP.value,
+            "save_strategy": strategy.value,
+            "agent_soul": {
+                "prompt": {"system_prompt": "x"},
+                "env": {
+                    "variables": [{"name": "TOKEN", "value": "plain"}],
+                    "secret_refs": [{"name": "TOKEN", "value": "credential-1"}],
+                },
+            },
+        }
+    )
+
+
+@pytest.mark.parametrize(
+    "strategy",
+    [
+        ComposerSaveStrategy.NODE_JOB_ONLY,
+        ComposerSaveStrategy.SAVE_TO_CURRENT_VERSION,
+    ],
+)
+def test_draft_save_strategies_skip_publish_validation(strategy: ComposerSaveStrategy):
+    composer_service._validate_composer_payload_for_strategy(_duplicate_env_secret_payload(strategy))
+
+
+@pytest.mark.parametrize(
+    "strategy",
+    [
+        ComposerSaveStrategy.SAVE_AS_NEW_VERSION,
+        ComposerSaveStrategy.SAVE_AS_NEW_AGENT,
+        ComposerSaveStrategy.SAVE_TO_ROSTER,
+    ],
+)
+def test_publish_save_strategies_run_publish_validation(strategy: ComposerSaveStrategy):
+    with pytest.raises(InvalidComposerConfigError, match="duplicate env/secret name 'TOKEN'"):
+        composer_service._validate_composer_payload_for_strategy(_duplicate_env_secret_payload(strategy))
+
+
 def test_save_agent_app_composer_creates_agent_when_missing(monkeypatch: pytest.MonkeyPatch):
     fake_session = FakeSession(scalar=[None])
     created_version = SimpleNamespace(id="version-1")
 
     monkeypatch.setattr(composer_service.db, "session", fake_session)
-    monkeypatch.setattr(composer_service.ComposerConfigValidator, "validate_save_payload", lambda payload: None)
+    monkeypatch.setattr(composer_service.ComposerConfigValidator, "validate_draft_save_payload", lambda payload: None)
     monkeypatch.setattr(AgentComposerService, "_create_config_version", lambda **kwargs: created_version)
     monkeypatch.setattr(AgentComposerService, "load_agent_app_composer", lambda **kwargs: {"loaded": True})
     payload = ComposerSavePayload.model_validate(
@@ -255,7 +297,7 @@ def test_save_agent_app_composer_updates_current_version(monkeypatch: pytest.Mon
     updated = {}
 
     monkeypatch.setattr(composer_service.db, "session", fake_session)
-    monkeypatch.setattr(composer_service.ComposerConfigValidator, "validate_save_payload", lambda payload: None)
+    monkeypatch.setattr(composer_service.ComposerConfigValidator, "validate_draft_save_payload", lambda payload: None)
     monkeypatch.setattr(AgentComposerService, "_require_version", lambda **kwargs: SimpleNamespace(id="version-1"))
     monkeypatch.setattr(
         AgentComposerService,
@@ -532,6 +574,100 @@ def test_node_job_only_updates_inline_agent_soul(monkeypatch: pytest.MonkeyPatch
     assert inline_agent.updated_by == "account-1"
 
 
+def test_node_job_only_switches_roster_binding_to_inline_agent(monkeypatch: pytest.MonkeyPatch):
+    fake_session = FakeSession()
+    monkeypatch.setattr(composer_service.db, "session", fake_session)
+    created_agent = SimpleNamespace(id="inline-agent-1", active_config_snapshot_id="inline-version-1")
+    captured: dict[str, object] = {}
+
+    def fake_create_workflow_only_agent(**kwargs):
+        captured.update(kwargs)
+        return created_agent
+
+    monkeypatch.setattr(AgentComposerService, "_create_workflow_only_agent", fake_create_workflow_only_agent)
+    existing_node_job = WorkflowNodeJobConfig(workflow_prompt="keep the existing task")
+    binding = WorkflowAgentNodeBinding(
+        tenant_id="tenant-1",
+        app_id="app-1",
+        workflow_id="workflow-1",
+        workflow_version="draft",
+        node_id="node-1",
+        binding_type=WorkflowAgentBindingType.ROSTER_AGENT,
+        agent_id="roster-agent-1",
+        current_snapshot_id="roster-version-1",
+        node_job_config=existing_node_job,
+        created_by="account-1",
+        updated_by="account-1",
+    )
+    payload = ComposerSavePayload.model_validate(
+        {
+            "variant": ComposerVariant.WORKFLOW.value,
+            "save_strategy": ComposerSaveStrategy.NODE_JOB_ONLY.value,
+            "binding": {"binding_type": WorkflowAgentBindingType.INLINE_AGENT.value},
+            "agent_soul": {"prompt": {"system_prompt": "start from scratch"}},
+        }
+    )
+
+    updated_binding = AgentComposerService._save_node_job_only(
+        tenant_id="tenant-1",
+        app_id="app-1",
+        workflow_id="workflow-1",
+        node_id="node-1",
+        account_id="account-1",
+        binding=binding,
+        payload=payload,
+    )
+
+    assert updated_binding is binding
+    assert binding.binding_type == WorkflowAgentBindingType.INLINE_AGENT
+    assert binding.agent_id == "inline-agent-1"
+    assert binding.current_snapshot_id == "inline-version-1"
+    assert binding.node_job_config is existing_node_job
+    assert binding.updated_by == "account-1"
+    assert captured["tenant_id"] == "tenant-1"
+    assert captured["app_id"] == "app-1"
+    assert captured["workflow_id"] == "workflow-1"
+    assert captured["node_id"] == "node-1"
+    assert captured["account_id"] == "account-1"
+    assert captured["agent_soul"].prompt.system_prompt == "start from scratch"
+    assert fake_session.flushes == 1
+
+
+def test_node_job_only_rejects_start_from_scratch_with_existing_inline_binding_id():
+    binding = WorkflowAgentNodeBinding(
+        tenant_id="tenant-1",
+        app_id="app-1",
+        workflow_id="workflow-1",
+        workflow_version="draft",
+        node_id="node-1",
+        binding_type=WorkflowAgentBindingType.ROSTER_AGENT,
+        agent_id="roster-agent-1",
+        current_snapshot_id="roster-version-1",
+        node_job_config=WorkflowNodeJobConfig(),
+    )
+    payload = ComposerSavePayload.model_validate(
+        {
+            "variant": ComposerVariant.WORKFLOW.value,
+            "save_strategy": ComposerSaveStrategy.NODE_JOB_ONLY.value,
+            "binding": {
+                "binding_type": WorkflowAgentBindingType.INLINE_AGENT.value,
+                "agent_id": "existing-inline-agent",
+            },
+        }
+    )
+
+    with pytest.raises(ValueError, match="Start from Scratch"):
+        AgentComposerService._save_node_job_only(
+            tenant_id="tenant-1",
+            app_id="app-1",
+            workflow_id="workflow-1",
+            node_id="node-1",
+            account_id="account-1",
+            binding=binding,
+            payload=payload,
+        )
+
+
 def test_node_job_only_rejects_inline_binding_pointing_to_roster_agent(monkeypatch: pytest.MonkeyPatch):
     fake_session = FakeSession()
     monkeypatch.setattr(composer_service.db, "session", fake_session)
@@ -998,6 +1134,11 @@ def test_roster_create_detail_and_lookup_helpers(monkeypatch: pytest.MonkeyPatch
         scalars=[[AgentConfigSnapshot(id="version-1", agent_id="agent-1", version=1)]],
     )
     service = AgentRosterService(fake_session)
+    monkeypatch.setattr(
+        AgentRosterService,
+        "_get_or_create_agent_app_debug_conversation",
+        lambda self, *, agent, account_id: "debug-conversation-1",
+    )
     payload = roster_service.RosterAgentCreatePayload(
         name="Analyst",
         description="desc",
@@ -1039,6 +1180,135 @@ def test_roster_create_detail_and_lookup_helpers(monkeypatch: pytest.MonkeyPatch
     assert loaded_versions["version-1"].agent_id == "agent-1"
 
 
+def test_agent_app_debug_conversation_create_reuse_and_recreate():
+    agent = Agent(
+        id="agent-1",
+        tenant_id="tenant-1",
+        app_id="app-1",
+        name="Analyst",
+        description="",
+        agent_kind=AgentKind.DIFY_AGENT,
+        scope=AgentScope.ROSTER,
+        source=AgentSource.AGENT_APP,
+        status=AgentStatus.ACTIVE,
+    )
+
+    create_session = FakeSession(scalar=[agent, None])
+    created_id = AgentRosterService(create_session).get_or_create_agent_app_debug_conversation_id(
+        tenant_id="tenant-1",
+        agent_id="agent-1",
+        account_id="account-1",
+    )
+    created_conversation = next(value for value in create_session.added if isinstance(value, Conversation))
+    created_mapping = next(value for value in create_session.added if isinstance(value, AgentDebugConversation))
+    assert created_id == created_mapping.conversation_id
+    assert created_conversation.app_id == "app-1"
+    assert created_conversation.from_account_id == "account-1"
+    assert created_mapping.tenant_id == "tenant-1"
+    assert created_mapping.agent_id == "agent-1"
+    assert created_mapping.account_id == "account-1"
+    assert create_session.commits == 1
+
+    existing_mapping = AgentDebugConversation(
+        tenant_id="tenant-1",
+        agent_id="agent-1",
+        app_id="app-1",
+        account_id="account-1",
+        conversation_id="existing-conversation",
+    )
+    reuse_session = FakeSession(scalar=[agent, existing_mapping, "existing-conversation"])
+    reused_id = AgentRosterService(reuse_session).get_or_create_agent_app_debug_conversation_id(
+        tenant_id="tenant-1",
+        agent_id="agent-1",
+        account_id="account-1",
+    )
+    assert reused_id == "existing-conversation"
+    assert reuse_session.added == []
+    assert reuse_session.commits == 1
+
+    stale_mapping = AgentDebugConversation(
+        tenant_id="tenant-1",
+        agent_id="agent-1",
+        app_id="app-1",
+        account_id="account-1",
+        conversation_id="deleted-conversation",
+    )
+    recreate_session = FakeSession(scalar=[agent, stale_mapping, None])
+    recreated_id = AgentRosterService(recreate_session).get_or_create_agent_app_debug_conversation_id(
+        tenant_id="tenant-1",
+        agent_id="agent-1",
+        account_id="account-1",
+    )
+    assert recreated_id == stale_mapping.conversation_id
+    assert recreated_id != "deleted-conversation"
+    assert any(isinstance(value, Conversation) for value in recreate_session.added)
+    assert recreate_session.commits == 1
+
+
+def test_agent_app_debug_conversation_requires_app_binding():
+    agent = Agent(
+        id="agent-1",
+        tenant_id="tenant-1",
+        app_id=None,
+        name="Analyst",
+        description="",
+        scope=AgentScope.ROSTER,
+        source=AgentSource.AGENT_APP,
+        status=AgentStatus.ACTIVE,
+    )
+
+    with pytest.raises(roster_service.AgentNotFoundError):
+        AgentRosterService(FakeSession())._get_or_create_agent_app_debug_conversation(
+            agent=agent,
+            account_id="account-1",
+        )
+
+
+def test_load_or_create_agent_app_debug_conversations_filters_agent_apps():
+    valid_agent = Agent(
+        id="agent-1",
+        tenant_id="tenant-1",
+        app_id="app-1",
+        name="Analyst",
+        description="",
+        scope=AgentScope.ROSTER,
+        source=AgentSource.AGENT_APP,
+        status=AgentStatus.ACTIVE,
+    )
+    wrong_tenant_agent = Agent(
+        id="agent-2",
+        tenant_id="tenant-2",
+        app_id="app-2",
+        name="Other tenant",
+        description="",
+        scope=AgentScope.ROSTER,
+        source=AgentSource.AGENT_APP,
+        status=AgentStatus.ACTIVE,
+    )
+    workflow_agent = Agent(
+        id="agent-3",
+        tenant_id="tenant-1",
+        app_id=None,
+        name="Workflow only",
+        description="",
+        scope=AgentScope.WORKFLOW_ONLY,
+        source=AgentSource.WORKFLOW,
+        status=AgentStatus.ACTIVE,
+    )
+
+    fake_session = FakeSession(scalar=[None])
+    result = AgentRosterService(fake_session).load_or_create_agent_app_debug_conversation_ids_by_agent_id(
+        tenant_id="tenant-1",
+        agents=[valid_agent, wrong_tenant_agent, workflow_agent],
+        account_id="account-1",
+    )
+
+    assert list(result) == ["agent-1"]
+    assert result["agent-1"]
+    assert fake_session.commits == 1
+    assert len([value for value in fake_session.added if isinstance(value, AgentDebugConversation)]) == 1
+
+
 def test_agent_app_visible_versions_exclude_draft_saves():
     agent_app = Agent(source=AgentSource.AGENT_APP)
     roster_agent = Agent(source=AgentSource.ROSTER)
@@ -1046,12 +1316,93 @@ def test_agent_app_visible_versions_exclude_draft_saves():
     agent_app_operations = AgentRosterService._visible_version_operations(agent_app)
     roster_operations = AgentRosterService._visible_version_operations(roster_agent)
 
-    assert agent_app_operations == {AgentConfigRevisionOperation.SAVE_NEW_VERSION}
+    assert agent_app_operations == {
+        AgentConfigRevisionOperation.SAVE_NEW_VERSION,
+        AgentConfigRevisionOperation.RESTORE_VERSION,
+    }
     assert AgentConfigRevisionOperation.SAVE_CURRENT_VERSION not in agent_app_operations
     assert AgentConfigRevisionOperation.CREATE_VERSION in roster_operations
+    assert AgentConfigRevisionOperation.RESTORE_VERSION in roster_operations
     assert AgentConfigRevisionOperation.SAVE_CURRENT_VERSION not in roster_operations
 
 
+def test_restore_roster_agent_version_switches_active_snapshot(monkeypatch: pytest.MonkeyPatch):
+    fake_session = FakeSession(scalar=["version-2", 6])
+    service = AgentRosterService(fake_session)
+    agent = Agent(
+        id="agent-1",
+        tenant_id="tenant-1",
+        name="Analyst",
+        description="old",
+        agent_kind=AgentKind.DIFY_AGENT,
+        scope=AgentScope.ROSTER,
+        source=AgentSource.AGENT_APP,
+        status=AgentStatus.ACTIVE,
+        active_config_snapshot_id="version-4",
+    )
+    version = AgentConfigSnapshot(
+        id="version-2",
+        tenant_id="tenant-1",
+        agent_id="agent-1",
+        version=2,
+        config_snapshot=_agent_soul_with_model(),
+    )
+
+    monkeypatch.setattr(service, "_get_agent", lambda **kwargs: agent)
+    monkeypatch.setattr(service, "_get_version", lambda **kwargs: version)
+
+    restored = service.restore_agent_version(
+        tenant_id="tenant-1",
+        agent_id="agent-1",
+        version_id="version-2",
+        account_id="account-1",
+    )
+
+    assert restored == {"result": "success", "active_config_snapshot_id": "version-2"}
+    assert agent.active_config_snapshot_id == "version-2"
+    assert agent.active_config_has_model is True
+    assert agent.updated_by == "account-1"
+    assert fake_session.commits == 1
+    revision = fake_session.added[0]
+    assert revision.tenant_id == "tenant-1"
+    assert revision.agent_id == "agent-1"
+    assert revision.previous_snapshot_id == "version-4"
+    assert revision.current_snapshot_id == "version-2"
+    assert revision.revision == 7
+    assert revision.operation == AgentConfigRevisionOperation.RESTORE_VERSION
+    assert revision.created_by == "account-1"
+
+
+def test_restore_roster_agent_version_rejects_invisible_versions(monkeypatch: pytest.MonkeyPatch):
+    fake_session = FakeSession(scalar=[None])
+    service = AgentRosterService(fake_session)
+    agent = Agent(
+        id="agent-1",
+        tenant_id="tenant-1",
+        name="Analyst",
+        description="old",
+        agent_kind=AgentKind.DIFY_AGENT,
+        scope=AgentScope.ROSTER,
+        source=AgentSource.AGENT_APP,
+        status=AgentStatus.ACTIVE,
+        active_config_snapshot_id="version-4",
+    )
+
+    monkeypatch.setattr(service, "_get_agent", lambda **kwargs: agent)
+
+    with pytest.raises(roster_service.AgentVersionNotFoundError):
+        service.restore_agent_version(
+            tenant_id="tenant-1",
+            agent_id="agent-1",
+            version_id="version-2",
+            account_id="account-1",
+        )
+
+    assert agent.active_config_snapshot_id == "version-4"
+    assert fake_session.added == []
+    assert fake_session.commits == 0
+
+
 def test_app_list_all_excludes_agent_apps_by_default():
     filters = AppService._build_app_list_filters(
         "account-1", "tenant-1", AppListParams(mode="all"), FakeSession(scalar=None, scalars=None)
@@ -1281,6 +1632,20 @@ class TestAgentAppBackingAgent:
             a for a in session.added if getattr(a, "operation", None) == AgentConfigRevisionOperation.CREATE_VERSION
         ]
         assert len(revisions) == 1
+        conversations = [a for a in session.added if isinstance(a, Conversation)]
+        assert len(conversations) == 1
+        assert conversations[0].app_id == "app-1"
+        assert conversations[0].mode == "agent"
+        assert conversations[0].status == ConversationStatus.NORMAL
+        assert conversations[0].from_source == ConversationFromSource.CONSOLE
+        assert conversations[0].from_account_id == "account-1"
+        debug_mappings = [a for a in session.added if isinstance(a, AgentDebugConversation)]
+        assert len(debug_mappings) == 1
+        assert debug_mappings[0].tenant_id == "tenant-1"
+        assert debug_mappings[0].agent_id == agent.id
+        assert debug_mappings[0].app_id == "app-1"
+        assert debug_mappings[0].account_id == "account-1"
+        assert debug_mappings[0].conversation_id == conversations[0].id
         # Caller (AppService.create_app) owns the commit — helper must not commit.
         assert session.commits == 0
 
@@ -1324,6 +1689,74 @@ class TestAgentAppBackingAgent:
         with pytest.raises(roster_service.AgentNotFoundError):
             service.get_agent_app_model(tenant_id="tenant-1", agent_id="agent-x")
 
+    def test_refresh_agent_app_debug_conversation_creates_mapping(self):
+        agent = Agent(
+            id="agent-1",
+            tenant_id="tenant-1",
+            name="Iris",
+            description="",
+            agent_kind=AgentKind.DIFY_AGENT,
+            scope=AgentScope.ROSTER,
+            source=AgentSource.AGENT_APP,
+            status=AgentStatus.ACTIVE,
+            app_id="app-1",
+        )
+        session = FakeSession(scalar=[agent, None])
+        service = AgentRosterService(session)
+
+        conversation_id = service.refresh_agent_app_debug_conversation_id(
+            tenant_id="tenant-1",
+            agent_id="agent-1",
+            account_id="account-1",
+        )
+
+        conversations = [a for a in session.added if isinstance(a, Conversation)]
+        assert len(conversations) == 1
+        assert conversations[0].id == conversation_id
+        assert conversations[0].app_id == "app-1"
+        assert conversations[0].from_source == ConversationFromSource.CONSOLE
+        assert conversations[0].from_account_id == "account-1"
+        mappings = [a for a in session.added if isinstance(a, AgentDebugConversation)]
+        assert len(mappings) == 1
+        assert mappings[0].tenant_id == "tenant-1"
+        assert mappings[0].agent_id == "agent-1"
+        assert mappings[0].app_id == "app-1"
+        assert mappings[0].account_id == "account-1"
+        assert mappings[0].conversation_id == conversation_id
+        assert session.deleted == []
+        assert session.commits == 1
+
+    def test_refresh_agent_app_debug_conversation_replaces_existing_mapping(self):
+        agent = Agent(
+            id="agent-1",
+            tenant_id="tenant-1",
+            name="Iris",
+            description="",
+            agent_kind=AgentKind.DIFY_AGENT,
+            scope=AgentScope.ROSTER,
+            source=AgentSource.AGENT_APP,
+            status=AgentStatus.ACTIVE,
+            app_id="app-1",
+        )
+        mapping = SimpleNamespace(app_id="old-app", conversation_id="old-conversation")
+        session = FakeSession(scalar=[agent, mapping])
+        service = AgentRosterService(session)
+
+        conversation_id = service.refresh_agent_app_debug_conversation_id(
+            tenant_id="tenant-1",
+            agent_id="agent-1",
+            account_id="account-1",
+        )
+
+        assert mapping.app_id == "app-1"
+        assert mapping.conversation_id == conversation_id
+        assert [a for a in session.added if isinstance(a, AgentDebugConversation)] == []
+        conversations = [a for a in session.added if isinstance(a, Conversation)]
+        assert len(conversations) == 1
+        assert conversations[0].id == conversation_id
+        assert session.deleted == []
+        assert session.commits == 1
+
     def test_duplicate_agent_app_copies_app_config_and_active_soul(self, monkeypatch: pytest.MonkeyPatch):
         source_config = SimpleNamespace(
             opening_statement="hello",
@@ -1490,8 +1923,11 @@ class TestAgentAppBackingAgent:
         monkeypatch.setattr(service, "_copy_agent_active_snapshot", lambda **_: None)
         monkeypatch.setattr(service, "_next_duplicate_agent_name", lambda **_: "Iris copy")
 
+        captured: dict[str, object] = {}
+
         class FakeAppService:
             def create_app(self, tenant_id: str, params, account: object) -> object:
+                captured["params"] = params
                 return target_app
 
         access_mode_updates = []
@@ -1517,9 +1953,11 @@ class TestAgentAppBackingAgent:
             tenant_id="tenant-1",
             agent_id="source-agent",
             account=SimpleNamespace(id="account-1"),
+            role="Custom Analyst",
         )
 
         assert duplicated is target_app
+        assert captured["params"].agent_role == "Custom Analyst"
         assert access_mode_updates == [("target-app", "private")]
 
     def test_duplicate_agent_app_falls_back_to_public_access_mode(self, monkeypatch: pytest.MonkeyPatch):
@@ -1663,6 +2101,97 @@ class TestListWorkflowsReferencingAppAgent:
 
 
 class TestWorkflowAgentDraftBindingSync:
+    def _agent_workflow(self) -> Workflow:
+        return Workflow(
+            id="workflow-1",
+            tenant_id="tenant-1",
+            app_id="app-1",
+            version=Workflow.VERSION_DRAFT,
+            graph=json.dumps(
+                {
+                    "nodes": [{"id": "agent-node", "data": {"type": "agent", "version": "2"}}],
+                    "edges": [],
+                }
+            ),
+        )
+
+    def _agent_binding(self) -> WorkflowAgentNodeBinding:
+        return WorkflowAgentNodeBinding(
+            id="binding-1",
+            tenant_id="tenant-1",
+            app_id="app-1",
+            workflow_id="workflow-1",
+            workflow_version=Workflow.VERSION_DRAFT,
+            node_id="agent-node",
+            binding_type=WorkflowAgentBindingType.ROSTER_AGENT,
+            agent_id="agent-1",
+            current_snapshot_id="snapshot-1",
+            node_job_config=WorkflowNodeJobConfig(),
+        )
+
+    def _publish_agent(self) -> Agent:
+        return Agent(
+            id="agent-1",
+            tenant_id="tenant-1",
+            name="Iris",
+            status=AgentStatus.ACTIVE,
+            active_config_snapshot_id="snapshot-1",
+        )
+
+    def _snapshot(self, agent_soul: AgentSoulConfig) -> AgentConfigSnapshot:
+        return AgentConfigSnapshot(
+            id="snapshot-1",
+            tenant_id="tenant-1",
+            agent_id="agent-1",
+            version=1,
+            config_snapshot=agent_soul,
+        )
+
+    def test_publish_validation_rejects_agent_soul_publish_only_errors(self):
+        binding = self._agent_binding()
+        agent_soul = AgentSoulConfig.model_validate(
+            {
+                "model": {
+                    "plugin_id": "langgenius/openai/openai",
+                    "model_provider": "openai",
+                    "model": "gpt-4o",
+                },
+                "prompt": {"system_prompt": "no human reference yet"},
+                "human": {"contacts": [{"id": "human-1", "name": "Reviewer"}]},
+            }
+        )
+        agent = self._publish_agent()
+        snapshot = self._snapshot(agent_soul)
+        session = FakeSession(scalar=[binding, agent, snapshot, agent, snapshot], scalars=[[binding]])
+
+        with pytest.raises(InvalidComposerConfigError, match="human_involvement_not_referenced"):
+            WorkflowAgentPublishService.validate_agent_nodes_for_publish(
+                session=session,
+                draft_workflow=self._agent_workflow(),
+            )
+
+    def test_publish_validation_rejects_dangling_agent_soul_drive_refs(self):
+        binding = self._agent_binding()
+        agent_soul = AgentSoulConfig.model_validate(
+            {
+                "model": {
+                    "plugin_id": "langgenius/openai/openai",
+                    "model_provider": "openai",
+                    "model": "gpt-4o",
+                },
+                "prompt": {"system_prompt": "Use [§skill:research%2FSKILL.md:Research§]."},
+            }
+        )
+        agent = self._publish_agent()
+        snapshot = self._snapshot(agent_soul)
+        session = FakeSession(scalar=[binding, agent, snapshot, agent, snapshot], scalars=[[binding], []])
+
+        with pytest.raises(WorkflowAgentNodeValidationError, match="skill_ref_dangling"):
+            WorkflowAgentPublishService.validate_agent_nodes_for_publish(
+                session=session,
+                draft_workflow=self._agent_workflow(),
+            )
+
     def test_projects_binding_declared_outputs_to_draft_graph_response(self):
         workflow = Workflow(
             id="workflow-1",
@@ -2251,18 +2780,17 @@ def test_workspace_dify_tools_returns_provider_and_tool_granularities(monkeypatc
     assert {entry["granularity"] for entry in entries[1:]} == {"tool"}
 
 
-# ── ENG-623 §4.4: drive-backed ref validation ────────────────────────────────
+# ── ENG-623 §4.4: drive-backed prompt mention validation ─────────────────────
 
 
 def _drive_soul(**overrides):
     from services.entities.agent_entities import AgentSoulConfig
 
     base = {
-        "skills_files": {
-            "skills": [
-                {"id": "sk-1", "name": "Tender Analyzer", "skill_md_key": "tender-analyzer/SKILL.md"},
-            ],
-            "files": [{"name": "sample.pdf", "drive_key": "files/sample.pdf"}],
+        "prompt": {
+            "system_prompt": (
+                "Use [§skill:tender-analyzer%2FSKILL.md:Tender Analyzer§] and [§file:files%2Fsample.pdf:sample.pdf§]."
+            )
         },
     }
     base.update(overrides)
@@ -2282,47 +2810,47 @@ def _patch_drive_keys(monkeypatch, existing_keys):
     return captured
 
 
-def test_drive_ref_findings_reports_missing_keys(monkeypatch: pytest.MonkeyPatch):
+def test_drive_mention_findings_reports_missing_keys(monkeypatch: pytest.MonkeyPatch):
     _patch_drive_keys(monkeypatch, existing_keys=["tender-analyzer/SKILL.md"])
 
-    findings = AgentComposerService._drive_ref_findings(
-        tenant_id="tenant-1", agent_id="agent-1", agent_soul=_drive_soul()
+    findings = AgentComposerService._drive_mention_findings(
+        tenant_id="tenant-1",
+        agent_id="agent-1",
+        prompt=_drive_soul().prompt.system_prompt,
     )
 
-    assert [(f["code"], f["id"]) for f in findings] == [("file_ref_dangling", "files/sample.pdf")]
-    assert str(findings[0]["message"]).startswith("file_ref_dangling: ")
+    assert [(f["code"], f["id"]) for f in findings] == [("mention_target_missing", "files/sample.pdf")]
+    assert findings[0]["kind"] == "file"
+    assert str(findings[0]["message"]).startswith("file 'sample.pdf' has no drive entry")
 
 
-def test_drive_ref_findings_clean_when_all_keys_exist(monkeypatch: pytest.MonkeyPatch):
+def test_drive_mention_findings_clean_when_all_keys_exist(monkeypatch: pytest.MonkeyPatch):
     _patch_drive_keys(monkeypatch, existing_keys=["tender-analyzer/SKILL.md", "files/sample.pdf"])
 
     assert (
-        AgentComposerService._drive_ref_findings(tenant_id="tenant-1", agent_id="agent-1", agent_soul=_drive_soul())
+        AgentComposerService._drive_mention_findings(
+            tenant_id="tenant-1",
+            agent_id="agent-1",
+            prompt=_drive_soul().prompt.system_prompt,
+        )
         == []
     )
 
 
-def test_drive_ref_findings_skips_refs_without_drive_keys(monkeypatch: pytest.MonkeyPatch):
-    # No drive-backed ref at all -> no DB roundtrip, no findings.
-    soul = _drive_soul(
-        skills_files={"skills": [{"id": "legacy", "name": "Legacy"}], "files": [{"name": "u.pdf", "file_id": "u-1"}]}
+def test_drive_mention_findings_skips_prompt_without_drive_mentions(monkeypatch: pytest.MonkeyPatch):
+    # No drive-backed mention at all -> no DB roundtrip, no findings.
+    soul = _drive_soul(prompt={"system_prompt": "Use [§knowledge:kb-1:Docs§]."})
+    findings = AgentComposerService._drive_mention_findings(
+        tenant_id="tenant-1",
+        agent_id="agent-1",
+        prompt=soul.prompt.system_prompt,
     )
-    findings = AgentComposerService._drive_ref_findings(tenant_id="tenant-1", agent_id="agent-1", agent_soul=soul)
     assert findings == []
 
 
-def test_require_drive_refs_resolved_raises_with_stable_code(monkeypatch: pytest.MonkeyPatch):
-    from services.agent.errors import InvalidComposerConfigError
-
-    _patch_drive_keys(monkeypatch, existing_keys=[])
-
-    with pytest.raises(InvalidComposerConfigError, match="skill_ref_dangling"):
-        AgentComposerService._require_drive_refs_resolved(
-            tenant_id="tenant-1", agent_id="agent-1", agent_soul=_drive_soul()
-        )
-
-
-def test_collect_validation_findings_appends_drive_findings_with_agent_context(monkeypatch: pytest.MonkeyPatch):
+def test_collect_validation_findings_appends_drive_mention_findings_with_agent_context(
+    monkeypatch: pytest.MonkeyPatch,
+):
     from services.entities.agent_entities import ComposerSavePayload
 
     _patch_drive_keys(monkeypatch, existing_keys=[])
@@ -2339,149 +2867,14 @@ def test_collect_validation_findings_appends_drive_findings_with_agent_context(m
     )
 
     codes = {w["code"] for w in findings["warnings"]}
-    assert {"skill_ref_dangling", "file_ref_dangling"} <= codes
+    assert codes >= {"mention_target_missing"}
+    assert {w["id"] for w in findings["warnings"] if w["code"] == "mention_target_missing"} == {
+        "tender-analyzer/SKILL.md",
+        "files/sample.pdf",
+    }
     # without agent context the drive check is skipped entirely
     findings_no_agent = AgentComposerService.collect_validation_findings(tenant_id="tenant-1", payload=payload)
-    assert all(w["code"] not in {"skill_ref_dangling", "file_ref_dangling"} for w in findings_no_agent["warnings"])
-
-
-# ── ENG-625 D5: soul-first ref removal ───────────────────────────────────────
-
-
-def _patch_remove_drive_refs_env(monkeypatch: pytest.MonkeyPatch, *, soul_dict):
-    """Wire the classmethod's collaborators so soul editing + versioning is observable."""
-    from types import SimpleNamespace
-
-    import services.agent.composer_service as module
-
-    agent = SimpleNamespace(id="agent-1", active_config_snapshot_id="snap-1", updated_by=None)
-    snapshot = SimpleNamespace(id="snap-1", tenant_id="tenant-1", agent_id="agent-1", config_snapshot_dict=soul_dict)
-    committed: dict[str, object] = {}
-
-    fake_session = SimpleNamespace(scalar=lambda stmt: agent, commit=lambda: committed.setdefault("committed", True))
-    monkeypatch.setattr(module.db, "session", fake_session)
-    monkeypatch.setattr(AgentComposerService, "_require_version", classmethod(lambda cls, **kwargs: snapshot))
-
-    captured: dict[str, object] = {}
-
-    def fake_update(cls, *, current_snapshot, account_id, agent_soul, operation, version_note):
-        captured["agent_soul"] = agent_soul
-        captured["version_note"] = version_note
-        return SimpleNamespace(id="snap-2")
-
-    monkeypatch.setattr(AgentComposerService, "_update_current_version", classmethod(fake_update))
-    return agent, captured, committed
-
-
-def test_remove_drive_refs_drops_skill_by_slug_and_versions(monkeypatch: pytest.MonkeyPatch):
-    soul_dict = {
-        "skills_files": {
-            "skills": [
-                {"id": "sk-1", "name": "Tender Analyzer", "skill_md_key": "tender-analyzer/SKILL.md"},
-                {"id": "sk-2", "name": "Other", "skill_md_key": "other-skill/SKILL.md"},
-            ],
-            "files": [],
-        }
-    }
-    agent, captured, committed = _patch_remove_drive_refs_env(monkeypatch, soul_dict=soul_dict)
-
-    version_id = AgentComposerService.remove_drive_refs(
-        tenant_id="tenant-1", agent_id="agent-1", account_id="acc-1", skill_slug="tender-analyzer"
-    )
-
-    assert version_id == "snap-2"
-    assert agent.active_config_snapshot_id == "snap-2"
-    kept = [s.skill_md_key for s in captured["agent_soul"].skills_files.skills]
-    assert kept == ["other-skill/SKILL.md"]
-    assert "Tender Analyzer" in str(captured["version_note"])
-    assert committed.get("committed") is True
-
-
-def test_remove_drive_refs_is_noop_when_ref_absent(monkeypatch: pytest.MonkeyPatch):
-    soul_dict = {"skills_files": {"skills": [], "files": []}}
-    agent, captured, committed = _patch_remove_drive_refs_env(monkeypatch, soul_dict=soul_dict)
-
-    assert (
-        AgentComposerService.remove_drive_refs(
-            tenant_id="tenant-1", agent_id="agent-1", account_id="acc-1", file_key="files/none.pdf"
-        )
-        is None
-    )
-    assert "agent_soul" not in captured
-    assert committed == {}
-
-
-def test_remove_drive_refs_drops_file_by_key(monkeypatch: pytest.MonkeyPatch):
-    soul_dict = {
-        "skills_files": {
-            "skills": [],
-            "files": [
-                {"name": "keep.pdf", "drive_key": "files/keep.pdf"},
-                {"name": "drop.pdf", "drive_key": "files/drop.pdf"},
-            ],
-        }
-    }
-    _, captured, _ = _patch_remove_drive_refs_env(monkeypatch, soul_dict=soul_dict)
-
-    version_id = AgentComposerService.remove_drive_refs(
-        tenant_id="tenant-1", agent_id="agent-1", account_id="acc-1", file_key="files/drop.pdf"
-    )
-
-    assert version_id == "snap-2"
-    assert [f.drive_key for f in captured["agent_soul"].skills_files.files] == ["files/keep.pdf"]
-
-
-def test_add_drive_file_ref_adds_or_replaces_file_and_versions(monkeypatch: pytest.MonkeyPatch):
-    soul_dict = {
-        "skills_files": {
-            "skills": [],
-            "files": [
-                {"name": "old.pdf", "drive_key": "files/old.pdf"},
-                {"name": "stale.pdf", "drive_key": "files/new.pdf"},
-            ],
-        }
-    }
-    agent, captured, committed = _patch_remove_drive_refs_env(monkeypatch, soul_dict=soul_dict)
-
-    version_id = AgentComposerService.add_drive_file_ref(
-        tenant_id="tenant-1",
-        agent_id="agent-1",
-        account_id="acc-1",
-        file_ref=AgentFileRefConfig(name="new.pdf", file_id="uf-1", drive_key="files/new.pdf", type="application/pdf"),
-    )
-
-    assert version_id == "snap-2"
-    assert agent.active_config_snapshot_id == "snap-2"
-    assert [f.drive_key for f in captured["agent_soul"].skills_files.files] == ["files/old.pdf", "files/new.pdf"]
-    assert captured["agent_soul"].skills_files.files[-1].name == "new.pdf"
-    assert "new.pdf" in str(captured["version_note"])
-    assert committed.get("committed") is True
-
-
-def test_add_drive_file_ref_syncs_workflow_binding_snapshot(monkeypatch: pytest.MonkeyPatch):
-    binding = SimpleNamespace(agent_id="agent-1", current_snapshot_id="snap-1", updated_by=None)
-    _patch_remove_drive_refs_env(monkeypatch, soul_dict={"skills_files": {"skills": [], "files": []}})
-    monkeypatch.setattr(
-        AgentComposerService, "_get_draft_workflow", classmethod(lambda cls, **kwargs: SimpleNamespace(id="wf-1"))
-    )
-    monkeypatch.setattr(AgentComposerService, "_get_workflow_binding", classmethod(lambda cls, **kwargs: binding))
-
-    AgentComposerService.add_drive_file_ref(
-        tenant_id="tenant-1",
-        agent_id="agent-1",
-        account_id="acc-1",
-        file_ref=AgentFileRefConfig(name="new.pdf", file_id="uf-1", drive_key="files/new.pdf"),
-        app_id="app-1",
-        node_id="agent-node-1",
-    )
-
-    assert binding.current_snapshot_id == "snap-2"
-    assert binding.updated_by == "acc-1"
-
-
-def test_remove_drive_refs_requires_exactly_one_scope():
-    with pytest.raises(ValueError):
-        AgentComposerService.remove_drive_refs(tenant_id="t", agent_id="a", account_id="u")
+    assert all(w["code"] != "mention_target_missing" for w in findings_no_agent["warnings"])
 
 
 # ── ENG-623/625: resolver helpers + save-path drive guard ────────────────────
@@ -2519,58 +2912,7 @@ def test_resolve_workflow_node_agent_id_degrades_without_workflow_or_binding(mon
     assert AgentComposerService.resolve_workflow_node_agent_id(tenant_id="t", app_id="a", node_id="n") == "agent-7"
 
 
-def test_remove_drive_refs_returns_none_without_agent_or_snapshot(monkeypatch: pytest.MonkeyPatch):
-    from types import SimpleNamespace
-
-    import services.agent.composer_service as module
-
-    monkeypatch.setattr(module.db, "session", SimpleNamespace(scalar=lambda stmt: None))
-    assert AgentComposerService.remove_drive_refs(tenant_id="t", agent_id="a", account_id="u", skill_slug="s") is None
-
-    agent_without_snapshot = SimpleNamespace(id="a", active_config_snapshot_id=None)
-    monkeypatch.setattr(module.db, "session", SimpleNamespace(scalar=lambda stmt: agent_without_snapshot))
-    assert AgentComposerService.remove_drive_refs(tenant_id="t", agent_id="a", account_id="u", skill_slug="s") is None
-
-
-def test_save_workflow_composer_guards_drive_refs_for_existing_agent_strategies(monkeypatch: pytest.MonkeyPatch):
-    from types import SimpleNamespace
-
-    from services.entities.agent_entities import ComposerSavePayload
-
-    payload = ComposerSavePayload.model_validate(
-        {
-            "variant": "workflow",
-            "save_strategy": "save_to_current_version",
-            "agent_soul": _drive_soul().model_dump(mode="json"),
-            "soul_lock": {"locked": False},
-        }
-    )
-    monkeypatch.setattr(
-        AgentComposerService, "_get_draft_workflow", classmethod(lambda cls, **kwargs: SimpleNamespace(id="wf-1"))
-    )
-    monkeypatch.setattr(
-        AgentComposerService,
-        "_get_workflow_binding",
-        classmethod(lambda cls, **kwargs: SimpleNamespace(agent_id="agent-1")),
-    )
-    guarded: dict[str, str] = {}
-
-    def fake_guard(cls, *, tenant_id, agent_id, agent_soul):
-        guarded["agent_id"] = agent_id
-        raise InvalidComposerConfigError("skill_ref_dangling: boom")
-
-    from services.agent.errors import InvalidComposerConfigError
-
-    monkeypatch.setattr(AgentComposerService, "_require_drive_refs_resolved", classmethod(fake_guard))
-
-    with pytest.raises(InvalidComposerConfigError, match="skill_ref_dangling"):
-        AgentComposerService.save_workflow_composer(
-            tenant_id="t-1", app_id="app-1", node_id="n-1", account_id="acc-1", payload=payload
-        )
-    assert guarded["agent_id"] == "agent-1"
-
-
-def test_save_workflow_composer_guards_drive_refs_for_inline_node_job_only(monkeypatch: pytest.MonkeyPatch):
+def test_save_workflow_composer_reports_drive_mentions_for_inline_node_job_only(monkeypatch: pytest.MonkeyPatch):
     payload = ComposerSavePayload.model_validate(
         {
             "variant": "workflow",
@@ -2608,26 +2950,27 @@ def test_save_workflow_composer_guards_drive_refs_for_inline_node_job_only(monke
     monkeypatch.setattr(
         AgentComposerService, "_serialize_workflow_state", classmethod(lambda cls, **kwargs: {"state": "ok"})
     )
-    monkeypatch.setattr(
-        AgentComposerService, "collect_validation_findings", classmethod(lambda cls, **kwargs: {"warnings": []})
-    )
     guarded: dict[str, str] = {}
 
-    def fake_guard(cls, *, tenant_id, agent_id, agent_soul):
+    def fake_collect(cls, *, tenant_id, payload, agent_id=None):
         guarded["tenant_id"] = tenant_id
         guarded["agent_id"] = agent_id
+        return {"warnings": [{"code": "mention_target_missing", "id": "files/sample.pdf"}]}
 
-    monkeypatch.setattr(AgentComposerService, "_require_drive_refs_resolved", classmethod(fake_guard))
+    monkeypatch.setattr(AgentComposerService, "collect_validation_findings", classmethod(fake_collect))
 
     result = AgentComposerService.save_workflow_composer(
         tenant_id="t-1", app_id="app-1", node_id="n-1", account_id="acc-1", payload=payload
     )
 
-    assert result == {"state": "ok", "validation": {"warnings": []}}
+    assert result == {
+        "state": "ok",
+        "validation": {"warnings": [{"code": "mention_target_missing", "id": "files/sample.pdf"}]},
+    }
     assert guarded == {"tenant_id": "t-1", "agent_id": "agent-1"}
 
 
-def test_save_workflow_composer_skips_drive_refs_for_roster_node_job_only(monkeypatch: pytest.MonkeyPatch):
+def test_save_workflow_composer_reports_drive_mentions_for_roster_node_job_only(monkeypatch: pytest.MonkeyPatch):
     payload = ComposerSavePayload.model_validate(
         {
             "variant": "workflow",
@@ -2665,29 +3008,17 @@ def test_save_workflow_composer_skips_drive_refs_for_roster_node_job_only(monkey
     monkeypatch.setattr(
         AgentComposerService, "_serialize_workflow_state", classmethod(lambda cls, **kwargs: {"state": "ok"})
     )
-    monkeypatch.setattr(
-        AgentComposerService, "collect_validation_findings", classmethod(lambda cls, **kwargs: {"warnings": []})
-    )
+    captured: dict[str, str | None] = {}
 
-    def fail_guard(cls, *, tenant_id, agent_id, agent_soul):
-        raise AssertionError("roster node-job-only saves must not validate agent drive refs")
+    def fake_collect(cls, *, tenant_id, payload, agent_id=None):
+        captured["agent_id"] = agent_id
+        return {"warnings": []}
 
-    monkeypatch.setattr(AgentComposerService, "_require_drive_refs_resolved", classmethod(fail_guard))
+    monkeypatch.setattr(AgentComposerService, "collect_validation_findings", classmethod(fake_collect))
 
     result = AgentComposerService.save_workflow_composer(
         tenant_id="t-1", app_id="app-1", node_id="n-1", account_id="acc-1", payload=payload
     )
 
     assert result == {"state": "ok", "validation": {"warnings": []}}
-
-
-def test_remove_drive_refs_noop_when_skill_slug_unmatched(monkeypatch: pytest.MonkeyPatch):
-    soul_dict = {"skills_files": {"skills": [{"name": "Other", "skill_md_key": "other/SKILL.md"}], "files": []}}
-    _, captured, committed = _patch_remove_drive_refs_env(monkeypatch, soul_dict=soul_dict)
-    assert (
-        AgentComposerService.remove_drive_refs(
-            tenant_id="t-1", agent_id="agent-1", account_id="acc-1", skill_slug="ghost"
-        )
-        is None
-    )
-    assert committed == {}
+    assert captured["agent_id"] == "agent-1"
diff --git a/api/tests/unit_tests/services/agent/test_composer_candidates.py b/api/tests/unit_tests/services/agent/test_composer_candidates.py
index 5eb9acf8b81..863ebafc994 100644
--- a/api/tests/unit_tests/services/agent/test_composer_candidates.py
+++ b/api/tests/unit_tests/services/agent/test_composer_candidates.py
@@ -118,10 +118,6 @@ def test_previous_outputs_capped_and_flagged():
 def _soul() -> AgentSoulConfig:
     return AgentSoulConfig.model_validate(
         {
-            "skills_files": {
-                "skills": [{"id": "sk-1", "name": "tender-analyzer"}],
-                "files": [{"id": "f-1", "name": "qna_report.pdf"}],
-            },
             "tools": {
                 "cli_tools": [
                     {"id": "ct-1", "name": "ffmpeg"},
@@ -144,7 +140,6 @@ def test_soul_candidates_lists_configured_items_only():
     )
 
     assert truncated is False
-    assert [item["kind"] for item in lists["skills_files"]] == ["skill", "file"]
     assert [item["name"] for item in lists["cli_tools"]] == ["ffmpeg"]
     # the stable mention id flows through so the frontend can mint [§cli_tool:<id>§]
     assert [item["id"] for item in lists["cli_tools"]] == ["ct-1"]
@@ -158,35 +153,19 @@ def test_soul_candidates_lists_configured_items_only():
     assert lists["dify_tools"][0]["id"] == "tavily/tavily_search"
 
 
-def test_candidates_response_preserves_skill_and_file_candidate_shapes():
+def test_candidates_response_omits_legacy_skill_file_candidates():
     response = AgentComposerCandidatesResponse.model_validate(
         {
             "variant": "agent_app",
             "allowed_node_job_candidates": {},
             "allowed_soul_candidates": {
-                "skills_files": [
-                    {"kind": "skill", "id": "sk-1", "name": "tender-analyzer", "path": "skills/tender.md"},
-                    {
-                        "kind": "file",
-                        "id": "f-1",
-                        "name": "qna_report.pdf",
-                        "transfer_method": "local_file",
-                        "reference": "upload-1",
-                        "url": "https://files.example/qna_report.pdf",
-                    },
-                ]
+                "cli_tools": [],
             },
             "capabilities": {"human_roster_available": False},
         }
     ).model_dump(mode="json")
 
-    skill, file = response["allowed_soul_candidates"]["skills_files"]
-    assert skill["kind"] == "skill"
-    assert skill["path"] == "skills/tender.md"
-    assert file["kind"] == "file"
-    assert file["transfer_method"] == "local_file"
-    assert file["reference"] == "upload-1"
-    assert file["url"] == "https://files.example/qna_report.pdf"
+    assert "skills_files" not in response["allowed_soul_candidates"]
 
 
 def test_soul_candidates_empty_config_yields_empty_lists():
diff --git a/api/tests/unit_tests/services/agent/test_composer_mention_validation.py b/api/tests/unit_tests/services/agent/test_composer_mention_validation.py
index e332b48ab1e..ffbec86f4e6 100644
--- a/api/tests/unit_tests/services/agent/test_composer_mention_validation.py
+++ b/api/tests/unit_tests/services/agent/test_composer_mention_validation.py
@@ -171,7 +171,6 @@ def test_configured_but_deleted_dataset_surfaces_as_placeholder():
 def test_unresolved_non_knowledge_mentions_warn_target_missing():
     findings = _findings(_soul_payload("use [§skill:nope:Ghost Skill§] and [§human:missing§]"))
     codes = [(w["code"], w["kind"]) for w in findings["warnings"]]
-    assert ("mention_target_missing", "skill") in codes
     assert ("mention_target_missing", "human") in codes
     assert findings["knowledge_retrieval_placeholder"] == []
 
diff --git a/api/tests/unit_tests/services/agent/test_prompt_mentions.py b/api/tests/unit_tests/services/agent/test_prompt_mentions.py
index b85a0a752e1..b8b908d432f 100644
--- a/api/tests/unit_tests/services/agent/test_prompt_mentions.py
+++ b/api/tests/unit_tests/services/agent/test_prompt_mentions.py
@@ -7,11 +7,13 @@ guarantees no mention-shaped marker survives to the model.
 
 from __future__ import annotations
 
+from urllib.parse import quote
+
 import pytest
 
 from models.agent_config_entities import AgentSoulConfig, WorkflowNodeJobConfig
 from services.agent.prompt_mentions import (
-    MAX_MENTION_FIELD_LENGTH,
+    MAX_MENTION_REF_ID_LENGTH,
     NODE_JOB_PROMPT_ALLOWED_KINDS,
     SOUL_PROMPT_ALLOWED_KINDS,
     MentionKind,
@@ -26,11 +28,11 @@ from services.agent.prompt_mentions import (
 
 
 def test_parse_extracts_kind_id_and_optional_label():
-    prompt = "Use [§skill:abc-1:tender-analyzer§] then ask [§human:c-1§]."
+    prompt = "Use [§skill:tender-analyzer%2FSKILL.md:tender-analyzer§] then ask [§human:c-1§]."
     mentions = parse_prompt_mentions(prompt)
 
     assert [(m.kind, m.ref_id, m.label) for m in mentions] == [
-        (MentionKind.SKILL, "abc-1", "tender-analyzer"),
+        (MentionKind.SKILL, "tender-analyzer%2FSKILL.md", "tender-analyzer"),
         (MentionKind.HUMAN, "c-1", None),
     ]
     assert prompt[mentions[0].start : mentions[0].end] == mentions[0].raw
@@ -48,10 +50,16 @@ def test_parse_ignores_legacy_template_forms_and_unknown_kinds():
 
 
 def test_parse_skips_oversized_id_or_label():
-    long_id = "x" * (MAX_MENTION_FIELD_LENGTH + 1)
+    long_id = "x" * (MAX_MENTION_REF_ID_LENGTH + 1)
     assert parse_prompt_mentions(f"[§skill:{long_id}§]") == []
 
 
+def test_parse_accepts_long_unicode_encoded_drive_key_within_drive_limit():
+    encoded_drive_key = quote("你" * 512)
+    mentions = parse_prompt_mentions(f"[§skill:{encoded_drive_key}:Long Skill§]")
+    assert [(mention.kind, mention.ref_id) for mention in mentions] == [(MentionKind.SKILL, encoded_drive_key)]
+
+
 # ── expand + scrub ────────────────────────────────────────────────────────────
 
 
@@ -88,10 +96,6 @@ def test_expand_empty_prompt_is_noop():
 def soul() -> AgentSoulConfig:
     return AgentSoulConfig.model_validate(
         {
-            "skills_files": {
-                "skills": [{"id": "sk-1", "name": "tender-analyzer"}],
-                "files": [{"id": "f-1", "name": "qna_report.pdf"}],
-            },
             "tools": {
                 "dify_tools": [
                     {
@@ -112,17 +116,13 @@ def soul() -> AgentSoulConfig:
 def test_soul_resolver_resolves_each_kind(soul: AgentSoulConfig):
     resolver = build_soul_mention_resolver(soul)
     prompt = (
-        "Use [§skill:sk-1§] with [§file:f-1§], search via "
-        "[§tool:tavily/tavily_search:tavily§], run [§cli_tool:ct-1:ffmpeg§], "
+        "Use [§tool:tavily/tavily_search:tavily§], run [§cli_tool:ct-1:ffmpeg§], "
         "ground in [§knowledge:ds-1§], ask [§human:c-1§]."
     )
 
     expanded = expand_prompt_mentions(prompt, resolver)
 
-    assert expanded == (
-        "Use tender-analyzer with qna_report.pdf, search via tavily_search, "
-        "run ffmpeg, ground in 产品手册, ask EMAIL · David Hayes."
-    )
+    assert expanded == ("Use tavily_search, run ffmpeg, ground in 产品手册, ask EMAIL · David Hayes.")
 
 
 def test_soul_resolver_unknown_ids_degrade(soul: AgentSoulConfig):
diff --git a/api/tests/unit_tests/services/agent/test_skill_package_service.py b/api/tests/unit_tests/services/agent/test_skill_package_service.py
index a29f641cfe2..c88b72b3fcc 100644
--- a/api/tests/unit_tests/services/agent/test_skill_package_service.py
+++ b/api/tests/unit_tests/services/agent/test_skill_package_service.py
@@ -121,16 +121,3 @@ def test_read_member_bytes_roundtrip_and_errors():
     with pytest.raises(SkillPackageError) as bad_zip:
         service.read_member_bytes(content=b"not a zip", member_path="SKILL.md")
     assert bad_zip.value.code == "invalid_archive"
-
-
-def test_to_skill_ref_carries_metadata():
-    manifest = _extract({"SKILL.md": _SKILL_MD.encode()})
-    ref = manifest.to_skill_ref(file_id="upload-1", path="pdf-toolkit/.DIFY-SKILL-FULL.zip")
-
-    assert ref.name == "PDF Toolkit"
-    assert ref.file_id == "upload-1"
-    assert ref.path == "pdf-toolkit/.DIFY-SKILL-FULL.zip"
-    assert ref.id == manifest.hash
-    dumped = ref.model_dump()
-    assert dumped["hash"] == manifest.hash
-    assert dumped["entry_path"] == "SKILL.md"
diff --git a/api/tests/unit_tests/services/agent/test_skill_standardize_service.py b/api/tests/unit_tests/services/agent/test_skill_standardize_service.py
index 128a6c42801..fa47c9bd905 100644
--- a/api/tests/unit_tests/services/agent/test_skill_standardize_service.py
+++ b/api/tests/unit_tests/services/agent/test_skill_standardize_service.py
@@ -32,16 +32,30 @@ def test_slugify_skill_name():
     assert slugify_skill_name("") == "skill"
 
 
-def test_standardize_creates_two_drive_owned_toolfiles_and_commits():
+def test_standardize_creates_drive_owned_toolfiles_and_commits_archive_members():
     content = _zip({"SKILL.md": _SKILL_MD, "scripts/run.py": b"print('x')\n"})
 
     tool_files = MagicMock()
     tool_files.create_file_by_raw.side_effect = [
         SimpleNamespace(id="md-tool-file"),
         SimpleNamespace(id="zip-tool-file"),
+        SimpleNamespace(id="script-tool-file"),
     ]
     drive = MagicMock()
     drive.commit.return_value = []
+    drive.list_skills.return_value = [
+        {
+            "path": "pdf-toolkit",
+            "skill_md_key": "pdf-toolkit/SKILL.md",
+            "archive_key": "pdf-toolkit/.DIFY-SKILL-FULL.zip",
+            "name": "PDF Toolkit",
+            "description": "Work with PDFs.",
+            "size": len(_SKILL_MD),
+            "mime_type": "text/markdown",
+            "hash": None,
+            "created_at": None,
+        },
+    ]
 
     service = SkillStandardizeService(tool_file_manager=tool_files, drive_service=drive)
     result = service.standardize(
@@ -52,29 +66,39 @@ def test_standardize_creates_two_drive_owned_toolfiles_and_commits():
         agent_id="agent-1",
     )
 
-    # Two ToolFiles: SKILL.md (markdown) + full archive (zip).
-    assert tool_files.create_file_by_raw.call_count == 2
-    md_call, zip_call = tool_files.create_file_by_raw.call_args_list
+    # ToolFiles: SKILL.md, full archive, and each inspectable package member.
+    assert tool_files.create_file_by_raw.call_count == 3
+    md_call, zip_call, script_call = tool_files.create_file_by_raw.call_args_list
     assert md_call.kwargs["mimetype"] == "text/markdown"
     assert md_call.kwargs["file_binary"] == _SKILL_MD
     assert zip_call.kwargs["mimetype"] == "application/zip"
     assert zip_call.kwargs["file_binary"] == content
+    assert script_call.kwargs["mimetype"] in {"text/x-python", "text/plain", "application/octet-stream"}
+    assert script_call.kwargs["file_binary"] == b"print('x')\n"
+    assert script_call.kwargs["filename"] == "run.py"
 
     # Committed as drive-owned with the standardized keys.
     commit_kwargs = drive.commit.call_args.kwargs
     assert commit_kwargs["agent_id"] == "agent-1"
     items = commit_kwargs["items"]
-    assert [item.key for item in items] == ["pdf-toolkit/SKILL.md", "pdf-toolkit/.DIFY-SKILL-FULL.zip"]
+    assert [item.key for item in items] == [
+        "pdf-toolkit/SKILL.md",
+        "pdf-toolkit/.DIFY-SKILL-FULL.zip",
+        "pdf-toolkit/scripts/run.py",
+    ]
     assert all(item.value_owned_by_drive for item in items)
-    assert [item.file_ref.id for item in items] == ["md-tool-file", "zip-tool-file"]
+    assert [item.file_ref.id for item in items] == ["md-tool-file", "zip-tool-file", "script-tool-file"]
+    assert items[0].is_skill is True
+    assert items[0].skill_metadata is not None
+    assert items[0].skill_metadata.name == "PDF Toolkit"
+    assert items[0].skill_metadata.manifest_files == ["SKILL.md", "scripts/run.py"]
+    assert items[1].is_skill is False
+    assert items[2].is_skill is False
 
-    # The returned skill ref carries stable drive paths + file ids.
+    # The returned upload response carries only the drive-derived fields the UI needs.
     skill = result["skill"]
     assert skill["path"] == "pdf-toolkit"
     assert skill["name"] == "PDF Toolkit"
-    assert skill["full_archive_file_id"] == "zip-tool-file"
-    assert skill["skill_md_file_id"] == "md-tool-file"
+    assert skill["archive_key"] == "pdf-toolkit/.DIFY-SKILL-FULL.zip"
     assert skill["skill_md_key"] == "pdf-toolkit/SKILL.md"
-    # ENG-371: zip member listing persisted for infer-tools signals
-    assert "SKILL.md" in skill["manifest_files"]
-    assert "scripts/run.py" in skill["manifest_files"]
+    assert result["manifest"]["files"] == ["SKILL.md", "scripts/run.py"]
diff --git a/api/tests/unit_tests/services/agent/test_skill_tool_inference_service.py b/api/tests/unit_tests/services/agent/test_skill_tool_inference_service.py
index c0b6e6490f4..25678bb4f4d 100644
--- a/api/tests/unit_tests/services/agent/test_skill_tool_inference_service.py
+++ b/api/tests/unit_tests/services/agent/test_skill_tool_inference_service.py
@@ -29,13 +29,8 @@ def _service(preview=_SKILL_MD_PREVIEW):
     return SkillToolInferenceService(drive_service=drive), drive
 
 
-def _patch_soul_files(monkeypatch, files):
-    monkeypatch.setattr(SkillToolInferenceService, "_manifest_files_from_soul", staticmethod(lambda **kwargs: files))
-
-
-def test_infer_returns_suggestions_with_inferred_from(monkeypatch: pytest.MonkeyPatch):
+def test_infer_returns_suggestions_with_inferred_from(monkeypatch):
     service, drive = _service()
-    _patch_soul_files(monkeypatch, ["SKILL.md", "scripts/transcribe.sh"])
     raw = (
         '{"inferable": true, "reason": null, "cli_tools": [{"name": "ffmpeg",'
         ' "description": "transcoding for step 2", "command": "ffmpeg",'
@@ -53,9 +48,8 @@ def test_infer_returns_suggestions_with_inferred_from(monkeypatch: pytest.Monkey
     drive.preview.assert_called_once_with(tenant_id="t-1", agent_id="a-1", key="audio-transcribe/SKILL.md")
 
 
-def test_infer_threads_manifest_files_into_the_prompt(monkeypatch: pytest.MonkeyPatch):
+def test_infer_threads_skill_md_into_the_prompt(monkeypatch):
     service, _ = _service()
-    _patch_soul_files(monkeypatch, ["scripts/run.sh"])
     captured: dict[str, str] = {}
 
     def fake_invoke(*, tenant_id, user_prompt):
@@ -65,22 +59,20 @@ def test_infer_threads_manifest_files_into_the_prompt(monkeypatch: pytest.Monkey
     with patch.object(SkillToolInferenceService, "_invoke", staticmethod(fake_invoke)):
         service.infer(tenant_id="t-1", agent_id="a-1", slug="audio-transcribe")
 
-    assert "scripts/run.sh" in captured["prompt"]
+    assert "Files inside the skill package" not in captured["prompt"]
     assert "ffmpeg" in captured["prompt"]  # SKILL.md body present
 
 
-def test_infer_not_inferable_passes_reason_through(monkeypatch: pytest.MonkeyPatch):
+def test_infer_not_inferable_passes_reason_through(monkeypatch):
     service, _ = _service()
-    _patch_soul_files(monkeypatch, [])
     raw = '{"inferable": false, "cli_tools": [], "reason": "SKILL.md 未描述任何外部命令依赖"}'
     with patch.object(SkillToolInferenceService, "_invoke", staticmethod(lambda **kwargs: raw)):
         result = service.infer(tenant_id="t-1", agent_id="a-1", slug="audio-transcribe")
     assert result == {"inferable": False, "cli_tools": [], "reason": "SKILL.md 未描述任何外部命令依赖"}
 
 
-def test_infer_retries_once_then_422(monkeypatch: pytest.MonkeyPatch):
+def test_infer_retries_once_then_422(monkeypatch):
     service, _ = _service()
-    _patch_soul_files(monkeypatch, [])
     calls: list[int] = []
 
     def bad_invoke(**kwargs):
@@ -96,9 +88,8 @@ def test_infer_retries_once_then_422(monkeypatch: pytest.MonkeyPatch):
     assert exc_info.value.status_code == 422
 
 
-def test_infer_repairs_slightly_malformed_json(monkeypatch: pytest.MonkeyPatch):
+def test_infer_repairs_slightly_malformed_json(monkeypatch):
     service, _ = _service()
-    _patch_soul_files(monkeypatch, [])
     raw = 'Here you go: {"inferable": true, "cli_tools": [], "reason": null,}'
     with patch.object(SkillToolInferenceService, "_invoke", staticmethod(lambda **kwargs: raw)):
         result = service.infer(tenant_id="t-1", agent_id="a-1", slug="audio-transcribe")
@@ -123,10 +114,10 @@ def test_binary_skill_md_maps_to_404():
     assert exc_info.value.code == "skill_not_found"
 
 
-# ── real-path coverage: _invoke / _manifest_files_from_soul / passthrough ────
+# ── real-path coverage: _invoke / passthrough ────────────────────────────────
 
 
-def test_invoke_maps_missing_default_model_to_400(monkeypatch: pytest.MonkeyPatch):
+def test_invoke_maps_missing_default_model_to_400(monkeypatch):
     import services.agent.skill_tool_inference_service as module
     from core.errors.error import ProviderTokenNotInitError
 
@@ -140,7 +131,7 @@ def test_invoke_maps_missing_default_model_to_400(monkeypatch: pytest.MonkeyPatc
     assert exc_info.value.status_code == 400
 
 
-def test_invoke_maps_model_failure_to_422_and_success_returns_text(monkeypatch: pytest.MonkeyPatch):
+def test_invoke_maps_model_failure_to_422_and_success_returns_text(monkeypatch):
     import services.agent.skill_tool_inference_service as module
 
     fake_manager = MagicMock()
@@ -171,55 +162,3 @@ def test_load_skill_md_passes_through_non_missing_drive_errors():
     with pytest.raises(SkillToolInferenceError) as exc_info:
         service.infer(tenant_id="t-1", agent_id="a-1", slug="x")
     assert exc_info.value.code == "agent_not_found"
-
-
-def _patch_inference_db(monkeypatch: pytest.MonkeyPatch, *, agent, snapshot):
-    from types import SimpleNamespace
-
-    import services.agent.skill_tool_inference_service as module
-
-    results = iter([agent, snapshot])
-    monkeypatch.setattr(module.db, "session", SimpleNamespace(scalar=lambda stmt: next(results)))
-
-
-def test_manifest_files_from_soul_reads_active_snapshot(monkeypatch: pytest.MonkeyPatch):
-    from types import SimpleNamespace
-
-    soul_dict = {
-        "skills_files": {
-            "skills": [
-                {"name": "Other", "skill_md_key": "other/SKILL.md", "manifest_files": ["x.md"]},
-                {"name": "Audio", "skill_md_key": "audio-transcribe/SKILL.md", "manifest_files": ["scripts/a.sh"]},
-            ]
-        }
-    }
-    agent = SimpleNamespace(active_config_snapshot_id="snap-1")
-    snapshot = SimpleNamespace(config_snapshot_dict=soul_dict)
-    _patch_inference_db(monkeypatch, agent=agent, snapshot=snapshot)
-
-    files = SkillToolInferenceService._manifest_files_from_soul(
-        tenant_id="t-1", agent_id="a-1", slug="audio-transcribe"
-    )
-    assert files == ["scripts/a.sh"]
-
-
-def test_manifest_files_from_soul_degrades_when_agent_or_snapshot_missing(monkeypatch: pytest.MonkeyPatch):
-    _patch_inference_db(monkeypatch, agent=None, snapshot=None)
-    assert SkillToolInferenceService._manifest_files_from_soul(tenant_id="t", agent_id="a", slug="s") == []
-
-    from types import SimpleNamespace
-
-    _patch_inference_db(monkeypatch, agent=SimpleNamespace(active_config_snapshot_id="snap-1"), snapshot=None)
-    assert SkillToolInferenceService._manifest_files_from_soul(tenant_id="t", agent_id="a", slug="s") == []
-
-
-def test_manifest_files_from_soul_empty_when_slug_not_in_soul(monkeypatch: pytest.MonkeyPatch):
-    from types import SimpleNamespace
-
-    soul_dict = {"skills_files": {"skills": [{"name": "Other", "skill_md_key": "other/SKILL.md"}]}}
-    _patch_inference_db(
-        monkeypatch,
-        agent=SimpleNamespace(active_config_snapshot_id="snap-1"),
-        snapshot=SimpleNamespace(config_snapshot_dict=soul_dict),
-    )
-    assert SkillToolInferenceService._manifest_files_from_soul(tenant_id="t", agent_id="a", slug="ghost") == []
diff --git a/api/tests/unit_tests/services/auth/test_firecrawl_auth.py b/api/tests/unit_tests/services/auth/test_firecrawl_auth.py
index 1369ff2ba05..8f8435cc59f 100644
--- a/api/tests/unit_tests/services/auth/test_firecrawl_auth.py
+++ b/api/tests/unit_tests/services/auth/test_firecrawl_auth.py
@@ -86,6 +86,7 @@ class TestFirecrawlAuth:
             "https://api.firecrawl.dev/v1/crawl",
             headers={"Content-Type": "application/json", "Authorization": "Bearer test_api_key_123"},
             json=expected_data,
+            timeout=httpx.Timeout(10.0),
         )
 
     @pytest.mark.parametrize(
diff --git a/api/tests/unit_tests/services/enterprise/test_rbac_service.py b/api/tests/unit_tests/services/enterprise/test_rbac_service.py
index aa4780af0b4..b43c01778eb 100644
--- a/api/tests/unit_tests/services/enterprise/test_rbac_service.py
+++ b/api/tests/unit_tests/services/enterprise/test_rbac_service.py
@@ -46,7 +46,7 @@ class TestCatalog:
         assert call.tenant_id == "tenant-1"
         assert call.account_id == "acct-1"
         assert call.json is None
-        assert call.params is None
+        assert call.params == {"billing_enabled": svc.dify_config.BILLING_ENABLED}
         assert len(out.groups) == 1
         assert out.groups[0].group_key == "workspace"
 
@@ -620,6 +620,45 @@ class TestMyPermissions:
         assert out.dataset.default_permission_keys == dataset_keys
         assert out.app.overrides == []
         assert out.dataset.overrides == []
+        if role == "owner":
+            assert "billing.view" in out.workspace.permission_keys
+            assert "snippets.management" in out.workspace.permission_keys
+            assert "app.acl.preview" in out.workspace.permission_keys
+            assert "dataset.acl.preview" in out.workspace.permission_keys
+            assert "app.acl.preview" in out.app.default_permission_keys
+            assert "dataset.acl.preview" in out.dataset.default_permission_keys
+
+    @pytest.mark.parametrize(
+        ("role", "expected_snippet_keys"),
+        [
+            ("owner", {"snippets.create_and_modify", "snippets.management"}),
+            ("admin", {"snippets.create_and_modify", "snippets.management"}),
+            ("editor", {"snippets.create_and_modify"}),
+            ("normal", set()),
+            ("dataset_operator", set()),
+        ],
+    )
+    def test_get_uses_legacy_snippet_permissions_when_rbac_disabled(
+        self,
+        mock_send: MagicMock,
+        role: str,
+        expected_snippet_keys: set[str],
+    ):
+        mock_session = MagicMock()
+        mock_session.__enter__.return_value = mock_session
+        mock_session.scalar.return_value = role
+        with (
+            patch(f"{MODULE}.dify_config.RBAC_ENABLED", False),
+            patch(f"{MODULE}.session_factory.create_session", return_value=mock_session),
+        ):
+            out = svc.RBACService.MyPermissions.get("tenant-1", "acct-1")
+
+        actual_snippet_keys = {
+            permission_key for permission_key in out.workspace.permission_keys if permission_key.startswith("snippets.")
+        }
+
+        mock_send.assert_not_called()
+        assert actual_snippet_keys == expected_snippet_keys
 
     def test_get_returns_empty_when_role_missing_and_rbac_disabled(self, mock_send: MagicMock):
         mock_session = MagicMock()
@@ -668,7 +707,8 @@ class TestMemberRoles:
                 }
             ],
         }
-        out = svc.RBACService.MemberRoles.get("tenant-1", "acct-1", "acct-2")
+        with patch(f"{MODULE}.dify_config.RBAC_ENABLED", True):
+            out = svc.RBACService.MemberRoles.get("tenant-1", "acct-1", "acct-2")
         call = _call_args(mock_send)
         assert call.method == "GET"
         assert call.endpoint == "/rbac/members/rbac-roles"
@@ -676,6 +716,33 @@ class TestMemberRoles:
         assert out.account_id == "acct-2"
         assert out.roles[0].name == "Member"
 
+    def test_get_legacy_role_includes_permission_keys(self, mock_send: MagicMock):
+        session = MagicMock()
+        session.scalar.return_value = svc.TenantAccountRole.EDITOR
+
+        with (
+            patch(f"{MODULE}.dify_config.RBAC_ENABLED", False),
+            patch(f"{MODULE}.session_factory.create_session") as create_session,
+        ):
+            create_session.return_value.__enter__.return_value = session
+            out = svc.RBACService.MemberRoles.get("tenant-1", "acct-1", "acct-2")
+
+        mock_send.assert_not_called()
+        assert out.account_id == "acct-2"
+        assert out.roles[0].name == "editor"
+        assert out.roles[0].permission_keys == list(
+            dict.fromkeys(
+                [
+                    *svc._LEGACY_WORKSPACE_EDITOR_KEYS,
+                    *svc._LEGACY_APP_EDITOR_KEYS,
+                    *svc._LEGACY_DATASET_EDITOR_KEYS,
+                ]
+            )
+        )
+        assert "snippets.create_and_modify" in out.roles[0].permission_keys
+        assert "app.acl.preview" in out.roles[0].permission_keys
+        assert "dataset.acl.preview" in out.roles[0].permission_keys
+
     def test_replace(self, mock_send: MagicMock):
         mock_send.return_value = {"account_id": "acct-2", "roles": []}
         svc.RBACService.MemberRoles.replace(
diff --git a/api/tests/unit_tests/services/hit_service.py b/api/tests/unit_tests/services/hit_service.py
index ddbc7dc0413..ae19daba898 100644
--- a/api/tests/unit_tests/services/hit_service.py
+++ b/api/tests/unit_tests/services/hit_service.py
@@ -147,8 +147,7 @@ class TestHitTestingServiceRetrieve:
         Provides a mocked database session for testing database operations
         like adding and committing DatasetQuery records.
         """
-        with patch("services.hit_testing_service.db.session", autospec=True) as mock_db:
-            yield mock_db
+        return MagicMock()
 
     def test_retrieve_success_with_default_retrieval_model(self, mock_db_session):
         """
@@ -186,7 +185,9 @@ class TestHitTestingServiceRetrieve:
             mock_format.return_value = mock_records
 
             # Act
-            result = HitTestingService.retrieve(dataset, query, account, retrieval_model, external_retrieval_model)
+            result = HitTestingService.retrieve(
+                mock_db_session, dataset, query, account, retrieval_model, external_retrieval_model
+            )
 
             # Assert
             assert result["query"]["content"] == query
@@ -232,7 +233,9 @@ class TestHitTestingServiceRetrieve:
             mock_format.return_value = mock_records
 
             # Act
-            result = HitTestingService.retrieve(dataset, query, account, retrieval_model, external_retrieval_model)
+            result = HitTestingService.retrieve(
+                mock_db_session, dataset, query, account, retrieval_model, external_retrieval_model
+            )
 
             # Assert
             assert result["query"]["content"] == query
@@ -257,9 +260,11 @@ class TestHitTestingServiceRetrieve:
         retrieval_model = {
             "metadata_filtering_conditions": {
                 "conditions": [
-                    {"field": "category", "operator": "is", "value": "test"},
+                    {"name": "category", "comparison_operator": "is", "value": "test"},
                 ],
             },
+            "reranking_enable": False,
+            "score_threshold_enabled": False,
         }
         external_retrieval_model = {}
 
@@ -286,7 +291,9 @@ class TestHitTestingServiceRetrieve:
             mock_format.return_value = mock_records
 
             # Act
-            result = HitTestingService.retrieve(dataset, query, account, retrieval_model, external_retrieval_model)
+            result = HitTestingService.retrieve(
+                mock_db_session, dataset, query, account, retrieval_model, external_retrieval_model
+            )
 
             # Assert
             assert result["query"]["content"] == query
@@ -308,9 +315,11 @@ class TestHitTestingServiceRetrieve:
         retrieval_model = {
             "metadata_filtering_conditions": {
                 "conditions": [
-                    {"field": "category", "operator": "is", "value": "test"},
+                    {"name": "category", "comparison_operator": "is", "value": "test"},
                 ],
             },
+            "reranking_enable": False,
+            "score_threshold_enabled": False,
         }
         external_retrieval_model = {}
 
@@ -327,7 +336,9 @@ class TestHitTestingServiceRetrieve:
             mock_format.return_value = []
 
             # Act
-            result = HitTestingService.retrieve(dataset, query, account, retrieval_model, external_retrieval_model)
+            result = HitTestingService.retrieve(
+                mock_db_session, dataset, query, account, retrieval_model, external_retrieval_model
+            )
 
             # Assert
             assert result["query"]["content"] == query
@@ -344,6 +355,8 @@ class TestHitTestingServiceRetrieve:
         dataset_retrieval_model = {
             "search_method": RetrievalMethod.HYBRID_SEARCH,
             "top_k": 3,
+            "reranking_enable": False,
+            "score_threshold_enabled": False,
         }
         dataset = HitTestingTestDataFactory.create_dataset_mock(retrieval_model=dataset_retrieval_model)
         account = HitTestingTestDataFactory.create_user_mock()
@@ -366,7 +379,9 @@ class TestHitTestingServiceRetrieve:
             mock_format.return_value = mock_records
 
             # Act
-            result = HitTestingService.retrieve(dataset, query, account, retrieval_model, external_retrieval_model)
+            result = HitTestingService.retrieve(
+                mock_db_session, dataset, query, account, retrieval_model, external_retrieval_model
+            )
 
             # Assert
             assert result["query"]["content"] == query
@@ -391,8 +406,7 @@ class TestHitTestingServiceExternalRetrieve:
         Provides a mocked database session for testing database operations
         like adding and committing DatasetQuery records.
         """
-        with patch("services.hit_testing_service.db.session", autospec=True) as mock_db:
-            yield mock_db
+        return MagicMock()
 
     def test_external_retrieve_success(self, mock_db_session):
         """
@@ -424,7 +438,7 @@ class TestHitTestingServiceExternalRetrieve:
 
             # Act
             result = HitTestingService.external_retrieve(
-                dataset, query, account, external_retrieval_model, metadata_filtering_conditions
+                mock_db_session, dataset, query, account, external_retrieval_model, metadata_filtering_conditions
             )
 
             # Assert
@@ -455,7 +469,7 @@ class TestHitTestingServiceExternalRetrieve:
 
         # Act
         result = HitTestingService.external_retrieve(
-            dataset, query, account, external_retrieval_model, metadata_filtering_conditions
+            mock_db_session, dataset, query, account, external_retrieval_model, metadata_filtering_conditions
         )
 
         # Assert
@@ -490,7 +504,7 @@ class TestHitTestingServiceExternalRetrieve:
 
             # Act
             result = HitTestingService.external_retrieve(
-                dataset, query, account, external_retrieval_model, metadata_filtering_conditions
+                mock_db_session, dataset, query, account, external_retrieval_model, metadata_filtering_conditions
             )
 
             # Assert
@@ -524,7 +538,7 @@ class TestHitTestingServiceExternalRetrieve:
 
             # Act
             result = HitTestingService.external_retrieve(
-                dataset, query, account, external_retrieval_model, metadata_filtering_conditions
+                mock_db_session, dataset, query, account, external_retrieval_model, metadata_filtering_conditions
             )
 
             # Assert
@@ -565,7 +579,7 @@ class TestHitTestingServiceCompactRetrieveResponse:
             mock_format.return_value = mock_records
 
             # Act
-            result = HitTestingService.compact_retrieve_response(query, documents)
+            result = HitTestingService.compact_retrieve_response(MagicMock(), query, documents)
 
             # Assert
             assert result["query"]["content"] == query
@@ -591,7 +605,7 @@ class TestHitTestingServiceCompactRetrieveResponse:
             mock_format.return_value = []
 
             # Act
-            result = HitTestingService.compact_retrieve_response(query, documents)
+            result = HitTestingService.compact_retrieve_response(MagicMock(), query, documents)
 
             # Assert
             assert result["query"]["content"] == query
@@ -708,7 +722,7 @@ class TestHitTestingServiceHitTestingArgsCheck:
         args = {"query": ""}
 
         # Act & Assert
-        with pytest.raises(ValueError, match="Query is required and cannot exceed 250 characters"):
+        with pytest.raises(ValueError, match="Query or attachment_ids is required"):
             HitTestingService.hit_testing_args_check(args)
 
     def test_hit_testing_args_check_none_query(self):
@@ -721,7 +735,7 @@ class TestHitTestingServiceHitTestingArgsCheck:
         args = {"query": None}
 
         # Act & Assert
-        with pytest.raises(ValueError, match="Query is required and cannot exceed 250 characters"):
+        with pytest.raises(ValueError, match="Query or attachment_ids is required"):
             HitTestingService.hit_testing_args_check(args)
 
     def test_hit_testing_args_check_too_long_query(self):
@@ -734,7 +748,7 @@ class TestHitTestingServiceHitTestingArgsCheck:
         args = {"query": "a" * 251}
 
         # Act & Assert
-        with pytest.raises(ValueError, match="Query is required and cannot exceed 250 characters"):
+        with pytest.raises(ValueError, match="Query cannot exceed 250 characters"):
             HitTestingService.hit_testing_args_check(args)
 
     def test_hit_testing_args_check_exactly_250_characters(self):
diff --git a/api/tests/unit_tests/services/retention/workflow_run/test_delete_archived_workflow_run.py b/api/tests/unit_tests/services/retention/workflow_run/test_delete_archived_workflow_run.py
new file mode 100644
index 00000000000..be1b94b2fad
--- /dev/null
+++ b/api/tests/unit_tests/services/retention/workflow_run/test_delete_archived_workflow_run.py
@@ -0,0 +1,96 @@
+import io
+import json
+import zipfile
+from datetime import UTC, datetime
+
+import pytest
+
+from libs.archive_storage import ArchiveStorage
+from services.retention.workflow_run.constants import ARCHIVE_SCHEMA_VERSION
+from services.retention.workflow_run.delete_archived_workflow_run import ArchivedWorkflowRunDeletion
+
+ARCHIVED_TABLES = [
+    "workflow_runs",
+    "workflow_app_logs",
+    "workflow_node_executions",
+    "workflow_node_execution_offload",
+    "workflow_pauses",
+    "workflow_pause_reasons",
+    "workflow_trigger_logs",
+]
+
+
+def _build_archive_bundle(
+    *,
+    run_id: str = "run-1",
+    tenant_id: str = "tenant-1",
+    app_id: str = "app-1",
+    workflow_id: str = "workflow-1",
+    corrupt_checksum_for: str | None = None,
+) -> bytes:
+    table_payloads: dict[str, bytes] = {}
+    for table_name in ARCHIVED_TABLES:
+        records = [{"id": run_id}] if table_name == "workflow_runs" else []
+        table_payloads[table_name] = ArchiveStorage.serialize_to_jsonl(records)
+
+    manifest = {
+        "schema_version": ARCHIVE_SCHEMA_VERSION,
+        "workflow_run_id": run_id,
+        "tenant_id": tenant_id,
+        "app_id": app_id,
+        "workflow_id": workflow_id,
+        "created_at": datetime.now(UTC).isoformat(),
+        "archived_at": datetime.now(UTC).isoformat(),
+        "tables": {
+            table_name: {
+                "row_count": 1 if table_name == "workflow_runs" else 0,
+                "checksum": ArchiveStorage.compute_checksum(payload),
+                "size_bytes": len(payload),
+            }
+            for table_name, payload in table_payloads.items()
+        },
+    }
+    if corrupt_checksum_for:
+        manifest["tables"][corrupt_checksum_for]["checksum"] = "bad-checksum"
+
+    buffer = io.BytesIO()
+    with zipfile.ZipFile(buffer, mode="w", compression=zipfile.ZIP_DEFLATED) as archive:
+        archive.writestr("manifest.json", json.dumps(manifest).encode("utf-8"))
+        for table_name, payload in table_payloads.items():
+            archive.writestr(f"{table_name}.jsonl", payload)
+    return buffer.getvalue()
+
+
+def test_validate_archive_bundle_accepts_valid_archive() -> None:
+    manifest = ArchivedWorkflowRunDeletion._validate_archive_bundle(
+        _build_archive_bundle(),
+        run_id="run-1",
+        tenant_id="tenant-1",
+        app_id="app-1",
+        workflow_id="workflow-1",
+    )
+
+    assert manifest["schema_version"] == ARCHIVE_SCHEMA_VERSION
+    assert manifest["tables"]["workflow_runs"]["row_count"] == 1
+
+
+def test_validate_archive_bundle_rejects_checksum_mismatch() -> None:
+    with pytest.raises(ValueError, match="archive member checksum mismatch"):
+        ArchivedWorkflowRunDeletion._validate_archive_bundle(
+            _build_archive_bundle(corrupt_checksum_for="workflow_runs"),
+            run_id="run-1",
+            tenant_id="tenant-1",
+            app_id="app-1",
+            workflow_id="workflow-1",
+        )
+
+
+def test_validate_archive_bundle_rejects_manifest_target_mismatch() -> None:
+    with pytest.raises(ValueError, match="manifest tenant_id does not match delete target"):
+        ArchivedWorkflowRunDeletion._validate_archive_bundle(
+            _build_archive_bundle(),
+            run_id="run-1",
+            tenant_id="different-tenant",
+            app_id="app-1",
+            workflow_id="workflow-1",
+        )
diff --git a/api/tests/unit_tests/services/test_account_service.py b/api/tests/unit_tests/services/test_account_service.py
index 0bfa4afb5ba..3b5c6cc9bd6 100644
--- a/api/tests/unit_tests/services/test_account_service.py
+++ b/api/tests/unit_tests/services/test_account_service.py
@@ -794,7 +794,9 @@ class TestTenantService:
         mock_db_dependencies["db"].session.add = MagicMock()
 
         # Execute test
-        result = TenantService.create_tenant_member(mock_tenant, mock_account, "normal")
+        result = TenantService.create_tenant_member(
+            mock_tenant, mock_account, mock_db_dependencies["db"].session, "normal"
+        )
 
         # Verify member was created with correct parameters
         assert result is not None
@@ -1483,7 +1485,9 @@ class TestRegisterService:
                     timezone=None,
                 )
                 mock_create_tenant.assert_called_once_with("Test User's Workspace")
-                mock_create_member.assert_called_once_with(mock_tenant, mock_account, role="owner")
+                mock_create_member.assert_called_once_with(
+                    mock_tenant, mock_account, mock_db_dependencies["db"].session, role="owner"
+                )
                 mock_event.send.assert_called_once_with(mock_tenant)
                 self._assert_database_operations_called(mock_db_dependencies["db"])
 
@@ -1863,7 +1867,9 @@ class TestRegisterService:
                     )
                     mock_lookup.assert_called_once_with(mixed_email)
                     mock_check_permission.assert_called_once_with(mock_tenant, mock_inviter, None, "add")
-                    mock_create_member.assert_called_once_with(mock_tenant, mock_new_account, "normal")
+                    mock_create_member.assert_called_once_with(
+                        mock_tenant, mock_new_account, mock_db_dependencies["db"].session, "normal"
+                    )
                     mock_switch_tenant.assert_called_once_with(mock_new_account, mock_tenant.id)
                     mock_generate_token.assert_called_once_with(
                         mock_tenant, mock_new_account, "normal", requires_setup=True
@@ -1910,7 +1916,9 @@ class TestRegisterService:
 
                 # Verify results
                 assert result == "invite-token-123"
-                mock_create_member.assert_called_once_with(mock_tenant, mock_existing_account, "normal")
+                mock_create_member.assert_called_once_with(
+                    mock_tenant, mock_existing_account, mock_db_dependencies["db"].session, "normal"
+                )
                 mock_generate_token.assert_called_once_with(
                     mock_tenant, mock_existing_account, "normal", requires_setup=True
                 )
@@ -2044,7 +2052,7 @@ class TestRegisterService:
 
                 assert result == "rbac-token"
                 mock_create_member.assert_called_once_with(
-                    mock_tenant, mock_new_account, TenantAccountRole.NORMAL.value
+                    mock_tenant, mock_new_account, mock_db_dependencies["db"].session, TenantAccountRole.NORMAL.value
                 )
                 mock_rbac_service.MemberRoles.replace.assert_called_once_with(
                     tenant_id=str(mock_tenant.id),
@@ -2089,7 +2097,10 @@ class TestRegisterService:
 
                 assert result == "rbac-token"
                 mock_create_member.assert_called_once_with(
-                    mock_tenant, mock_existing_account, TenantAccountRole.NORMAL.value
+                    mock_tenant,
+                    mock_existing_account,
+                    mock_db_dependencies["db"].session,
+                    TenantAccountRole.NORMAL.value,
                 )
                 mock_rbac_service.MemberRoles.replace.assert_called_once_with(
                     tenant_id=str(mock_tenant.id),
@@ -2133,7 +2144,10 @@ class TestRegisterService:
                     )
 
                 mock_create_member.assert_called_once_with(
-                    mock_tenant, mock_existing_account, TenantAccountRole.NORMAL.value
+                    mock_tenant,
+                    mock_existing_account,
+                    mock_db_dependencies["db"].session,
+                    TenantAccountRole.NORMAL.value,
                 )
                 mock_rbac_service.MemberRoles.replace.assert_called_once_with(
                     tenant_id=str(mock_tenant.id),
@@ -2180,7 +2194,9 @@ class TestRegisterService:
                 )
 
                 assert result == "legacy-token"
-                mock_create_member.assert_called_once_with(mock_tenant, mock_new_account, "editor")
+                mock_create_member.assert_called_once_with(
+                    mock_tenant, mock_new_account, mock_db_dependencies["db"].session, "editor"
+                )
                 mock_rbac_service.MemberRoles.replace.assert_not_called()
 
     # ==================== Token Management Tests ====================
diff --git a/api/tests/unit_tests/services/test_agent_app_feature_service.py b/api/tests/unit_tests/services/test_agent_app_feature_service.py
index 5503540356f..3d9337d79fb 100644
--- a/api/tests/unit_tests/services/test_agent_app_feature_service.py
+++ b/api/tests/unit_tests/services/test_agent_app_feature_service.py
@@ -12,7 +12,6 @@ from typing import Any
 
 import pytest
 
-from services import agent_app_feature_service as svc_mod
 from services.agent_app_feature_service import AgentAppFeatureConfigService
 
 TENANT_ID = "11111111-1111-1111-1111-111111111111"
@@ -89,9 +88,8 @@ class _FakeWriteSession:
 
 
 class TestUpdateFeatures:
-    def test_persists_new_app_model_config_version(self, monkeypatch: pytest.MonkeyPatch):
+    def test_persists_new_app_model_config_version(self):
         session = _FakeWriteSession()
-        monkeypatch.setattr(svc_mod.db, "session", session)
         app_model = SimpleNamespace(
             tenant_id=TENANT_ID, id="app-1", app_model_config_id=None, updated_by=None, updated_at=None
         )
@@ -101,6 +99,7 @@ class TestUpdateFeatures:
             app_model=app_model,  # type: ignore[arg-type]
             account=account,  # type: ignore[arg-type]
             config={"opening_statement": "Hi!", "suggested_questions_after_answer": {"enabled": True}},
+            session=session,
         )
 
         # New row carries the features but no Soul-owned model/prompt/agent_mode.
diff --git a/api/tests/unit_tests/services/test_agent_drive_service.py b/api/tests/unit_tests/services/test_agent_drive_service.py
index 09cde917946..e4a22b64a48 100644
--- a/api/tests/unit_tests/services/test_agent_drive_service.py
+++ b/api/tests/unit_tests/services/test_agent_drive_service.py
@@ -15,7 +15,7 @@ from sqlalchemy import delete, select
 
 from core.db.session_factory import session_factory
 from extensions.storage.storage_type import StorageType
-from models.agent import Agent, AgentDriveFile, AgentScope, AgentSource
+from models.agent import Agent, AgentDriveFile, AgentDriveFileKind, AgentScope, AgentSource
 from models.enums import CreatorUserRole
 from models.model import UploadFile
 from models.tools import ToolFile
@@ -23,6 +23,7 @@ from services.agent_drive_service import (
     AgentDriveError,
     AgentDriveService,
     DriveCommitItem,
+    DriveSkillMetadata,
     normalize_drive_key,
     parse_agent_drive_ref,
 )
@@ -132,6 +133,123 @@ def test_commit_then_manifest_lists_the_entry():
     assert AgentDriveService().manifest(tenant_id=TENANT, agent_id=AGENT, prefix="other/") == []
 
 
+def test_commit_skill_row_persists_metadata_and_lists_catalog() -> None:
+    tf = _seed_tool_file(name="SKILL.md")
+    AgentDriveService().commit(
+        tenant_id=TENANT,
+        user_id=USER,
+        agent_id=AGENT,
+        items=[
+            DriveCommitItem(
+                key="tender-analyzer/SKILL.md",
+                file_ref={"kind": "tool_file", "id": tf},
+                is_skill=True,
+                skill_metadata=DriveSkillMetadata(name="Tender Analyzer", description="Parses RFPs."),
+            )
+        ],
+    )
+
+    with session_factory.create_session() as session:
+        row = session.scalar(select(AgentDriveFile).where(AgentDriveFile.key == "tender-analyzer/SKILL.md"))
+        assert row is not None
+        assert row.is_skill is True
+        assert row.skill_metadata == '{"description":"Parses RFPs.","name":"Tender Analyzer"}'
+
+    skills = AgentDriveService().list_skills(tenant_id=TENANT, agent_id=AGENT)
+    assert len(skills) == 1
+    assert skills[0]["path"] == "tender-analyzer"
+    assert skills[0]["skill_md_key"] == "tender-analyzer/SKILL.md"
+    assert skills[0]["archive_key"] is None
+    assert skills[0]["name"] == "Tender Analyzer"
+    assert skills[0]["description"] == "Parses RFPs."
+    assert skills[0]["size"] == 5
+    assert skills[0]["mime_type"] == "text/plain"
+
+
+def test_commit_rejects_skill_row_without_skill_metadata() -> None:
+    tf = _seed_tool_file(name="SKILL.md")
+
+    with pytest.raises(AgentDriveError) as exc_info:
+        AgentDriveService().commit(
+            tenant_id=TENANT,
+            user_id=USER,
+            agent_id=AGENT,
+            items=[
+                DriveCommitItem(
+                    key="tender-analyzer/SKILL.md",
+                    file_ref={"kind": "tool_file", "id": tf},
+                    is_skill=True,
+                )
+            ],
+        )
+
+    assert exc_info.value.code == "invalid_skill_metadata"
+
+
+@pytest.mark.parametrize("raw_metadata", [None, '{"description":"oops"}'])
+def test_list_skills_raises_controlled_error_for_invalid_stored_metadata(raw_metadata: str | None) -> None:
+    tf = _seed_tool_file(name="SKILL.md")
+
+    with session_factory.create_session() as session:
+        session.add(
+            AgentDriveFile(
+                id="44444444-4444-4444-4444-444444444444",
+                tenant_id=TENANT,
+                agent_id=AGENT,
+                key="broken-skill/SKILL.md",
+                file_kind=AgentDriveFileKind.TOOL_FILE,
+                file_id=tf,
+                value_owned_by_drive=True,
+                is_skill=True,
+                skill_metadata=raw_metadata,
+                size=5,
+                mime_type="text/plain",
+                created_by=USER,
+            )
+        )
+        session.commit()
+
+    with pytest.raises(AgentDriveError) as exc_info:
+        AgentDriveService().list_skills(tenant_id=TENANT, agent_id=AGENT)
+
+    assert exc_info.value.code == "invalid_skill_metadata"
+
+
+def test_commit_rejects_non_skill_row_with_skill_metadata() -> None:
+    tf = _seed_tool_file()
+    with pytest.raises(AgentDriveError, match="skill metadata"):
+        AgentDriveService().commit(
+            tenant_id=TENANT,
+            user_id=USER,
+            agent_id=AGENT,
+            items=[
+                DriveCommitItem(
+                    key="files/report.txt",
+                    file_ref={"kind": "tool_file", "id": tf},
+                    skill_metadata=DriveSkillMetadata(name="Bad", description=""),
+                )
+            ],
+        )
+
+
+def test_commit_rejects_non_canonical_skill_key() -> None:
+    tf = _seed_tool_file(name="README.md")
+    with pytest.raises(AgentDriveError, match="canonical"):
+        AgentDriveService().commit(
+            tenant_id=TENANT,
+            user_id=USER,
+            agent_id=AGENT,
+            items=[
+                DriveCommitItem(
+                    key="tender-analyzer/README.md",
+                    file_ref={"kind": "tool_file", "id": tf},
+                    is_skill=True,
+                    skill_metadata=DriveSkillMetadata(name="Tender Analyzer", description=""),
+                )
+            ],
+        )
+
+
 def test_commit_rejects_tool_file_not_owned_by_user():
     other = _seed_tool_file(user_id="99999999-9999-9999-9999-999999999999")
     with pytest.raises(AgentDriveError) as exc_info:
@@ -246,6 +364,49 @@ def test_recommit_same_value_is_idempotent_and_keeps_value():
     assert len(rows) == 1
 
 
+def test_recommit_same_skill_value_updates_metadata_without_cleaning_backing_file() -> None:
+    tf = _seed_tool_file(name="SKILL.md")
+    AgentDriveService().commit(
+        tenant_id=TENANT,
+        user_id=USER,
+        agent_id=AGENT,
+        items=[
+            DriveCommitItem(
+                key="tender-analyzer/SKILL.md",
+                file_ref={"kind": "tool_file", "id": tf},
+                value_owned_by_drive=True,
+                is_skill=True,
+                skill_metadata=DriveSkillMetadata(name="Tender Analyzer", description="v1"),
+            )
+        ],
+    )
+
+    with patch("services.agent_drive_service.storage") as storage_mock:
+        AgentDriveService().commit(
+            tenant_id=TENANT,
+            user_id=USER,
+            agent_id=AGENT,
+            items=[
+                DriveCommitItem(
+                    key="tender-analyzer/SKILL.md",
+                    file_ref={"kind": "tool_file", "id": tf},
+                    value_owned_by_drive=False,
+                    is_skill=True,
+                    skill_metadata=DriveSkillMetadata(name="Tender Analyzer v2", description="v2"),
+                )
+            ],
+        )
+        storage_mock.delete.assert_not_called()
+
+    with session_factory.create_session() as session:
+        row = session.scalar(select(AgentDriveFile).where(AgentDriveFile.key == "tender-analyzer/SKILL.md"))
+        assert row is not None
+        assert row.file_id == tf
+        assert row.value_owned_by_drive is False
+        assert row.skill_metadata == '{"description":"v2","name":"Tender Analyzer v2"}'
+        assert session.scalar(select(ToolFile).where(ToolFile.id == tf)) is not None
+
+
 def _seed_upload_file(*, name: str = "u.txt") -> str:
     upload = UploadFile(
         tenant_id=TENANT,
@@ -318,7 +479,7 @@ def test_manifest_includes_internal_download_url():
 
     with (
         patch("services.agent_drive_service.file_factory.build_from_mapping", return_value=object()),
-        patch("services.agent_drive_service.DifyWorkflowFileRuntime") as runtime_cls,
+        patch("core.app.workflow.file_runtime.DifyWorkflowFileRuntime") as runtime_cls,
     ):
         runtime_cls.return_value.resolve_file_url.return_value = "http://internal/files/x?sign=1"
         items = AgentDriveService().manifest(tenant_id=TENANT, agent_id=AGENT, include_download_url=True)
@@ -348,16 +509,31 @@ def test_delete_by_key_cleans_drive_owned_value():
     _commit("files/doomed.txt", tf, owned=True)
 
     with patch("services.agent_drive_service.storage") as storage_mock:
-        removed = AgentDriveService().delete(tenant_id=TENANT, agent_id=AGENT, key="files/doomed.txt")
+        removed = AgentDriveService().commit(
+            tenant_id=TENANT,
+            user_id=USER,
+            agent_id=AGENT,
+            items=[DriveCommitItem(key="files/doomed.txt", file_ref=None)],
+        )
         storage_mock.delete.assert_called_once()
 
-    assert removed == ["files/doomed.txt"]
+    assert removed == [
+        {
+            "key": "files/doomed.txt",
+            "file_kind": "tool_file",
+            "file_id": tf,
+            "value_owned_by_drive": True,
+            "is_skill": False,
+            "skill_metadata": None,
+            "removed": True,
+        }
+    ]
     with session_factory.create_session() as session:
         assert session.scalar(select(ToolFile).where(ToolFile.id == tf)) is None
         assert list(session.scalars(select(AgentDriveFile))) == []
 
 
-def test_delete_by_prefix_removes_all_skill_keys():
+def test_commit_null_batch_removes_multiple_skill_keys():
     md = _seed_tool_file(name="SKILL.md")
     zf = _seed_tool_file(name="full.zip")
     _commit("tender-analyzer/SKILL.md", md, owned=True)
@@ -366,9 +542,20 @@ def test_delete_by_prefix_removes_all_skill_keys():
     _commit("files/other.txt", other, owned=True)
 
     with patch("services.agent_drive_service.storage"):
-        removed = AgentDriveService().delete(tenant_id=TENANT, agent_id=AGENT, prefix="tender-analyzer/")
+        removed = AgentDriveService().commit(
+            tenant_id=TENANT,
+            user_id=USER,
+            agent_id=AGENT,
+            items=[
+                DriveCommitItem(key="tender-analyzer/SKILL.md", file_ref=None),
+                DriveCommitItem(key="tender-analyzer/.DIFY-SKILL-FULL.zip", file_ref=None),
+            ],
+        )
 
-    assert sorted(removed) == ["tender-analyzer/.DIFY-SKILL-FULL.zip", "tender-analyzer/SKILL.md"]
+    assert sorted(item["key"] for item in removed) == [
+        "tender-analyzer/.DIFY-SKILL-FULL.zip",
+        "tender-analyzer/SKILL.md",
+    ]
     with session_factory.create_session() as session:
         # both skill ToolFiles physically removed, the unrelated file untouched
         assert session.scalar(select(ToolFile).where(ToolFile.id == md)) is None
@@ -378,28 +565,30 @@ def test_delete_by_prefix_removes_all_skill_keys():
     assert keys == ["files/other.txt"]
 
 
-def test_delete_is_idempotent():
-    assert AgentDriveService().delete(tenant_id=TENANT, agent_id=AGENT, key="files/never-there.txt") == []
-    assert AgentDriveService().delete(tenant_id=TENANT, agent_id=AGENT, prefix="ghost-skill/") == []
+def test_commit_null_is_idempotent_for_missing_keys():
+    removed = AgentDriveService().commit(
+        tenant_id=TENANT,
+        user_id=USER,
+        agent_id=AGENT,
+        items=[DriveCommitItem(key="files/never-there.txt", file_ref=None)],
+    )
+    assert removed == [{"key": "files/never-there.txt", "removed": True, "noop": True}]
 
 
-def test_delete_requires_exactly_one_scope():
-    with pytest.raises(AgentDriveError) as exc_info:
-        AgentDriveService().delete(tenant_id=TENANT, agent_id=AGENT)
-    assert exc_info.value.code == "invalid_delete_scope"
-    with pytest.raises(AgentDriveError):
-        AgentDriveService().delete(tenant_id=TENANT, agent_id=AGENT, prefix="a/", key="a/b")
-
-
-def test_delete_keeps_shared_value_records():
+def test_commit_null_keeps_shared_value_records():
     tf = _seed_tool_file(name="shared.txt")
     _commit("files/shared.txt", tf, owned=False)
 
     with patch("services.agent_drive_service.storage") as storage_mock:
-        removed = AgentDriveService().delete(tenant_id=TENANT, agent_id=AGENT, key="files/shared.txt")
+        removed = AgentDriveService().commit(
+            tenant_id=TENANT,
+            user_id=USER,
+            agent_id=AGENT,
+            items=[DriveCommitItem(key="files/shared.txt", file_ref=None)],
+        )
         storage_mock.delete.assert_not_called()
 
-    assert removed == ["files/shared.txt"]
+    assert removed[0]["key"] == "files/shared.txt"
     with session_factory.create_session() as session:
         # only the KV row dropped; the shared ToolFile survives
         assert session.scalar(select(ToolFile).where(ToolFile.id == tf)) is not None
@@ -501,7 +690,7 @@ def test_upload_file_download_url_uses_attachment_filename():
     upload_file_id = _seed_upload_file(name="report.pdf")
     _commit_upload("files/report.pdf", upload_file_id)
 
-    with patch("services.agent_drive_service.DifyWorkflowFileRuntime") as runtime_cls:
+    with patch("core.app.workflow.file_runtime.DifyWorkflowFileRuntime") as runtime_cls:
         runtime_cls.return_value.resolve_upload_file_url.return_value = "https://files.example/report.pdf"
         url = AgentDriveService().download_url(tenant_id=TENANT, agent_id=AGENT, key="files/report.pdf")
 
@@ -515,3 +704,104 @@ def test_manifest_items_carry_created_at_for_inspector():
     _commit("files/x.txt", tf)
     items = AgentDriveService().manifest(tenant_id=TENANT, agent_id=AGENT)
     assert items[0]["created_at"] is None or isinstance(items[0]["created_at"], int)
+
+
+# ── DIFY-2517: skill catalog / inspect ───────────────────────────────────────
+
+
+def _commit_skill(*, manifest_files: list[str] | None = None) -> None:
+    md = _seed_tool_file(name="SKILL.md")
+    zf = _seed_tool_file(name="full.zip")
+    AgentDriveService().commit(
+        tenant_id=TENANT,
+        user_id=USER,
+        agent_id=AGENT,
+        items=[
+            DriveCommitItem(
+                key="pdf-toolkit/SKILL.md",
+                file_ref={"kind": "tool_file", "id": md},
+                value_owned_by_drive=True,
+                is_skill=True,
+                skill_metadata=DriveSkillMetadata(
+                    name="PDF Toolkit",
+                    description="Work with PDFs.",
+                    manifest_files=manifest_files,
+                ),
+            ),
+            DriveCommitItem(
+                key="pdf-toolkit/.DIFY-SKILL-FULL.zip",
+                file_ref={"kind": "tool_file", "id": zf},
+                value_owned_by_drive=True,
+            ),
+        ],
+    )
+
+
+def test_list_skills_uses_canonical_skill_rows():
+    _commit_skill(manifest_files=["SKILL.md", "scripts/run.py"])
+
+    skills = AgentDriveService().list_skills(tenant_id=TENANT, agent_id=AGENT)
+
+    created_at = skills[0].pop("created_at")
+    assert skills == [
+        {
+            "path": "pdf-toolkit",
+            "skill_md_key": "pdf-toolkit/SKILL.md",
+            "archive_key": "pdf-toolkit/.DIFY-SKILL-FULL.zip",
+            "name": "PDF Toolkit",
+            "description": "Work with PDFs.",
+            "size": 5,
+            "mime_type": "text/plain",
+            "hash": None,
+        }
+    ]
+    assert created_at is None or isinstance(created_at, int)
+
+
+def test_inspect_skill_returns_manifest_files_and_file_tree():
+    _commit_skill(manifest_files=["SKILL.md", "references/guide.md", "scripts/run.py"])
+
+    with patch("services.agent_drive_service.storage") as storage_mock:
+        storage_mock.load_stream.return_value = iter([b"# PDF Toolkit\n"])
+        result = AgentDriveService().inspect_skill(tenant_id=TENANT, agent_id=AGENT, skill_path="pdf-toolkit")
+
+    assert result["source"] == "skill_md"
+    assert result["warnings"] == []
+    assert [file["path"] for file in result["files"]] == ["SKILL.md", "references/guide.md", "scripts/run.py"]
+    assert result["files"][0]["available_in_drive"] is True
+    assert result["files"][1]["available_in_drive"] is False
+    assert result["file_tree"][0]["name"] == "references"
+    assert result["file_tree"][1]["name"] == "scripts"
+    assert result["file_tree"][2]["name"] == "SKILL.md"
+    assert result["skill_md"]["text"] == "# PDF Toolkit\n"
+
+
+def test_inspect_skill_falls_back_to_drive_keys_when_manifest_missing():
+    _commit_skill(manifest_files=None)
+
+    with patch("services.agent_drive_service.storage") as storage_mock:
+        storage_mock.load_stream.return_value = iter([b"# PDF Toolkit\n"])
+        result = AgentDriveService().inspect_skill(tenant_id=TENANT, agent_id=AGENT, skill_path="pdf-toolkit")
+
+    assert result["warnings"] == ["manifest_files_unavailable"]
+    assert [file["path"] for file in result["files"]] == ["SKILL.md"]
+
+
+def test_skill_metadata_rejects_non_canonical_rows():
+    tf = _seed_tool_file(name="not-skill.md")
+    with pytest.raises(AgentDriveError) as exc_info:
+        AgentDriveService().commit(
+            tenant_id=TENANT,
+            user_id=USER,
+            agent_id=AGENT,
+            items=[
+                DriveCommitItem(
+                    key="files/not-skill.md",
+                    file_ref={"kind": "tool_file", "id": tf},
+                    value_owned_by_drive=True,
+                    is_skill=True,
+                    skill_metadata=DriveSkillMetadata(name="Bad"),
+                )
+            ],
+        )
+    assert exc_info.value.code == "invalid_skill_key"
diff --git a/api/tests/unit_tests/services/test_app_generate_service_streaming_integration.py b/api/tests/unit_tests/services/test_app_generate_service_streaming_integration.py
index 4293be8f726..4fc08516d3d 100644
--- a/api/tests/unit_tests/services/test_app_generate_service_streaming_integration.py
+++ b/api/tests/unit_tests/services/test_app_generate_service_streaming_integration.py
@@ -109,7 +109,7 @@ def _patch_get_channel_streams(monkeypatch: pytest.MonkeyPatch):
 
 @pytest.fixture
 def _patch_get_channel_pubsub(monkeypatch: pytest.MonkeyPatch):
-    from libs.broadcast_channel.redis.channel import BroadcastChannel as RedisBroadcastChannel
+    from libs.broadcast_channel.redis.pubsub_channel import BroadcastChannel as RedisBroadcastChannel
 
     store: dict[str, deque[bytes]] = defaultdict(deque)
     client = _FakeRedisClient(store)
diff --git a/api/tests/unit_tests/services/test_app_service.py b/api/tests/unit_tests/services/test_app_service.py
index e595721e169..c57fb6ed775 100644
--- a/api/tests/unit_tests/services/test_app_service.py
+++ b/api/tests/unit_tests/services/test_app_service.py
@@ -3,7 +3,11 @@ from __future__ import annotations
 from types import SimpleNamespace
 from unittest.mock import MagicMock, patch
 
+import pytest
+from sqlalchemy.exc import IntegrityError
+
 from models.model import App
+from services.agent.errors import AgentNameConflictError
 from services.app_service import AppService
 
 
@@ -317,6 +321,59 @@ class TestAgentAppType:
 
         assert backing_agent.role == ""
 
+    def test_update_agent_app_duplicate_name_rolls_back_and_raises_conflict(self):
+        from models.agent import AgentIconType
+        from models.model import AppMode, IconType
+        from services.app_service import AppService
+
+        app = SimpleNamespace(
+            id="app-1",
+            tenant_id="tenant-1",
+            mode=AppMode.AGENT,
+            name="Old",
+            description="old",
+            role="draft",
+            icon_type=IconType.EMOJI,
+            icon="robot",
+            icon_background="#fff",
+            use_icon_as_answer_icon=False,
+            max_active_requests=None,
+            created_by="account-1",
+        )
+        backing_agent = SimpleNamespace(
+            name="Old",
+            description="old",
+            role="research assistant",
+            icon_type=AgentIconType.EMOJI,
+            icon="robot",
+            icon_background="#fff",
+            updated_by=None,
+            updated_at=None,
+        )
+
+        with (
+            patch("services.app_service.db") as mock_db,
+            patch("services.app_service.current_user", SimpleNamespace(id="account-2")),
+        ):
+            mock_db.session.scalar.return_value = backing_agent
+            mock_db.session.commit.side_effect = IntegrityError("duplicate", None, None)
+            with pytest.raises(AgentNameConflictError):
+                AppService().update_app(
+                    app,  # type: ignore[arg-type]
+                    {
+                        "name": "Existing Agent",
+                        "description": "agent app",
+                        "role": "research assistant",
+                        "icon_type": "emoji",
+                        "icon": "robot",
+                        "icon_background": "#fff",
+                        "use_icon_as_answer_icon": False,
+                        "max_active_requests": 0,
+                    },
+                )
+
+        mock_db.session.rollback.assert_called_once()
+
     def test_delete_agent_app_archives_backing_agent(self):
         from models.agent import AgentStatus
         from models.model import AppMode
diff --git a/api/tests/unit_tests/services/test_archive_workflow_run_logs.py b/api/tests/unit_tests/services/test_archive_workflow_run_logs.py
index bb9e5a8deab..a21f1de769c 100644
--- a/api/tests/unit_tests/services/test_archive_workflow_run_logs.py
+++ b/api/tests/unit_tests/services/test_archive_workflow_run_logs.py
@@ -9,8 +9,6 @@ This module contains tests for:
 from datetime import datetime
 from unittest.mock import MagicMock, patch
 
-from services.retention.workflow_run.constants import ARCHIVE_BUNDLE_NAME
-
 
 class TestWorkflowRunArchiver:
     """Tests for the WorkflowRunArchiver class."""
@@ -37,18 +35,20 @@ class TestWorkflowRunArchiver:
         assert archiver.limit == 50
         assert archiver.dry_run is True
 
-    def test_get_archive_key(self):
-        """Test archive key generation."""
+    def test_get_bundle_manifest_key(self):
+        """Test V2 bundle manifest key generation."""
         from services.retention.workflow_run.archive_paid_plan_workflow_run import WorkflowRunArchiver
 
-        archiver = WorkflowRunArchiver.__new__(WorkflowRunArchiver)
+        archiver = WorkflowRunArchiver(run_shard_index=1, run_shard_total=4)
 
         mock_run = MagicMock()
-        mock_run.tenant_id = "tenant-123"
-        mock_run.app_id = "app-999"
+        mock_run.tenant_id = "9enant-123"
         mock_run.id = "run-456"
         mock_run.created_at = datetime(2024, 1, 15, 12, 0, 0)
 
-        key = archiver._get_archive_key(mock_run)
+        identity = archiver._build_bundle_identity([mock_run])
+        key = archiver._get_manifest_object_key(identity)
 
-        assert key == f"tenant-123/app_id=app-999/year=2024/month=01/workflow_run_id=run-456/{ARCHIVE_BUNDLE_NAME}"
+        assert key.endswith("/manifest.json")
+        assert "workflow-runs/v2/tenant_prefix=9/tenant_id=9enant-123/year=2024/month=01" in key
+        assert "/shard=01-of-04/" in key
diff --git a/api/tests/unit_tests/services/test_billing_service.py b/api/tests/unit_tests/services/test_billing_service.py
index 67d1cc02913..f244b69407f 100644
--- a/api/tests/unit_tests/services/test_billing_service.py
+++ b/api/tests/unit_tests/services/test_billing_service.py
@@ -14,6 +14,7 @@ Tests follow the Arrange-Act-Assert pattern for clarity.
 """
 
 import json
+import logging
 from unittest.mock import MagicMock, patch
 
 import httpx
@@ -170,7 +171,9 @@ class TestBillingServiceSendRequest:
     @pytest.mark.parametrize(
         "status_code", [httpx.codes.BAD_REQUEST, httpx.codes.INTERNAL_SERVER_ERROR, httpx.codes.NOT_FOUND]
     )
-    def test_delete_request_non_200_with_valid_json(self, mock_httpx_request, mock_billing_config, status_code):
+    def test_delete_request_non_200_with_valid_json(
+        self, mock_httpx_request, mock_billing_config, status_code, caplog: pytest.LogCaptureFixture
+    ):
         """Test DELETE request with non-200 status code raises ValueError.
 
         DELETE now checks status code and raises ValueError for non-200 responses.
@@ -184,13 +187,11 @@ class TestBillingServiceSendRequest:
         mock_httpx_request.return_value = mock_response
 
         # Act & Assert
-        with patch("services.billing_service.logger") as mock_logger:
+        with caplog.at_level(logging.ERROR, logger="services.billing_service"):
             with pytest.raises(ValueError) as exc_info:
                 BillingService._send_request("DELETE", "/test", json={"key": "value"})
             assert "Unable to process delete request" in str(exc_info.value)
-            # Verify error logging
-            mock_logger.error.assert_called_once()
-            assert "DELETE response" in str(mock_logger.error.call_args)
+            assert "DELETE response" in caplog.text
 
     @pytest.mark.parametrize(
         "status_code", [httpx.codes.BAD_REQUEST, httpx.codes.INTERNAL_SERVER_ERROR, httpx.codes.NOT_FOUND]
@@ -213,7 +214,9 @@ class TestBillingServiceSendRequest:
     @pytest.mark.parametrize(
         "status_code", [httpx.codes.BAD_REQUEST, httpx.codes.INTERNAL_SERVER_ERROR, httpx.codes.NOT_FOUND]
     )
-    def test_delete_request_non_200_with_invalid_json(self, mock_httpx_request, mock_billing_config, status_code):
+    def test_delete_request_non_200_with_invalid_json(
+        self, mock_httpx_request, mock_billing_config, status_code, caplog: pytest.LogCaptureFixture
+    ):
         """Test DELETE request with non-200 status code raises ValueError before JSON parsing.
 
         DELETE now checks status code before calling response.json(), so ValueError is raised
@@ -227,13 +230,11 @@ class TestBillingServiceSendRequest:
         mock_httpx_request.return_value = mock_response
 
         # Act & Assert
-        with patch("services.billing_service.logger") as mock_logger:
+        with caplog.at_level(logging.ERROR, logger="services.billing_service"):
             with pytest.raises(ValueError) as exc_info:
                 BillingService._send_request("DELETE", "/test", json={"key": "value"})
             assert "Unable to process delete request" in str(exc_info.value)
-            # Verify error logging
-            mock_logger.error.assert_called_once()
-            assert "DELETE response" in str(mock_logger.error.call_args)
+            assert "DELETE response" in caplog.text
 
     def test_retry_on_request_error(self, mock_httpx_request, mock_billing_config):
         """Test that _send_request retries on httpx.RequestError."""
@@ -1511,7 +1512,7 @@ class TestBillingServiceSubscriptionOperations:
         assert isinstance(result["tenant-1"]["expiration_date"], int)
         assert result["tenant-1"]["expiration_date"] == 1735689600
 
-    def test_get_plan_bulk_with_invalid_tenant_plan_skipped(self, mock_send_request):
+    def test_get_plan_bulk_with_invalid_tenant_plan_skipped(self, mock_send_request, caplog: pytest.LogCaptureFixture):
         """Test bulk plan retrieval when one tenant has invalid plan data (should skip that tenant)."""
         # Arrange
         tenant_ids = ["tenant-valid-1", "tenant-invalid", "tenant-valid-2"]
@@ -1526,7 +1527,7 @@ class TestBillingServiceSubscriptionOperations:
         }
 
         # Act
-        with patch("services.billing_service.logger") as mock_logger:
+        with caplog.at_level(logging.ERROR, logger="services.billing_service"):
             result = BillingService.get_plan_bulk(tenant_ids)
 
         # Assert - should only contain valid tenants
@@ -1542,10 +1543,11 @@ class TestBillingServiceSubscriptionOperations:
         assert result["tenant-valid-2"]["expiration_date"] == 1767225600
 
         # Verify exception was logged for the invalid tenant
-        mock_logger.exception.assert_called_once()
-        log_call_args = mock_logger.exception.call_args[0]
-        assert "get_plan_bulk: failed to validate subscription plan for tenant" in log_call_args[0]
-        assert "tenant-invalid" in log_call_args[1]
+        exception_records = [r for r in caplog.records if r.levelname == "ERROR"]
+        assert len(exception_records) == 1
+        formatted = exception_records[0].getMessage()
+        assert "get_plan_bulk: failed to validate subscription plan for tenant" in formatted
+        assert "tenant-invalid" in formatted
 
     def test_get_expired_subscription_cleanup_whitelist_success(self, mock_send_request):
         """Test successful retrieval of expired subscription cleanup whitelist."""
diff --git a/api/tests/unit_tests/services/test_credit_pool_service.py b/api/tests/unit_tests/services/test_credit_pool_service.py
new file mode 100644
index 00000000000..5e589804c3d
--- /dev/null
+++ b/api/tests/unit_tests/services/test_credit_pool_service.py
@@ -0,0 +1,304 @@
+from collections.abc import Generator
+from contextlib import contextmanager
+from types import SimpleNamespace
+from unittest.mock import MagicMock, patch
+from uuid import uuid4
+
+import pytest
+from sqlalchemy import create_engine, select
+from sqlalchemy.engine import Engine
+from sqlalchemy.orm import sessionmaker
+
+from core.errors.error import QuotaExceededError
+from models import TenantCreditPool
+from models.enums import ProviderQuotaType
+from services.credit_pool_service import (
+    CREDIT_POOL_TENANT_LOCK_BLOCKING_TIMEOUT_SECONDS,
+    CREDIT_POOL_TENANT_LOCK_TIMEOUT_SECONDS,
+    CreditPoolService,
+)
+
+
+def _create_engine_with_pool(*, quota_limit: int, quota_used: int) -> tuple[Engine, str, str]:
+    engine = create_engine("sqlite:///:memory:")
+    TenantCreditPool.__table__.create(engine)
+    tenant_id = str(uuid4())
+    pool_id = str(uuid4())
+    with engine.begin() as connection:
+        connection.execute(
+            TenantCreditPool.__table__.insert(),
+            {
+                "id": pool_id,
+                "tenant_id": tenant_id,
+                "pool_type": ProviderQuotaType.TRIAL,
+                "quota_limit": quota_limit,
+                "quota_used": quota_used,
+            },
+        )
+    return engine, tenant_id, pool_id
+
+
+@contextmanager
+def _patched_session_factory(engine: Engine) -> Generator[None, None, None]:
+    session_maker = sessionmaker(bind=engine, expire_on_commit=False)
+    with patch("services.credit_pool_service.session_factory.get_session_maker", return_value=session_maker):
+        yield
+
+
+def _get_quota_used(*, engine: Engine, pool_id: str) -> int | None:
+    with engine.connect() as connection:
+        return connection.scalar(select(TenantCreditPool.quota_used).where(TenantCreditPool.id == pool_id))
+
+
+def _make_session_maker(session: MagicMock) -> MagicMock:
+    session_maker = MagicMock()
+    transaction = session_maker.begin.return_value
+    transaction.__enter__.return_value = session
+    transaction.__exit__.return_value = None
+    return session_maker
+
+
+def _make_redis_lock() -> MagicMock:
+    lock = MagicMock()
+    lock.acquire.return_value = True
+    return lock
+
+
+def test_get_pool_uses_configured_session_factory_without_flask_app_context() -> None:
+    engine, tenant_id, _ = _create_engine_with_pool(quota_limit=10, quota_used=2)
+
+    with _patched_session_factory(engine):
+        pool = CreditPoolService.get_pool(tenant_id=tenant_id, pool_type=ProviderQuotaType.TRIAL)
+
+    assert pool is not None
+    assert pool.tenant_id == tenant_id
+    assert pool.quota_used == 2
+
+
+def test_check_and_deduct_credits_deducts_exact_amount_when_sufficient() -> None:
+    engine, tenant_id, pool_id = _create_engine_with_pool(quota_limit=10, quota_used=2)
+
+    with _patched_session_factory(engine):
+        deducted_credits = CreditPoolService.check_and_deduct_credits(tenant_id=tenant_id, credits_required=3)
+
+    assert deducted_credits == 3
+    assert _get_quota_used(engine=engine, pool_id=pool_id) == 5
+
+
+def test_check_and_deduct_credits_returns_zero_for_non_positive_request() -> None:
+    assert CreditPoolService.check_and_deduct_credits(tenant_id=str(uuid4()), credits_required=0) == 0
+
+
+def test_check_and_deduct_credits_raises_when_pool_is_missing() -> None:
+    engine = create_engine("sqlite:///:memory:")
+    TenantCreditPool.__table__.create(engine)
+
+    with (
+        _patched_session_factory(engine),
+        pytest.raises(QuotaExceededError, match="Credit pool not found"),
+    ):
+        CreditPoolService.check_and_deduct_credits(tenant_id=str(uuid4()), credits_required=1)
+
+
+def test_check_and_deduct_credits_raises_when_pool_is_empty() -> None:
+    engine, tenant_id, pool_id = _create_engine_with_pool(quota_limit=10, quota_used=10)
+
+    with (
+        _patched_session_factory(engine),
+        pytest.raises(QuotaExceededError, match="No credits remaining"),
+    ):
+        CreditPoolService.check_and_deduct_credits(tenant_id=tenant_id, credits_required=1)
+
+    assert _get_quota_used(engine=engine, pool_id=pool_id) == 10
+
+
+def test_check_and_deduct_credits_raises_without_partial_deduction_when_insufficient() -> None:
+    engine, tenant_id, pool_id = _create_engine_with_pool(quota_limit=10, quota_used=9)
+
+    with (
+        _patched_session_factory(engine),
+        pytest.raises(QuotaExceededError, match="Insufficient credits remaining"),
+    ):
+        CreditPoolService.check_and_deduct_credits(tenant_id=tenant_id, credits_required=3)
+
+    assert _get_quota_used(engine=engine, pool_id=pool_id) == 9
+
+
+def test_check_and_deduct_credits_wraps_unexpected_deduction_errors() -> None:
+    engine, tenant_id, pool_id = _create_engine_with_pool(quota_limit=10, quota_used=2)
+
+    with (
+        _patched_session_factory(engine),
+        patch.object(CreditPoolService, "_get_locked_pool", side_effect=RuntimeError("database unavailable")),
+        pytest.raises(QuotaExceededError, match="Failed to deduct credits"),
+    ):
+        CreditPoolService.check_and_deduct_credits(tenant_id=tenant_id, credits_required=1)
+
+    assert _get_quota_used(engine=engine, pool_id=pool_id) == 2
+
+
+def test_deduct_credits_capped_returns_zero_for_non_positive_request() -> None:
+    assert CreditPoolService.deduct_credits_capped(tenant_id=str(uuid4()), credits_required=0) == 0
+
+
+def test_deduct_credits_capped_returns_zero_when_pool_is_missing() -> None:
+    engine = create_engine("sqlite:///:memory:")
+    TenantCreditPool.__table__.create(engine)
+
+    with _patched_session_factory(engine):
+        deducted_credits = CreditPoolService.deduct_credits_capped(tenant_id=str(uuid4()), credits_required=1)
+
+    assert deducted_credits == 0
+
+
+def test_deduct_credits_capped_returns_zero_when_pool_is_empty() -> None:
+    engine, tenant_id, pool_id = _create_engine_with_pool(quota_limit=10, quota_used=10)
+
+    with _patched_session_factory(engine):
+        deducted_credits = CreditPoolService.deduct_credits_capped(tenant_id=tenant_id, credits_required=1)
+
+    assert deducted_credits == 0
+    assert _get_quota_used(engine=engine, pool_id=pool_id) == 10
+
+
+def test_deduct_credits_capped_deducts_only_remaining_balance_when_insufficient() -> None:
+    engine, tenant_id, pool_id = _create_engine_with_pool(quota_limit=10, quota_used=9)
+
+    with _patched_session_factory(engine):
+        deducted_credits = CreditPoolService.deduct_credits_capped(tenant_id=tenant_id, credits_required=3)
+
+    assert deducted_credits == 1
+    assert _get_quota_used(engine=engine, pool_id=pool_id) == 10
+
+
+def test_deduct_credits_capped_wraps_unexpected_deduction_errors() -> None:
+    engine, tenant_id, pool_id = _create_engine_with_pool(quota_limit=10, quota_used=2)
+
+    with (
+        _patched_session_factory(engine),
+        patch.object(CreditPoolService, "_get_locked_pool", side_effect=RuntimeError("database unavailable")),
+        pytest.raises(QuotaExceededError, match="Failed to deduct credits"),
+    ):
+        CreditPoolService.deduct_credits_capped(tenant_id=tenant_id, credits_required=1)
+
+    assert _get_quota_used(engine=engine, pool_id=pool_id) == 2
+
+
+def test_deduct_credits_capped_reraises_quota_exceeded_errors() -> None:
+    engine, tenant_id, pool_id = _create_engine_with_pool(quota_limit=10, quota_used=2)
+
+    with (
+        _patched_session_factory(engine),
+        patch.object(CreditPoolService, "_get_locked_pool", side_effect=QuotaExceededError("quota unavailable")),
+        pytest.raises(QuotaExceededError, match="quota unavailable"),
+    ):
+        CreditPoolService.deduct_credits_capped(tenant_id=tenant_id, credits_required=1)
+
+    assert _get_quota_used(engine=engine, pool_id=pool_id) == 2
+
+
+def test_check_and_deduct_credits_uses_tenant_redis_lock_before_db_deduction() -> None:
+    tenant_id = "tenant-1"
+    session = MagicMock()
+    session_maker = _make_session_maker(session)
+    pool = SimpleNamespace(remaining_credits=10, quota_used=2)
+    redis_lock = _make_redis_lock()
+
+    with (
+        patch("services.credit_pool_service.redis_client.lock", return_value=redis_lock) as lock,
+        patch("services.credit_pool_service.session_factory.get_session_maker", return_value=session_maker),
+        patch.object(CreditPoolService, "_get_locked_pool", return_value=pool) as get_locked_pool,
+    ):
+        result = CreditPoolService.check_and_deduct_credits(
+            tenant_id=tenant_id,
+            credits_required=3,
+            pool_type=ProviderQuotaType.TRIAL,
+        )
+
+    assert result == 3
+    assert pool.quota_used == 5
+    lock.assert_called_once_with(
+        "credit_pool:tenant:tenant-1:deduct_lock",
+        timeout=CREDIT_POOL_TENANT_LOCK_TIMEOUT_SECONDS,
+        blocking_timeout=CREDIT_POOL_TENANT_LOCK_BLOCKING_TIMEOUT_SECONDS,
+    )
+    redis_lock.acquire.assert_called_once_with(blocking=True)
+    redis_lock.release.assert_called_once_with()
+    get_locked_pool.assert_called_once_with(session=session, tenant_id=tenant_id, pool_type=ProviderQuotaType.TRIAL)
+
+
+def test_deduct_credits_capped_uses_tenant_redis_lock_before_db_deduction() -> None:
+    tenant_id = "tenant-1"
+    session = MagicMock()
+    session_maker = _make_session_maker(session)
+    pool = SimpleNamespace(remaining_credits=2, quota_used=8)
+    redis_lock = _make_redis_lock()
+
+    with (
+        patch("services.credit_pool_service.redis_client.lock", return_value=redis_lock) as lock,
+        patch("services.credit_pool_service.session_factory.get_session_maker", return_value=session_maker),
+        patch.object(CreditPoolService, "_get_locked_pool", return_value=pool) as get_locked_pool,
+    ):
+        result = CreditPoolService.deduct_credits_capped(
+            tenant_id=tenant_id,
+            credits_required=5,
+            pool_type=ProviderQuotaType.PAID,
+        )
+
+    assert result == 2
+    assert pool.quota_used == 10
+    lock.assert_called_once_with(
+        "credit_pool:tenant:tenant-1:deduct_lock",
+        timeout=CREDIT_POOL_TENANT_LOCK_TIMEOUT_SECONDS,
+        blocking_timeout=CREDIT_POOL_TENANT_LOCK_BLOCKING_TIMEOUT_SECONDS,
+    )
+    redis_lock.acquire.assert_called_once_with(blocking=True)
+    redis_lock.release.assert_called_once_with()
+    get_locked_pool.assert_called_once_with(session=session, tenant_id=tenant_id, pool_type=ProviderQuotaType.PAID)
+
+
+@pytest.mark.parametrize(
+    "deduct_method",
+    [
+        CreditPoolService.check_and_deduct_credits,
+        CreditPoolService.deduct_credits_capped,
+    ],
+)
+def test_non_positive_credit_request_skips_tenant_redis_lock(deduct_method) -> None:
+    with patch("services.credit_pool_service.redis_client.lock") as lock:
+        result = deduct_method(tenant_id="tenant-1", credits_required=0)
+
+    assert result == 0
+    lock.assert_not_called()
+
+
+def test_check_and_deduct_credits_wraps_redis_lock_errors_without_querying_db() -> None:
+    session_maker = MagicMock()
+
+    with (
+        patch("services.credit_pool_service.redis_client.lock", side_effect=RuntimeError("redis unavailable")),
+        patch("services.credit_pool_service.session_factory.get_session_maker", return_value=session_maker),
+        pytest.raises(QuotaExceededError, match="Failed to deduct credits"),
+    ):
+        CreditPoolService.check_and_deduct_credits(tenant_id="tenant-1", credits_required=1)
+
+    session_maker.begin.assert_not_called()
+
+
+def test_deduct_credits_capped_ignores_release_errors_after_successful_deduction() -> None:
+    session = MagicMock()
+    session_maker = _make_session_maker(session)
+    pool = SimpleNamespace(remaining_credits=3, quota_used=7)
+    redis_lock = _make_redis_lock()
+    redis_lock.release.side_effect = RuntimeError("release failed")
+
+    with (
+        patch("services.credit_pool_service.redis_client.lock", return_value=redis_lock),
+        patch("services.credit_pool_service.session_factory.get_session_maker", return_value=session_maker),
+        patch.object(CreditPoolService, "_get_locked_pool", return_value=pool),
+    ):
+        result = CreditPoolService.deduct_credits_capped(tenant_id="tenant-1", credits_required=2)
+
+    assert result == 2
+    assert pool.quota_used == 9
+    redis_lock.release.assert_called_once_with()
diff --git a/api/tests/unit_tests/services/test_file_service.py b/api/tests/unit_tests/services/test_file_service.py
index 2e6ca7dbb9c..b81fb823949 100644
--- a/api/tests/unit_tests/services/test_file_service.py
+++ b/api/tests/unit_tests/services/test_file_service.py
@@ -375,19 +375,19 @@ class TestFileService:
         file_service.delete_file("file_id")
         # Should return without doing anything
 
-    @patch("services.file_service.db")
-    def test_get_upload_files_by_ids_empty(self, mock_db):
-        result = FileService.get_upload_files_by_ids("tenant_id", [])
+    def test_get_upload_files_by_ids_empty(self):
+        session = MagicMock()
+        result = FileService.get_upload_files_by_ids(session, "tenant_id", [])
         assert result == {}
 
-    @patch("services.file_service.db")
-    def test_get_upload_files_by_ids(self, mock_db):
+    def test_get_upload_files_by_ids(self):
         upload_file = MagicMock(spec=UploadFile)
         upload_file.id = "550e8400-e29b-41d4-a716-446655440000"
         upload_file.tenant_id = "tenant_id"
-        mock_db.session.scalars().all.return_value = [upload_file]
+        session = MagicMock()
+        session.scalars().all.return_value = [upload_file]
 
-        result = FileService.get_upload_files_by_ids("tenant_id", ["550e8400-e29b-41d4-a716-446655440000"])
+        result = FileService.get_upload_files_by_ids(session, "tenant_id", ["550e8400-e29b-41d4-a716-446655440000"])
         assert result["550e8400-e29b-41d4-a716-446655440000"] == upload_file
 
     def test_sanitize_zip_entry_name(self):
diff --git a/api/tests/unit_tests/services/test_hit_testing_service_dump_records.py b/api/tests/unit_tests/services/test_hit_testing_service_dump_records.py
deleted file mode 100644
index 5dd0194fd01..00000000000
--- a/api/tests/unit_tests/services/test_hit_testing_service_dump_records.py
+++ /dev/null
@@ -1,102 +0,0 @@
-from datetime import datetime
-from unittest.mock import Mock, patch
-
-import pytest
-
-from services.hit_testing_service import HitTestingService
-
-
-def _retrieval_record(payload: dict):
-    record = Mock()
-    record.model_dump.return_value = payload
-    segment = payload.get("segment")
-    if isinstance(segment, dict):
-        record.segment = Mock()
-        record.segment.id = segment.get("id")
-        record.segment.document_id = segment.get("document_id")
-        record.segment.created_at = datetime(2024, 1, 1, 0, 0, 0)
-    else:
-        record.segment = None
-    return record
-
-
-def _dataset_document(
-    document_id: str = "document-1",
-    name: str = "guide.md",
-    data_source_type: str = "upload_file",
-    doc_type: str | None = None,
-    doc_metadata: dict | None = None,
-):
-    document = Mock()
-    document.id = document_id
-    document.name = name
-    document.data_source_type = data_source_type
-    document.doc_type = doc_type
-    document.doc_metadata = doc_metadata
-    return document
-
-
-class TestHitTestingServiceDumpRecords:
-    def test_dump_dataset_document_returns_frontend_required_fields(self):
-        document = _dataset_document(doc_metadata={"source": "manual"})
-
-        assert HitTestingService._dump_dataset_document(document) == {
-            "id": "document-1",
-            "data_source_type": "upload_file",
-            "name": "guide.md",
-            "doc_type": None,
-            "doc_metadata": {"source": "manual"},
-        }
-
-    def test_dump_retrieval_records_returns_dumped_records_without_document_ids(self):
-        record = _retrieval_record({"segment": {"id": "segment-1", "document_id": None}, "score": 0.95})
-        record.segment.document_id = None
-
-        assert HitTestingService._dump_retrieval_records([record]) == [
-            {"segment": {"id": "segment-1", "document_id": None}, "score": 0.95}
-        ]
-
-    def test_dump_retrieval_records_injects_documents(self):
-        record_with_document = _retrieval_record(
-            {
-                "segment": {
-                    "id": "segment-1",
-                    "document_id": "document-1",
-                },
-                "score": 0.9,
-            }
-        )
-        scalars_result = Mock()
-        scalars_result.all.return_value = [_dataset_document()]
-
-        with patch("services.hit_testing_service.db.session.scalars", return_value=scalars_result):
-            result = HitTestingService._dump_retrieval_records([record_with_document])
-
-        assert result[0]["segment"]["document"] == {
-            "id": "document-1",
-            "data_source_type": "upload_file",
-            "name": "guide.md",
-            "doc_type": None,
-            "doc_metadata": None,
-        }
-
-        assert result[0]["segment"]["created_at"] == datetime(2024, 1, 1, 0, 0, 0)
-
-    def test_dump_retrieval_records_skips_records_with_missing_documents(self, caplog: pytest.LogCaptureFixture):
-        record = _retrieval_record(
-            {
-                "segment": {
-                    "id": "segment-1",
-                    "document_id": "missing-document",
-                },
-                "score": 0.95,
-            }
-        )
-        scalars_result = Mock()
-        scalars_result.all.return_value = []
-
-        with patch("services.hit_testing_service.db.session.scalars", return_value=scalars_result):
-            result = HitTestingService._dump_retrieval_records([record])
-
-        assert result == []
-        assert "Skipping hit-testing records with missing documents" in caplog.text
diff --git a/api/tests/unit_tests/services/test_human_input_service.py b/api/tests/unit_tests/services/test_human_input_service.py
index 4c4abbbb8ec..d9d81d66566 100644
--- a/api/tests/unit_tests/services/test_human_input_service.py
+++ b/api/tests/unit_tests/services/test_human_input_service.py
@@ -1,4 +1,5 @@
 import dataclasses
+import logging
 from datetime import datetime, timedelta
 from unittest.mock import MagicMock
 
@@ -672,7 +673,7 @@ def test_enqueue_resume_workflow_not_found(mocker: MockerFixture, mock_session_f
     assert "WorkflowRun not found" in str(excinfo.value)
 
 
-def test_enqueue_resume_app_not_found(mocker: MockerFixture, mock_session_factory):
+def test_enqueue_resume_app_not_found(mocker, mock_session_factory, caplog):
     session_factory, session = mock_session_factory
     service = HumanInputService(session_factory)
 
@@ -687,10 +688,10 @@ def test_enqueue_resume_app_not_found(mocker: MockerFixture, mock_session_factor
     )
 
     session.execute.return_value.scalar_one_or_none.return_value = None
-    logger_spy = mocker.patch("services.human_input_service.logger")
 
-    service.enqueue_resume("workflow-run-id")
-    logger_spy.error.assert_called_once()
+    with caplog.at_level(logging.ERROR, logger="services.human_input_service"):
+        service.enqueue_resume("workflow-run-id")
+        assert any(r.levelno >= logging.ERROR for r in caplog.records)
 
 
 def test_is_globally_expired_zero_timeout(
diff --git a/api/tests/unit_tests/services/test_operation_service.py b/api/tests/unit_tests/services/test_operation_service.py
index e43a7fa649e..dffded658eb 100644
--- a/api/tests/unit_tests/services/test_operation_service.py
+++ b/api/tests/unit_tests/services/test_operation_service.py
@@ -4,7 +4,7 @@ from unittest.mock import MagicMock, patch
 import httpx
 import pytest
 
-from services.operation_service import OperationService
+from services.operation_service import OPERATION_REQUEST_TIMEOUT, OperationService
 
 
 class TestOperationService:
@@ -44,6 +44,7 @@ class TestOperationService:
         assert kwargs["json"] == json_data
         assert kwargs["headers"]["Billing-Api-Secret-Key"] == "s3cr3t"
         assert kwargs["headers"]["Content-Type"] == "application/json"
+        assert kwargs["timeout"] == OPERATION_REQUEST_TIMEOUT
 
     @patch("httpx.request")
     def test_should_propagate_httpx_error_when__send_request_raises(
diff --git a/api/tests/unit_tests/services/test_summary_index_service.py b/api/tests/unit_tests/services/test_summary_index_service.py
index e17d4134ace..cef11c0038d 100644
--- a/api/tests/unit_tests/services/test_summary_index_service.py
+++ b/api/tests/unit_tests/services/test_summary_index_service.py
@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import logging
 import sys
 from dataclasses import dataclass
 from datetime import UTC, datetime
@@ -532,7 +533,10 @@ def test_vectorize_summary_error_handler_tries_chunk_id_lookup_and_can_warn_not_
     error_session.commit.assert_not_called()
 
 
-def test_update_summary_record_error_warns_when_missing(monkeypatch: pytest.MonkeyPatch) -> None:
+def test_update_summary_record_error_warns_when_missing(
+    monkeypatch: pytest.MonkeyPatch,
+    caplog: pytest.LogCaptureFixture,
+) -> None:
     dataset = _dataset()
     segment = _segment()
 
@@ -544,14 +548,15 @@ def test_update_summary_record_error_warns_when_missing(monkeypatch: pytest.Monk
         SimpleNamespace(create_session=MagicMock(return_value=_SessionContext(session))),
     )
 
-    logger_mock = MagicMock()
-    monkeypatch.setattr(summary_module, "logger", logger_mock)
-
-    SummaryIndexService.update_summary_record_error(segment, dataset, "err")
-    logger_mock.warning.assert_called_once()
+    with caplog.at_level(logging.WARNING, logger="services.summary_index_service"):
+        SummaryIndexService.update_summary_record_error(segment, dataset, "err")
+        assert any(r.levelno >= logging.WARNING for r in caplog.records)
 
 
-def test_generate_and_vectorize_summary_creates_missing_record_and_logs_usage(monkeypatch: pytest.MonkeyPatch) -> None:
+def test_generate_and_vectorize_summary_creates_missing_record_and_logs_usage(
+    monkeypatch: pytest.MonkeyPatch,
+    caplog: pytest.LogCaptureFixture,
+) -> None:
     dataset = _dataset()
     segment = _segment()
 
@@ -567,12 +572,10 @@ def test_generate_and_vectorize_summary_creates_missing_record_and_logs_usage(mo
     monkeypatch.setattr(SummaryIndexService, "generate_summary_for_segment", MagicMock(return_value=("sum", usage)))
     monkeypatch.setattr(SummaryIndexService, "vectorize_summary", MagicMock(return_value=None))
 
-    logger_mock = MagicMock()
-    monkeypatch.setattr(summary_module, "logger", logger_mock)
-
-    result = SummaryIndexService.generate_and_vectorize_summary(segment, dataset, {"enable": True})
-    assert result.status in {SummaryStatus.GENERATING, SummaryStatus.COMPLETED}
-    logger_mock.info.assert_called()
+    with caplog.at_level(logging.INFO, logger="services.summary_index_service"):
+        result = SummaryIndexService.generate_and_vectorize_summary(segment, dataset, {"enable": True})
+        assert result.status in {SummaryStatus.GENERATING, SummaryStatus.COMPLETED}
+        assert any(r.levelno >= logging.INFO for r in caplog.records)
 
 
 def test_generate_summaries_for_document_skip_conditions(monkeypatch: pytest.MonkeyPatch) -> None:
@@ -759,6 +762,7 @@ def test_enable_summaries_for_segments_no_summaries_noop(monkeypatch: pytest.Mon
 
 def test_enable_summaries_for_segments_skips_segment_or_content_and_handles_vectorize_error(
     monkeypatch: pytest.MonkeyPatch,
+    caplog: pytest.LogCaptureFixture,
 ) -> None:
     dataset = _dataset()
     summary1 = _summary_record(summary_content="sum", node_id="n1")
@@ -786,12 +790,11 @@ def test_enable_summaries_for_segments_skips_segment_or_content_and_handles_vect
         SimpleNamespace(create_session=MagicMock(return_value=_SessionContext(session))),
     )
 
-    logger_mock = MagicMock()
-    monkeypatch.setattr(summary_module, "logger", logger_mock)
     monkeypatch.setattr(SummaryIndexService, "vectorize_summary", MagicMock(side_effect=RuntimeError("boom")))
 
-    SummaryIndexService.enable_summaries_for_segments(dataset)
-    logger_mock.exception.assert_called_once()
+    with caplog.at_level(logging.ERROR, logger="services.summary_index_service"):
+        SummaryIndexService.enable_summaries_for_segments(dataset)
+        assert any(r.levelno >= logging.ERROR for r in caplog.records)
     session.commit.assert_called_once()
 
 
@@ -859,7 +862,10 @@ def test_update_summary_for_segment_empty_content_deletes_existing(monkeypatch:
     session.commit.assert_called_once()
 
 
-def test_update_summary_for_segment_empty_content_delete_vector_warns(monkeypatch: pytest.MonkeyPatch) -> None:
+def test_update_summary_for_segment_empty_content_delete_vector_warns(
+    monkeypatch: pytest.MonkeyPatch,
+    caplog: pytest.LogCaptureFixture,
+) -> None:
     dataset = _dataset()
     segment = _segment()
     record = _summary_record(summary_content="old", node_id="n1")
@@ -875,11 +881,10 @@ def test_update_summary_for_segment_empty_content_delete_vector_warns(monkeypatc
     vector_instance = MagicMock()
     vector_instance.delete_by_ids.side_effect = RuntimeError("boom")
     monkeypatch.setattr(summary_module, "Vector", MagicMock(return_value=vector_instance))
-    logger_mock = MagicMock()
-    monkeypatch.setattr(summary_module, "logger", logger_mock)
 
-    assert SummaryIndexService.update_summary_for_segment(segment, dataset, "") is None
-    logger_mock.warning.assert_called()
+    with caplog.at_level(logging.WARNING, logger="services.summary_index_service"):
+        assert SummaryIndexService.update_summary_for_segment(segment, dataset, "") is None
+        assert any(r.levelno >= logging.WARNING for r in caplog.records)
 
 
 def test_update_summary_for_segment_empty_content_no_record_noop(monkeypatch: pytest.MonkeyPatch) -> None:
@@ -923,7 +928,10 @@ def test_update_summary_for_segment_updates_existing_and_vectorizes(monkeypatch:
     session.commit.assert_called()
 
 
-def test_update_summary_for_segment_existing_vector_delete_warns(monkeypatch: pytest.MonkeyPatch) -> None:
+def test_update_summary_for_segment_existing_vector_delete_warns(
+    monkeypatch: pytest.MonkeyPatch,
+    caplog: pytest.LogCaptureFixture,
+) -> None:
     dataset = _dataset()
     segment = _segment()
     record = _summary_record(summary_content="old", node_id="n1")
@@ -940,11 +948,10 @@ def test_update_summary_for_segment_existing_vector_delete_warns(monkeypatch: py
     vector_instance.delete_by_ids.side_effect = RuntimeError("boom")
     monkeypatch.setattr(summary_module, "Vector", MagicMock(return_value=vector_instance))
     monkeypatch.setattr(SummaryIndexService, "vectorize_summary", MagicMock(return_value=None))
-    logger_mock = MagicMock()
-    monkeypatch.setattr(summary_module, "logger", logger_mock)
 
-    SummaryIndexService.update_summary_for_segment(segment, dataset, "new")
-    logger_mock.warning.assert_called()
+    with caplog.at_level(logging.WARNING, logger="services.summary_index_service"):
+        SummaryIndexService.update_summary_for_segment(segment, dataset, "new")
+        assert any(r.levelno >= logging.WARNING for r in caplog.records)
 
 
 def test_update_summary_for_segment_existing_vectorize_failure_returns_error_record(
diff --git a/api/tests/unit_tests/services/test_trigger_provider_service.py b/api/tests/unit_tests/services/test_trigger_provider_service.py
index 184e1375ed9..0a4452cf478 100644
--- a/api/tests/unit_tests/services/test_trigger_provider_service.py
+++ b/api/tests/unit_tests/services/test_trigger_provider_service.py
@@ -253,7 +253,7 @@ def test_add_trigger_subscription_should_raise_error_when_provider_limit_reached
     mock_session: MagicMock,
     provider_id: TriggerProviderID,
     provider_controller: MagicMock,
-    caplog,
+    caplog: pytest.LogCaptureFixture,
 ) -> None:
     # Arrange
     _patch_redis_lock(mocker)
@@ -274,7 +274,7 @@ def test_add_trigger_subscription_should_raise_error_when_provider_limit_reached
                 properties={},
                 credentials={},
             )
-    assert sum(1 for r in caplog.records if r.levelno >= logging.ERROR) == 1
+        assert any(r.levelno >= logging.ERROR for r in caplog.records)
 
 
 def test_add_trigger_subscription_should_raise_error_when_name_exists(
@@ -560,6 +560,7 @@ def test_refresh_oauth_token_should_refresh_and_persist_new_credentials(
         return_value=(cred_enc, cache),
     )
     mocker.patch.object(TriggerProviderService, "get_oauth_client", return_value={"client_id": "id"})
+    mock_delete_cache = mocker.patch("services.trigger.trigger_provider_service.delete_cache_for_subscription")
     refreshed = SimpleNamespace(credentials={"access_token": "new"}, expires_at=12345)
     oauth_handler = MagicMock()
     oauth_handler.refresh_credentials.return_value = refreshed
@@ -573,7 +574,12 @@ def test_refresh_oauth_token_should_refresh_and_persist_new_credentials(
     assert subscription.credentials == {"access_token": "new"}
     assert subscription.credential_expires_at == 12345
 
-    cache.delete.assert_called_once()
+    cache.delete.assert_not_called()
+    mock_delete_cache.assert_called_once_with(
+        tenant_id="tenant-1",
+        provider_id=str(provider_id),
+        subscription_id="sub-1",
+    )
 
 
 def test_refresh_subscription_should_raise_error_when_subscription_missing(
diff --git a/api/tests/unit_tests/services/test_vector_service.py b/api/tests/unit_tests/services/test_vector_service.py
index a78a033f4d3..a5873870103 100644
--- a/api/tests/unit_tests/services/test_vector_service.py
+++ b/api/tests/unit_tests/services/test_vector_service.py
@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import logging
 from dataclasses import dataclass
 from typing import Any
 from unittest.mock import MagicMock
@@ -269,6 +270,7 @@ def test_create_segments_vector_parent_child_uses_default_embedding_model_when_p
 
 def test_create_segments_vector_parent_child_missing_document_logs_warning_and_continues(
     monkeypatch: pytest.MonkeyPatch,
+    caplog: pytest.LogCaptureFixture,
 ) -> None:
     dataset = _make_dataset(doc_form=vector_service_module.IndexStructureType.PARENT_CHILD_INDEX)
     segment = _make_segment()
@@ -280,18 +282,16 @@ def test_create_segments_vector_parent_child_missing_document_logs_warning_and_c
         _mock_parent_child_queries(dataset_document=None, processing_rule=processing_rule),
     )
 
-    logger_mock = MagicMock()
-    monkeypatch.setattr(vector_service_module, "logger", logger_mock)
-
     index_processor = MagicMock()
     factory_instance = MagicMock()
     factory_instance.init_index_processor.return_value = index_processor
     monkeypatch.setattr(vector_service_module, "IndexProcessorFactory", MagicMock(return_value=factory_instance))
 
-    VectorService.create_segments_vector(
-        None, [segment], dataset, vector_service_module.IndexStructureType.PARENT_CHILD_INDEX
-    )
-    logger_mock.warning.assert_called_once()
+    with caplog.at_level(logging.WARNING, logger="services.vector_service"):
+        VectorService.create_segments_vector(
+            None, [segment], dataset, vector_service_module.IndexStructureType.PARENT_CHILD_INDEX
+        )
+        assert any(r.levelno >= logging.WARNING for r in caplog.records)
     index_processor.load.assert_not_called()
 
 
@@ -616,6 +616,7 @@ def test_update_multimodel_vector_commits_when_no_upload_files_found(monkeypatch
 
 def test_update_multimodel_vector_adds_bindings_and_vectors_and_skips_missing_upload_files(
     monkeypatch: pytest.MonkeyPatch,
+    caplog: pytest.LogCaptureFixture,
 ) -> None:
     dataset = _make_dataset(indexing_technique=IndexTechniqueType.HIGH_QUALITY, is_multimodal=True)
     segment = _make_segment(segment_id="seg-1", tenant_id="tenant-1", attachments=[{"id": "old-1"}])
@@ -630,12 +631,9 @@ def test_update_multimodel_vector_adds_bindings_and_vectors_and_skips_missing_up
     monkeypatch.setattr(vector_service_module, "delete", MagicMock())
     monkeypatch.setattr(vector_service_module, "select", MagicMock())
 
-    logger_mock = MagicMock()
-    monkeypatch.setattr(vector_service_module, "logger", logger_mock)
-
-    VectorService.update_multimodel_vector(segment=segment, attachment_ids=["file-1", "missing"], dataset=dataset)
-
-    logger_mock.warning.assert_called_once()
+    with caplog.at_level(logging.WARNING, logger="services.vector_service"):
+        VectorService.update_multimodel_vector(segment=segment, attachment_ids=["file-1", "missing"], dataset=dataset)
+        assert any(r.levelno >= logging.WARNING for r in caplog.records)
     db_mock.session.add_all.assert_called_once()
     bindings = db_mock.session.add_all.call_args.args[0]
     assert len(bindings) == 1
@@ -673,7 +671,10 @@ def test_update_multimodel_vector_updates_bindings_without_multimodal_vector_ops
     db_mock.session.commit.assert_called_once()
 
 
-def test_update_multimodel_vector_rolls_back_and_reraises_on_error(monkeypatch: pytest.MonkeyPatch) -> None:
+def test_update_multimodel_vector_rolls_back_and_reraises_on_error(
+    monkeypatch: pytest.MonkeyPatch,
+    caplog: pytest.LogCaptureFixture,
+) -> None:
     dataset = _make_dataset(indexing_technique=IndexTechniqueType.HIGH_QUALITY, is_multimodal=True)
     segment = _make_segment(segment_id="seg-1", tenant_id="tenant-1", attachments=[{"id": "old-1"}])
 
@@ -688,11 +689,9 @@ def test_update_multimodel_vector_rolls_back_and_reraises_on_error(monkeypatch:
     monkeypatch.setattr(vector_service_module, "delete", MagicMock())
     monkeypatch.setattr(vector_service_module, "select", MagicMock())
 
-    logger_mock = MagicMock()
-    monkeypatch.setattr(vector_service_module, "logger", logger_mock)
+    with caplog.at_level(logging.ERROR, logger="services.vector_service"):
+        with pytest.raises(RuntimeError, match="boom"):
+            VectorService.update_multimodel_vector(segment=segment, attachment_ids=["file-1"], dataset=dataset)
 
-    with pytest.raises(RuntimeError, match="boom"):
-        VectorService.update_multimodel_vector(segment=segment, attachment_ids=["file-1"], dataset=dataset)
-
-    logger_mock.exception.assert_called_once()
+        assert any(r.levelno >= logging.ERROR for r in caplog.records)
     db_mock.session.rollback.assert_called_once()
diff --git a/api/tests/unit_tests/services/test_webhook_service_additional.py b/api/tests/unit_tests/services/test_webhook_service_additional.py
index 491dd948427..e3a8e282e9c 100644
--- a/api/tests/unit_tests/services/test_webhook_service_additional.py
+++ b/api/tests/unit_tests/services/test_webhook_service_additional.py
@@ -1,3 +1,4 @@
+import logging
 from types import SimpleNamespace
 from typing import Any
 from unittest.mock import MagicMock
@@ -31,21 +32,21 @@ class TestWebhookServiceExtractionFallbacks:
         self,
         flask_app: Flask,
         monkeypatch: pytest.MonkeyPatch,
+        caplog: pytest.LogCaptureFixture,
     ) -> None:
-        warning_mock = MagicMock()
-        monkeypatch.setattr(service_module.logger, "warning", warning_mock)
         webhook_trigger = MagicMock()
 
-        with flask_app.test_request_context(
-            "/webhook",
-            method="POST",
-            headers={"Content-Type": "application/vnd.custom"},
-            data="plain content",
-        ):
-            result = WebhookService.extract_webhook_data(webhook_trigger)
+        with caplog.at_level(logging.WARNING, logger="services.trigger.webhook_service"):
+            with flask_app.test_request_context(
+                "/webhook",
+                method="POST",
+                headers={"Content-Type": "application/vnd.custom"},
+                data="plain content",
+            ):
+                result = WebhookService.extract_webhook_data(webhook_trigger)
 
-        assert result["body"] == {"raw": "plain content"}
-        warning_mock.assert_called_once()
+            assert result["body"] == {"raw": "plain content"}
+            assert any(r.levelno >= logging.WARNING for r in caplog.records)
 
     def test_extract_webhook_data_should_raise_for_request_too_large(
         self,
@@ -171,14 +172,13 @@ class TestWebhookServiceValidationAndConversion:
     def test_validate_json_value_should_return_original_for_unmapped_supported_segment_type(
         self,
         monkeypatch: pytest.MonkeyPatch,
+        caplog: pytest.LogCaptureFixture,
     ) -> None:
-        warning_mock = MagicMock()
-        monkeypatch.setattr(service_module.logger, "warning", warning_mock)
+        with caplog.at_level(logging.WARNING, logger="services.trigger.webhook_service"):
+            result = WebhookService._validate_json_value("param", {"x": 1}, "unsupported-type")
 
-        result = WebhookService._validate_json_value("param", {"x": 1}, "unsupported-type")
-
-        assert result == {"x": 1}
-        warning_mock.assert_called_once()
+            assert result == {"x": 1}
+            assert any(r.levelno >= logging.WARNING for r in caplog.records)
 
     def test_validate_and_convert_value_should_wrap_conversion_errors(self) -> None:
         with pytest.raises(ValueError, match="validation failed"):
diff --git a/api/tests/unit_tests/services/workflow/test_workflow_event_snapshot_service.py b/api/tests/unit_tests/services/workflow/test_workflow_event_snapshot_service.py
index eafbabe1f9b..dc3a6a31205 100644
--- a/api/tests/unit_tests/services/workflow/test_workflow_event_snapshot_service.py
+++ b/api/tests/unit_tests/services/workflow/test_workflow_event_snapshot_service.py
@@ -16,12 +16,14 @@ from core.app.app_config.entities import WorkflowUIBasedAppConfig
 from core.app.entities.app_invoke_entities import InvokeFrom, WorkflowAppGenerateEntity
 from core.app.entities.task_entities import StreamEvent
 from core.app.layers.pause_state_persist_layer import WorkflowResumptionContext, _WorkflowGenerateEntityWrapper
+from core.workflow.human_input_policy import FormDisposition, HumanInputSurface
 from graphon.entities.pause_reason import HumanInputRequired
 from graphon.enums import WorkflowExecutionStatus, WorkflowNodeExecutionStatus
 from graphon.nodes.human_input.entities import SelectInputConfig, StringListSource
 from graphon.nodes.human_input.enums import ValueSourceType
 from graphon.runtime import GraphRuntimeState, VariablePool
 from models.enums import CreatorUserRole
+from models.human_input import RecipientType
 from models.model import AppMode
 from models.workflow import WorkflowRun
 from repositories.api_workflow_node_execution_repository import WorkflowNodeExecutionSnapshot
@@ -763,7 +765,11 @@ def test_build_snapshot_events_preserves_public_form_token(monkeypatch: pytest.M
     snapshot = _build_snapshot(WorkflowNodeExecutionStatus.PAUSED)
     resumption_context = _build_resumption_context("task-ctx")
     monkeypatch.setattr(
-        service_module, "load_form_tokens_by_form_id", lambda form_ids, session=None, surface=None: {"form-1": "wtok"}
+        service_module,
+        "load_form_dispositions_by_form_id",
+        lambda form_ids, session=None, surface=None: {
+            "form-1": FormDisposition(form_token="wtok", approval_channels=[])
+        },
     )
     session_maker = _SessionMaker(
         SimpleNamespace(
@@ -803,12 +809,99 @@ def test_build_snapshot_events_preserves_public_form_token(monkeypatch: pytest.M
     assert pause_data["reasons"][0]["expiration_time"] == int(datetime(2024, 1, 1, tzinfo=UTC).timestamp())
 
 
+def _build_recipient_snapshot_events(recipients: Sequence[Any]) -> list[Mapping[str, Any]]:
+    """Drive the reconnect snapshot pause path for the OPENAPI surface.
+
+    Lets the real disposition loader run against a fake session whose ``scalars``
+    yields the given recipients, so the reconnect path derives the same token and
+    approval channels as the live path for the same recipient set.
+    """
+    workflow_run = _build_workflow_run(WorkflowExecutionStatus.PAUSED)
+    snapshot = _build_snapshot(WorkflowNodeExecutionStatus.PAUSED)
+    resumption_context = _build_resumption_context("task-ctx")
+    expiration_time = datetime(2024, 1, 1, tzinfo=UTC)
+    session_maker = _SessionMaker(
+        SimpleNamespace(
+            execute=lambda _stmt: [("form-1", expiration_time, '{"display_in_ui": true}')],
+            scalars=lambda _stmt: list(recipients),
+        )
+    )
+    pause_entity = _FakePauseEntity(
+        pause_id="pause-1",
+        workflow_run_id="run-1",
+        paused_at_value=expiration_time,
+        pause_reasons=[
+            HumanInputRequired(
+                form_id="form-1",
+                form_content="content",
+                node_id="node-1",
+                node_title="Human Input",
+            )
+        ],
+    )
+
+    return _build_snapshot_events(
+        workflow_run=workflow_run,
+        node_snapshots=[snapshot],
+        task_id="task-ctx",
+        message_context=None,
+        pause_entity=pause_entity,
+        resumption_context=resumption_context,
+        session_maker=cast(sessionmaker[Session], session_maker),
+        human_input_surface=HumanInputSurface.OPENAPI,
+    )
+
+
+def test_reconnect_pause_without_web_app_recipient_emits_approval_channels() -> None:
+    events = _build_recipient_snapshot_events(
+        recipients=[
+            SimpleNamespace(form_id="form-1", recipient_type=RecipientType.EMAIL_MEMBER, access_token="email-token"),
+            SimpleNamespace(form_id="form-1", recipient_type=RecipientType.BACKSTAGE, access_token="backstage-token"),
+        ],
+    )
+
+    human_input_event = events[-2]
+    assert human_input_event["event"] == StreamEvent.HUMAN_INPUT_REQUIRED
+    assert human_input_event["data"]["form_token"] is None
+    assert human_input_event["data"]["approval_channels"] == ["console", "email"]
+
+    pause_data = events[-1]["data"]
+    assert pause_data["reasons"][0]["form_token"] is None
+    assert pause_data["reasons"][0]["approval_channels"] == ["console", "email"]
+
+
+def test_reconnect_pause_with_web_app_recipient_sets_token_and_channels() -> None:
+    events = _build_recipient_snapshot_events(
+        recipients=[
+            SimpleNamespace(
+                form_id="form-1",
+                recipient_type=RecipientType.STANDALONE_WEB_APP,
+                access_token="web-app-token",
+            ),
+            SimpleNamespace(form_id="form-1", recipient_type=RecipientType.BACKSTAGE, access_token="backstage-token"),
+        ],
+    )
+
+    human_input_event = events[-2]
+    assert human_input_event["event"] == StreamEvent.HUMAN_INPUT_REQUIRED
+    assert human_input_event["data"]["form_token"] == "web-app-token"
+    assert human_input_event["data"]["approval_channels"] == ["console"]
+
+    pause_data = events[-1]["data"]
+    assert pause_data["reasons"][0]["form_token"] == "web-app-token"
+    assert pause_data["reasons"][0]["approval_channels"] == ["console"]
+
+
 def test_build_snapshot_events_resolves_pause_reason_select_options(monkeypatch: pytest.MonkeyPatch) -> None:
     workflow_run = _build_workflow_run(WorkflowExecutionStatus.PAUSED)
     snapshot = _build_snapshot(WorkflowNodeExecutionStatus.PAUSED)
     resumption_context = _build_resumption_context("task-ctx", select_options=["approve", "reject"])
     monkeypatch.setattr(
-        service_module, "load_form_tokens_by_form_id", lambda form_ids, session=None, surface=None: {"form-1": "wtok"}
+        service_module,
+        "load_form_dispositions_by_form_id",
+        lambda form_ids, session=None, surface=None: {
+            "form-1": FormDisposition(form_token="wtok", approval_channels=[])
+        },
     )
     session_maker = _SessionMaker(
         SimpleNamespace(
@@ -886,7 +979,11 @@ def test_build_workflow_event_stream_loads_pause_tokens_without_flask_app_contex
         service_module, "_load_resumption_context", MagicMock(return_value=_build_resumption_context("task-1"))
     )
     monkeypatch.setattr(
-        service_module, "load_form_tokens_by_form_id", lambda form_ids, session=None, surface=None: {"form-1": "wtok"}
+        service_module,
+        "load_form_dispositions_by_form_id",
+        lambda form_ids, session=None, surface=None: {
+            "form-1": FormDisposition(form_token="wtok", approval_channels=[])
+        },
     )
 
     session = SimpleNamespace(
diff --git a/api/uv.lock b/api/uv.lock
index 048d991a49e..6e998f6f6ed 100644
--- a/api/uv.lock
+++ b/api/uv.lock
@@ -1304,7 +1304,7 @@ requires-dist = [
     { name = "pydantic-ai-slim", extras = ["anthropic", "google", "openai"], marker = "extra == 'server'", specifier = ">=1.85.1,<2.0.0" },
     { name = "pydantic-settings", marker = "extra == 'server'", specifier = ">=2.12.0,<3.0.0" },
     { name = "redis", marker = "extra == 'server'", specifier = ">=7.4.0,<8.0.0" },
-    { name = "shell-session-manager", marker = "extra == 'server'", specifier = "==2.2.0" },
+    { name = "shell-session-manager", marker = "extra == 'server'", specifier = "==2.2.1" },
     { name = "typer", specifier = ">=0.16.1,<0.17" },
     { name = "typing-extensions", specifier = ">=4.12.2,<5.0.0" },
     { name = "uvicorn", extras = ["standard"], marker = "extra == 'server'", specifier = "==0.46.0" },
diff --git a/cli/package.json b/cli/package.json
index 7af5c7d0f53..3d25fb6b833 100644
--- a/cli/package.json
+++ b/cli/package.json
@@ -1,12 +1,12 @@
 {
   "name": "@langgenius/difyctl",
   "type": "module",
-  "version": "0.1.0-rc.1",
+  "version": "0.1.0-alpha",
   "description": "Dify command-line interface",
   "difyctl": {
-    "channel": "rc",
+    "channel": "alpha",
     "compat": {
-      "minDify": "1.14.0",
+      "minDify": "1.15.0",
       "maxDify": "1.15.0"
     },
     "release": {
diff --git a/cli/scripts/generate-command-tree.test.ts b/cli/scripts/generate-command-tree.test.ts
index cf25ddcf71a..c811de8b4fe 100644
--- a/cli/scripts/generate-command-tree.test.ts
+++ b/cli/scripts/generate-command-tree.test.ts
@@ -137,6 +137,17 @@ export const commandTree: CommandTree = {
     const verIdx = out.indexOf('Version')
     expect(authIdx).toBeLessThan(verIdx)
   })
+
+  it('quotes hyphenated keys and leaves plain identifier keys unquoted', () => {
+    const entries: CommandEntry[] = [
+      { tokens: ['export', 'app'], identifier: 'ExportApp', importPath: '@/commands/export/app/index' },
+      { tokens: ['export', 'studio-app'], identifier: 'ExportStudioApp', importPath: '@/commands/export/studio-app/index' },
+    ]
+    const out = formatModule(entries, buildTree(entries))
+    expect(out).toContain(`'studio-app': { command: ExportStudioApp, subcommands: {} },`)
+    expect(out).toContain(`app: { command: ExportApp, subcommands: {} },`)
+    expect(out).not.toContain(`'app':`)
+  })
 })
 
 function makeFixture(): string {
diff --git a/cli/scripts/generate-command-tree.ts b/cli/scripts/generate-command-tree.ts
index 769490df834..9f3357bd6ea 100644
--- a/cli/scripts/generate-command-tree.ts
+++ b/cli/scripts/generate-command-tree.ts
@@ -141,13 +141,24 @@ function emitNode(node: TreeNode, indent: string): string {
   return parts.join('\n')
 }
 
+function needsQuoting(key: string): boolean {
+  // A bare object key must be a valid JS identifier: the start class excludes digits
+  // (letter/_/$ only), so a leading digit fails the match and the key gets quoted.
+  return !/^[A-Z_$][\w$]*$/i.test(key)
+}
+
+function emitKey(key: string): string {
+  return needsQuoting(key) ? `'${key}'` : key
+}
+
 function emitEntry(key: string, node: TreeNode, indent: string): string {
+  const k = emitKey(key)
   const isLeaf = node.subcommands.size === 0 && node.command !== undefined
   if (isLeaf)
-    return `${indent}${key}: { command: ${node.command}, subcommands: {} },`
+    return `${indent}${k}: { command: ${node.command}, subcommands: {} },`
 
   return [
-    `${indent}${key}: {`,
+    `${indent}${k}: {`,
     emitNode(node, indent),
     `${indent}},`,
   ].join('\n')
diff --git a/cli/scripts/lib/resolve-buildinfo.ts b/cli/scripts/lib/resolve-buildinfo.ts
index ee0cc7b5506..10cdf2814b0 100644
--- a/cli/scripts/lib/resolve-buildinfo.ts
+++ b/cli/scripts/lib/resolve-buildinfo.ts
@@ -4,7 +4,7 @@ import { readFileSync } from 'node:fs'
 import { dirname, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
-export const BUILD_CHANNELS = ['dev', 'rc', 'stable'] as const
+export const BUILD_CHANNELS = ['dev', 'alpha', 'rc', 'edge', 'stable'] as const
 export type BuildChannel = (typeof BUILD_CHANNELS)[number]
 
 export type BuildInfo = {
diff --git a/cli/scripts/release-naming.mjs b/cli/scripts/release-naming.mjs
index 5d7457b59b0..376c215633e 100644
--- a/cli/scripts/release-naming.mjs
+++ b/cli/scripts/release-naming.mjs
@@ -26,6 +26,7 @@ const SEMVER_CORE_LEN = 3
 // Add channels here: { name, prerelease, versionForm }.
 const CHANNELS = [
   { name: 'stable', prerelease: false, versionForm: /^\d+\.\d+\.\d+(\+[0-9A-Z.-]+)?$/i },
+  { name: 'alpha', prerelease: true, versionForm: /^\d+\.\d+\.\d+-alpha(\.\d+)?$/ },
   { name: 'rc', prerelease: true, versionForm: /^\d+\.\d+\.\d+-rc\.\d+$/ },
   { name: 'edge', prerelease: true, versionForm: /^\d+\.\d+\.\d+-edge\.[0-9a-f]{7,40}$/ },
 ]
diff --git a/cli/scripts/release-naming.test.ts b/cli/scripts/release-naming.test.ts
index ad2a699ef8d..559d15ad759 100644
--- a/cli/scripts/release-naming.test.ts
+++ b/cli/scripts/release-naming.test.ts
@@ -15,13 +15,13 @@ function run(args: string[]): { code: number, stdout: string, stderr: string } {
   }
 }
 
-describe('release-naming compat-check (compat 1.14.0..1.15.0)', () => {
+describe('release-naming compat-check (compat 1.15.0..1.15.0)', () => {
   it('accepts a version inside the window', () => {
-    expect(run(['compat-check', '1.14.7']).code).toBe(0)
+    expect(run(['compat-check', '1.15.0']).code).toBe(0)
   })
 
   it('accepts the inclusive lower bound', () => {
-    expect(run(['compat-check', '1.14.0']).code).toBe(0)
+    expect(run(['compat-check', '1.15.0']).code).toBe(0)
   })
 
   it('accepts the inclusive upper bound', () => {
@@ -29,26 +29,22 @@ describe('release-naming compat-check (compat 1.14.0..1.15.0)', () => {
   })
 
   it('accepts a v-prefixed tag', () => {
-    expect(run(['compat-check', 'v1.14.2']).code).toBe(0)
+    expect(run(['compat-check', 'v1.15.0']).code).toBe(0)
   })
 
   it('rejects a version below the lower bound', () => {
-    expect(run(['compat-check', '1.13.9']).code).not.toBe(0)
+    expect(run(['compat-check', '1.14.9']).code).not.toBe(0)
   })
 
   it('rejects a version above the upper bound', () => {
     expect(run(['compat-check', '1.15.1']).code).not.toBe(0)
   })
 
-  it('treats a prerelease of the upper bound as in range (1.15.0-rc1 <= 1.15.0)', () => {
-    expect(run(['compat-check', '1.15.0-rc1']).code).toBe(0)
+  it('treats a prerelease of the bound as below it (1.15.0-rc1 < 1.15.0)', () => {
+    expect(run(['compat-check', '1.15.0-rc1']).code).not.toBe(0)
   })
 
-  it('treats a prerelease of the lower bound as below it (1.14.0-rc1 < 1.14.0)', () => {
-    expect(run(['compat-check', '1.14.0-rc1']).code).not.toBe(0)
-  })
-
-  it('ignores build metadata on the upper bound (1.15.0+build == 1.15.0)', () => {
+  it('ignores build metadata on the bound (1.15.0+build == 1.15.0)', () => {
     expect(run(['compat-check', '1.15.0+build123']).code).toBe(0)
   })
 
@@ -64,7 +60,7 @@ describe('release-naming compat-check (compat 1.14.0..1.15.0)', () => {
 describe('release-naming github-env', () => {
   it('emits difyctlTag = tagPrefix + version', () => {
     const { stdout } = run(['github-env'])
-    expect(stdout).toMatch(/^difyctlTag=difyctl-v0\.1\.0-rc\.1$/m)
+    expect(stdout).toMatch(/^difyctlTag=difyctl-v0\.1\.0-alpha$/m)
   })
 
   it('still emits the existing trace fields', () => {
@@ -79,8 +75,8 @@ describe('release-naming edge channel', () => {
     expect(run(['channels']).stdout).toMatch(/^edge$/m)
   })
 
-  it('edge-version derives <pkgcore>-edge.<sha> stripping the rc prerelease', () => {
-    // package.json version is 0.1.0-rc.1 -> core 0.1.0
+  it('edge-version derives <pkgcore>-edge.<sha> stripping the alpha prerelease', () => {
+    // package.json version is 0.1.0-alpha -> core 0.1.0
     expect(run(['edge-version', '2fd7b82']).stdout.trim()).toBe('0.1.0-edge.2fd7b82')
   })
 
diff --git a/cli/scripts/release-r2-edge.test.ts b/cli/scripts/release-r2-edge.test.ts
index 1514c6a28e3..12e3ee1822c 100644
--- a/cli/scripts/release-r2-edge.test.ts
+++ b/cli/scripts/release-r2-edge.test.ts
@@ -81,7 +81,7 @@ describe('release-r2-edge manifest', () => {
 
   it('carries the compat window from package.json', () => {
     const { json } = buildManifest()
-    expect(json.compat).toEqual({ minDify: '1.14.0', maxDify: '1.15.0' })
+    expect(json.compat).toEqual({ minDify: '1.15.0', maxDify: '1.15.0' })
   })
 
   it('lists all 5 targets with asset name + sha256 from the checksums file', () => {
diff --git a/cli/src/api/app-meta.ts b/cli/src/api/app-meta.ts
index c2ca9a5aa9b..03ae59bd392 100644
--- a/cli/src/api/app-meta.ts
+++ b/cli/src/api/app-meta.ts
@@ -1,17 +1,17 @@
-import type { AppsClient } from './apps'
+import type { AppReader } from './app-reader'
 import type { AppInfoCache } from '@/cache/app-info'
 import type { AppMeta, AppMetaFieldKey } from '@/types/app-meta'
 import { covers, fromDescribe, mergeMeta } from '@/types/app-meta'
 
 export type AppMetaClientOptions = {
-  readonly apps: AppsClient
+  readonly apps: AppReader
   readonly host: string
   readonly cache?: AppInfoCache
   readonly now?: () => Date
 }
 
 export class AppMetaClient {
-  private readonly apps: AppsClient
+  private readonly apps: AppReader
   private readonly host: string
   private readonly cache: AppInfoCache | undefined
   private readonly now: () => Date
diff --git a/cli/src/api/app-reader.test.ts b/cli/src/api/app-reader.test.ts
new file mode 100644
index 00000000000..ff584c85c49
--- /dev/null
+++ b/cli/src/api/app-reader.test.ts
@@ -0,0 +1,30 @@
+import type { ActiveContext } from '@/auth/hosts'
+import type { HttpClient } from '@/http/types'
+import { describe, expect, it } from 'vitest'
+import { selectAppReader, SubjectKind, subjectOf } from './app-reader'
+import { AppsClient } from './apps'
+import { PermittedExternalAppsClient } from './permitted-external-apps'
+
+const http = { baseURL: 'https://x', request: async () => new Response() } as unknown as HttpClient
+
+function ctx(external: boolean): ActiveContext {
+  return {
+    host: 'h',
+    email: 'e',
+    ctx: {
+      account: { id: 'a', email: 'e', name: 'n' },
+      external_subject: external ? { email: 'e', issuer: 'i' } : undefined,
+    },
+  }
+}
+
+describe('selectAppReader', () => {
+  it('account login → AppsClient', () => {
+    expect(selectAppReader(ctx(false), http)).toBeInstanceOf(AppsClient)
+    expect(subjectOf(ctx(false))).toBe(SubjectKind.Account)
+  })
+  it('external_subject present → PermittedExternalAppsClient', () => {
+    expect(selectAppReader(ctx(true), http)).toBeInstanceOf(PermittedExternalAppsClient)
+    expect(subjectOf(ctx(true))).toBe(SubjectKind.External)
+  })
+})
diff --git a/cli/src/api/app-reader.ts b/cli/src/api/app-reader.ts
new file mode 100644
index 00000000000..fe41e35bfe9
--- /dev/null
+++ b/cli/src/api/app-reader.ts
@@ -0,0 +1,35 @@
+import type { AppDescribeResponse, AppListResponse } from '@dify/contracts/api/openapi/types.gen'
+import type { ListQuery } from './apps'
+import type { ActiveContext } from '@/auth/hosts'
+import type { HttpClient } from '@/http/types'
+import { AppsClient } from './apps'
+import { PermittedExternalAppsClient } from './permitted-external-apps'
+
+export type AppReader = {
+  list: (q: ListQuery) => Promise<AppListResponse>
+  describe: (appId: string, fields?: readonly string[]) => Promise<AppDescribeResponse>
+}
+
+// The auth subject behind an openapi bearer token. Each kind reads apps from its own surface.
+export const SubjectKind = {
+  Account: 'account',
+  External: 'external',
+} as const
+
+export type SubjectKindValue = (typeof SubjectKind)[keyof typeof SubjectKind]
+
+export function subjectOf(active: ActiveContext): SubjectKindValue {
+  return active.ctx.external_subject !== undefined ? SubjectKind.External : SubjectKind.Account
+}
+
+type AppReaderFactory = (http: HttpClient) => AppReader
+
+// Maps each auth subject to the app reader for its surface.
+const APP_READER_BY_SUBJECT: Readonly<Record<SubjectKindValue, AppReaderFactory>> = {
+  [SubjectKind.Account]: http => new AppsClient(http),
+  [SubjectKind.External]: http => new PermittedExternalAppsClient(http),
+}
+
+export function selectAppReader(active: ActiveContext, http: HttpClient): AppReader {
+  return APP_READER_BY_SUBJECT[subjectOf(active)](http)
+}
diff --git a/cli/src/api/apps.test.ts b/cli/src/api/apps.test.ts
index 68e7bcc86a3..861f60feb26 100644
--- a/cli/src/api/apps.test.ts
+++ b/cli/src/api/apps.test.ts
@@ -36,7 +36,6 @@ describe('AppsClient.list', () => {
     // Optional filters are omitted entirely when not supplied.
     expect(q.has('mode')).toBe(false)
     expect(q.has('name')).toBe(false)
-    expect(q.has('tag')).toBe(false)
   })
 
   it('forwards explicit pagination and filters', async () => {
@@ -48,7 +47,6 @@ describe('AppsClient.list', () => {
       limit: 50,
       mode: 'chat',
       name: 'support bot',
-      tag: 'prod',
     })
 
     const q = queryOf(stub.captured.url)
@@ -56,18 +54,16 @@ describe('AppsClient.list', () => {
     expect(q.get('limit')).toBe('50')
     expect(q.get('mode')).toBe('chat')
     expect(q.get('name')).toBe('support bot')
-    expect(q.get('tag')).toBe('prod')
   })
 
   it('treats empty-string filters as absent (not blank query params)', async () => {
     stub = await startStubServer(cap => jsonResponder(200, LIST_BODY, cap))
 
-    await makeClient(stub.url).list({ workspaceId: 'ws-1', mode: '', name: '', tag: '' })
+    await makeClient(stub.url).list({ workspaceId: 'ws-1', mode: '', name: '' })
 
     const q = queryOf(stub.captured.url)
     expect(q.has('mode')).toBe(false)
     expect(q.has('name')).toBe(false)
-    expect(q.has('tag')).toBe(false)
   })
 
   it('propagates server 403 as a classified BaseError', async () => {
diff --git a/cli/src/api/apps.ts b/cli/src/api/apps.ts
index ea0e41c252f..1189fdeaa06 100644
--- a/cli/src/api/apps.ts
+++ b/cli/src/api/apps.ts
@@ -1,4 +1,5 @@
-import type { AppDescribeResponse, AppListResponse, AppMode } from '@dify/contracts/api/openapi/types.gen'
+import type { AppDescribeResponse, AppListResponse, SupportedAppType } from '@dify/contracts/api/openapi/types.gen'
+import type { AppReader } from './app-reader'
 import type { OpenApiClient } from '@/http/orpc'
 import type { HttpClient } from '@/http/types'
 import { createOpenApiClient } from '@/http/orpc'
@@ -7,12 +8,16 @@ export type ListQuery = {
   readonly workspaceId: string
   readonly page?: number
   readonly limit?: number
-  readonly mode?: AppMode | ''
+  readonly mode?: SupportedAppType | ''
   readonly name?: string
-  readonly tag?: string
 }
 
-export class AppsClient {
+// An absent or empty mode filter means "any mode" — collapse both to undefined for the query.
+export function normalizeMode(mode: SupportedAppType | '' | undefined): SupportedAppType | undefined {
+  return mode !== undefined && mode !== '' ? mode : undefined
+}
+
+export class AppsClient implements AppReader {
   private readonly orpc: OpenApiClient
 
   constructor(http: HttpClient) {
@@ -25,9 +30,8 @@ export class AppsClient {
         workspace_id: q.workspaceId,
         page: q.page ?? 1,
         limit: q.limit ?? 20,
-        mode: q.mode !== undefined && q.mode !== '' ? q.mode : undefined,
+        mode: normalizeMode(q.mode),
         name: q.name !== undefined && q.name !== '' ? q.name : undefined,
-        tag: q.tag !== undefined && q.tag !== '' ? q.tag : undefined,
       },
     })
   }
diff --git a/cli/src/api/permitted-external-apps.test.ts b/cli/src/api/permitted-external-apps.test.ts
new file mode 100644
index 00000000000..f6fa38cb3eb
--- /dev/null
+++ b/cli/src/api/permitted-external-apps.test.ts
@@ -0,0 +1,27 @@
+import type { HttpClient } from '@/http/types'
+import { describe, expect, it, vi } from 'vitest'
+import { PermittedExternalAppsClient } from './permitted-external-apps'
+
+function fakeHttp() {
+  return { baseURL: 'https://x', request: vi.fn() } as unknown as HttpClient
+}
+
+type WithOrpc = { orpc: unknown }
+
+describe('PermittedExternalAppsClient', () => {
+  it('list calls permittedExternalApps.get with paging/filter query', async () => {
+    const c = new PermittedExternalAppsClient(fakeHttp())
+    const get = vi.fn().mockResolvedValue({ page: 1, limit: 20, total: 0, has_more: false, data: [] })
+    ;(c as unknown as WithOrpc).orpc = { permittedExternalApps: { get, byAppId: { describe: { get: vi.fn() } } } }
+    await c.list({ workspaceId: '', page: 2, limit: 5, mode: undefined, name: 'a' })
+    expect(get).toHaveBeenCalledWith({ query: { page: 2, limit: 5, mode: undefined, name: 'a' } })
+  })
+
+  it('describe calls permittedExternalApps.byAppId.describe.get with app_id + fields', async () => {
+    const c = new PermittedExternalAppsClient(fakeHttp())
+    const dget = vi.fn().mockResolvedValue({ info: null, parameters: null, input_schema: null })
+    ;(c as unknown as WithOrpc).orpc = { permittedExternalApps: { get: vi.fn(), byAppId: { describe: { get: dget } } } }
+    await c.describe('app-1', ['info'])
+    expect(dget).toHaveBeenCalledWith({ params: { app_id: 'app-1' }, query: { fields: 'info' } })
+  })
+})
diff --git a/cli/src/api/permitted-external-apps.ts b/cli/src/api/permitted-external-apps.ts
new file mode 100644
index 00000000000..497c398d0ba
--- /dev/null
+++ b/cli/src/api/permitted-external-apps.ts
@@ -0,0 +1,34 @@
+import type { AppDescribeResponse, AppListResponse } from '@dify/contracts/api/openapi/types.gen'
+import type { AppReader } from './app-reader'
+import type { ListQuery } from './apps'
+import type { OpenApiClient } from '@/http/orpc'
+import type { HttpClient } from '@/http/types'
+import { createOpenApiClient } from '@/http/orpc'
+import { normalizeMode } from './apps'
+
+export class PermittedExternalAppsClient implements AppReader {
+  private readonly orpc: OpenApiClient
+
+  constructor(http: HttpClient) {
+    this.orpc = createOpenApiClient(http)
+  }
+
+  // workspaceId is ignored: the external grant is not workspace-scoped.
+  async list(q: ListQuery): Promise<AppListResponse> {
+    return this.orpc.permittedExternalApps.get({
+      query: {
+        page: q.page ?? 1,
+        limit: q.limit ?? 20,
+        mode: normalizeMode(q.mode),
+        name: q.name !== undefined && q.name !== '' ? q.name : undefined,
+      },
+    })
+  }
+
+  async describe(appId: string, fields?: readonly string[]): Promise<AppDescribeResponse> {
+    return this.orpc.permittedExternalApps.byAppId.describe.get({
+      params: { app_id: appId },
+      query: { fields: fields !== undefined && fields.length > 0 ? fields.join(',') : undefined },
+    })
+  }
+}
diff --git a/cli/src/cache/app-info.test.ts b/cli/src/cache/app-info.test.ts
index 50ac1c67d35..ae6f15f249d 100644
--- a/cli/src/cache/app-info.test.ts
+++ b/cli/src/cache/app-info.test.ts
@@ -21,8 +21,6 @@ function metaInfoOnly(): AppMeta {
       name: 'Greeter',
       description: '',
       mode: 'chat',
-      author: 'tester',
-      tags: [],
       updated_at: undefined,
       service_api_enabled: false,
       is_agent: false,
diff --git a/cli/src/commands/agent-guides.test.ts b/cli/src/commands/agent-guides.test.ts
index e1bcb0925aa..3ad18f540f1 100644
--- a/cli/src/commands/agent-guides.test.ts
+++ b/cli/src/commands/agent-guides.test.ts
@@ -2,7 +2,9 @@ import type { CommandConstructor } from '@/framework/command'
 import { describe, expect, it } from 'vitest'
 import Login from '@/commands/auth/login/index'
 import DescribeApp from '@/commands/describe/app/index'
+import ExportStudioApp from '@/commands/export/studio-app/index'
 import GetApp from '@/commands/get/app/index'
+import ImportStudioApp from '@/commands/import/studio-app/index'
 import ResumeApp from '@/commands/resume/app/index'
 import RunApp from '@/commands/run/app/index'
 
@@ -13,6 +15,8 @@ const GUIDED_COMMANDS: ReadonlyArray<readonly [string, CommandConstructor]> = [
   ['resume app', ResumeApp],
   ['describe app', DescribeApp],
   ['get app', GetApp],
+  ['export studio-app', ExportStudioApp],
+  ['import studio-app', ImportStudioApp],
   ['auth login', Login],
 ]
 
diff --git a/cli/src/commands/auth/devices/_shared/devices.test.ts b/cli/src/commands/auth/devices/_shared/devices.test.ts
index fb510ef1af1..0b64ac8b14e 100644
--- a/cli/src/commands/auth/devices/_shared/devices.test.ts
+++ b/cli/src/commands/auth/devices/_shared/devices.test.ts
@@ -146,6 +146,43 @@ describe('runDevicesRevoke', () => {
     expect(saved?.hosts[mock.url]).toBeUndefined()
   })
 
+  it('TTY without --yes: prompts and aborts on decline (no revoke)', async () => {
+    const base = bufferStreams('n\n')
+    const io = { ...base, isErrTTY: true }
+    const store = new MemStore()
+    const { reg, active } = buildRegistry(mock.url, 'tester@dify.ai', 'tok-1')
+    const http = testHttpClient(mock.url, 'dfoa_test')
+
+    await expect(runDevicesRevoke({ io, reg, active, store, http, all: true }))
+      .rejects
+      .toThrow(/aborted by user/)
+    expect(base.errBuf()).toContain('Revoke 2 session(s)? [y/N]')
+    expect(base.outBuf()).not.toContain('Revoked')
+  })
+
+  it('TTY without --yes: proceeds on accept', async () => {
+    const base = bufferStreams('y\n')
+    const io = { ...base, isErrTTY: true }
+    const store = new MemStore()
+    const { reg, active } = buildRegistry(mock.url, 'tester@dify.ai', 'tok-1')
+    const http = testHttpClient(mock.url, 'dfoa_test')
+
+    await runDevicesRevoke({ io, reg, active, store, http, target: 'tok-2', all: false })
+    expect(base.outBuf()).toContain('Revoked 1 session(s)')
+  })
+
+  it('TTY with --yes: skips prompt entirely', async () => {
+    const base = bufferStreams()
+    const io = { ...base, isErrTTY: true }
+    const store = new MemStore()
+    const { reg, active } = buildRegistry(mock.url, 'tester@dify.ai', 'tok-1')
+    const http = testHttpClient(mock.url, 'dfoa_test')
+
+    await runDevicesRevoke({ io, reg, active, store, http, target: 'tok-2', all: false, yes: true })
+    expect(base.errBuf()).not.toContain('[y/N]')
+    expect(base.outBuf()).toContain('Revoked 1 session(s)')
+  })
+
   it('no target + no --all: throws UsageMissingArg', async () => {
     const io = bufferStreams()
     const store = new MemStore()
diff --git a/cli/src/commands/auth/devices/_shared/devices.ts b/cli/src/commands/auth/devices/_shared/devices.ts
index 15f17e0a3e3..b328e59f93f 100644
--- a/cli/src/commands/auth/devices/_shared/devices.ts
+++ b/cli/src/commands/auth/devices/_shared/devices.ts
@@ -8,6 +8,7 @@ import { BaseError } from '@/errors/base'
 import { ErrorCode } from '@/errors/codes'
 import { LIMIT_DEFAULT, LIMIT_MAX, parseLimit } from '@/limit/limit'
 import { colorEnabled, colorScheme } from '@/sys/io/color'
+import { promptConfirm } from '@/sys/io/prompt'
 import { runWithSpinner } from '@/sys/io/spinner'
 
 export type DevicesListOptions = {
@@ -96,6 +97,17 @@ export async function runDevicesRevoke(opts: DevicesRevokeOptions): Promise<void
     return
   }
 
+  if (opts.yes !== true && opts.io.isErrTTY) {
+    const confirmed = await promptConfirm(opts.io, `Revoke ${ids.length} session(s)? [y/N] `)
+    if (!confirmed) {
+      throw new BaseError({
+        code: ErrorCode.UsageMissingArg,
+        message: 'aborted by user',
+        hint: 'pass --yes to skip confirmation',
+      })
+    }
+  }
+
   for (const id of ids)
     await sessions.revoke(id)
 
diff --git a/cli/src/commands/auth/devices/revoke/index.ts b/cli/src/commands/auth/devices/revoke/index.ts
index b08bdb376bd..03f5d2294b9 100644
--- a/cli/src/commands/auth/devices/revoke/index.ts
+++ b/cli/src/commands/auth/devices/revoke/index.ts
@@ -21,7 +21,7 @@ export default class DevicesRevoke extends DifyCommand {
   static override flags = {
     'all': Flags.boolean({ description: 'revoke every session except the current one', default: false }),
     'http-retry': httpRetryFlag,
-    'yes': Flags.boolean({ description: 'skip confirmation prompt', default: false }),
+    'yes': Flags.boolean({ char: 'y', description: 'skip confirmation prompt', default: false }),
   }
 
   async run(argv: string[]): Promise<void> {
diff --git a/cli/src/commands/delete/member/run.ts b/cli/src/commands/delete/member/run.ts
index 07ec3ad7720..f11e3ee4b93 100644
--- a/cli/src/commands/delete/member/run.ts
+++ b/cli/src/commands/delete/member/run.ts
@@ -1,11 +1,11 @@
 import type { ActiveContext } from '@/auth/hosts'
 import type { HttpClient } from '@/http/types'
 import type { IOStreams } from '@/sys/io/streams'
-import * as readline from 'node:readline'
 import { MembersClient } from '@/api/members'
 import { BaseError } from '@/errors/base'
 import { ErrorCode } from '@/errors/codes'
 import { colorEnabled, colorScheme } from '@/sys/io/color'
+import { promptConfirm } from '@/sys/io/prompt'
 import { runWithSpinner } from '@/sys/io/spinner'
 import { nullStreams } from '@/sys/io/streams'
 import { resolveWorkspaceId } from '@/workspace/resolver'
@@ -76,15 +76,3 @@ export async function runDeleteMember(
     workspaceId: wsId,
   }
 }
-
-async function promptConfirm(io: IOStreams, message: string): Promise<boolean> {
-  io.err.write(message)
-  const rl = readline.createInterface({ input: io.in, output: io.err, terminal: false })
-  try {
-    const line: string = await new Promise(resolve => rl.once('line', resolve))
-    return line.trim().toLowerCase() === 'y'
-  }
-  finally {
-    rl.close()
-  }
-}
diff --git a/cli/src/commands/describe/app/handlers.ts b/cli/src/commands/describe/app/handlers.ts
index 6b934c87148..133260e6509 100644
--- a/cli/src/commands/describe/app/handlers.ts
+++ b/cli/src/commands/describe/app/handlers.ts
@@ -1,4 +1,4 @@
-import type { AppDescribeInfo, TagItem } from '@dify/contracts/api/openapi/types.gen'
+import type { AppDescribeInfo } from '@dify/contracts/api/openapi/types.gen'
 import type { AppMeta } from '@/types/app-meta'
 
 export const APP_DESCRIBE_MODE_KEY = 'app-describe'
@@ -28,10 +28,8 @@ export class AppDescribeOutput {
         ['Name', info.name],
         ['ID', info.id],
         ['Mode', info.mode],
-        ['Author', info.author ?? ''],
         ['Updated', info.updated_at ?? ''],
         ['Service API', info.service_api_enabled ? 'true' : 'false'],
-        ['Tags', joinTags(info.tags ?? [])],
       ]
       if (info.description !== '' && info.description !== undefined)
         rows.push(['Description', info.description ?? ''])
@@ -55,12 +53,6 @@ export class AppDescribeOutput {
   }
 }
 
-function joinTags(tags: readonly TagItem[]): string {
-  if (tags.length === 0)
-    return '<none>'
-  return tags.map(t => t.name).join(',')
-}
-
 function alignedRows(rows: readonly [string, string][]): string[] {
   const widest = rows.reduce((m, [k]) => Math.max(m, k.length), 0)
   return rows.map(([k, v]) => `${`${k}:`.padEnd(widest + 2)}${v}`)
diff --git a/cli/src/commands/describe/app/run.test.ts b/cli/src/commands/describe/app/run.test.ts
index 4ed7cedc7a5..96dfae5acb5 100644
--- a/cli/src/commands/describe/app/run.test.ts
+++ b/cli/src/commands/describe/app/run.test.ts
@@ -5,7 +5,7 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { startMock } from '@test/fixtures/dify-mock/server'
 import { testHttpClient } from '@test/fixtures/http-client'
-import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { loadAppInfoCache } from '@/cache/app-info'
 import { formatted, stringifyOutput } from '@/framework/output'
 import { ENV_CACHE_DIR } from '@/store/dir'
@@ -34,6 +34,7 @@ describe('runDescribeApp', () => {
     process.env[ENV_CACHE_DIR] = dir
   })
   afterEach(async () => {
+    vi.restoreAllMocks()
     if (prevCacheDir === undefined)
       delete process.env[ENV_CACHE_DIR]
     else
@@ -60,8 +61,6 @@ describe('runDescribeApp', () => {
     expect(out).toContain('Mode:')
     expect(out).toContain('chat')
     expect(out).toContain('Service API:')
-    expect(out).toContain('Tags:')
-    expect(out).toContain('demo')
     expect(out).toContain('Description:')
     expect(out).toContain('Parameters:')
   })
@@ -115,4 +114,13 @@ describe('runDescribeApp', () => {
       },
     )).rejects.toThrow()
   })
+
+  it('external login resolves describe via the permitted-external route', async () => {
+    const activeExt: ActiveContext = { host: mock.url, email: 'e', ctx: { account: { id: 'a', email: 'e', name: 'n' }, external_subject: { email: 'e', issuer: 'i' } } }
+    const out = await runDescribeApp(
+      { appId: 'app-1' },
+      { active: activeExt, http: testHttpClient(mock.url, 'dfoe_test'), host: mock.url },
+    )
+    expect(out.payload.info?.id).toBe('app-1')
+  })
 })
diff --git a/cli/src/commands/describe/app/run.ts b/cli/src/commands/describe/app/run.ts
index 8af2a5dc441..0d5eea784d4 100644
--- a/cli/src/commands/describe/app/run.ts
+++ b/cli/src/commands/describe/app/run.ts
@@ -3,7 +3,7 @@ import type { AppInfoCache } from '@/cache/app-info'
 import type { HttpClient } from '@/http/types'
 import type { IOStreams } from '@/sys/io/streams'
 import { AppMetaClient } from '@/api/app-meta'
-import { AppsClient } from '@/api/apps'
+import { selectAppReader } from '@/api/app-reader'
 import { runWithSpinner } from '@/sys/io/spinner'
 import { nullStreams } from '@/sys/io/streams'
 import { FieldInfo, FieldInputSchema, FieldParameters } from '@/types/app-meta'
@@ -26,7 +26,7 @@ export type DescribeAppDeps = {
 }
 
 export async function runDescribeApp(opts: DescribeAppOptions, deps: DescribeAppDeps): Promise<AppDescribeOutput> {
-  const apps = new AppsClient(deps.http)
+  const apps = selectAppReader(deps.active, deps.http)
   const meta = new AppMetaClient({ apps, host: deps.host, cache: deps.cache })
   const io = deps.io ?? nullStreams()
   const result = await runWithSpinner(
diff --git a/cli/src/commands/export/studio-app/guide.ts b/cli/src/commands/export/studio-app/guide.ts
new file mode 100644
index 00000000000..d41b502b191
--- /dev/null
+++ b/cli/src/commands/export/studio-app/guide.ts
@@ -0,0 +1,12 @@
+export const agentGuide = `
+WHEN TO USE
+  A studio app is what you build and edit in Studio on the web console,
+  inside a workspace — the app's source definition, not the published app
+  that 'run app' invokes. Export pulls that definition as YAML to back it
+  up, diff it, or recreate the app elsewhere with 'import studio-app'. To
+  run or inspect an app instead, use the 'app' noun.
+
+ERROR RECOVERY
+  app not found (404)      difyctl get app
+  not logged in (exit 4)   difyctl auth login
+`
diff --git a/cli/src/commands/export/app/index.ts b/cli/src/commands/export/studio-app/index.ts
similarity index 71%
rename from cli/src/commands/export/app/index.ts
rename to cli/src/commands/export/studio-app/index.ts
index 7afd0234982..69bdcf09aa3 100644
--- a/cli/src/commands/export/app/index.ts
+++ b/cli/src/commands/export/studio-app/index.ts
@@ -1,16 +1,17 @@
 import { DifyCommand } from '@/commands/_shared/dify-command'
 import { httpRetryFlag } from '@/commands/_shared/global-flags'
 import { Args, Flags } from '@/framework/flags'
+import { agentGuide } from './guide'
 import { runExportApp } from './run'
 
-export default class ExportApp extends DifyCommand {
-  static override description = 'Export an app\'s DSL configuration as YAML'
+export default class ExportStudioApp extends DifyCommand {
+  static override description = 'Export a studio app\'s DSL configuration as YAML'
 
   static override examples = [
-    '<%= config.bin %> export app <app-id>',
-    '<%= config.bin %> export app <app-id> --output ./my-app.yaml',
-    '<%= config.bin %> export app <app-id> --include-secret',
-    '<%= config.bin %> export app <app-id> --workflow-id <workflow-id>',
+    '<%= config.bin %> export studio-app <app-id>',
+    '<%= config.bin %> export studio-app <app-id> --output ./my-app.yaml',
+    '<%= config.bin %> export studio-app <app-id> --include-secret',
+    '<%= config.bin %> export studio-app <app-id> --workflow-id <workflow-id>',
   ]
 
   static override args = {
@@ -26,7 +27,7 @@ export default class ExportApp extends DifyCommand {
   }
 
   async run(argv: string[]) {
-    const { args, flags } = this.parse(ExportApp, argv)
+    const { args, flags } = this.parse(ExportStudioApp, argv)
     const ctx = await this.authedCtx({ retryFlag: flags['http-retry'] })
     const result = await runExportApp({
       appId: args.id,
@@ -42,4 +43,8 @@ export default class ExportApp extends DifyCommand {
         ctx.io.out.write('\n')
     }
   }
+
+  override agentGuide(): string {
+    return agentGuide
+  }
 }
diff --git a/cli/src/commands/export/app/run.test.ts b/cli/src/commands/export/studio-app/run.test.ts
similarity index 100%
rename from cli/src/commands/export/app/run.test.ts
rename to cli/src/commands/export/studio-app/run.test.ts
diff --git a/cli/src/commands/export/app/run.ts b/cli/src/commands/export/studio-app/run.ts
similarity index 89%
rename from cli/src/commands/export/app/run.ts
rename to cli/src/commands/export/studio-app/run.ts
index 93abe2f8b46..351a2fc349f 100644
--- a/cli/src/commands/export/app/run.ts
+++ b/cli/src/commands/export/studio-app/run.ts
@@ -35,9 +35,8 @@ export async function runExportApp(opts: ExportAppOptions, deps: ExportAppDeps):
   const io = deps.io ?? nullStreams()
   const dslFactory = deps.dslFactory ?? ((h: HttpClient) => new AppDslClient(h))
 
-  // workspace is needed to satisfy the auth pipeline; resolving it here
-  // mirrors what other commands do even though the export endpoint does not
-  // take workspace_id as a query parameter (it loads tenant from app).
+  // workspace is resolved to satisfy the auth pipeline; the export endpoint itself
+  // takes no workspace_id query parameter (it loads tenant from the app).
   resolveWorkspaceId({ flag: opts.workspace, env: env('DIFY_WORKSPACE_ID'), active: deps.active })
 
   const client = dslFactory(deps.http)
diff --git a/cli/src/commands/get/app/handlers.ts b/cli/src/commands/get/app/handlers.ts
index ac7008fa537..9c91057d26d 100644
--- a/cli/src/commands/get/app/handlers.ts
+++ b/cli/src/commands/get/app/handlers.ts
@@ -1,4 +1,4 @@
-import type { AppListResponse, AppListRow, TagItem } from '@dify/contracts/api/openapi/types.gen'
+import type { AppListResponse, AppListRow } from '@dify/contracts/api/openapi/types.gen'
 import type { TableCell, TableColumn } from '@/framework/output'
 
 export const APP_MODE_KEY = 'app'
@@ -7,9 +7,7 @@ export const APP_COLUMNS: readonly TableColumn[] = [
   { name: 'NAME', priority: 0 },
   { name: 'ID', priority: 0 },
   { name: 'MODE', priority: 0 },
-  { name: 'TAGS', priority: 0 },
   { name: 'UPDATED', priority: 0 },
-  { name: 'AUTHOR', priority: 1 },
   { name: 'WORKSPACE', priority: 1 },
 ]
 
@@ -25,9 +23,7 @@ export class AppRow {
       this.data.name,
       this.data.id,
       this.data.mode,
-      joinTags(this.data.tags ?? []),
       this.data.updated_at ?? '',
-      this.data.created_by_name ?? '',
       this.data.workspace_name ?? '',
     ]
   }
@@ -70,7 +66,3 @@ export class AppListOutput {
     return this.envelope
   }
 }
-
-function joinTags(tags: readonly TagItem[]): string {
-  return tags.map(t => t.name).join(',')
-}
diff --git a/cli/src/commands/get/app/index.ts b/cli/src/commands/get/app/index.ts
index 47594813704..4deed4ade9f 100644
--- a/cli/src/commands/get/app/index.ts
+++ b/cli/src/commands/get/app/index.ts
@@ -1,4 +1,5 @@
-import type { AppMode } from '@dify/contracts/api/openapi/types.gen'
+import type { SupportedAppType } from '@dify/contracts/api/openapi/types.gen'
+import { zSupportedAppType } from '@dify/contracts/api/openapi/zod.gen'
 import { DifyCommand } from '@/commands/_shared/dify-command'
 import { httpRetryFlag } from '@/commands/_shared/global-flags'
 import { Args, Flags } from '@/framework/flags'
@@ -6,16 +7,9 @@ import { OutputFormat, table } from '@/framework/output'
 import { agentGuide } from './guide'
 import { runGetApp } from './run'
 
-const APP_MODE_VALUES: readonly AppMode[] = [
-  'advanced-chat',
-  'agent',
-  'agent-chat',
-  'channel',
-  'chat',
-  'completion',
-  'rag-pipeline',
-  'workflow',
-]
+// Single source: derived from the backend's listable app types (openapi codegen).
+// Adding/removing a listable type is a backend-only change that flows here on regen.
+const APP_MODE_VALUES: readonly SupportedAppType[] = zSupportedAppType.options
 
 export default class GetApp extends DifyCommand {
   static override description = 'List apps or describe one app\'s basic info'
@@ -42,7 +36,6 @@ export default class GetApp extends DifyCommand {
     'limit': Flags.string({ description: 'page size [1..200]' }),
     'mode': Flags.string({ description: 'filter by app mode', options: APP_MODE_VALUES }),
     'name': Flags.string({ description: 'filter by app name (server-side substring)' }),
-    'tag': Flags.string({ description: 'filter by tag name (server-side exact match)' }),
     'http-retry': httpRetryFlag,
     'output': Flags.outputFormat({ options: [OutputFormat.JSON, OutputFormat.YAML, OutputFormat.NAME, OutputFormat.WIDE], default: '' }),
   }
@@ -57,9 +50,8 @@ export default class GetApp extends DifyCommand {
       allWorkspaces: flags['all-workspaces'],
       page: flags.page,
       limitRaw: flags.limit,
-      mode: flags.mode as AppMode | undefined,
+      mode: flags.mode as SupportedAppType | undefined,
       name: flags.name,
-      tag: flags.tag,
       format,
     }, { active: ctx.active, http: ctx.http, io: ctx.io })
     return table({
diff --git a/cli/src/commands/get/app/mode-whitelist.test.ts b/cli/src/commands/get/app/mode-whitelist.test.ts
new file mode 100644
index 00000000000..93ecd86402c
--- /dev/null
+++ b/cli/src/commands/get/app/mode-whitelist.test.ts
@@ -0,0 +1,13 @@
+import { zSupportedAppType } from '@dify/contracts/api/openapi/zod.gen'
+import { describe, expect, it } from 'vitest'
+
+// The `get app --mode` whitelist is derived from this generated enum (see index.ts).
+// These pins guard the original bug: the CLI must not advertise modes the backend
+// rejects (rag-pipeline, channel) or modes that aren't listable here (agent).
+describe('get app --mode whitelist', () => {
+  it('is exactly the listable app types', () => {
+    expect([...zSupportedAppType.options].sort()).toEqual(
+      ['advanced-chat', 'agent-chat', 'chat', 'completion', 'workflow'],
+    )
+  })
+})
diff --git a/cli/src/commands/get/app/run.test.ts b/cli/src/commands/get/app/run.test.ts
index 7c0cc76c009..d517859addd 100644
--- a/cli/src/commands/get/app/run.test.ts
+++ b/cli/src/commands/get/app/run.test.ts
@@ -1,8 +1,9 @@
 import type { DifyMock } from '@test/fixtures/dify-mock/server'
 import type { ActiveContext } from '@/auth/hosts'
+import type { HttpClient } from '@/http/types'
 import { startMock } from '@test/fixtures/dify-mock/server'
 import { testHttpClient } from '@test/fixtures/http-client'
-import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { stringifyOutput, table } from '@/framework/output'
 import { AppListOutput } from './handlers.js'
 import { runGetApp } from './run.js'
@@ -25,6 +26,7 @@ describe('runGetApp', () => {
   })
 
   afterEach(async () => {
+    vi.restoreAllMocks()
     await mock.stop()
   })
 
@@ -40,13 +42,12 @@ describe('runGetApp', () => {
     }))
   }
 
-  it('list (no id, default format) renders table with NAME ID MODE TAGS UPDATED', async () => {
+  it('list (no id, default format) renders table with NAME ID MODE UPDATED', async () => {
     const out = await render()
-    expect(out).toMatch(/^NAME\s+ID\s+MODE\s+TAGS\s+UPDATED/)
+    expect(out).toMatch(/^NAME\s+ID\s+MODE\s+UPDATED/)
     expect(out).toContain('Greeter')
     expect(out).toContain('app-1')
     expect(out).toContain('chat')
-    expect(out).toContain('demo')
     expect(out).toContain('Workflow')
     expect(out).not.toContain('app-3')
   })
@@ -56,9 +57,7 @@ describe('runGetApp', () => {
       'NAME',
       'ID',
       'MODE',
-      'TAGS',
       'UPDATED',
-      'AUTHOR',
       'WORKSPACE',
     ])
   })
@@ -76,12 +75,6 @@ describe('runGetApp', () => {
     expect(out).not.toContain('Greeter')
   })
 
-  it('--tag filters server-side', async () => {
-    const out = await render({ tag: 'demo' })
-    expect(out).toContain('Greeter')
-    expect(out).not.toContain('Workflow')
-  })
-
   it('-A all-workspaces aggregates across workspaces sorted by id', async () => {
     const out = await render({ allWorkspaces: true })
     expect(out).toContain('app-1')
@@ -110,10 +103,9 @@ describe('runGetApp', () => {
     expect(out.trim().split('\n').sort()).toEqual(['app-1', 'app-2'])
   })
 
-  it('-o wide includes AUTHOR and WORKSPACE columns', async () => {
+  it('-o wide includes the WORKSPACE column', async () => {
     const out = await render({ format: 'wide' })
-    expect(out).toMatch(/^NAME\s+ID\s+MODE\s+TAGS\s+UPDATED\s+AUTHOR\s+WORKSPACE/)
-    expect(out).toContain('tester')
+    expect(out).toMatch(/^NAME\s+ID\s+MODE\s+UPDATED\s+WORKSPACE/)
     expect(out).toContain('Default')
   })
 
@@ -138,4 +130,25 @@ describe('runGetApp', () => {
     }
     await expect(runGetApp({}, { active: minimal, http: http() })).rejects.toThrow(/no workspace/)
   })
+
+  it('external login lists via permitted-external client without workspace', async () => {
+    const list = vi.fn().mockResolvedValue({ page: 1, limit: 20, total: 1, has_more: false, data: [{ id: 'x', name: 'X', description: null, mode: 'chat', updated_at: null, workspace_id: 'w', workspace_name: 'W' }] })
+    const { PermittedExternalAppsClient } = await import('@/api/permitted-external-apps')
+    vi.spyOn(PermittedExternalAppsClient.prototype, 'list').mockImplementation(list)
+    const active: ActiveContext = { host: 'h', email: 'e', ctx: { account: { id: 'a', email: 'e', name: 'n' }, external_subject: { email: 'e', issuer: 'i' } } }
+    const http = { baseURL: 'https://x', request: vi.fn() } as unknown as HttpClient
+    const res = await runGetApp({}, { active, http })
+    expect(list).toHaveBeenCalled()
+    const firstCallArg = list.mock.calls[0]![0] as { workspaceId: string }
+    expect(firstCallArg.workspaceId).toBe('')
+    expect(res.data).toBeDefined()
+  })
+
+  it('--all-workspaces throws UsageInvalidFlag for external logins', async () => {
+    const active: ActiveContext = { host: 'h', email: 'e', ctx: { account: { id: 'a', email: 'e', name: 'n' }, external_subject: { email: 'e', issuer: 'i' } } }
+    const httpClient = { baseURL: 'https://x', request: vi.fn() } as unknown as HttpClient
+    await expect(runGetApp({ allWorkspaces: true }, { active, http: httpClient }))
+      .rejects
+      .toThrow(/--all-workspaces is not available for external logins/)
+  })
 })
diff --git a/cli/src/commands/get/app/run.ts b/cli/src/commands/get/app/run.ts
index 102cf066499..9008cfb70c5 100644
--- a/cli/src/commands/get/app/run.ts
+++ b/cli/src/commands/get/app/run.ts
@@ -1,9 +1,12 @@
-import type { AppDescribeResponse, AppListResponse, AppMode } from '@dify/contracts/api/openapi/types.gen'
+import type { AppDescribeResponse, AppListResponse, AppMode, SupportedAppType } from '@dify/contracts/api/openapi/types.gen'
+import type { AppReader } from '@/api/app-reader'
 import type { ActiveContext } from '@/auth/hosts'
 import type { HttpClient } from '@/http/types'
 import type { IOStreams } from '@/sys/io/streams'
-import { AppsClient } from '@/api/apps'
+import { selectAppReader, SubjectKind, subjectOf } from '@/api/app-reader'
 import { WorkspacesClient } from '@/api/workspaces'
+import { newError } from '@/errors/base'
+import { ErrorCode } from '@/errors/codes'
 import { LIMIT_DEFAULT, parseLimit } from '@/limit/limit'
 import { getEnv } from '@/sys/index'
 import { runWithSpinner } from '@/sys/io/spinner'
@@ -17,9 +20,8 @@ export type GetAppOptions = {
   readonly allWorkspaces?: boolean
   readonly page?: number
   readonly limitRaw?: string
-  readonly mode?: AppMode
+  readonly mode?: SupportedAppType
   readonly name?: string
-  readonly tag?: string
   readonly format?: string
 }
 
@@ -28,7 +30,6 @@ export type GetAppDeps = {
   readonly http: HttpClient
   readonly io?: IOStreams
   readonly envLookup?: (k: string) => string | undefined
-  readonly appsFactory?: (http: HttpClient) => AppsClient
   readonly workspacesFactory?: (http: HttpClient) => WorkspacesClient
 }
 
@@ -40,10 +41,10 @@ export type GetAppResult = {
 
 export async function runGetApp(opts: GetAppOptions, deps: GetAppDeps): Promise<GetAppResult> {
   const env = deps.envLookup ?? getEnv
-  const appsFactory = deps.appsFactory ?? ((h: HttpClient) => new AppsClient(h))
   const wsFactory = deps.workspacesFactory ?? ((h: HttpClient) => new WorkspacesClient(h))
 
-  const apps = appsFactory(deps.http)
+  const external = subjectOf(deps.active) === SubjectKind.External
+  const apps = selectAppReader(deps.active, deps.http)
   const pageSize = resolveLimit(opts.limitRaw, env)
   const page = opts.page === undefined || opts.page <= 0 ? 1 : opts.page
   const label = opts.appId !== undefined && opts.appId !== '' ? 'Fetching app' : 'Fetching apps'
@@ -53,15 +54,20 @@ export async function runGetApp(opts: GetAppOptions, deps: GetAppDeps): Promise<
     { io, label },
     async (): Promise<AppListResponse> => {
       if (opts.allWorkspaces === true) {
+        if (external)
+          throw newError(ErrorCode.UsageInvalidFlag, '--all-workspaces is not available for external logins')
         const ws = wsFactory(deps.http)
         return runAllWorkspaces(apps, ws, opts, page, pageSize)
       }
       if (opts.appId !== undefined && opts.appId !== '') {
-        const wsId = resolveWorkspaceId({ flag: opts.workspace, env: env('DIFY_WORKSPACE_ID'), active: deps.active })
-        const wsName = workspaceNameForId(deps.active, wsId)
+        const wsId = external ? '' : resolveWorkspaceId({ flag: opts.workspace, env: env('DIFY_WORKSPACE_ID'), active: deps.active })
+        const wsName = external ? '' : workspaceNameForId(deps.active, wsId)
         const desc = await apps.describe(opts.appId, ['info'])
         return describeToEnvelope(desc, wsId, wsName)
       }
+      if (external) {
+        return apps.list({ workspaceId: '', page, limit: pageSize, mode: opts.mode, name: opts.name })
+      }
       const wsId = resolveWorkspaceId({ flag: opts.workspace, env: env('DIFY_WORKSPACE_ID'), active: deps.active })
       return apps.list({
         workspaceId: wsId,
@@ -69,7 +75,6 @@ export async function runGetApp(opts: GetAppOptions, deps: GetAppDeps): Promise<
         limit: pageSize,
         mode: opts.mode,
         name: opts.name,
-        tag: opts.tag,
       })
     },
   )
@@ -102,9 +107,7 @@ function describeToEnvelope(desc: AppDescribeResponse, wsId: string, wsName: str
       name: desc.info.name,
       description: desc.info.description,
       mode: desc.info.mode as AppMode,
-      tags: desc.info.tags,
       updated_at: desc.info.updated_at,
-      created_by_name: desc.info.author === '' ? undefined : desc.info.author,
       workspace_id: wsId,
       workspace_name: wsName === '' ? undefined : wsName,
     }],
@@ -118,7 +121,7 @@ function workspaceNameForId(active: ActiveContext, id: string): string {
 }
 
 async function runAllWorkspaces(
-  apps: AppsClient,
+  apps: AppReader,
   ws: WorkspacesClient,
   opts: GetAppOptions,
   page: number,
@@ -139,7 +142,6 @@ async function runAllWorkspaces(
       limit,
       mode: opts.mode,
       name: opts.name,
-      tag: opts.tag,
     })
     merged.total += env.total
     merged.data = [...merged.data, ...env.data]
diff --git a/cli/src/commands/import/studio-app/guide.ts b/cli/src/commands/import/studio-app/guide.ts
new file mode 100644
index 00000000000..66ecdda9aa5
--- /dev/null
+++ b/cli/src/commands/import/studio-app/guide.ts
@@ -0,0 +1,17 @@
+export const agentGuide = `
+WHEN TO USE
+  A studio app is what you build and edit in Studio on the web console,
+  inside a workspace — the app's source definition. Import materialises a
+  DSL YAML into a new (or existing) studio app; pair it with
+  'export studio-app' to move an app between workspaces or instances. To
+  run or inspect the result, switch to the 'app' noun.
+
+BEHAVIOUR
+  A DSL version mismatch is auto-confirmed; no second command needed.
+  Missing plugin dependencies are listed on stderr — install them before
+  running the app.
+
+ERROR RECOVERY
+  workspace required        difyctl get workspace
+  not logged in (exit 4)    difyctl auth login
+`
diff --git a/cli/src/commands/import/app/index.ts b/cli/src/commands/import/studio-app/index.ts
similarity index 80%
rename from cli/src/commands/import/app/index.ts
rename to cli/src/commands/import/studio-app/index.ts
index fddda88f441..6e0b491199b 100644
--- a/cli/src/commands/import/app/index.ts
+++ b/cli/src/commands/import/studio-app/index.ts
@@ -1,16 +1,17 @@
 import { DifyCommand } from '@/commands/_shared/dify-command'
 import { httpRetryFlag } from '@/commands/_shared/global-flags'
 import { Flags } from '@/framework/flags'
+import { agentGuide } from './guide'
 import { pluginDependencyLabel, runImportApp } from './run'
 
-export default class ImportApp extends DifyCommand {
-  static override description = 'Import an app from a DSL YAML file or URL'
+export default class ImportStudioApp extends DifyCommand {
+  static override description = 'Import a studio app from a DSL YAML file or URL'
 
   static override examples = [
-    '<%= config.bin %> import app --from-file ./app.yaml',
-    '<%= config.bin %> import app --from-file /path/to/app.yaml --name "My App"',
-    '<%= config.bin %> import app --from-url https://example.com/my-app.yaml',
-    '<%= config.bin %> import app --from-file ./app.yaml --app-id <existing-app-id>',
+    '<%= config.bin %> import studio-app --from-file ./app.yaml',
+    '<%= config.bin %> import studio-app --from-file /path/to/app.yaml --name "My App"',
+    '<%= config.bin %> import studio-app --from-url https://example.com/my-app.yaml',
+    '<%= config.bin %> import studio-app --from-file ./app.yaml --app-id <existing-app-id>',
   ]
 
   static override flags = {
@@ -27,7 +28,7 @@ export default class ImportApp extends DifyCommand {
   }
 
   async run(argv: string[]) {
-    const { flags } = this.parse(ImportApp, argv)
+    const { flags } = this.parse(ImportStudioApp, argv)
     if (flags['from-file'] === undefined && flags['from-url'] === undefined)
       this.error('one of --from-file or --from-url is required', { exit: 1 })
     if (flags['from-file'] !== undefined && flags['from-url'] !== undefined)
@@ -57,4 +58,8 @@ export default class ImportApp extends DifyCommand {
         ctx.io.err.write(`  - ${pluginDependencyLabel(dep)}\n`)
     }
   }
+
+  override agentGuide(): string {
+    return agentGuide
+  }
 }
diff --git a/cli/src/commands/import/app/run.test.ts b/cli/src/commands/import/studio-app/run.test.ts
similarity index 100%
rename from cli/src/commands/import/app/run.test.ts
rename to cli/src/commands/import/studio-app/run.test.ts
diff --git a/cli/src/commands/import/app/run.ts b/cli/src/commands/import/studio-app/run.ts
similarity index 100%
rename from cli/src/commands/import/app/run.ts
rename to cli/src/commands/import/studio-app/run.ts
diff --git a/cli/src/commands/resume/app/guide.ts b/cli/src/commands/resume/app/guide.ts
index 03b904f3d5b..1483d40b9d4 100644
--- a/cli/src/commands/resume/app/guide.ts
+++ b/cli/src/commands/resume/app/guide.ts
@@ -1,14 +1,15 @@
 export const agentGuide = `
 WHEN TO USE
   Continue a workflow that paused for human input. run app (or a prior
-  resume app) exits 2 and prints a JSON object with status "paused",
+  resume app) exits 0 and prints a JSON object with status "paused",
   form_token, workflow_run_id and resolved_default_values. Resume with:
     difyctl resume app <app_id> <form_token> --workflow-run-id <id> \\
       --inputs '{"name":"Alice"}' -o json
 
 LOOP
-  A resume can pause again (exit 2 with a new form_token). Repeat until
-  exit 0. Pass --stream to print events live.
+  A resume can pause again (exit 0 with a new form_token and status
+  "paused"). Repeat until the output is no longer a pause. Pass --stream
+  to print events live.
 
 ERROR RECOVERY
   not logged in (exit 4)    difyctl auth login
diff --git a/cli/src/commands/resume/app/run.test.ts b/cli/src/commands/resume/app/run.test.ts
new file mode 100644
index 00000000000..a72b0a93b25
--- /dev/null
+++ b/cli/src/commands/resume/app/run.test.ts
@@ -0,0 +1,66 @@
+import type { ActiveContext } from '@/auth/hosts'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { AppRunClient } from '@/api/app-run'
+import { AppsClient } from '@/api/apps'
+import { PermittedExternalAppsClient } from '@/api/permitted-external-apps'
+import { bufferStreams } from '@/sys/io/streams'
+import { resumeApp } from './run.js'
+
+const DESCRIBE_RESULT = {
+  info: { id: 'app-2', name: 'X', mode: 'workflow', description: '', updated_at: null, service_api_enabled: true, is_agent: false },
+  parameters: null,
+  input_schema: null,
+}
+
+const FORM_RESP = { user_actions: [{ id: 'submit' }] }
+
+function makeExternalActive(): ActiveContext {
+  return {
+    host: 'http://localhost',
+    email: 'sso@x.io',
+    ctx: {
+      account: { id: 'acct-1', email: 'sso@x.io', name: 'SSO User' },
+      external_subject: { email: 'sso@x.io', issuer: 'https://issuer.example.com' },
+    },
+  } as unknown as ActiveContext
+}
+
+afterEach(() => {
+  vi.restoreAllMocks()
+})
+
+describe('resumeApp pre-flight subject strategy', () => {
+  it('external login: mode pre-flight calls PermittedExternalAppsClient.describe, not AppsClient.describe', async () => {
+    const externalDescribe = vi.fn().mockResolvedValue(DESCRIBE_RESULT)
+    const externalSpy = vi.spyOn(PermittedExternalAppsClient.prototype, 'describe').mockImplementation(externalDescribe)
+    const accountSpy = vi.spyOn(AppsClient.prototype, 'describe')
+
+    vi.spyOn(AppRunClient.prototype, 'submitHumanInput').mockResolvedValue(undefined as never)
+
+    const io = bufferStreams()
+    const http = {
+      baseURL: 'http://localhost',
+      request: vi.fn().mockImplementation((opts: { path: string }) => {
+        if (typeof opts.path === 'string' && opts.path.includes('form/human_input')) {
+          return Promise.resolve(FORM_RESP)
+        }
+        // reconnect stream — return an async iterable that ends immediately
+        const iter: AsyncIterable<never> = { [Symbol.asyncIterator]: () => ({ next: () => Promise.resolve({ done: true, value: undefined as never }) }) }
+        return Promise.resolve(iter)
+      }),
+    } as unknown as import('@/http/types').HttpClient
+
+    try {
+      await resumeApp(
+        { appId: 'app-2', formToken: 'ft-1', workflowRunId: 'wf-run-1', action: 'submit', inputs: {} },
+        { active: makeExternalActive(), http, host: 'http://localhost', io },
+      )
+    }
+    catch {
+      // run may fail after pre-flight due to stream mock; we only check which describe was called
+    }
+
+    expect(externalSpy).toHaveBeenCalled()
+    expect(accountSpy).not.toHaveBeenCalled()
+  })
+})
diff --git a/cli/src/commands/resume/app/run.ts b/cli/src/commands/resume/app/run.ts
index 81eb4e01f00..1dc2855a118 100644
--- a/cli/src/commands/resume/app/run.ts
+++ b/cli/src/commands/resume/app/run.ts
@@ -4,10 +4,11 @@ import type { RunContext } from '@/commands/run/app/_strategies/index'
 import type { HttpClient } from '@/http/types'
 import type { IOStreams } from '@/sys/io/streams'
 import { AppMetaClient } from '@/api/app-meta'
+import { selectAppReader } from '@/api/app-reader'
 import { AppRunClient } from '@/api/app-run'
-import { AppsClient } from '@/api/apps'
 import { pickStrategy } from '@/commands/run/app/_strategies/index'
 import { RUN_MODES } from '@/commands/run/app/handlers'
+import { resolveInputs, TEXT_FORMATS } from '@/commands/run/app/input-flags'
 import { processExit } from '@/sys/index'
 import { colorEnabled, colorScheme } from '@/sys/io/color'
 import { FieldInfo } from '@/types/app-meta'
@@ -37,45 +38,8 @@ export type ResumeAppDeps = {
   readonly exit?: (code: number) => never
 }
 
-const TEXT_FORMATS = new Set(['', 'text'])
-
-async function resolveInputs(
-  inputsJson: string | undefined,
-  inputsFile: string | undefined,
-  directInputs: Readonly<Record<string, unknown>> | undefined,
-): Promise<Record<string, unknown>> {
-  if (inputsJson !== undefined && inputsFile !== undefined)
-    throw new Error('--inputs and --inputs-file are mutually exclusive')
-  if (inputsJson !== undefined) {
-    let parsed: unknown
-    try {
-      parsed = JSON.parse(inputsJson)
-    }
-    catch {
-      throw new Error('--inputs must be valid JSON')
-    }
-    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
-      throw new Error('--inputs must be a JSON object')
-    return parsed as Record<string, unknown>
-  }
-  if (inputsFile !== undefined) {
-    const { readFile } = await import('node:fs/promises')
-    let parsed: unknown
-    try {
-      parsed = JSON.parse(await readFile(inputsFile, 'utf8'))
-    }
-    catch {
-      throw new Error('--inputs-file must contain valid JSON')
-    }
-    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
-      throw new Error('--inputs-file must be a JSON object')
-    return parsed as Record<string, unknown>
-  }
-  return { ...(directInputs ?? {}) }
-}
-
 export async function resumeApp(opts: ResumeAppOptions, deps: ResumeAppDeps): Promise<void> {
-  const apps = new AppsClient(deps.http)
+  const apps = selectAppReader(deps.active, deps.http)
   const meta = new AppMetaClient({ apps, host: deps.host, cache: deps.cache })
   const m = await meta.get(opts.appId, [FieldInfo])
   const mode = m.info?.mode ?? RUN_MODES.Workflow
diff --git a/cli/src/commands/run/app/_strategies/streaming-structured.ts b/cli/src/commands/run/app/_strategies/streaming-structured.ts
index c6f02292528..3ed602a3410 100644
--- a/cli/src/commands/run/app/_strategies/streaming-structured.ts
+++ b/cli/src/commands/run/app/_strategies/streaming-structured.ts
@@ -1,16 +1,14 @@
 import type { RunContext, RunStrategy } from './index'
 import type { SseEvent } from '@/http/sse'
 import { buildRunBody } from '@/api/app-run'
-import { chatConversationHint, newAppRunObject, RUN_MODES } from '@/commands/run/app/handlers'
+import { CHAT_MODES, chatConversationHint, newAppRunObject, RUN_MODES } from '@/commands/run/app/handlers'
 import { renderHitlHint, renderHitlOutput } from '@/commands/run/app/hitl-render'
 import { collect, HitlPauseError } from '@/commands/run/app/sse-collector'
 import { formatted, stringifyOutput } from '@/framework/output'
 import { handle, unhandle } from '@/sys/index'
 import { colorEnabled, colorScheme } from '@/sys/io/color'
 import { startSpinner } from '@/sys/io/spinner'
-import { extractThinkBlocks, stripThinkBlocks } from '@/sys/io/think-filter'
-
-const CHAT_MODES: ReadonlySet<string> = new Set([RUN_MODES.Chat, RUN_MODES.AgentChat, RUN_MODES.AdvancedChat])
+import { extractThinkBlocks, filterThinkInOutputs, stripThinkBlocks } from '@/sys/io/think-filter'
 
 async function* captureTaskId(
   iter: AsyncIterable<SseEvent>,
@@ -88,6 +86,18 @@ export class StreamingStructuredStrategy implements RunStrategy {
         processedResp = { ...processedResp, answer: stripThinkBlocks(processedResp.answer) }
       }
     }
+    else if (mode === RUN_MODES.Workflow) {
+      const data = processedResp.data
+      if (data !== null && typeof data === 'object' && 'outputs' in data) {
+        const raw = (data as { outputs: unknown }).outputs
+        if (raw !== null && typeof raw === 'object' && !Array.isArray(raw)) {
+          const { outputs, thinking } = filterThinkInOutputs(raw as Record<string, unknown>, ctx.think)
+          if (ctx.think && thinking !== '')
+            deps.io.err.write(`${thinking}\n`)
+          processedResp = { ...processedResp, data: { ...(data as Record<string, unknown>), outputs } }
+        }
+      }
+    }
 
     const respMode = typeof processedResp.mode === 'string' && processedResp.mode !== '' ? processedResp.mode : mode
     deps.io.out.write(stringifyOutput(formatted({ format, data: newAppRunObject(respMode, processedResp) })))
diff --git a/cli/src/commands/run/app/guide.ts b/cli/src/commands/run/app/guide.ts
index 70433fb4632..66403c0cbf1 100644
--- a/cli/src/commands/run/app/guide.ts
+++ b/cli/src/commands/run/app/guide.ts
@@ -9,14 +9,14 @@ WORKFLOW
        difyctl run app <id> --inputs '{"key":"value"}' -o json
 
 APP MODES
-  chat / advanced-chat   Conversational. Accepts --conversation <id> to
-                         resume an existing thread.
+  chat / agent-chat /    Conversational. Accept --conversation <id> to
+  advanced-chat          resume an existing thread. agent-chat adds
+                         autonomous tool use.
   completion             Single-turn. Ignores --conversation.
   workflow               Multi-step graph. Pass all input variables as a
                          JSON object via --inputs.
-  agent-chat             Conversational with autonomous tool use.
 
-HITL PAUSE (exit code 2)
+HITL PAUSE (exit code 0 — success-with-pending)
   When a workflow pauses for human input, stdout receives a JSON object
   with status "paused", form_token, workflow_run_id, and resolved_default_values.
   Resume with:
diff --git a/cli/src/commands/run/app/handlers.ts b/cli/src/commands/run/app/handlers.ts
index 3d3d75ec082..9536c4fe2a9 100644
--- a/cli/src/commands/run/app/handlers.ts
+++ b/cli/src/commands/run/app/handlers.ts
@@ -11,6 +11,12 @@ export const RUN_MODES = {
 
 export type RunMode = typeof RUN_MODES[keyof typeof RUN_MODES]
 
+export const CHAT_MODES: ReadonlySet<string> = new Set<RunMode>([
+  RUN_MODES.Chat,
+  RUN_MODES.AgentChat,
+  RUN_MODES.AdvancedChat,
+])
+
 export type AppRunObject = FormattedPrintable
 
 export function newAppRunObject(mode: string, resp: Record<string, unknown>): AppRunObject {
diff --git a/cli/src/commands/run/app/hitl-render.test.ts b/cli/src/commands/run/app/hitl-render.test.ts
new file mode 100644
index 00000000000..92d91575735
--- /dev/null
+++ b/cli/src/commands/run/app/hitl-render.test.ts
@@ -0,0 +1,68 @@
+import type { HitlPauseData, HitlPausePayload } from './sse-collector'
+import { describe, expect, it } from 'vitest'
+import { buildHitlExitObject, renderHitlHint } from './hitl-render'
+
+function payload(overrides: Partial<HitlPauseData> = {}): HitlPausePayload {
+  return {
+    event: 'human_input_required',
+    task_id: 'task-1',
+    workflow_run_id: 'run-1',
+    data: {
+      form_id: 'form-1',
+      node_id: 'node-1',
+      node_title: 'Approve',
+      form_content: 'Please approve',
+      inputs: [],
+      actions: [],
+      display_in_ui: false,
+      form_token: null,
+      approval_channels: ['email'],
+      resolved_default_values: {},
+      expiration_time: 0,
+      ...overrides,
+    },
+  }
+}
+
+describe('renderHitlHint — non-resumable form (form_token null)', () => {
+  it.each<[string[], string]>([
+    [['email'], 'form delivered via email — resume only from that channel'],
+    [['console'], 'form delivered via the console — resume only from that channel'],
+    [['web_app'], 'form delivered via the web app — resume only from that channel'],
+    [['console', 'email'], 'form delivered via the console or email — resume only from those channels'],
+    [[], 'form delivered via another channel — resume only from that channel'],
+  ])('renders %j as the channel note', (channels, expected) => {
+    const out = renderHitlHint('app-1', payload({ approval_channels: channels }), false)
+    expect(out).toBe(`hint: workflow paused — ${expected}\n`)
+    expect(out).not.toContain('difyctl resume')
+  })
+
+  it('falls back to a generic note when approval_channels is absent (older server)', () => {
+    const p = payload()
+    delete p.data.approval_channels
+    const out = renderHitlHint('app-1', p, false)
+    expect(out).toContain('another channel')
+  })
+})
+
+describe('renderHitlHint — resumable form (form_token present)', () => {
+  it('renders the resume command and ignores approval_channels', () => {
+    const out = renderHitlHint('app-1', payload({ form_token: 'tok-123', approval_channels: [] }), false)
+    expect(out).toContain('difyctl resume app app-1 tok-123 --workflow-run-id run-1')
+    expect(out).not.toContain('delivered via')
+  })
+})
+
+describe('buildHitlExitObject', () => {
+  it('carries approval_channels into the JSON exit object', () => {
+    const obj = buildHitlExitObject('app-1', payload({ approval_channels: ['email'] }))
+    expect(obj.approval_channels).toEqual(['email'])
+    expect(obj.form_token).toBeNull()
+  })
+
+  it('defaults approval_channels to [] when absent', () => {
+    const p = payload({ form_token: 'tok' })
+    delete p.data.approval_channels
+    expect(buildHitlExitObject('app-1', p).approval_channels).toEqual([])
+  })
+})
diff --git a/cli/src/commands/run/app/hitl-render.ts b/cli/src/commands/run/app/hitl-render.ts
index 991c63e1112..6eb251f4b38 100644
--- a/cli/src/commands/run/app/hitl-render.ts
+++ b/cli/src/commands/run/app/hitl-render.ts
@@ -10,6 +10,7 @@ export type HitlExitObject = {
   node_id: string
   node_title: string
   form_token: string | null
+  approval_channels: string[]
   form_content: string
   inputs: unknown[]
   actions: unknown[]
@@ -29,6 +30,7 @@ export function buildHitlExitObject(appId: string, payload: HitlPausePayload): H
     node_id: d.node_id,
     node_title: d.node_title,
     form_token: d.form_token,
+    approval_channels: d.approval_channels ?? [],
     form_content: d.form_content,
     inputs: d.inputs,
     actions: d.actions,
@@ -92,15 +94,35 @@ export function renderHitlOutput(appId: string, payload: HitlPausePayload, isTex
   return `${renderHitlExit(obj)}\n`
 }
 
-const EXTERNAL_CHANNEL_NOTE = 'form delivered via email/external channel — resume only from that channel'
+// Server approval-channel labels → human wording for the pause hint.
+const APPROVAL_CHANNEL_LABELS: Record<string, string> = {
+  email: 'email',
+  console: 'the console',
+  web_app: 'the web app',
+}
+
+function describeApprovalChannels(channels: string[]): string {
+  const labels = channels.map(c => APPROVAL_CHANNEL_LABELS[c] ?? c)
+  if (labels.length <= 1)
+    return labels[0] ?? 'another channel'
+  if (labels.length === 2)
+    return `${labels[0]} or ${labels[1]}`
+  return `${labels.slice(0, -1).join(', ')}, or ${labels[labels.length - 1]}`
+}
+
+function externalChannelNote(channels: string[]): string {
+  const where = channels.length > 1 ? 'those channels' : 'that channel'
+  return `form delivered via ${describeApprovalChannels(channels)} — resume only from ${where}`
+}
 
 export function renderHitlHint(appId: string, payload: HitlPausePayload, isErrTTY: boolean): string {
   const d = payload.data
   const cs = colorScheme(colorEnabled(isErrTTY))
   if (d.form_token === null) {
+    const note = externalChannelNote(d.approval_channels ?? [])
     if (!isErrTTY)
-      return `hint: workflow paused — ${EXTERNAL_CHANNEL_NOTE}\n`
-    return `${cs.warningIcon()} ${cs.bold('workflow paused')} — ${cs.dim(EXTERNAL_CHANNEL_NOTE)}\n`
+      return `hint: workflow paused — ${note}\n`
+    return `${cs.warningIcon()} ${cs.bold('workflow paused')} — ${cs.dim(note)}\n`
   }
   const actions = (d.actions ?? []) as { id: string }[]
   let cmd = `difyctl resume app ${appId} ${d.form_token} --workflow-run-id ${payload.workflow_run_id}`
diff --git a/cli/src/commands/run/app/index.ts b/cli/src/commands/run/app/index.ts
index 44ea93c542b..815d708d9d8 100644
--- a/cli/src/commands/run/app/index.ts
+++ b/cli/src/commands/run/app/index.ts
@@ -4,6 +4,7 @@ import { httpRetryFlag } from '@/commands/_shared/global-flags'
 import { Args, Flags } from '@/framework/flags'
 import { OutputFormat } from '@/framework/output'
 import { agentGuide } from './guide'
+import { CHAT_MODES } from './handlers'
 import { runApp } from './run'
 
 export default class RunApp extends DifyCommand {
@@ -30,7 +31,7 @@ export default class RunApp extends DifyCommand {
     'inputs': Flags.string({ description: 'Input variables as a JSON object, e.g. --inputs \'{"key":"value"}\'. Mutually exclusive with --inputs-file.' }),
     'inputs-file': Flags.string({ description: 'Path to a JSON file containing the inputs object. Mutually exclusive with --inputs.' }),
     'file': Flags.stringArray({ description: 'Named file input: --file key=@path for a local file or --file key=https://url for a remote URL. Repeatable.', default: [] }),
-    'conversation': Flags.string({ description: 'Resume a chat conversation by id (chat/advanced-chat only)' }),
+    'conversation': Flags.string({ description: `Resume a chat conversation by id (${[...CHAT_MODES].join('/')} only)` }),
     'workflow-id': Flags.string({ description: 'Pin to a specific published workflow version' }),
     'workspace': Flags.string({ description: 'Workspace id (overrides DIFY_WORKSPACE_ID and stored default)' }),
     'stream': Flags.boolean({ description: 'Print output live as tokens/events arrive (default: collect and print at end)', default: false }),
diff --git a/cli/src/commands/run/app/input-flags.ts b/cli/src/commands/run/app/input-flags.ts
new file mode 100644
index 00000000000..b6d296ad7c0
--- /dev/null
+++ b/cli/src/commands/run/app/input-flags.ts
@@ -0,0 +1,42 @@
+import { BaseError } from '@/errors/base'
+import { ErrorCode } from '@/errors/codes'
+
+// Output formats that render the run/resume result as plain text rather than JSON/YAML.
+export const TEXT_FORMATS = new Set(['', 'text'])
+
+// Shared by `run app` and `resume app`: --inputs (inline JSON) / --inputs-file (JSON file) /
+// direct inputs are mutually exclusive ways to supply the run's variable map.
+export async function resolveInputs(
+  inputsJson: string | undefined,
+  inputsFile: string | undefined,
+  directInputs: Readonly<Record<string, unknown>> | undefined,
+): Promise<Record<string, unknown>> {
+  if (inputsJson !== undefined && inputsFile !== undefined)
+    throw new BaseError({ code: ErrorCode.UsageInvalidFlag, message: '--inputs and --inputs-file are mutually exclusive' })
+  if (inputsJson !== undefined) {
+    let parsed: unknown
+    try {
+      parsed = JSON.parse(inputsJson)
+    }
+    catch {
+      throw new BaseError({ code: ErrorCode.UsageInvalidFlag, message: '--inputs must be valid JSON' })
+    }
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
+      throw new BaseError({ code: ErrorCode.UsageInvalidFlag, message: '--inputs must be a JSON object' })
+    return parsed as Record<string, unknown>
+  }
+  if (inputsFile !== undefined) {
+    const { readFile } = await import('node:fs/promises')
+    let parsed: unknown
+    try {
+      parsed = JSON.parse(await readFile(inputsFile, 'utf8'))
+    }
+    catch {
+      throw new BaseError({ code: ErrorCode.UsageInvalidFlag, message: '--inputs-file must contain valid JSON' })
+    }
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
+      throw new BaseError({ code: ErrorCode.UsageInvalidFlag, message: '--inputs-file must be a JSON object' })
+    return parsed as Record<string, unknown>
+  }
+  return { ...(directInputs ?? {}) }
+}
diff --git a/cli/src/commands/run/app/run.test.ts b/cli/src/commands/run/app/run.test.ts
index 4fff2d02873..57b02aeb47d 100644
--- a/cli/src/commands/run/app/run.test.ts
+++ b/cli/src/commands/run/app/run.test.ts
@@ -1,11 +1,12 @@
 import type { DifyMock } from '@test/fixtures/dify-mock/server'
 import type { ActiveContext } from '@/auth/hosts'
+import type { HttpClient } from '@/http/types'
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { startMock } from '@test/fixtures/dify-mock/server'
 import { testHttpClient } from '@test/fixtures/http-client'
-import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { loadAppInfoCache } from '@/cache/app-info'
 import { resumeApp } from '@/commands/resume/app/run'
 import { ENV_CACHE_DIR } from '@/store/dir'
@@ -165,6 +166,43 @@ describe('runApp', () => {
     expect(parsed.data.status).toBe('succeeded')
   })
 
+  it('workflow: strips <think> from outputs by default', async () => {
+    mock.setScenario('workflow-think')
+    const io = bufferStreams()
+    const cache = await loadAppInfoCache({ store: getCache(CACHE_APP_INFO) })
+    await runApp(
+      { appId: 'app-2', inputs: { x: '1' } },
+      { active: active(), http: testHttpClient(mock.url, 'dfoa_test'), host: mock.url, io, cache },
+    )
+    expect(io.outBuf()).toBe('final answer\n')
+    expect(io.errBuf()).not.toContain('secret reasoning')
+  })
+
+  it('workflow --think: routes <think> to stderr, clean stdout', async () => {
+    mock.setScenario('workflow-think')
+    const io = bufferStreams()
+    const cache = await loadAppInfoCache({ store: getCache(CACHE_APP_INFO) })
+    await runApp(
+      { appId: 'app-2', inputs: { x: '1' }, think: true },
+      { active: active(), http: testHttpClient(mock.url, 'dfoa_test'), host: mock.url, io, cache },
+    )
+    expect(io.outBuf()).toBe('final answer\n')
+    expect(io.errBuf()).toContain('secret reasoning')
+  })
+
+  it('--stream workflow -o json --think: strips outputs and routes thinking to stderr', async () => {
+    mock.setScenario('workflow-think')
+    const io = bufferStreams()
+    const cache = await loadAppInfoCache({ store: getCache(CACHE_APP_INFO) })
+    await runApp(
+      { appId: 'app-2', inputs: { x: '1' }, stream: true, format: 'json', think: true },
+      { active: active(), http: testHttpClient(mock.url, 'dfoa_test'), host: mock.url, io, cache },
+    )
+    const parsed = JSON.parse(io.outBuf()) as { data: { outputs: { result: string } } }
+    expect(parsed.data.outputs.result).toBe('final answer')
+    expect(io.errBuf()).toContain('secret reasoning')
+  })
+
   it('stream-error scenario: error event surfaces typed BaseError', async () => {
     mock.setScenario('stream-error')
     const io = bufferStreams()
@@ -381,4 +419,35 @@ describe('runApp', () => {
     expect(docInput.transfer_method).toBe('remote_url')
     expect(docInput.url).toBe('https://example.com/override.pdf')
   })
+
+  it('external login: mode pre-flight calls PermittedExternalAppsClient.describe, not AppsClient.describe', async () => {
+    const describeResult = { info: { id: 'app-1', name: 'X', mode: 'chat', description: '', updated_at: null, service_api_enabled: true, is_agent: false }, parameters: null, input_schema: null }
+    const externalDescribe = vi.fn().mockResolvedValue(describeResult)
+    const { PermittedExternalAppsClient } = await import('@/api/permitted-external-apps')
+    const { AppsClient } = await import('@/api/apps')
+    const externalSpy = vi.spyOn(PermittedExternalAppsClient.prototype, 'describe').mockImplementation(externalDescribe)
+    const accountSpy = vi.spyOn(AppsClient.prototype, 'describe')
+    const io = bufferStreams()
+    const http = { baseURL: mock.url, request: vi.fn().mockResolvedValue({ answer: 'echo: hi', conversation_id: 'conv-1', message_id: 'msg-1', mode: 'chat', metadata: {} }) } as unknown as HttpClient
+    const activeExt: ActiveContext = {
+      host: mock.url,
+      email: 'sso@x.io',
+      ctx: {
+        account: { id: 'acct-1', email: 'sso@x.io', name: 'SSO User' },
+        external_subject: { email: 'sso@x.io', issuer: 'https://issuer.example.com' },
+      },
+    }
+    try {
+      await runApp(
+        { appId: 'app-1', message: 'hi' },
+        { active: activeExt, http, host: mock.url, io },
+      )
+    }
+    catch {
+      // run may fail due to mocked http; we only care about which describe was called
+    }
+    expect(externalSpy).toHaveBeenCalled()
+    expect(accountSpy).not.toHaveBeenCalled()
+    vi.restoreAllMocks()
+  })
 })
diff --git a/cli/src/commands/run/app/run.ts b/cli/src/commands/run/app/run.ts
index 8eb767c5dbe..ab468678a72 100644
--- a/cli/src/commands/run/app/run.ts
+++ b/cli/src/commands/run/app/run.ts
@@ -3,8 +3,8 @@ import type { AppInfoCache } from '@/cache/app-info'
 import type { HttpClient } from '@/http/types'
 import type { IOStreams } from '@/sys/io/streams'
 import { AppMetaClient } from '@/api/app-meta'
+import { selectAppReader } from '@/api/app-reader'
 import { AppRunClient } from '@/api/app-run'
-import { AppsClient } from '@/api/apps'
 import { FileUploadClient } from '@/api/file-upload'
 import { pickStrategy } from '@/commands/run/app/_strategies/index'
 import { BaseError, HttpClientError } from '@/errors/base'
@@ -13,6 +13,7 @@ import { processExit } from '@/sys/index'
 import { FieldInfo } from '@/types/app-meta'
 import { resolveFileInputs } from './file-flags.js'
 import { RUN_MODES } from './handlers.js'
+import { resolveInputs, TEXT_FORMATS } from './input-flags.js'
 
 export type RunAppOptions = {
   readonly appId: string
@@ -40,45 +41,8 @@ export type RunAppDeps = {
   readonly exit?: (code: number) => never
 }
 
-const TEXT_FORMATS = new Set(['', 'text'])
-
-async function resolveInputs(
-  inputsJson: string | undefined,
-  inputsFile: string | undefined,
-  directInputs: Readonly<Record<string, unknown>> | undefined,
-): Promise<Record<string, unknown>> {
-  if (inputsJson !== undefined && inputsFile !== undefined)
-    throw new BaseError({ code: ErrorCode.UsageInvalidFlag, message: '--inputs and --inputs-file are mutually exclusive' })
-  if (inputsJson !== undefined) {
-    let parsed: unknown
-    try {
-      parsed = JSON.parse(inputsJson)
-    }
-    catch {
-      throw new BaseError({ code: ErrorCode.UsageInvalidFlag, message: '--inputs must be valid JSON' })
-    }
-    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
-      throw new BaseError({ code: ErrorCode.UsageInvalidFlag, message: '--inputs must be a JSON object' })
-    return parsed as Record<string, unknown>
-  }
-  if (inputsFile !== undefined) {
-    const { readFile } = await import('node:fs/promises')
-    let parsed: unknown
-    try {
-      parsed = JSON.parse(await readFile(inputsFile, 'utf8'))
-    }
-    catch {
-      throw new BaseError({ code: ErrorCode.UsageInvalidFlag, message: '--inputs-file must contain valid JSON' })
-    }
-    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
-      throw new BaseError({ code: ErrorCode.UsageInvalidFlag, message: '--inputs-file must be a JSON object' })
-    return parsed as Record<string, unknown>
-  }
-  return { ...(directInputs ?? {}) }
-}
-
 export async function runApp(opts: RunAppOptions, deps: RunAppDeps): Promise<void> {
-  const apps = new AppsClient(deps.http)
+  const apps = selectAppReader(deps.active, deps.http)
   const meta = new AppMetaClient({ apps, host: deps.host, cache: deps.cache })
 
   try {
diff --git a/cli/src/commands/run/app/sse-collector.ts b/cli/src/commands/run/app/sse-collector.ts
index ba329746e73..043a9690d5f 100644
--- a/cli/src/commands/run/app/sse-collector.ts
+++ b/cli/src/commands/run/app/sse-collector.ts
@@ -13,6 +13,8 @@ export type HitlPauseData = {
   actions: unknown[]
   display_in_ui: boolean
   form_token: string | null
+  // Channels where the form can be approved when it is not CLI-resumable, e.g. ['email'].
+  approval_channels?: string[]
   resolved_default_values: Record<string, string>
   expiration_time: number
 }
diff --git a/cli/src/commands/run/app/stream-handlers.test.ts b/cli/src/commands/run/app/stream-handlers.test.ts
index 885b059abf2..bab45144a01 100644
--- a/cli/src/commands/run/app/stream-handlers.test.ts
+++ b/cli/src/commands/run/app/stream-handlers.test.ts
@@ -74,6 +74,37 @@ describe('streamPrinterFor — workflow', () => {
   })
 })
 
+describe('streamPrinterFor — workflow think filtering', () => {
+  it('think: false (default) strips <think> from string outputs, nothing to stderr', () => {
+    const sp = streamPrinterFor('workflow')
+    const cap = captures()
+    sp.onEvent(cap.out, cap.err, ev('workflow_finished', { data: { outputs: { text: '<think>hidden</think>\nresult' } } }))
+    sp.onEnd(cap.out, cap.err)
+    const parsed = JSON.parse(cap.outBuf().trim()) as { text: string }
+    expect(parsed.text).toBe('result')
+    expect(cap.errBuf()).toBe('')
+  })
+
+  it('think: true strips <think> from string outputs and routes thinking to stderr', () => {
+    const sp = streamPrinterFor('workflow', true)
+    const cap = captures()
+    sp.onEvent(cap.out, cap.err, ev('workflow_finished', { data: { outputs: { text: '<think>reasoning</think>\nresult' } } }))
+    sp.onEnd(cap.out, cap.err)
+    const parsed = JSON.parse(cap.outBuf().trim()) as { text: string }
+    expect(parsed.text).toBe('result')
+    expect(cap.errBuf()).toContain('<think>')
+    expect(cap.errBuf()).toContain('reasoning')
+  })
+
+  it('array outputs pass through unchanged (not reshaped into an object)', () => {
+    const sp = streamPrinterFor('workflow', true)
+    const cap = captures()
+    sp.onEvent(cap.out, cap.err, ev('workflow_finished', { data: { outputs: ['a', 'b'] } }))
+    sp.onEnd(cap.out, cap.err)
+    expect(cap.outBuf().trim()).toBe('["a","b"]')
+  })
+})
+
 describe('streamPrinterFor — unknown mode', () => {
   it('throws', () => {
     expect(() => streamPrinterFor('whatever')).toThrow()
diff --git a/cli/src/commands/run/app/stream-handlers.ts b/cli/src/commands/run/app/stream-handlers.ts
index 355813d82b9..1955d5996bf 100644
--- a/cli/src/commands/run/app/stream-handlers.ts
+++ b/cli/src/commands/run/app/stream-handlers.ts
@@ -4,7 +4,7 @@ import type { SseEvent } from '@/http/sse'
 import { newError } from '@/errors/base'
 import { ErrorCode } from '@/errors/codes'
 import { colorEnabled, colorScheme } from '@/sys/io/color'
-import { ThinkChunkFilter } from '@/sys/io/think-filter'
+import { filterThinkInOutputs, ThinkChunkFilter } from '@/sys/io/think-filter'
 import { RUN_MODES } from './handlers'
 import { HitlPauseError } from './sse-collector'
 
@@ -106,6 +106,11 @@ class CompletionStreamPrinter implements StreamPrinter {
 
 class WorkflowStreamPrinter implements StreamPrinter {
   private final: Record<string, unknown> | undefined
+  private readonly think: boolean
+  constructor(think: boolean) {
+    this.think = think
+  }
+
   onEvent(_out: NodeJS.WritableStream, errOut: NodeJS.WritableStream, ev: SseEvent): void {
     if (handleCommonEvents(ev))
       return
@@ -132,12 +137,20 @@ class WorkflowStreamPrinter implements StreamPrinter {
     }
   }
 
-  onEnd(out: NodeJS.WritableStream): void {
+  onEnd(out: NodeJS.WritableStream, errOut: NodeJS.WritableStream): void {
     if (this.final === undefined)
       return
     const data = this.final.data
     if (data !== null && typeof data === 'object' && 'outputs' in data) {
-      out.write(`${JSON.stringify((data as { outputs: unknown }).outputs)}\n`)
+      const raw = (data as { outputs: unknown }).outputs
+      if (raw !== null && typeof raw === 'object' && !Array.isArray(raw)) {
+        const { outputs, thinking } = filterThinkInOutputs(raw as Record<string, unknown>, this.think)
+        if (this.think && thinking !== '')
+          errOut.write(`${thinking}\n`)
+        out.write(`${JSON.stringify(outputs)}\n`)
+        return
+      }
+      out.write(`${JSON.stringify(raw)}\n`)
       return
     }
     out.write(`${JSON.stringify(this.final)}\n`)
@@ -149,7 +162,7 @@ const FACTORIES: Record<string, (think: boolean, isTTY: boolean) => StreamPrinte
   [RUN_MODES.AdvancedChat]: (think, isTTY) => new ChatStreamPrinter(think, isTTY),
   [RUN_MODES.AgentChat]: (think, isTTY) => new ChatStreamPrinter(think, isTTY),
   [RUN_MODES.Completion]: (think, _isTTY) => new CompletionStreamPrinter(think),
-  [RUN_MODES.Workflow]: (_think, _isTTY) => new WorkflowStreamPrinter(),
+  [RUN_MODES.Workflow]: (think, _isTTY) => new WorkflowStreamPrinter(think),
 }
 
 export function streamPrinterFor(mode: string, think = false, isTTY = false): StreamPrinter {
diff --git a/cli/src/commands/tree.generated.ts b/cli/src/commands/tree.generated.ts
index 03963865e56..fdaf8f269ed 100644
--- a/cli/src/commands/tree.generated.ts
+++ b/cli/src/commands/tree.generated.ts
@@ -17,11 +17,11 @@ import CreateMember from '@/commands/create/member/index'
 import DeleteMember from '@/commands/delete/member/index'
 import DescribeApp from '@/commands/describe/app/index'
 import EnvList from '@/commands/env/list/index'
-import ExportApp from '@/commands/export/app/index'
+import ExportStudioApp from '@/commands/export/studio-app/index'
 import GetApp from '@/commands/get/app/index'
 import GetMember from '@/commands/get/member/index'
 import GetWorkspace from '@/commands/get/workspace/index'
-import ImportApp from '@/commands/import/app/index'
+import ImportStudioApp from '@/commands/import/studio-app/index'
 import ResumeApp from '@/commands/resume/app/index'
 import RunApp from '@/commands/run/app/index'
 import SetMember from '@/commands/set/member/index'
@@ -77,7 +77,7 @@ export const commandTree: CommandTree = {
   },
   export: {
     subcommands: {
-      app: { command: ExportApp, subcommands: {} },
+      'studio-app': { command: ExportStudioApp, subcommands: {} },
     },
   },
   get: {
@@ -89,7 +89,7 @@ export const commandTree: CommandTree = {
   },
   import: {
     subcommands: {
-      app: { command: ImportApp, subcommands: {} },
+      'studio-app': { command: ImportStudioApp, subcommands: {} },
     },
   },
   resume: {
diff --git a/cli/src/commands/version/version.test.ts b/cli/src/commands/version/version.test.ts
index affa01c959f..60512e01d04 100644
--- a/cli/src/commands/version/version.test.ts
+++ b/cli/src/commands/version/version.test.ts
@@ -158,6 +158,6 @@ describe('Version command', () => {
     if (output?.kind !== 'formatted')
       throw new Error('expected formatted output')
 
-    expect(output.data.text()).toContain('WARNING: This build is a release candidate')
+    expect(output.data.text()).toContain('WARNING: This build is a rc release')
   })
 })
diff --git a/cli/src/framework/registry.test.ts b/cli/src/framework/registry.test.ts
index 0d208d485d9..8c414908e45 100644
--- a/cli/src/framework/registry.test.ts
+++ b/cli/src/framework/registry.test.ts
@@ -139,3 +139,114 @@ describe('findSuggestions', () => {
     expect(suggestions).toHaveLength(0)
   })
 })
+
+describe('findSuggestions — cross-namespace fallback', () => {
+  // Mirrors the real command tree shape (auth/login, auth/devices/list, …) so the
+  // omitted-namespace cases are deterministic without importing the generated tree.
+  const realish: CommandTree = {
+    auth: {
+      subcommands: {
+        login: { command: FooBarCmd, subcommands: {} },
+        logout: { command: FooBarCmd, subcommands: {} },
+        devices: {
+          subcommands: {
+            list: { command: FooBarCmd, subcommands: {} },
+          },
+        },
+      },
+    },
+    describe: { subcommands: { app: { command: FooBarCmd, subcommands: {} } } },
+    get: { subcommands: { app: { command: FooBarCmd, subcommands: {} } } },
+    create: { subcommands: { member: { command: FooBarCmd, subcommands: {} } } },
+    set: { subcommands: { member: { command: FooBarCmd, subcommands: {} } } },
+    verbose: { subcommands: { snapshot: { command: FooBarCmd, subcommands: {} } } },
+    io: { subcommands: { dir: { command: FooBarCmd, subcommands: {} } } },
+  }
+
+  it('recovers an omitted namespace for a bare leaf', () => {
+    expect(findSuggestions(realish, ['login'])).toEqual(['auth login'])
+  })
+
+  it('does not suggest a leaf outside the length-aware threshold', () => {
+    // editDistance('login','logout') = 3 > threshold(2) — logout must not appear.
+    expect(findSuggestions(realish, ['login'])).not.toContain('auth logout')
+  })
+
+  it('recovers a two-level omitted namespace with one typo', () => {
+    // 'list' anchors the leaf; 'device'→'devices' costs 1; 'auth' omitted → score 2.5.
+    expect(findSuggestions(realish, ['device', 'list'])).toEqual(['auth devices list'])
+  })
+
+  it('recovers a transposed leaf typo the same-level walk cannot fix', () => {
+    // editDistance('descrbie','describe') = 2 > traverse's fixed 1, but within length-aware threshold(2).
+    expect(findSuggestions(realish, ['descrbie', 'app'])).toEqual(['describe app'])
+  })
+
+  it('ranks a same-level fix ahead of any omitted-namespace match', () => {
+    // 'descibe' (edit distance 1 to the 'describe' namespace) is fixed in-place by the walk,
+    // so the ambiguous omitted-namespace 'app' fan-out never runs.
+    const suggestions = findSuggestions(realish, ['descibe', 'app'])
+    expect(suggestions[0]).toBe('describe app')
+    expect(suggestions).not.toContain('get app')
+  })
+
+  it('tolerates a two-edit typo on a long leaf', () => {
+    // editDistance('snpashot','snapshot') = 2, leaf length 8 → threshold 2.
+    expect(findSuggestions(realish, ['verbose', 'snpashot'])).toContain('verbose snapshot')
+  })
+
+  it('keeps short tokens strict and rejects a two-edit neighbor', () => {
+    // editDistance('dxx','dir') = 2 > threshold(1) for a 3-char token.
+    expect(findSuggestions(realish, ['dxx'])).not.toContain('io dir')
+    // editDistance('dxr','dir') = 1 ≤ threshold(1) — the one-edit neighbor is recovered.
+    expect(findSuggestions(realish, ['dxr'])).toEqual(['io dir'])
+  })
+
+  it('suppresses ambiguous fan-out when a bare leaf lives under many namespaces', () => {
+    // 'member' (create/set) and 'app' (describe/get) each tie with zero spelling cost — unroutable.
+    expect(findSuggestions(realish, ['member'])).toEqual([])
+    expect(findSuggestions(realish, ['app'])).toEqual([])
+  })
+
+  it('stays silent when nothing clears the threshold', () => {
+    expect(findSuggestions(realish, ['zzzzz'])).toEqual([])
+  })
+
+  it('drops a low-confidence two-level omission past the score cutoff', () => {
+    // 'list' only reaches the depth-3 'auth devices list' (two namespaces omitted,
+    // score 3.0) — beyond the cutoff, so nothing is suggested.
+    expect(findSuggestions(realish, ['list'])).toEqual([])
+  })
+
+  it('rejects a candidate when more tokens are typed than its path can hold', () => {
+    // Three positional tokens cannot align to the two-segment 'describe app'.
+    expect(findSuggestions(realish, ['extra', 'descrbie', 'app'])).toEqual([])
+  })
+
+  it('produces a deterministic, stable result across runs', () => {
+    expect(findSuggestions(realish, ['login'])).toEqual(findSuggestions(realish, ['login']))
+    expect(findSuggestions(realish, ['device', 'list'])).toEqual(findSuggestions(realish, ['device', 'list']))
+  })
+})
+
+describe('findSuggestions — hidden commands', () => {
+  class Visible extends Command {
+    async run(_argv: string[]) {}
+  }
+  class Hidden extends Command {
+    static hidden = true
+    async run(_argv: string[]) {}
+  }
+  const hiddenTree: CommandTree = {
+    status: { command: Visible, subcommands: {} },
+    secret: { command: Hidden, subcommands: {} },
+  }
+
+  it('never surfaces a hidden command, even for a near typo', () => {
+    expect(findSuggestions(hiddenTree, ['secrt'])).toEqual([])
+  })
+
+  it('still suggests visible siblings', () => {
+    expect(findSuggestions(hiddenTree, ['statuss'])).toEqual(['status'])
+  })
+})
diff --git a/cli/src/framework/registry.ts b/cli/src/framework/registry.ts
index a2249788e90..58ef363b2a3 100644
--- a/cli/src/framework/registry.ts
+++ b/cli/src/framework/registry.ts
@@ -76,11 +76,97 @@ export function collectCommands(
   return results
 }
 
+// Below MAX_SCORE a score decomposes uniquely into (integer spelling cost,
+// 1.5 × omitted namespaces), so scoreFallback's ambiguity guard can read
+// `spelling === 0` as "exact leaf, only the namespace was omitted".
+const OMIT_PENALTY = 1.5
+const MAX_SCORE = 3
+
+function relThreshold(token: string): number {
+  return token.length <= 3 ? 1 : 2
+}
+
+function positionalTokens(argv: string[]): string[] {
+  const tokens: string[] = []
+  for (const token of argv) {
+    if (token.startsWith('-'))
+      break
+    tokens.push(token)
+  }
+  return tokens
+}
+
+// Minimum total edit distance to align `tokens` as an ordered subsequence of
+// `segments`, every matched pair within its length-aware threshold. Returns
+// null when no alignment exists (e.g. more tokens than segments).
+function minSubsequenceCost(tokens: string[], segments: string[]): number | null {
+  const [head, ...rest] = tokens
+  if (head === undefined)
+    return 0
+
+  const threshold = relThreshold(head)
+  let best: number | null = null
+  for (const [index, segment] of segments.entries()) {
+    const cost = editDistance(head, segment)
+    if (cost > threshold)
+      continue
+    const tail = minSubsequenceCost(rest, segments.slice(index + 1))
+    if (tail !== null && (best === null || cost + tail < best))
+      best = cost + tail
+  }
+  return best
+}
+
+// Recovers a wrong/omitted namespace by scoring the typed tokens against the
+// flat command list. The last token must align to a candidate's leaf; earlier
+// tokens align, in order, to the candidate's preceding segments (the rest are
+// namespace the user omitted). Lower score = higher confidence.
+function scoreFallback(tree: CommandTree, tokens: string[]): string[] {
+  const last = tokens.length - 1
+  const lastToken = tokens[last]
+  if (lastToken === undefined)
+    return []
+  const prefix = tokens.slice(0, last)
+
+  const scored: Array<{ path: string, score: number, spelling: number, depth: number }> = []
+  for (const { path } of collectCommands(tree)) {
+    const leaf = path[path.length - 1] ?? ''
+    const leafCost = editDistance(lastToken, leaf)
+    if (leafCost > relThreshold(lastToken))
+      continue
+
+    const prefixCost = minSubsequenceCost(prefix, path.slice(0, -1))
+    if (prefixCost === null)
+      continue
+
+    const spelling = leafCost + prefixCost
+    const score = spelling + OMIT_PENALTY * (path.length - tokens.length)
+    if (score >= MAX_SCORE)
+      continue
+
+    scored.push({ path: buildPath(path), score, spelling, depth: path.length })
+  }
+
+  if (scored.length === 0)
+    return []
+
+  scored.sort((a, b) => a.score - b.score || a.depth - b.depth || a.path.localeCompare(b.path))
+
+  // An exact leaf living under several namespaces is unroutable — staying silent
+  // beats guessing an arbitrary one.
+  const best = scored[0]?.score
+  const tied = scored.filter(item => item.score === best)
+  if (tied.length >= 2 && tied.every(item => item.spelling === 0))
+    return []
+
+  return scored.map(item => item.path)
+}
+
 export function findSuggestions(tree: CommandTree, argv: string[]): string[] {
   const results: string[] = []
 
   function collectAll(node: CommandNode, path: string[]): void {
-    if (node.command)
+    if (node.command && node.command.hidden !== true)
       results.push(buildPath(path))
     for (const [key, child] of Object.entries(node.subcommands))
       collectAll(child, [...path, key])
@@ -106,6 +192,11 @@ export function findSuggestions(tree: CommandTree, argv: string[]): string[] {
     }
   }
 
+  // Same-level typos and namespace listing first; only fall back to
+  // cross-namespace scoring when the level-by-level walk finds nothing.
   traverse(tree, argv, [])
-  return results
+  if (results.length > 0)
+    return results
+
+  return scoreFallback(tree, positionalTokens(argv))
 }
diff --git a/cli/src/help/contract.test.ts b/cli/src/help/contract.test.ts
new file mode 100644
index 00000000000..272e1ff8d88
--- /dev/null
+++ b/cli/src/help/contract.test.ts
@@ -0,0 +1,26 @@
+import type { ErrorBody } from '@dify/contracts/api/openapi/types.gen'
+import { describe, expect, it } from 'vitest'
+import { HttpClientError, newError } from '@/errors/base'
+import { ErrorCode } from '@/errors/codes'
+import { CONTRACT } from './contract'
+
+describe('errorEnvelope contract', () => {
+  // Guard against the documented shape drifting from the real envelope: build an
+  // error with every optional field populated and assert each JSON key it emits
+  // is named in the contract string. Adding/removing an envelope field without
+  // updating the doc fails here.
+  it('documents every key the real JSON envelope can emit', () => {
+    const server: ErrorBody = { code: 'app_unavailable', message: 'gone', status: 404 }
+    const err = HttpClientError.from(newError(ErrorCode.Server4xxOther, 'boom'))
+      .withHint('do x')
+      .withRequest('GET', 'https://api.dify.ai/v1/me')
+      .withHttpStatus(404)
+      .withRawResponse('{"x":1}')
+      .withServerError(server)
+
+    const env = err.toEnvelope()
+
+    for (const key of Object.keys(env.error))
+      expect(CONTRACT.errorEnvelope.shape).toContain(`"${key}"`)
+  })
+})
diff --git a/cli/src/help/contract.ts b/cli/src/help/contract.ts
index 1d68da8b268..d3a7549ecc9 100644
--- a/cli/src/help/contract.ts
+++ b/cli/src/help/contract.ts
@@ -14,9 +14,9 @@ export type Contract = {
 }
 
 const EXIT_CODE_DESCRIPTIONS: Readonly<Record<number, string>> = {
-  [ExitCode.Success]: 'success',
+  [ExitCode.Success]: 'success (also a workflow paused for human input — check stdout for status "paused")',
   [ExitCode.Generic]: 'generic error',
-  [ExitCode.Usage]: 'usage error (bad flag / missing arg), or a workflow paused for human input',
+  [ExitCode.Usage]: 'usage error (bad flag / missing arg)',
   [ExitCode.Auth]: 'auth error (not logged in / token expired)',
   [ExitCode.VersionCompat]: 'version / compatibility error',
 }
@@ -38,11 +38,11 @@ export const CONTRACT: Contract = {
     description:
       'On failure the error goes to stderr. Under -o json/yaml it is a structured envelope; otherwise a human line.',
     shape:
-      '{ "error": { "code": string, "message": string, "hint"?: string, "http_status"?: number, "request"?: string } }',
+      '{ "error": { "code": string, "message": string, "hint"?: string, "http_status"?: number, "method"?: string, "url"?: string, "raw_response"?: string, "server"?: object } }',
   },
   hitl: {
     description:
-      'When a workflow pauses for human input, `run app` exits 2 and writes a JSON object to stdout with status "paused", form_token, workflow_run_id and resolved_default_values.',
+      'When a workflow pauses for human input, `run app` exits 0 (success-with-pending) and writes a JSON object to stdout with status "paused", form_token, workflow_run_id and resolved_default_values.',
     resume:
       'difyctl resume app <app_id> <form_token> --workflow-run-id <id> [--inputs \'{"key":"value"}\']',
   },
diff --git a/cli/src/help/skill-template.ts b/cli/src/help/skill-template.ts
index 1038a8f99ef..581d6392e13 100644
--- a/cli/src/help/skill-template.ts
+++ b/cli/src/help/skill-template.ts
@@ -26,7 +26,7 @@ output formats, error envelope, HITL protocol). Treat that JSON as the
 source of truth; this file only bootstraps you into it.
 
 ## The one non-obvious thing: HITL pauses are not failures
-A run can pause for human input. It exits with **code 2** and emits a
+A run can pause for human input. It exits with **code 0** and emits a
 \`paused\` JSON payload — this is success-with-pending, NOT a crash.
 Resume as the payload instructs (see \`difyctl resume app --help\`).
 
diff --git a/cli/src/help/topics.test.ts b/cli/src/help/topics.test.ts
index f5b2d1843e9..5a326895035 100644
--- a/cli/src/help/topics.test.ts
+++ b/cli/src/help/topics.test.ts
@@ -50,10 +50,10 @@ describe('agent topic', () => {
 })
 
 describe('external topic', () => {
-  it('mentions external bearer prefix and login flag', () => {
+  it('mentions external bearer prefix and DIFY_TOKEN onboarding', () => {
     const out = render('external')
     expect(out).toContain('dfoe_')
-    expect(out).toContain('--external')
+    expect(out).toContain('export DIFY_TOKEN')
     expect(out).toContain('DIFY_TOKEN')
   })
 
diff --git a/cli/src/help/topics.ts b/cli/src/help/topics.ts
index 3da5c0f8dfc..de2becdfa36 100644
--- a/cli/src/help/topics.ts
+++ b/cli/src/help/topics.ts
@@ -22,6 +22,9 @@ const ACCOUNT_HELP_TEXT = `difyctl: account-bearer onboarding
        difyctl run app <id> "hello" -o json
 
 Tips:
+  * Two app nouns: 'studio-app' is what you build and edit in Studio on the
+    web console inside a workspace (its source definition — export or move it);
+    'app' is a published app you run and inspect.
   * 'difyctl auth list' shows your authenticated contexts; 'difyctl use host'
     and 'difyctl use account' switch between them.
   * Pass --workspace <id> to target a non-default workspace.
@@ -37,8 +40,8 @@ const EXTERNAL_HELP_TEXT = `difyctl: external-SSO bearer onboarding
   smaller dataset:
 
   1. Acquire a token through your SSO provider (out of band).
-  2. Hand it to the CLI:
-       difyctl auth login --external --token "$DIFY_TOKEN"
+  2. Hand it to the CLI via the DIFY_TOKEN environment variable:
+       export DIFY_TOKEN="<your-token>"
 
   3. List apps your subject is permitted to invoke:
        difyctl get app
@@ -74,6 +77,16 @@ OUTPUT
   Pass -o json (or -o yaml) on every command — the JSON shape is stable and
   documented. Without it you get human tables meant for a terminal.
 
+APP vs STUDIO-APP
+  Two nouns, two faces of the same app:
+    studio-app   what you build and edit in Studio on the web console,
+                 inside a workspace — the app's source definition.
+    app          a published app, live and runnable.
+  Use 'studio-app' to work with the definition you manage on the website
+  (export it, move it between workspaces or instances); use 'app' to run
+  and inspect a published one. The COMMANDS list shows the verbs each
+  noun supports.
+
 DISCOVERY
   difyctl help -o json        full command tree + this contract, machine-readable
   difyctl get app -o json     list apps (ids + modes)
diff --git a/cli/src/http/error-mapper.test.ts b/cli/src/http/error-mapper.test.ts
index 0a487723352..3244222da07 100644
--- a/cli/src/http/error-mapper.test.ts
+++ b/cli/src/http/error-mapper.test.ts
@@ -72,6 +72,25 @@ describe('classifyResponse — canonical ErrorBody', () => {
   })
 })
 
+describe('classifyResponse 403', () => {
+  it('maps 403 to AccessDenied (exit 4 bucket)', async () => {
+    const req403 = new Request('https://x/openapi/v1/apps/abc/export')
+    const res403 = new Response(
+      JSON.stringify({ code: 'unsupported_token_type', message: 'unsupported_token_type', status: 403 }),
+      { status: 403, headers: { 'content-type': 'application/json' } },
+    )
+    const err = await classifyResponse(req403, res403)
+    expect(err.code).toBe(ErrorCode.AccessDenied)
+    expect(err.message).toBe('unsupported_token_type')
+  })
+
+  it('403 with no parseable ErrorBody falls back to generic denied message', async () => {
+    const err = await classified(403, 'not json')
+    expect(err.code).toBe(ErrorCode.AccessDenied)
+    expect(err.message).toBe('not permitted')
+  })
+})
+
 describe('classifyResponse — non-conforming bodies (no fallback by design)', () => {
   it('non-JSON body yields no serverError, classification by status', async () => {
     const err = await classified(502, '<html>bad gateway</html>')
diff --git a/cli/src/http/error-mapper.ts b/cli/src/http/error-mapper.ts
index aca1a7e6184..34d7637d4e0 100644
--- a/cli/src/http/error-mapper.ts
+++ b/cli/src/http/error-mapper.ts
@@ -44,9 +44,17 @@ const RATE_LIMITED_CLASS: StatusClass = {
   includeRaw: false,
 }
 
+const ACCESS_DENIED_CLASS: StatusClass = {
+  code: ErrorCode.AccessDenied,
+  fallbackMessage: () => 'not permitted',
+  includeRaw: false,
+}
+
 function statusClass(status: number): StatusClass {
   if (status === 401)
     return AUTH_EXPIRED_CLASS
+  if (status === 403)
+    return ACCESS_DENIED_CLASS
   if (status === 429)
     return RATE_LIMITED_CLASS
   if (status >= 500)
diff --git a/cli/src/http/orpc.test.ts b/cli/src/http/orpc.test.ts
index c99232b975f..0d1f2e12d57 100644
--- a/cli/src/http/orpc.test.ts
+++ b/cli/src/http/orpc.test.ts
@@ -44,10 +44,10 @@ describe('createOpenApiClient error mapping', () => {
   }
 
   it('recovers Dify message from a canonical ErrorBody 4xx response', async () => {
-    const caught = await classifiedError(403, { code: 'access_denied', message: 'no access', status: 403 })
+    const caught = await classifiedError(422, { code: 'invalid_param', message: 'no access', status: 422 })
 
     expect(caught.code).toBe(ErrorCode.Server4xxOther)
-    expect(caught.httpStatus).toBe(403)
+    expect(caught.httpStatus).toBe(422)
     expect(caught.message).toBe('no access')
     // Parity with the transport path: the migrated endpoint's error keeps the request
     // method/url and the raw body, so formatted errors still print the `request:` line
diff --git a/cli/src/sys/io/prompt.ts b/cli/src/sys/io/prompt.ts
index d5cc2498b96..15b3d95eb5e 100644
--- a/cli/src/sys/io/prompt.ts
+++ b/cli/src/sys/io/prompt.ts
@@ -33,6 +33,18 @@ function normalize(raw: string, opts: Pick<PromptTextOptions<unknown>, 'default'
   return trimmed
 }
 
+export async function promptConfirm(io: IOStreams, message: string): Promise<boolean> {
+  io.err.write(message)
+  const rl = readline.createInterface({ input: io.in, output: io.err, terminal: false })
+  try {
+    const line = await new Promise<string>(resolve => rl.once('line', resolve))
+    return line.trim().toLowerCase() === 'y'
+  }
+  finally {
+    rl.close()
+  }
+}
+
 export async function promptText<T>(opts: PromptTextOptions<T>): Promise<T> {
   const prompt = buildPromptLine(opts)
   const cs = colorScheme(colorEnabled(opts.io.isErrTTY))
diff --git a/cli/src/sys/io/think-filter.test.ts b/cli/src/sys/io/think-filter.test.ts
index 72ec036abdd..db07d65cd90 100644
--- a/cli/src/sys/io/think-filter.test.ts
+++ b/cli/src/sys/io/think-filter.test.ts
@@ -1,7 +1,7 @@
 import { Buffer } from 'node:buffer'
 import { PassThrough } from 'node:stream'
 import { describe, expect, it } from 'vitest'
-import { extractThinkBlocks, stripThinkBlocks, ThinkChunkFilter } from './think-filter'
+import { extractThinkBlocks, filterThinkInOutputs, stripThinkBlocks, ThinkChunkFilter } from './think-filter'
 
 function captures() {
   const out = new PassThrough()
@@ -63,6 +63,50 @@ describe('extractThinkBlocks', () => {
   })
 })
 
+// --- workflow outputs helper ---
+
+describe('filterThinkInOutputs', () => {
+  it('no think block — outputs unchanged, thinking empty', () => {
+    const r = filterThinkInOutputs({ text: 'hello' }, true)
+    expect(r.outputs).toEqual({ text: 'hello' })
+    expect(r.thinking).toBe('')
+  })
+
+  it('showThink: false — strips from string field, thinking empty', () => {
+    const r = filterThinkInOutputs({ text: '<think>reasoning</think>\nanswer' }, false)
+    expect(r.outputs).toEqual({ text: 'answer' })
+    expect(r.thinking).toBe('')
+  })
+
+  it('showThink: true — strips from string field, captures thinking', () => {
+    const r = filterThinkInOutputs({ text: '<think>step 1</think>\nfinal' }, true)
+    expect(r.outputs).toEqual({ text: 'final' })
+    expect(r.thinking).toBe('<think>\nstep 1\n</think>')
+  })
+
+  it('multiple string fields — thinking joined with separator', () => {
+    const r = filterThinkInOutputs(
+      { a: '<think>x</think>\nfoo', b: '<think>y</think>\nbar' },
+      true,
+    )
+    expect(r.outputs).toEqual({ a: 'foo', b: 'bar' })
+    expect(r.thinking).toBe('<think>\nx\n</think>\n---\n<think>\ny\n</think>')
+  })
+
+  it('non-string values pass through untouched', () => {
+    const outputs = { n: 42, flag: true, nested: { k: '<think>v</think>\nx' }, arr: ['a'], nil: null }
+    const r = filterThinkInOutputs(outputs, true)
+    expect(r.outputs).toEqual(outputs)
+    expect(r.thinking).toBe('')
+  })
+
+  it('empty outputs — empty result', () => {
+    const r = filterThinkInOutputs({}, true)
+    expect(r.outputs).toEqual({})
+    expect(r.thinking).toBe('')
+  })
+})
+
 // --- streaming chunk filter ---
 
 describe('ThinkChunkFilter — showThink: false (strip)', () => {
diff --git a/cli/src/sys/io/think-filter.ts b/cli/src/sys/io/think-filter.ts
index 401ea728f24..88c2fb7c717 100644
--- a/cli/src/sys/io/think-filter.ts
+++ b/cli/src/sys/io/think-filter.ts
@@ -14,6 +14,28 @@ export function extractThinkBlocks(s: string): { clean: string, thinking: string
   return { clean, thinking: parts.join('\n---\n') }
 }
 
+// Workflow outputs carry their answer text in top-level string fields rather than
+// a single `answer`, so think filtering navigates the outputs object. Nested
+// strings (inside arrays/objects) are left untouched.
+export function filterThinkInOutputs(
+  outputs: Record<string, unknown>,
+  showThink: boolean,
+): { outputs: Record<string, unknown>, thinking: string } {
+  const thoughts: string[] = []
+  const clean: Record<string, unknown> = {}
+  for (const [key, value] of Object.entries(outputs)) {
+    if (typeof value !== 'string') {
+      clean[key] = value
+      continue
+    }
+    const extracted = extractThinkBlocks(value)
+    clean[key] = extracted.clean
+    if (showThink && extracted.thinking !== '')
+      thoughts.push(extracted.thinking)
+  }
+  return { outputs: clean, thinking: thoughts.join('\n---\n') }
+}
+
 function splitAtPotentialTag(s: string, tag: string): [string, string] {
   const maxHold = tag.length - 1
   for (let len = Math.min(maxHold, s.length); len > 0; len--) {
diff --git a/cli/src/types/app-meta.test.ts b/cli/src/types/app-meta.test.ts
index b62d81579ea..c1ac765190d 100644
--- a/cli/src/types/app-meta.test.ts
+++ b/cli/src/types/app-meta.test.ts
@@ -9,8 +9,6 @@ function describeResp(): AppDescribeResponse {
       name: 'Greeter',
       description: '',
       mode: 'chat',
-      author: 'tester',
-      tags: [],
       updated_at: undefined,
       service_api_enabled: false,
       is_agent: false,
diff --git a/cli/src/version/info.ts b/cli/src/version/info.ts
index e8d38180fca..c43fef07d36 100644
--- a/cli/src/version/info.ts
+++ b/cli/src/version/info.ts
@@ -1,7 +1,7 @@
 import { arch, platform } from '@/sys/index'
 import { compatString } from './compat'
 
-export type Channel = 'dev' | 'edge' | 'rc' | 'stable'
+export type Channel = 'dev' | 'alpha' | 'edge' | 'rc' | 'stable'
 
 export type VersionInfo = {
   version: string
diff --git a/cli/src/version/render.test.ts b/cli/src/version/render.test.ts
index d1f40f13e58..c88ce998b9c 100644
--- a/cli/src/version/render.test.ts
+++ b/cli/src/version/render.test.ts
@@ -52,7 +52,7 @@ describe('renderVersionText', () => {
     expect(text).not.toContain('WARNING:')
   })
 
-  it('appends RC warning when channel is rc', () => {
+  it('appends warning when channel is rc', () => {
     const report: VersionReport = {
       client: baseClient({ channel: 'rc' }),
       server: { endpoint: '', reachable: false },
@@ -60,8 +60,43 @@ describe('renderVersionText', () => {
     }
     const text = renderVersionText(report)
 
-    expect(text).toContain('WARNING: This build is a release candidate')
-    expect(text).toContain('install the stable channel')
+    expect(text).toContain('WARNING: This build is a rc release')
+    expect(text).toContain('install or wait for the stable channel')
+  })
+
+  it('appends warning when channel is alpha', () => {
+    const report: VersionReport = {
+      client: baseClient({ channel: 'alpha' }),
+      server: { endpoint: '', reachable: false },
+      compat: { ...compatible(), status: 'unknown', detail: 'server probe skipped' },
+    }
+    const text = renderVersionText(report)
+
+    expect(text).toContain('WARNING: This build is a alpha release')
+    expect(text).toContain('install or wait for the stable channel')
+  })
+
+  it('appends warning when channel is edge', () => {
+    const report: VersionReport = {
+      client: baseClient({ channel: 'edge' }),
+      server: { endpoint: '', reachable: false },
+      compat: { ...compatible(), status: 'unknown', detail: 'server probe skipped' },
+    }
+    const text = renderVersionText(report)
+
+    expect(text).toContain('WARNING: This build is a edge release')
+    expect(text).toContain('install or wait for the stable channel')
+  })
+
+  it('does not append warning when channel is stable', () => {
+    const report: VersionReport = {
+      client: baseClient({ channel: 'stable' }),
+      server: { endpoint: '', reachable: false },
+      compat: { ...compatible(), status: 'unknown', detail: 'server probe skipped' },
+    }
+    const text = renderVersionText(report)
+
+    expect(text).not.toContain('WARNING:')
   })
 
   it('shows "(skipped …)" when server.endpoint is empty', () => {
@@ -105,7 +140,7 @@ describe('renderVersionText', () => {
     // RC warning) ran, yet the output is byte-clean.
     expect(plain).not.toMatch(ANSI_RE)
     expect(plain).toContain('Compatibility: incompatible')
-    expect(plain).toContain('WARNING: This build is a release candidate')
+    expect(plain).toContain('WARNING: This build is a rc release')
   })
 
   describe('with picocolors stubbed to always emit ANSI', () => {
@@ -147,8 +182,8 @@ describe('renderVersionText', () => {
       const colored = render(report, { color: true })
       expect(colored).toMatch(ANSI_RE)
       expect(colored).toContain('Compatibility: incompatible')
-      // RC warning lines also routed through yellow.
-      expect(colored).toContain('release candidate')
+      // prerelease warning lines also routed through yellow.
+      expect(colored).toContain('WARNING: This build is a rc release')
     })
   })
 
diff --git a/cli/src/version/render.ts b/cli/src/version/render.ts
index ffedc8c5c07..fa8ee721202 100644
--- a/cli/src/version/render.ts
+++ b/cli/src/version/render.ts
@@ -1,10 +1,13 @@
+import type { Channel } from './info'
 import type { VersionReport } from './probe'
 import { colorScheme } from '@/sys/io/color'
 
-const RC_WARNING_LINES = [
-  'WARNING: This build is a release candidate. It is in beta test, not stable,',
-  '         and may have bugs. For production use, install the stable channel.',
-] as const
+function prereleaseWarning(channel: Channel): readonly string[] {
+  return [
+    `WARNING: This build is a ${channel} release. It is not stable`,
+    '         and may have bugs. For production use, install or wait for the stable channel.',
+  ]
+}
 
 export type RenderOptions = {
   readonly color?: boolean
@@ -49,9 +52,9 @@ export function renderVersionText(report: VersionReport, opts: RenderOptions = {
   const verdictText = `Compatibility: ${COMPAT_LABEL[compat.status]} — ${compat.detail}`
   lines.push(compat.status === 'unsupported' ? c.yellow(verdictText) : verdictText)
 
-  if (client.channel === 'rc') {
+  if (client.channel !== 'stable') {
     lines.push('')
-    for (const line of RC_WARNING_LINES)
+    for (const line of prereleaseWarning(client.channel))
       lines.push(c.yellow(line))
   }
 
diff --git a/cli/test/e2e/setup/global-setup.ts b/cli/test/e2e/setup/global-setup.ts
index 35e171ecafb..20b23295acb 100644
--- a/cli/test/e2e/setup/global-setup.ts
+++ b/cli/test/e2e/setup/global-setup.ts
@@ -519,14 +519,14 @@ async function provisionApps(
 
   async function importAppCli(filePath: string, wsId: string): Promise<string> {
     const result = await run(
-      ['import', 'app', '--from-file', filePath, '--workspace', wsId],
+      ['import', 'studio-app', '--from-file', filePath, '--workspace', wsId],
       { configDir, timeout: 60_000 },
     )
     if (result.exitCode !== 0)
-      throw new Error(`import app failed (exit ${result.exitCode}): ${result.stderr}`)
+      throw new Error(`import studio-app failed (exit ${result.exitCode}): ${result.stderr}`)
     const match = result.stderr.match(/app ([0-9a-f-]{36})/)
     if (!match?.[1])
-      throw new Error(`import app: could not parse app_id: ${result.stderr}`)
+      throw new Error(`import studio-app: could not parse app_id: ${result.stderr}`)
     return match[1]
   }
 
diff --git a/cli/test/e2e/suites/agent/agent-skill-workflow.e2e.ts b/cli/test/e2e/suites/agent/agent-skill-workflow.e2e.ts
index a1dea13e66a..dd83592be36 100644
--- a/cli/test/e2e/suites/agent/agent-skill-workflow.e2e.ts
+++ b/cli/test/e2e/suites/agent/agent-skill-workflow.e2e.ts
@@ -288,7 +288,7 @@ describe('E2E / agent skill — get app -o json (auth required)', () => {
       expect(line.trim()).not.toMatch(/\s/)
   })
 
-  itWithSso('[P0] [SSO] dfoe_ get app → JSON error envelope (insufficient_scope)', async () => {
+  itWithSso('[P0] [SSO] dfoe_ get app -o json → permitted-apps list envelope', async () => {
     const tc = await withTempConfig()
     try {
       const { mkdir, writeFile } = await import('node:fs/promises')
@@ -296,12 +296,21 @@ describe('E2E / agent skill — get app -o json (auth required)', () => {
       await mkdir(tc.configDir, { recursive: true })
       await writeFile(
         join(tc.configDir, 'hosts.yml'),
-        `${[`current_host: ${E.host}`, 'token_storage: file', 'tokens:', `  bearer: ${E.ssoToken}`].join('\n')}\n`,
+        `${[
+          `current_host: ${E.host}`,
+          'token_storage: file',
+          'tokens:',
+          `  bearer: ${E.ssoToken}`,
+          'external_subject:',
+          '  email: sso@example.com',
+          '  issuer: https://issuer.example.com',
+        ].join('\n')}\n`,
         { mode: 0o600 },
       )
       const r = await run(['get', 'app', '-o', 'json'], { configDir: tc.configDir })
-      expect(r.exitCode).not.toBe(0)
-      assertErrorEnvelope(r)
+      assertExitCode(r, 0)
+      const parsed = assertJson<{ data: unknown[] }>(r)
+      expect(Array.isArray(parsed.data), 'permitted-apps envelope has a data array').toBe(true)
     }
     finally { await tc.cleanup() }
   })
diff --git a/cli/test/e2e/suites/auth/whoami.e2e.ts b/cli/test/e2e/suites/auth/whoami.e2e.ts
index 2caec57dd7e..69404bb9550 100644
--- a/cli/test/e2e/suites/auth/whoami.e2e.ts
+++ b/cli/test/e2e/suites/auth/whoami.e2e.ts
@@ -57,6 +57,8 @@ describe('E2E / difyctl auth whoami + SSO session', () => {
     })
   }
 
+  const itWithSso = optionalIt(Boolean(E.ssoToken))
+
   // ── auth whoami — internal user ──────────────────────────────────────────────
 
   it('[P0] internal user auth whoami outputs email', async () => {
@@ -123,12 +125,12 @@ describe('E2E / difyctl auth whoami + SSO session', () => {
     expect(result.exitCode).not.toBe(0)
   })
 
-  it('[P0] external user get app returns insufficient_scope error', async () => {
-    // Spec: external user get app returns insufficient_scope
+  itWithSso('[P0] external user can list permitted apps via SSO token', async () => {
+    // External users read apps via the permitted-external surface (no workspace scope).
     await withSSOAuth()
     const result = await r(['get', 'app'])
-    expect(result.exitCode).not.toBe(0)
-    expect(result.stderr).toMatch(/insufficient|scope|workspace|SSO/i)
+    assertExitCode(result, 0)
+    expect(result.stdout).toMatch(/NAME\s+ID\s+MODE/i)
   })
 
   it('[P0] external user whoami outputs SSO email', async () => {
@@ -138,8 +140,6 @@ describe('E2E / difyctl auth whoami + SSO session', () => {
     expect(result.stdout).toContain('sso-user@example.com')
   })
 
-  const itWithSso = optionalIt(Boolean(E.ssoToken))
-
   itWithSso('[P0] external user can execute run app using SSO token', async () => {
     await injectSsoAuth(configDir, {
       host: E.host,
diff --git a/cli/test/e2e/suites/discovery/describe-app.e2e.ts b/cli/test/e2e/suites/discovery/describe-app.e2e.ts
index 75cfe226370..68902a32da6 100644
--- a/cli/test/e2e/suites/discovery/describe-app.e2e.ts
+++ b/cli/test/e2e/suites/discovery/describe-app.e2e.ts
@@ -67,12 +67,6 @@ describe('E2E / difyctl describe app', () => {
     expect(result.stdout).toMatch(/Name:/i)
   })
 
-  it('[P1] describe output contains Tags field', async () => {
-    const result = await fx.r(['describe', 'app', E.chatAppId])
-    assertExitCode(result, 0)
-    expect(result.stdout).toMatch(/Tags:/i)
-  })
-
   // ── Input schema ──────────────────────────────────────────────────────────
 
   it('[P0] describe output contains Parameters section', async () => {
@@ -172,8 +166,9 @@ describe('E2E / difyctl describe app', () => {
 
   // ── External SSO ──────────────────────────────────────────────────────────
 
-  itWithSso('[P0] external SSO user describe app returns insufficient_scope (3.86)', async () => {
-    // Spec 3.86: dfoe_ token → insufficient_scope, exit non-0.
+  itWithSso('[P0] external SSO user can describe a permitted app', async () => {
+    // A dfoe_ token resolves `describe app` via the permitted-external surface
+    // (not the account /apps surface), so a permitted app describes successfully.
     // Uses DIFY_E2E_SSO_TOKEN; skipped when not configured.
     const { mkdir, writeFile } = await import('node:fs/promises')
     const { join } = await import('node:path')
@@ -191,8 +186,10 @@ describe('E2E / difyctl describe app', () => {
       ].join('\n')}\n`
       await writeFile(join(ssoTmp.configDir, 'hosts.yml'), hostsYml, { mode: 0o600 })
       const result = await run(['describe', 'app', E.chatAppId], { configDir: ssoTmp.configDir })
-      expect(result.exitCode, 'SSO user describe app should exit non-zero').not.toBe(0)
-      expect(result.stderr).toMatch(/insufficient_scope|scope|not_logged_in|auth/i)
+      assertExitCode(result, 0)
+      expect(result.stdout).toMatch(/ID:/i)
+      expect(result.stdout).toContain(E.chatAppId)
+      expect(result.stdout).toMatch(/Mode:/i)
     }
     finally {
       await ssoTmp.cleanup()
@@ -225,16 +222,6 @@ describe('E2E / difyctl describe app', () => {
     expect(result.stdout).toContain('e2e-test')
   })
 
-  it('[P1] describe output contains Author field (3.67)', async () => {
-    // Spec 3.67: output includes Author field when app has an author.
-    const result = await withRetry(
-      () => fx.r(['describe', 'app', E.chatAppId]),
-      { attempts: 3, delayMs: 2000 },
-    )
-    assertExitCode(result, 0)
-    expect(result.stdout).toMatch(/Author:/i)
-  })
-
   it('[P0] Inputs section shows parameter names (3.70)', async () => {
     // Spec 3.70: Parameters/Inputs section displays variable names.
     // workflow app has x, num, enum_var, paragraph.
diff --git a/cli/test/e2e/suites/discovery/get-app-all-workspaces.e2e.ts b/cli/test/e2e/suites/discovery/get-app-all-workspaces.e2e.ts
index 38d9e0a427f..54feaf9a34c 100644
--- a/cli/test/e2e/suites/discovery/get-app-all-workspaces.e2e.ts
+++ b/cli/test/e2e/suites/discovery/get-app-all-workspaces.e2e.ts
@@ -61,7 +61,7 @@ describe('E2E / difyctl get app -A (all-workspaces)', () => {
 
   eeIt('[EE][P0] -o wide output contains WORKSPACE column and JSON has workspace_id (3.92)', async () => {
     // Spec 3.92: WORKSPACE column (priority:1) appears only in -o wide mode.
-    // Default table shows priority:0 columns only (NAME/ID/MODE/TAGS/UPDATED).
+    // Default table shows priority:0 columns only (NAME/ID/MODE/UPDATED).
     const wideResult = await withRetry(
       () => fx.r(['get', 'app', '-A', '-o', 'wide']),
       { attempts: 3, delayMs: 2000 },
@@ -151,15 +151,15 @@ describe('E2E / difyctl get app -A (all-workspaces)', () => {
 
   // ── External SSO ──────────────────────────────────────────────────────────
 
-  itWithSso('[P0] external SSO user get app -A returns insufficient_scope error (3.103)', async () => {
-    // Spec 3.103: dfoe_ token on -A → insufficient_scope, exit non-0.
-    // Merged from two duplicate fake-token cases; now uses real DIFY_E2E_SSO_TOKEN.
+  itWithSso('[P0] external SSO user get app -A is rejected as an invalid flag', async () => {
+    // --all-workspaces is meaningless for external SSO users (no workspace
+    // scope), so the CLI rejects it client-side with usage_invalid_flag (exit 2).
+    // Uses real DIFY_E2E_SSO_TOKEN; skipped when not configured.
     const { mkdir, writeFile } = await import('node:fs/promises')
     const { join } = await import('node:path')
     const ssoTmp = await withTempConfig()
     try {
       await mkdir(ssoTmp.configDir, { recursive: true })
-      // Use minimal SSO hosts.yml (no workspace) so CLI hits the scope/auth error path.
       const hostsYml = `${[
         `current_host: ${E.host}`,
         `token_storage: file`,
@@ -171,8 +171,8 @@ describe('E2E / difyctl get app -A (all-workspaces)', () => {
       ].join('\n')}\n`
       await writeFile(join(ssoTmp.configDir, 'hosts.yml'), hostsYml, { mode: 0o600 })
       const result = await run(['get', 'app', '-A'], { configDir: ssoTmp.configDir })
-      expect(result.exitCode, 'SSO user -A should exit non-zero').not.toBe(0)
-      expect(result.stderr).toMatch(/insufficient_scope|scope|not_logged_in|auth|missing/i)
+      assertExitCode(result, 2)
+      expect(result.stderr).toMatch(/--all-workspaces is not available for external logins/)
     }
     finally {
       await ssoTmp.cleanup()
diff --git a/cli/test/e2e/suites/discovery/get-app-list.e2e.ts b/cli/test/e2e/suites/discovery/get-app-list.e2e.ts
index 781d351826b..61d235794ad 100644
--- a/cli/test/e2e/suites/discovery/get-app-list.e2e.ts
+++ b/cli/test/e2e/suites/discovery/get-app-list.e2e.ts
@@ -8,7 +8,6 @@
  *   DIFY_E2E_WORKFLOW_APP_ID — echo-workflow app
  */
 
-import { Buffer } from 'node:buffer'
 import { afterEach, beforeEach, describe, expect, inject, it } from 'vitest'
 import {
   assertErrorEnvelope,
@@ -99,8 +98,8 @@ describe('E2E / difyctl get app (list)', () => {
   it('[P1] -o wide outputs extended fields', async () => {
     const result = await fx.r(['get', 'app', '-o', 'wide'])
     assertExitCode(result, 0)
-    // wide adds AUTHOR and WORKSPACE columns
-    expect(result.stdout).toMatch(/AUTHOR|WORKSPACE/i)
+    // wide adds the WORKSPACE column
+    expect(result.stdout).toMatch(/WORKSPACE/i)
   })
 
   it('[P1] output is pipe-friendly in JSON mode', async () => {
@@ -178,6 +177,19 @@ describe('E2E / difyctl get app (list)', () => {
     expect(result.exitCode, '--mode chatbot should cause non-zero exit').not.toBe(0)
   })
 
+  // Regression: rag-pipeline (a knowledge Pipeline), channel (unused) and agent
+  // (roster-owned) are AppMode members but not listable app types. The old CLI
+  // whitelist advertised rag-pipeline/channel, so the CLI forwarded them and the
+  // server replied 400. The whitelist now derives from SupportedAppType, so the
+  // CLI rejects them before any HTTP call.
+  it.each(['rag-pipeline', 'channel', 'agent'])(
+    '[P0] non-listable mode %s is intercepted client-side',
+    async (mode) => {
+      const result = await fx.r(['get', 'app', '--mode', mode])
+      expect(result.exitCode, `--mode ${mode} should be rejected client-side`).not.toBe(0)
+    },
+  )
+
   // ── workspace override ────────────────────────────────────────────────────
 
   it('[P0] -w overrides the default workspace', async () => {
@@ -206,17 +218,15 @@ describe('E2E / difyctl get app (list)', () => {
 
   // ── External SSO ──────────────────────────────────────────────────────────
 
-  itWithSso('[P0] external SSO user get app returns insufficient_scope error (3.24 / 3.25)', async () => {
-    // Spec 3.24: dfoe_ token → insufficient_scope; Spec 3.25: exit code is 1.
+  itWithSso('[P0] external SSO user can list permitted apps', async () => {
+    // A dfoe_ token lists apps via the permitted-external surface
+    // (apps:read:permitted-external scope), with no workspace scoping.
     // Uses DIFY_E2E_SSO_TOKEN (itWithSso skips when not configured).
     const { mkdir, writeFile } = await import('node:fs/promises')
     const { join } = await import('node:path')
     const ssoTmp = await withTempConfig()
     try {
       await mkdir(ssoTmp.configDir, { recursive: true })
-      // SSO (dfoe_) users have apps:run scope only, not apps:list.
-      // Inject a minimal hosts.yml without workspace so the CLI reaches the
-      // scope-check path rather than resolving the workspace successfully.
       const hostsYml = `${[
         `current_host: ${E.host}`,
         `token_storage: file`,
@@ -228,8 +238,8 @@ describe('E2E / difyctl get app (list)', () => {
       ].join('\n')}\n`
       await writeFile(join(ssoTmp.configDir, 'hosts.yml'), hostsYml, { mode: 0o600 })
       const result = await run(['get', 'app'], { configDir: ssoTmp.configDir })
-      expect(result.exitCode, 'SSO user get app should exit non-zero').not.toBe(0)
-      expect(result.stderr).toMatch(/insufficient_scope|scope|not_logged_in|auth/i)
+      assertExitCode(result, 0)
+      expect(result.stdout).toMatch(/NAME\s+ID\s+MODE/i)
     }
     finally {
       await ssoTmp.cleanup()
@@ -348,114 +358,4 @@ describe('E2E / difyctl get app (list)', () => {
       await networkTmp.cleanup()
     }
   })
-
-  it('[P1] --tag filter returns only apps that carry the specified tag (3.20)', async () => {
-    // Spec 3.20: --tag performs exact tag-name match.
-    //
-    // Before asserting: ensure echo-chat app has the 'e2e-test' tag.
-    //  1. GET /console/api/tags?type=app&keyword=e2e-test  → find or confirm tag exists
-    //  2. POST /console/api/tags                           → create tag when absent
-    //  3. GET /console/api/apps/<id>                       → check existing bindings
-    //  4. POST /console/api/tag-bindings                   → bind when not yet bound
-
-    const base = E.host.replace(/\/$/, '')
-
-    // ── Console login: obtain cookie + CSRF (console API rejects dfoa_ Bearer) ──
-    const passwordB64 = Buffer.from(E.password, 'utf8').toString('base64')
-    const loginRes = await fetch(`${base}/console/api/login`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ email: E.email, password: passwordB64, remember_me: false }),
-    })
-    expect(loginRes.ok, `console login failed: ${loginRes.status}`).toBe(true)
-
-    // Helper: extract cookie string + csrf from Set-Cookie array
-    function parseCookies(res: Response): { cookieString: string, csrfToken: string } {
-      const setCookies = res.headers.getSetCookie?.() ?? []
-      const cookieString = setCookies.map(kv => kv.split(';')[0]).join('; ')
-      const csrfPair = setCookies.map(kv => kv.split(';')[0]).filter((p): p is string => typeof p === 'string' && p.includes('csrf_token='))[0]
-      const csrfToken = csrfPair !== undefined
-        ? csrfPair.slice(csrfPair.indexOf('csrf_token=') + 'csrf_token='.length)
-        : ''
-      return { cookieString, csrfToken }
-    }
-
-    let { cookieString, csrfToken } = parseCookies(loginRes)
-
-    // ── Switch to the workspace that contains the test fixtures ──────────────
-    // E.workspaceId is resolved by global-setup; tag-bindings scope to the active workspace.
-    const switchRes = await fetch(`${base}/console/api/workspaces/switch`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', 'Cookie': cookieString, 'X-CSRF-Token': csrfToken },
-      body: JSON.stringify({ tenant_id: E.workspaceId }),
-    })
-    // After workspace switch the server issues fresh cookies; use them for all subsequent calls.
-    if (switchRes.ok && switchRes.headers.getSetCookie?.().length) {
-      const switched = parseCookies(switchRes)
-      cookieString = switched.cookieString
-      csrfToken = switched.csrfToken
-    }
-
-    const headers: Record<string, string> = {
-      'Content-Type': 'application/json',
-      'Cookie': cookieString,
-      'X-CSRF-Token': csrfToken,
-    }
-
-    // ── Step 1: find the 'e2e-test' app tag ──────────────────────────────────
-    const tagsRes = await fetch(`${base}/console/api/tags?type=app&keyword=e2e-test`, { headers })
-    expect(tagsRes.ok, `GET /tags failed: ${tagsRes.status}`).toBe(true)
-    const tagsList = await tagsRes.json() as Array<{ id: string, name: string }>
-    let tagId = tagsList.find(t => t.name === 'e2e-test')?.id
-
-    // ── Step 2: create the tag if it doesn't exist yet ───────────────────────
-    if (!tagId) {
-      const createRes = await fetch(`${base}/console/api/tags`, {
-        method: 'POST',
-        headers,
-        body: JSON.stringify({ name: 'e2e-test', type: 'app' }),
-      })
-      expect(createRes.ok, `POST /tags failed: ${createRes.status}`).toBe(true)
-      const created = await createRes.json() as { id: string, name: string }
-      tagId = created.id
-    }
-
-    expect(tagId, 'tag id must be resolved').toBeTruthy()
-
-    // ── Step 3 & 4: bind tag idempotently (tag-bindings is idempotent on duplicates) ──
-    const bindRes = await fetch(`${base}/console/api/tag-bindings`, {
-      method: 'POST',
-      headers,
-      body: JSON.stringify({
-        tag_ids: [tagId],
-        target_id: E.chatAppId,
-        type: 'app',
-      }),
-    })
-    // Accept 200 (bound) or 409/4xx if already bound — binding is idempotent
-    expect(
-      bindRes.ok || bindRes.status === 409,
-      `POST /tag-bindings failed unexpectedly: ${bindRes.status}`,
-    ).toBe(true)
-
-    // ── Assertion: difyctl --tag e2e-test returns echo-chat ──────────────────
-    const result = await fx.r(['get', 'app', '--tag', 'e2e-test', '-o', 'json'])
-    assertExitCode(result, 0)
-    const parsed = assertJson<{ data: Array<{ id: string, name: string, tags: Array<{ name: string }> }> }>(result)
-
-    // echo-chat must appear in the filtered list
-    const echoChatInResult = parsed.data.find(app => app.id === E.chatAppId)
-    expect(
-      echoChatInResult,
-      `echo-chat (id=${E.chatAppId}) should appear in --tag e2e-test results`,
-    ).toBeDefined()
-
-    // Every returned app must carry the e2e-test tag
-    parsed.data.forEach(app =>
-      expect(
-        app.tags.some(t => t.name === 'e2e-test'),
-        `app "${app.name}" should carry the e2e-test tag`,
-      ).toBe(true),
-    )
-  })
 })
diff --git a/cli/test/e2e/suites/discovery/get-app-single.e2e.ts b/cli/test/e2e/suites/discovery/get-app-single.e2e.ts
index b09ce25d679..b620eb383ef 100644
--- a/cli/test/e2e/suites/discovery/get-app-single.e2e.ts
+++ b/cli/test/e2e/suites/discovery/get-app-single.e2e.ts
@@ -68,8 +68,9 @@ describe('E2E / difyctl get app <id> (single)', () => {
 
   // ── External SSO ──────────────────────────────────────────────────────────
 
-  itWithSso('[P0] external SSO user get app <id> returns insufficient_scope error (3.55)', async () => {
-    // Spec 3.55: dfoe_ token on get app <id> → insufficient_scope, exit 1.
+  itWithSso('[P0] external SSO user can get a permitted app by id', async () => {
+    // A dfoe_ token resolves get app <id> via the permitted-external describe
+    // surface (apps:read:permitted-external scope), so a permitted app is returned.
     // Uses DIFY_E2E_SSO_TOKEN; skipped when not configured.
     const { mkdir, writeFile } = await import('node:fs/promises')
     const { join } = await import('node:path')
@@ -87,8 +88,8 @@ describe('E2E / difyctl get app <id> (single)', () => {
       ].join('\n')}\n`
       await writeFile(join(ssoTmp.configDir, 'hosts.yml'), hostsYml, { mode: 0o600 })
       const result = await run(['get', 'app', E.chatAppId], { configDir: ssoTmp.configDir })
-      expect(result.exitCode, 'SSO user get app <id> should exit non-zero').not.toBe(0)
-      expect(result.stderr).toMatch(/insufficient_scope|scope|not_logged_in|auth/i)
+      assertExitCode(result, 0)
+      expect(result.stdout).toContain(E.chatAppId)
     }
     finally {
       await ssoTmp.cleanup()
@@ -153,13 +154,13 @@ describe('E2E / difyctl get app <id> (single)', () => {
   })
 
   it('[P1] get app <id> -o wide outputs extended columns (3.48)', async () => {
-    // Spec 3.48: -o wide → TAGS/UPDATED/AUTHOR columns, exit 0.
+    // Spec 3.48: -o wide → UPDATED/WORKSPACE columns, exit 0.
     const result = await withRetry(
       () => fx.r(['get', 'app', E.chatAppId, '-o', 'wide']),
       { attempts: 3, delayMs: 2000 },
     )
     assertExitCode(result, 0)
-    expect(result.stdout).toMatch(/AUTHOR|UPDATED|TAGS/i)
+    expect(result.stdout).toMatch(/UPDATED|WORKSPACE/i)
   })
 
   it('[P1] get app <id> -o json is pipe-friendly with no ANSI (3.49)', async () => {
diff --git a/cli/test/e2e/suites/dsl/export-app.e2e.ts b/cli/test/e2e/suites/dsl/export-studio-app.e2e.ts
similarity index 82%
rename from cli/test/e2e/suites/dsl/export-app.e2e.ts
rename to cli/test/e2e/suites/dsl/export-studio-app.e2e.ts
index f96fbd216a4..e158ceaccec 100644
--- a/cli/test/e2e/suites/dsl/export-app.e2e.ts
+++ b/cli/test/e2e/suites/dsl/export-studio-app.e2e.ts
@@ -1,5 +1,5 @@
 /**
- * E2E: difyctl export app — DSL export
+ * E2E: difyctl export studio-app — DSL export
  *
  * Prerequisites (DIFY_E2E_* env vars):
  *   DIFY_E2E_WORKFLOW_APP_ID — echo-workflow app (no model provider dependency)
@@ -21,7 +21,7 @@ import { resolveEnv } from '../../setup/env.js'
 const caps = inject('e2eCapabilities') as import('../../setup/env.js').E2ECapabilities
 const E = resolveEnv(caps)
 
-describe('E2E / difyctl export app', () => {
+describe('E2E / difyctl export studio-app', () => {
   let fx: AuthFixture
 
   beforeEach(async () => {
@@ -34,37 +34,37 @@ describe('E2E / difyctl export app', () => {
   // ── Basic export ──────────────────────────────────────────────────────────
 
   it('[P0] exported DSL is non-empty YAML printed to stdout', async () => {
-    const result = await fx.r(['export', 'app', E.workflowAppId])
+    const result = await fx.r(['export', 'studio-app', E.workflowAppId])
     assertExitCode(result, 0)
     expect(result.stdout.trim().length).toBeGreaterThan(0)
   })
 
   it('[P0] exported YAML contains kind: app', async () => {
-    const result = await fx.r(['export', 'app', E.workflowAppId])
+    const result = await fx.r(['export', 'studio-app', E.workflowAppId])
     assertExitCode(result, 0)
     expect(result.stdout).toMatch(/^kind:\s*app/m)
   })
 
   it('[P0] exported YAML contains version field', async () => {
-    const result = await fx.r(['export', 'app', E.workflowAppId])
+    const result = await fx.r(['export', 'studio-app', E.workflowAppId])
     assertExitCode(result, 0)
     expect(result.stdout).toMatch(/^version:/m)
   })
 
   it('[P0] exported YAML contains app section with mode', async () => {
-    const result = await fx.r(['export', 'app', E.workflowAppId])
+    const result = await fx.r(['export', 'studio-app', E.workflowAppId])
     assertExitCode(result, 0)
     expect(result.stdout).toMatch(/^\s+mode:/m)
   })
 
   it('[P1] exported YAML ends with a newline (POSIX pipe convention)', async () => {
-    const result = await fx.r(['export', 'app', E.workflowAppId])
+    const result = await fx.r(['export', 'studio-app', E.workflowAppId])
     assertExitCode(result, 0)
     expect(result.stdout.endsWith('\n')).toBe(true)
   })
 
   it('[P1] chat app export also succeeds and includes mode', async () => {
-    const result = await fx.r(['export', 'app', E.chatAppId])
+    const result = await fx.r(['export', 'studio-app', E.chatAppId])
     assertExitCode(result, 0)
     expect(result.stdout).toMatch(/^kind:\s*app/m)
     expect(result.stdout).toMatch(/^\s+mode:/m)
@@ -76,7 +76,7 @@ describe('E2E / difyctl export app', () => {
     const dir = await mkdtemp(join(tmpdir(), 'difyctl-e2e-export-'))
     const outPath = join(dir, 'exported.yaml')
     try {
-      const result = await fx.r(['export', 'app', E.workflowAppId, '--output', outPath])
+      const result = await fx.r(['export', 'studio-app', E.workflowAppId, '--output', outPath])
       assertExitCode(result, 0)
       const content = await readFile(outPath, 'utf8')
       expect(content).toMatch(/^kind:\s*app/m)
@@ -92,8 +92,8 @@ describe('E2E / difyctl export app', () => {
     const outPath = join(dir, 'exported.yaml')
     try {
       const [stdoutResult, fileResult] = await Promise.all([
-        fx.r(['export', 'app', E.workflowAppId]),
-        fx.r(['export', 'app', E.workflowAppId, '--output', outPath]).then(async (r) => {
+        fx.r(['export', 'studio-app', E.workflowAppId]),
+        fx.r(['export', 'studio-app', E.workflowAppId, '--output', outPath]).then(async (r) => {
           const content = await readFile(outPath, 'utf8')
           return { exitCode: r.exitCode, content }
         }),
@@ -113,12 +113,12 @@ describe('E2E / difyctl export app', () => {
     const dir = await mkdtemp(join(tmpdir(), 'difyctl-e2e-roundtrip-'))
     const dslPath = join(dir, 'roundtrip.yaml')
     try {
-      const exportResult = await fx.r(['export', 'app', E.workflowAppId, '--output', dslPath])
+      const exportResult = await fx.r(['export', 'studio-app', E.workflowAppId, '--output', dslPath])
       assertExitCode(exportResult, 0)
 
       const importResult = await fx.r([
         'import',
-        'app',
+        'studio-app',
         '--from-file',
         dslPath,
         '--name',
@@ -137,7 +137,7 @@ describe('E2E / difyctl export app', () => {
   // ── Error scenarios ───────────────────────────────────────────────────────
 
   it('[P0] non-existent app returns exit code 1 with error in stderr', async () => {
-    const result = await fx.r(['export', 'app', 'nonexistent-app-id-export-e2e'])
+    const result = await fx.r(['export', 'studio-app', 'nonexistent-app-id-export-e2e'])
     expect(result.exitCode).toBe(1)
     expect(result.stderr.length).toBeGreaterThan(0)
   })
@@ -145,7 +145,7 @@ describe('E2E / difyctl export app', () => {
   it('[P0] unauthenticated export returns auth error (exit code 4)', async () => {
     const unauthTmp = await withTempConfig()
     try {
-      const result = await run(['export', 'app', E.workflowAppId], {
+      const result = await run(['export', 'studio-app', E.workflowAppId], {
         configDir: unauthTmp.configDir,
       })
       assertExitCode(result, 4)
@@ -156,13 +156,13 @@ describe('E2E / difyctl export app', () => {
   })
 
   it('[P1] export with missing app id argument exits non-zero', async () => {
-    const result = await fx.r(['export', 'app'])
+    const result = await fx.r(['export', 'studio-app'])
     expect(result.exitCode).not.toBe(0)
     expect(result.stderr).toMatch(/missing required argument|required|app id/i)
   })
 
   it('[P1] malformed --workflow-id returns a 4xx, not a 5xx', async () => {
-    const result = await fx.r(['export', 'app', E.workflowAppId, '--workflow-id', 'not-a-uuid'])
+    const result = await fx.r(['export', 'studio-app', E.workflowAppId, '--workflow-id', 'not-a-uuid'])
     expect(result.exitCode).not.toBe(0)
     expect(result.stderr).toMatch(/http_status:\s*4\d\d/)
     expect(result.stderr).not.toMatch(/http_status:\s*5\d\d/)
@@ -171,7 +171,7 @@ describe('E2E / difyctl export app', () => {
   it('[P1] non-existent --workflow-id returns 404, not a 5xx', async () => {
     const result = await fx.r([
       'export',
-      'app',
+      'studio-app',
       E.workflowAppId,
       '--workflow-id',
       '00000000-0000-0000-0000-000000000000',
@@ -184,7 +184,7 @@ describe('E2E / difyctl export app', () => {
     const dir = await mkdtemp(join(tmpdir(), 'difyctl-e2e-export-nofile-'))
     const outPath = join(dir, 'should-not-exist.yaml')
     try {
-      const result = await fx.r(['export', 'app', 'nonexistent-app-id-nofile-e2e', '--output', outPath])
+      const result = await fx.r(['export', 'studio-app', 'nonexistent-app-id-nofile-e2e', '--output', outPath])
       expect(result.exitCode).not.toBe(0)
       const exists = await readFile(outPath, 'utf8').then(() => true).catch(() => false)
       expect(exists, 'output file must not be created on export failure').toBe(false)
diff --git a/cli/test/e2e/suites/error-handling/error-messages.e2e.ts b/cli/test/e2e/suites/error-handling/error-messages.e2e.ts
index 932998d9afe..5c4a9f79fa0 100644
--- a/cli/test/e2e/suites/error-handling/error-messages.e2e.ts
+++ b/cli/test/e2e/suites/error-handling/error-messages.e2e.ts
@@ -82,10 +82,9 @@ describe('E2E / error message standards (spec 5.3)', () => {
 
   // ── 5.63  dfoe_ token insufficient_scope ──────────────────────────────────
 
-  itWithSso('[P0] 5.63 dfoe_ SSO token with workspace returns insufficient_scope for management commands', async () => {
-    // Spec 5.63: an external SSO token (dfoe_) must not be able to access
-    // internal management APIs; the CLI must return an insufficient_scope
-    // error with exit 1.
+  itWithSso('[P0] dfoe_ SSO token is denied account-only management commands', async () => {
+    // A dfoe_ SSO token is rejected with a non-zero exit when it targets an
+    // account-only management command (`export studio-app`).
     const { mkdir } = await import('node:fs/promises')
     const ssoTmp = await withTempConfig()
     try {
@@ -95,16 +94,13 @@ describe('E2E / error message standards (spec 5.3)', () => {
         `token_storage: file`,
         `tokens:`,
         `  bearer: ${E.ssoToken}`,
-        `workspace:`,
-        `  id: ${E.workspaceId}`,
-        `  name: "${E.workspaceName}"`,
-        `  role: member`,
+        `external_subject:`,
+        `  email: sso@example.com`,
+        `  issuer: https://issuer.example.com`,
       ].join('\n')}\n`
       await writeFile(join(ssoTmp.configDir, 'hosts.yml'), hostsYml, { mode: 0o600 })
-      const result = await run(['get', 'app'], { configDir: ssoTmp.configDir })
+      const result = await run(['export', 'studio-app', E.chatAppId], { configDir: ssoTmp.configDir })
       assertNonZeroExit(result)
-      // In this environment ssoToken may be a dfoa_ token; the server returns
-      // either insufficient_scope or server_5xx — both are non-zero exits.
       expect(result.stderr.trim().length, 'stderr must contain an error message').toBeGreaterThan(0)
     }
     finally {
diff --git a/cli/test/e2e/suites/output/table-output.e2e.ts b/cli/test/e2e/suites/output/table-output.e2e.ts
index c3300f8bec0..ecfb0577d96 100644
--- a/cli/test/e2e/suites/output/table-output.e2e.ts
+++ b/cli/test/e2e/suites/output/table-output.e2e.ts
@@ -41,7 +41,7 @@ import type { AuthFixture } from '../../helpers/cli.js'
 import { afterEach, beforeEach, describe, expect, it, inject } from 'vitest'
 import { assertExitCode, assertNoAnsi } from '../../helpers/assert.js'
 import { withAuthFixture } from '../../helpers/cli.js'
-import { loadE2EEnv, resolveEnv } from '../../setup/env.js'
+import { resolveEnv } from '../../setup/env.js'
 
 // @ts-expect-error — see test/e2e/helpers/vitest-context.ts for explanation
 const caps = inject('e2eCapabilities') as import('../../setup/env.js').E2ECapabilities
@@ -65,19 +65,18 @@ describe('E2E / table output — header and column format (spec 5.1–5.19)', ()
     expect(result.stdout.trim().length).toBeGreaterThan(0)
   })
 
-  it('[P0] 5.2 header row contains all five expected column names', async () => {
-    // Spec 5.2: header columns are NAME / ID / MODE / TAGS / UPDATED.
+  it('[P0] 5.2 header row contains all four expected column names', async () => {
+    // Spec 5.2: header columns are NAME / ID / MODE / UPDATED.
     const result = await fx.r(['get', 'app'])
     assertExitCode(result, 0)
     const header = result.stdout.split('\n')[0] ?? ''
     expect(header).toMatch(/NAME/i)
     expect(header).toMatch(/ID/i)
     expect(header).toMatch(/MODE/i)
-    expect(header).toMatch(/TAGS/i)
     expect(header).toMatch(/UPDATED/i)
   })
 
-  it('[P0] 5.3 column order is NAME → ID → MODE → TAGS → UPDATED', async () => {
+  it('[P0] 5.3 column order is NAME → ID → MODE → UPDATED', async () => {
     // Spec 5.3: columns appear in the defined order (as verified from actual CLI output).
     const result = await fx.r(['get', 'app'])
     assertExitCode(result, 0)
@@ -85,19 +84,16 @@ describe('E2E / table output — header and column format (spec 5.1–5.19)', ()
     const nameIdx = header.indexOf('NAME')
     const idIdx = header.indexOf('ID')
     const modeIdx = header.indexOf('MODE')
-    const tagsIdx = header.indexOf('TAGS')
     const updatedIdx = header.indexOf('UPDATED')
     // All columns must be present
     expect(nameIdx).toBeGreaterThanOrEqual(0)
     expect(idIdx).toBeGreaterThanOrEqual(0)
     expect(modeIdx).toBeGreaterThanOrEqual(0)
-    expect(tagsIdx).toBeGreaterThanOrEqual(0)
     expect(updatedIdx).toBeGreaterThanOrEqual(0)
     // Verify left-to-right order
     expect(nameIdx).toBeLessThan(idIdx)
     expect(idIdx).toBeLessThan(modeIdx)
-    expect(modeIdx).toBeLessThan(tagsIdx)
-    expect(tagsIdx).toBeLessThan(updatedIdx)
+    expect(modeIdx).toBeLessThan(updatedIdx)
   })
 
   it('[P0] 5.5 table displays multiple data rows when more than one app exists', async () => {
@@ -153,32 +149,6 @@ describe('E2E / table output — header and column format (spec 5.1–5.19)', ()
     expect(result.stdout).not.toMatch(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/)
   })
 
-  // ── 5.17 — Empty-field rendering ─────────────────────────────────────────
-
-  it('[P1] 5.17 empty TAGS field is rendered as blank — not as a dash (-)', async () => {
-    // Spec 5.17: empty fields show blank, not the `-` placeholder.
-    // Most apps in the fixture workspace have no tags.
-    const result = await fx.r(['get', 'app'])
-    assertExitCode(result, 0)
-    const lines = result.stdout.trim().split('\n')
-    const header = lines[0] ?? ''
-    const tagsStart = header.indexOf('TAGS')
-    const updatedStart = header.indexOf('UPDATED')
-    // Check at least one data row: the TAGS slice should be blank, not '-'
-    const dataLines = lines.slice(1).filter(l => l.trim())
-    if (dataLines.length > 0 && tagsStart >= 0 && updatedStart > tagsStart) {
-      const tagsSlice = (dataLines[0] ?? '').substring(tagsStart, updatedStart).trim()
-      // If there are no tags, the slice should be empty (not contain a lone '-')
-      if (tagsSlice === '') {
-        expect(tagsSlice).toBe('')
-      }
-      else {
-        // Tags are present — just verify it's not the placeholder dash
-        expect(tagsSlice).not.toBe('-')
-      }
-    }
-  })
-
   // ── 5.25 — Performance ────────────────────────────────────────────────────
 
   it('[P1] 5.25 querying up to 100 apps completes without timeout', async () => {
diff --git a/cli/test/e2e/suites/run/run-app-hitl.e2e.ts b/cli/test/e2e/suites/run/run-app-hitl.e2e.ts
index a582bc5282c..58290331c90 100644
--- a/cli/test/e2e/suites/run/run-app-hitl.e2e.ts
+++ b/cli/test/e2e/suites/run/run-app-hitl.e2e.ts
@@ -386,15 +386,7 @@ describeExternal('E2E / difyctl run app — HITL display_in_ui=false (4.5.8)', (
     await fx.cleanup()
   })
 
-  it('[P1] 4.5.8 HITL pause with display_in_ui=false: JSON contains display_in_ui=false and exit is 0', async () => {
-    // Spec 4.5.8: when the Human Input node has display_in_ui=false the CLI
-    // should indicate the form is delivered via an external channel.
-    //
-    // Current CLI behaviour (v1.0): the JSON field display_in_ui is correctly
-    // set to false.  The stderr hint still includes the resume command (the
-    // "form delivered via external channel" hint is not yet implemented in CLI).
-    // This test verifies the current actual behaviour and will need updating
-    // once the CLI implements the display_in_ui=false hint distinction.
+  it('[P1] 4.5.8 HITL pause with display_in_ui=false: external-channel form is not CLI-resumable', async () => {
     const result = await fx.r([
       'run',
       'app',
@@ -407,7 +399,8 @@ describeExternal('E2E / difyctl run app — HITL display_in_ui=false (4.5.8)', (
     const parsed = assertJson<{
       status: string
       display_in_ui: boolean
-      form_token: string
+      form_token: string | null
+      approval_channels: string[]
       workflow_run_id: string
     }>(result)
 
@@ -417,12 +410,13 @@ describeExternal('E2E / difyctl run app — HITL display_in_ui=false (4.5.8)', (
     // status must be paused
     expect(parsed.status).toBe('paused')
 
-    // form_token must be present (resume is still possible even for external delivery)
-    expect(parsed.form_token, 'form_token must be non-empty').toBeTruthy()
+    // external delivery is not CLI-resumable: no token, channels name the real route
+    expect(parsed.form_token, 'form_token must be null for external delivery').toBeNull()
+    expect(parsed.approval_channels, 'approval_channels must name the delivery channel').toContain('email')
 
-    // stderr must contain a hint (current behaviour: hint includes resume command)
-    expect(result.stderr.trim().length, 'stderr must contain a hint').toBeGreaterThan(0)
-    expect(result.stderr).toMatch(/hint|resume|paused/i)
+    // stderr hint must describe the channel, not offer a resume command
+    expect(result.stderr).toMatch(/delivered via|resume only from/i)
+    expect(result.stderr).not.toMatch(/difyctl resume/i)
   })
 })
 
diff --git a/cli/test/fixtures/dify-mock/scenarios.ts b/cli/test/fixtures/dify-mock/scenarios.ts
index 8ee839381c5..221ccbb6b81 100644
--- a/cli/test/fixtures/dify-mock/scenarios.ts
+++ b/cli/test/fixtures/dify-mock/scenarios.ts
@@ -14,6 +14,7 @@ export type Scenario
     | 'server-version-empty'
     | 'server-version-unsupported'
     | 'run-422-stale'
+    | 'workflow-think'
     | 'import-pending'
     | 'import-failed'
 
diff --git a/cli/test/fixtures/dify-mock/server.ts b/cli/test/fixtures/dify-mock/server.ts
index 96edc96f9ba..4b119286dbc 100644
--- a/cli/test/fixtures/dify-mock/server.ts
+++ b/cli/test/fixtures/dify-mock/server.ts
@@ -269,8 +269,34 @@ export function buildApp(getScenario: () => Scenario, state?: MockState): Hono {
             name: app.name,
             description: app.description,
             mode: app.mode,
-            author: app.author ?? '',
-            tags: app.tags,
+            updated_at: app.updated_at,
+            service_api_enabled: app.service_api_enabled ?? false,
+            is_agent: app.is_agent ?? false,
+          }
+        : null,
+      parameters: wantParams ? (app.parameters ?? null) : null,
+      input_schema: wantInputSchema ? (app.input_schema ?? null) : null,
+    })
+  })
+
+  app.get('/openapi/v1/permitted-external-apps/:id/describe', (c) => {
+    const id = c.req.param('id')
+    const fieldsRaw = c.req.query('fields') ?? ''
+    const fields = fieldsRaw === '' ? [] : fieldsRaw.split(',').map(s => s.trim()).filter(s => s !== '')
+    // External subjects have no workspace scope; the app is reachable across workspaces.
+    const app = APPS.find(a => a.id === id)
+    if (app === undefined)
+      return c.json({ error: { code: 'not_found', message: 'app not found' } }, { status: 404 })
+    const wantInfo = fields.length === 0 || fields.includes('info')
+    const wantParams = fields.length === 0 || fields.includes('parameters')
+    const wantInputSchema = fields.length === 0 || fields.includes('input_schema')
+    return c.json({
+      info: wantInfo
+        ? {
+            id: app.id,
+            name: app.name,
+            description: app.description,
+            mode: app.mode,
             updated_at: app.updated_at,
             service_api_enabled: app.service_api_enabled ?? false,
             is_agent: app.is_agent ?? false,
@@ -337,6 +363,13 @@ export function buildApp(getScenario: () => Scenario, state?: MockState): Hono {
     if (scenario === 'hitl-pause') {
       return new Response(hitlPauseResponse(), { status: 200, headers: { 'content-type': 'text/event-stream' } })
     }
+    if (scenario === 'workflow-think') {
+      const thinkSse = sseChunks([
+        { event: 'workflow_started', data: { id: 'wf-run-1', workflow_id: 'wf-1' } },
+        { event: 'workflow_finished', data: { id: 'wf-run-1', workflow_id: 'wf-1', data: { id: 'wf-run-1', status: 'succeeded', outputs: { result: '<think>secret reasoning</think>\nfinal answer' } } } },
+      ])
+      return new Response(thinkSse, { status: 200, headers: { 'content-type': 'text/event-stream' } })
+    }
     const sse = streamingRunResponse(app.mode, query, isAgent)
     return new Response(sse, { status: 200, headers: { 'content-type': 'text/event-stream' } })
   })
diff --git a/dify-agent/docker/local-sandbox/Dockerfile b/dify-agent/docker/local-sandbox/Dockerfile
new file mode 100644
index 00000000000..2dd3dbb677a
--- /dev/null
+++ b/dify-agent/docker/local-sandbox/Dockerfile
@@ -0,0 +1,59 @@
+# Local sandbox image for shellctl-managed Dify Agent workspaces.
+#
+# Build this from the dify-agent package root:
+#   docker build -f docker/local-sandbox/Dockerfile -t dify-agent-local-sandbox:local .
+#
+# This image merges the former shellctl-only image with the sandbox-visible
+# Agent Stub client CLI. It runs shellctl by default, and shellctl-managed jobs
+# can call `dify-agent ...` without installing extra packages at runtime.
+
+FROM python:3.12-slim-bookworm AS base
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PIP_NO_CACHE_DIR=1 \
+    DIFY_AGENT_STUB_DRIVE_BASE=/mnt/drive
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        ca-certificates \
+        curl \
+        tmux \
+    && rm -rf /var/lib/apt/lists/*
+
+ENV UV_VERSION=0.8.9
+RUN python -m pip install --no-cache-dir "uv==${UV_VERSION}"
+
+WORKDIR /opt/dify-agent
+
+
+FROM base AS packages
+
+ENV SHELL_SESSION_MANAGER_VERSION=2.2.1
+
+COPY pyproject.toml uv.lock README.md ./
+COPY src ./src
+
+RUN uv sync --frozen --no-dev --no-editable --extra grpc \
+    && uv pip install --python .venv/bin/python "shell-session-manager==${SHELL_SESSION_MANAGER_VERSION}"
+
+
+FROM base AS production
+
+ENV VIRTUAL_ENV=/opt/dify-agent/.venv
+ENV PATH="${VIRTUAL_ENV}/bin:${PATH}"
+
+COPY --from=packages ${VIRTUAL_ENV} ${VIRTUAL_ENV}
+
+RUN ln -s ${VIRTUAL_ENV}/bin/dify-agent /usr/local/bin/dify-agent \
+    && ln -s ${VIRTUAL_ENV}/bin/shellctl /usr/local/bin/shellctl \
+    && useradd --create-home --shell /bin/sh dify \
+    && mkdir -p /mnt/drive \
+    && chown -R dify:dify /home/dify /mnt/drive
+
+USER dify
+WORKDIR /home/dify
+
+EXPOSE 5004
+
+CMD ["shellctl", "serve", "--listen", "0.0.0.0:5004"]
diff --git a/dify-agent/docker/shellctl/Dockerfile b/dify-agent/docker/shellctl/Dockerfile
deleted file mode 100644
index 24f6460064c..00000000000
--- a/dify-agent/docker/shellctl/Dockerfile
+++ /dev/null
@@ -1,25 +0,0 @@
-FROM python:3.13-slim
-
-ENV PYTHONDONTWRITEBYTECODE=1 \
-    PYTHONUNBUFFERED=1 \
-    PIP_NO_CACHE_DIR=1
-
-RUN apt-get update \
-    && apt-get install -y --no-install-recommends \
-        ca-certificates \
-        curl \
-        tmux \
-    && rm -rf /var/lib/apt/lists/*
-
-RUN python -m pip install --no-cache-dir \
-        shell-session-manager==2.2.0 \
-        uv
-
-RUN useradd --create-home --shell /bin/sh dify
-
-USER dify
-WORKDIR /home/dify
-
-EXPOSE 5004
-
-CMD ["shellctl", "serve", "--listen", "0.0.0.0:5004"]
diff --git a/dify-agent/docs/dify-agent/get-started/index.md b/dify-agent/docs/dify-agent/get-started/index.md
index 78a7db84371..347e85e3d81 100644
--- a/dify-agent/docs/dify-agent/get-started/index.md
+++ b/dify-agent/docs/dify-agent/get-started/index.md
@@ -51,6 +51,9 @@ DIFY_AGENT_REDIS_PREFIX=dify-agent
 
 DIFY_AGENT_PLUGIN_DAEMON_URL=http://localhost:5002
 DIFY_AGENT_PLUGIN_DAEMON_API_KEY=replace-with-plugin-daemon-server-key
+
+DIFY_AGENT_INNER_API_URL=http://localhost:5001
+DIFY_AGENT_INNER_API_KEY=replace-with-dify-inner-api-key-for-plugin
 EOF
 ```
 
@@ -63,12 +66,16 @@ The minimum settings are:
 - `DIFY_AGENT_PLUGIN_DAEMON_API_KEY`: API key sent by the server to the plugin
   daemon. In a Dify Docker setup this is usually the value previously configured
   as `PLUGIN_DAEMON_KEY`.
+- `DIFY_AGENT_INNER_API_URL`: Dify API service root for `/inner/api/...` calls.
+- `DIFY_AGENT_INNER_API_KEY`: API key sent to Dify API inner plugin endpoints.
+  In Docker this should match `PLUGIN_DIFY_INNER_API_KEY`, which maps to Dify
+  API `INNER_API_KEY_FOR_PLUGIN`.
 
 See `.example.env` for the full server settings template.
 
 If you plan to run `dify.shell`, also configure `DIFY_AGENT_SHELLCTL_ENTRYPOINT`
 and, when shell jobs need to call back with the `dify-agent` command, set
-`DIFY_AGENT_STUB_URL` plus a 32-byte base64url
+`DIFY_AGENT_STUB_API_BASE_URL` plus a 32-byte base64url
 `DIFY_AGENT_SERVER_SECRET_KEY` as documented in `.example.env`.
 
 ## Start the Dify Agent server
diff --git a/dify-agent/docs/dify-agent/guide/index.md b/dify-agent/docs/dify-agent/guide/index.md
index 27ec96ab349..89d9e0599c7 100644
--- a/dify-agent/docs/dify-agent/guide/index.md
+++ b/dify-agent/docs/dify-agent/guide/index.md
@@ -36,11 +36,13 @@ also reads `.env` and `dify-agent/.env` when present.
 | `DIFY_AGENT_RUN_RETENTION_SECONDS` | `259200` | Seconds to retain Redis run records and per-run event streams; defaults to 3 days. |
 | `DIFY_AGENT_PLUGIN_DAEMON_URL` | `http://localhost:5002` | Base URL for the Dify plugin daemon. |
 | `DIFY_AGENT_PLUGIN_DAEMON_API_KEY` | empty | API key sent to the Dify plugin daemon. |
+| `DIFY_AGENT_INNER_API_URL` | `http://localhost:5001` | Dify API service root used when dify-agent calls `/inner/api/...` endpoints. |
+| `DIFY_AGENT_INNER_API_KEY` | empty | API key sent to Dify API inner plugin endpoints. Set this to Dify API `INNER_API_KEY_FOR_PLUGIN` (Docker: `PLUGIN_DIFY_INNER_API_KEY`). |
 | `DIFY_AGENT_SHELLCTL_ENTRYPOINT` | empty | Base URL for the shellctl server used by `dify.shell`; required when runs include the shell layer. |
 | `DIFY_AGENT_SHELLCTL_AUTH_TOKEN` | empty | Optional bearer token sent to the shellctl server. |
-| `DIFY_AGENT_STUB_URL` | empty | Public Agent Stub URL reachable from shellctl-managed remote machines. Use `http(s)://.../agent-stub` for HTTP or `grpc://host:port` for gRPC; enables `DIFY_AGENT_STUB_*` env injection for user `shell.run` jobs. |
-| `DIFY_AGENT_STUB_GRPC_BIND_ADDRESS` | empty | Optional `host:port` bind override used only when `DIFY_AGENT_STUB_URL` uses `grpc://`. |
-| `DIFY_AGENT_SERVER_SECRET_KEY` | empty | Server-wide root secret used to derive Agent Stub JWE keys; required when `DIFY_AGENT_STUB_URL` is set and must be unpadded base64url for 32 bytes. |
+| `DIFY_AGENT_STUB_API_BASE_URL` | empty | Public Agent Stub API base URL reachable from shellctl-managed remote machines. HTTP may be the service root or `/agent-stub`; gRPC must be `grpc://host:port`. Enables `DIFY_AGENT_STUB_*` env injection for user `shell.run` jobs. |
+| `DIFY_AGENT_STUB_GRPC_BIND_ADDRESS` | empty | Optional `host:port` bind override used only when `DIFY_AGENT_STUB_API_BASE_URL` uses `grpc://`. |
+| `DIFY_AGENT_SERVER_SECRET_KEY` | empty | Server-wide root secret used to derive Agent Stub JWE keys; required when `DIFY_AGENT_STUB_API_BASE_URL` is set and must be unpadded base64url for 32 bytes. |
 | `DIFY_AGENT_PLUGIN_DAEMON_CONNECT_TIMEOUT` | `10` | Plugin-daemon HTTP connect timeout in seconds. |
 | `DIFY_AGENT_PLUGIN_DAEMON_READ_TIMEOUT` | `600` | Plugin-daemon HTTP read timeout in seconds. |
 | `DIFY_AGENT_PLUGIN_DAEMON_WRITE_TIMEOUT` | `30` | Plugin-daemon HTTP write timeout in seconds. |
@@ -58,10 +60,12 @@ DIFY_AGENT_SHUTDOWN_GRACE_SECONDS=30
 DIFY_AGENT_RUN_RETENTION_SECONDS=259200
 DIFY_AGENT_PLUGIN_DAEMON_URL=http://localhost:5002
 DIFY_AGENT_PLUGIN_DAEMON_API_KEY=replace-with-daemon-key
+DIFY_AGENT_INNER_API_URL=http://localhost:5001
+DIFY_AGENT_INNER_API_KEY=replace-with-dify-inner-api-key-for-plugin
 DIFY_AGENT_SHELLCTL_ENTRYPOINT=http://127.0.0.1:5004
 DIFY_AGENT_SHELLCTL_AUTH_TOKEN=replace-with-shellctl-token
 # Generate with: python -c 'import base64, secrets; print(base64.urlsafe_b64encode(secrets.token_bytes(32)).rstrip(b"=").decode())'
-DIFY_AGENT_STUB_URL=https://agent.example.com/agent-stub
+DIFY_AGENT_STUB_API_BASE_URL=https://agent.example.com/agent-stub
 DIFY_AGENT_SERVER_SECRET_KEY=replace-with-base64url-32-byte-secret
 ```
 
diff --git a/dify-agent/docs/dify-agent/user-manual/shell-layer/index.md b/dify-agent/docs/dify-agent/user-manual/shell-layer/index.md
index eb2e39f298d..91842f05dbc 100644
--- a/dify-agent/docs/dify-agent/user-manual/shell-layer/index.md
+++ b/dify-agent/docs/dify-agent/user-manual/shell-layer/index.md
@@ -55,10 +55,14 @@ To let commands inside user-visible shell jobs call back to the Dify Agent serve
 with `dify-agent ...`, also enable the Agent Stub:
 
 ```env
-DIFY_AGENT_STUB_URL=https://agent.example.com/agent-stub
+DIFY_AGENT_STUB_API_BASE_URL=https://agent.example.com/agent-stub
 DIFY_AGENT_SERVER_SECRET_KEY=replace-with-base64url-32-byte-secret
 ```
 
+HTTP `DIFY_AGENT_STUB_API_BASE_URL` may be either the service root or the
+explicit `/agent-stub` API root; the server normalizes the service root to
+`/agent-stub`. Other HTTP paths are rejected at startup.
+
 `DIFY_AGENT_SERVER_SECRET_KEY` must be unpadded base64url text for exactly 32
 decoded bytes. One way to generate it is:
 
@@ -69,10 +73,14 @@ python -c 'import base64, secrets; print(base64.urlsafe_b64encode(secrets.token_
 ## Client request shape
 
 A client adds the shell layer as an ordinary composition layer. Basic shell jobs
-do not need dependencies. To inject `DIFY_AGENT_STUB_URL` and
-`DIFY_AGENT_STUB_AUTH_JWE` into user-visible `shell.run` jobs, declare the
-execution-context layer as the shell layer's `execution_context` dependency. A
-typical run still also includes:
+do not need dependencies. To inject `DIFY_AGENT_STUB_API_BASE_URL`,
+`DIFY_AGENT_STUB_AUTH_JWE`, and `DIFY_AGENT_STUB_DRIVE_BASE` into user-visible
+`shell.run` jobs, declare the execution-context layer as the shell layer's
+`execution_context` dependency. When the run also includes `dify.drive`, declare
+it as the shell layer's `drive` dependency; the injected drive base is then
+computed from the fixed Agent Stub drive mount and the drive reference, for
+example `/mnt/drive/agent-123`. Without a drive dependency, the CLI keeps the
+historical `/mnt/drive` fallback. A typical run still also includes:
 
 - a prompt layer that supplies the task;
 - an execution-context layer carrying tenant/user context;
@@ -194,33 +202,34 @@ Here is the analysis of the sales dataset:
 * **SHA-256 Hash:** `e86521a0d759037a09b059cb3cb2419f0a3f06e674db8151ccf2f93811dac0b8`
 ````
 
-## Running shellctl in Docker
+## Running the local sandbox in Docker
 
-Build the shellctl image from the Dify Agent package root:
+Build the local sandbox image from the Dify Agent package root:
 
 ```bash
-docker build -f docker/shellctl/Dockerfile -t dify-agent-shellctl:local .
+docker build -f docker/local-sandbox/Dockerfile -t dify-agent-local-sandbox:local .
 ```
 
 Run it with a bearer token and publish the API on localhost:
 
 ```bash
-docker run --rm --name dify-agent-shellctl \
+docker run --rm --name dify-agent-local-sandbox \
   -e SHELLCTL_AUTH_TOKEN=replace-with-a-token \
   -p 127.0.0.1:5004:5004 \
-  dify-agent-shellctl:local
+  dify-agent-local-sandbox:local
 ```
 
 The image starts `shellctl serve --listen 0.0.0.0:5004` as the non-root
-`dify` user and leaves shellctl state/runtime directories at their package
-defaults.
+`dify` user. It also sets the fallback `DIFY_AGENT_STUB_DRIVE_BASE=/mnt/drive`
+and pre-creates that directory with write access for the same user.
 
 ## Docker image contents
 
-The provided `docker/shellctl/Dockerfile` installs:
+The provided `docker/local-sandbox/Dockerfile` installs:
 
 - `tmux`, required by `shellctl` to manage shell jobs;
-- `shell-session-manager==2.2.0`, which provides the `shellctl` CLI/server;
+- `shell-session-manager==2.2.1`, which provides the `shellctl` CLI/server;
 - `uv`, so uv shebang scripts with PEP 723 metadata can run inside the shell
   workspace;
+- the `dify-agent` Agent Stub client CLI, including its gRPC transport extra;
 - a non-root default user named `dify`.
diff --git a/dify-agent/pyproject.toml b/dify-agent/pyproject.toml
index 03f2525ace7..c6f1138e087 100644
--- a/dify-agent/pyproject.toml
+++ b/dify-agent/pyproject.toml
@@ -26,7 +26,7 @@ server = [
     "pydantic-ai-slim[anthropic,google,openai]>=1.85.1,<2.0.0",
     "pydantic-settings>=2.12.0,<3.0.0",
     "redis>=7.4.0,<8.0.0",
-    "shell-session-manager==2.2.0",
+    "shell-session-manager==2.2.1",
     "uvicorn[standard]==0.46.0",
 ]
 
diff --git a/dify-agent/src/dify_agent/agent_stub/cli/_drive.py b/dify-agent/src/dify_agent/agent_stub/cli/_drive.py
index 19611592c0e..d3d6241449b 100644
--- a/dify-agent/src/dify_agent/agent_stub/cli/_drive.py
+++ b/dify-agent/src/dify_agent/agent_stub/cli/_drive.py
@@ -11,6 +11,7 @@ ToolFile ids back into the drive.
 from __future__ import annotations
 
 import stat
+from concurrent.futures import ThreadPoolExecutor
 from dataclasses import dataclass
 from pathlib import Path, PurePosixPath
 from tempfile import TemporaryDirectory
@@ -32,6 +33,7 @@ from dify_agent.agent_stub.protocol.agent_stub import (
     AgentStubDriveFileRef,
     AgentStubDriveItem,
     AgentStubDriveManifestResponse,
+    DEFAULT_AGENT_STUB_DRIVE_BASE,
 )
 
 _SKILL_MD_FILENAME = "SKILL.md"
@@ -81,11 +83,15 @@ def list_drive_from_environment(prefix: str, json_output: bool) -> str | AgentSt
     return _format_manifest(response)
 
 
-def pull_drive_from_environment(prefix: str, drive_base: str = "/mnt/drive") -> list[Path]:
+def pull_drive_from_environment(
+    targets: list[str] | None = None,
+    drive_base: str = DEFAULT_AGENT_STUB_DRIVE_BASE,
+) -> list[Path]:
     """Pull drive files into one local drive base via signed download URLs.
 
     Args:
-        prefix: Optional drive-key prefix forwarded to the manifest request.
+        targets: Optional drive-key targets or prefixes. An empty list preserves
+            the historical whole-drive pull by using ``[""]``.
         drive_base: Local base directory that receives downloaded drive files.
 
     Returns:
@@ -117,16 +123,24 @@ def pull_drive_from_environment(prefix: str, drive_base: str = "/mnt/drive") ->
     """
 
     environment = read_agent_stub_environment()
-    response = request_agent_stub_drive_manifest_sync(
-        url=environment.url,
-        auth_jwe=environment.auth_jwe,
-        prefix=prefix,
-        include_download_url=True,
-    )
+    manifest_targets = targets or [""]
+    with ThreadPoolExecutor(max_workers=min(len(manifest_targets), 4)) as executor:
+        responses = list(
+            executor.map(
+                lambda target: request_agent_stub_drive_manifest_sync(
+                    url=environment.url,
+                    auth_jwe=environment.auth_jwe,
+                    prefix=target,
+                    include_download_url=True,
+                ),
+                manifest_targets,
+            )
+        )
     base_path = Path(drive_base).expanduser().resolve()
     base_path.mkdir(parents=True, exist_ok=True)
     written_paths: list[Path] = []
-    for item in response.items:
+    deduplicated_items = {item.key: item for response in responses for item in response.items}
+    for item in [deduplicated_items[key] for key in sorted(deduplicated_items)]:
         download_url = item.download_url
         if not isinstance(download_url, str) or not download_url:
             raise AgentStubValidationError(f"drive manifest item is missing download_url: {item.key}")
diff --git a/dify-agent/src/dify_agent/agent_stub/cli/_env.py b/dify-agent/src/dify_agent/agent_stub/cli/_env.py
index 1c906db8723..da268f6a369 100644
--- a/dify-agent/src/dify_agent/agent_stub/cli/_env.py
+++ b/dify-agent/src/dify_agent/agent_stub/cli/_env.py
@@ -8,8 +8,10 @@ import os
 
 from dify_agent.agent_stub.protocol.agent_stub import (
     AGENT_STUB_AUTH_JWE_ENV_VAR,
-    AGENT_STUB_URL_ENV_VAR,
-    normalize_agent_stub_url,
+    AGENT_STUB_DRIVE_BASE_ENV_VAR,
+    AGENT_STUB_API_BASE_URL_ENV_VAR,
+    DEFAULT_AGENT_STUB_DRIVE_BASE,
+    normalize_agent_stub_api_base_url,
 )
 
 
@@ -28,32 +30,44 @@ class AgentStubEnvironment:
 def has_agent_stub_environment(env: Mapping[str, str] | None = None) -> bool:
     """Return whether both required Agent Stub environment variables exist."""
     values = env or os.environ
-    return bool(values.get(AGENT_STUB_URL_ENV_VAR) and values.get(AGENT_STUB_AUTH_JWE_ENV_VAR))
+    return bool(values.get(AGENT_STUB_API_BASE_URL_ENV_VAR) and values.get(AGENT_STUB_AUTH_JWE_ENV_VAR))
 
 
 def read_agent_stub_environment(env: Mapping[str, str] | None = None) -> AgentStubEnvironment:
     """Read and validate the Agent Stub environment variables."""
     values = env or os.environ
-    url = (values.get(AGENT_STUB_URL_ENV_VAR) or "").strip()
+    url = (values.get(AGENT_STUB_API_BASE_URL_ENV_VAR) or "").strip()
     auth_jwe = (values.get(AGENT_STUB_AUTH_JWE_ENV_VAR) or "").strip()
     missing: list[str] = []
     if not url:
-        missing.append(AGENT_STUB_URL_ENV_VAR)
+        missing.append(AGENT_STUB_API_BASE_URL_ENV_VAR)
     if not auth_jwe:
         missing.append(AGENT_STUB_AUTH_JWE_ENV_VAR)
     if missing:
         names = ", ".join(missing)
         raise MissingAgentStubEnvironmentError(f"missing required Agent Stub environment variables: {names}")
     try:
-        normalized_url = normalize_agent_stub_url(url)
+        normalized_url = normalize_agent_stub_api_base_url(url)
     except ValueError as exc:
-        raise MissingAgentStubEnvironmentError(f"invalid {AGENT_STUB_URL_ENV_VAR}: {exc}") from exc
+        raise MissingAgentStubEnvironmentError(f"invalid {AGENT_STUB_API_BASE_URL_ENV_VAR}: {exc}") from exc
     return AgentStubEnvironment(url=normalized_url, auth_jwe=auth_jwe)
 
 
+def read_agent_stub_drive_base(env: Mapping[str, str] | None = None) -> str:
+    """Read the sandbox-local drive base used by ``dify-agent drive pull``.
+
+    The variable is optional because older Agent Stub environments only injected
+    URL/auth values. Blank values keep the historical ``/mnt/drive`` fallback.
+    """
+    values = env or os.environ
+    configured_drive_base = (values.get(AGENT_STUB_DRIVE_BASE_ENV_VAR) or "").strip()
+    return configured_drive_base or DEFAULT_AGENT_STUB_DRIVE_BASE
+
+
 __all__ = [
     "AgentStubEnvironment",
     "MissingAgentStubEnvironmentError",
     "has_agent_stub_environment",
+    "read_agent_stub_drive_base",
     "read_agent_stub_environment",
 ]
diff --git a/dify-agent/src/dify_agent/agent_stub/cli/main.py b/dify-agent/src/dify_agent/agent_stub/cli/main.py
index 466a53339e7..c5c722d7e03 100644
--- a/dify-agent/src/dify_agent/agent_stub/cli/main.py
+++ b/dify-agent/src/dify_agent/agent_stub/cli/main.py
@@ -21,9 +21,14 @@ from dify_agent.agent_stub.cli._drive import (
     pull_drive_from_environment,
     push_drive_from_environment,
 )
-from dify_agent.agent_stub.cli._env import MissingAgentStubEnvironmentError, has_agent_stub_environment
+from dify_agent.agent_stub.cli._env import (
+    MissingAgentStubEnvironmentError,
+    has_agent_stub_environment,
+    read_agent_stub_drive_base,
+)
 from dify_agent.agent_stub.cli._files import download_file_from_environment, upload_file_from_environment
 from dify_agent.agent_stub.client._errors import AgentStubClientError
+from dify_agent.agent_stub.protocol.agent_stub import AGENT_STUB_DRIVE_BASE_ENV_VAR, DEFAULT_AGENT_STUB_DRIVE_BASE
 
 
 app = typer.Typer(
@@ -78,11 +83,22 @@ def drive_list(
 
 @drive_app.command("pull")
 def drive_pull(
-    path_prefix: str = typer.Argument("", metavar="PATH_PREFIX"),
-    drive_base: str = typer.Option("/mnt/drive", "--drive-base", help="Local base directory for pulled drive files."),
+    targets: list[str] = typer.Argument(None, metavar="TARGET"),
+    drive_base: str | None = typer.Option(
+        None,
+        "--drive-base",
+        help=(
+            f"Local base directory for pulled drive files. Defaults to ${AGENT_STUB_DRIVE_BASE_ENV_VAR} "
+            f"or {DEFAULT_AGENT_STUB_DRIVE_BASE}."
+        ),
+    ),
 ) -> None:
-    """Pull drive files into one local directory tree."""
-    _run_drive_pull(path_prefix=path_prefix, drive_base=drive_base)
+    """Pull one or more drive keys/prefixes into one local directory tree.
+
+    Passing no ``TARGET`` preserves the historical whole-drive behavior by
+    pulling from the empty prefix.
+    """
+    _run_drive_pull(targets=targets, drive_base=drive_base)
 
 
 @drive_app.command("push")
@@ -207,9 +223,9 @@ def _run_drive_list(*, path_prefix: str, json_output: bool) -> None:
     typer.echo(response)
 
 
-def _run_drive_pull(*, path_prefix: str, drive_base: str) -> None:
+def _run_drive_pull(*, targets: list[str] | None, drive_base: str | None) -> None:
     try:
-        response = pull_drive_from_environment(prefix=path_prefix, drive_base=drive_base)
+        response = pull_drive_from_environment(targets=targets, drive_base=drive_base or read_agent_stub_drive_base())
     except MissingAgentStubEnvironmentError as exc:
         typer.echo(str(exc), err=True)
         raise SystemExit(2) from exc
diff --git a/dify-agent/src/dify_agent/agent_stub/protocol/__init__.py b/dify-agent/src/dify_agent/agent_stub/protocol/__init__.py
index 18ea874a2a6..b607b3daa09 100644
--- a/dify-agent/src/dify_agent/agent_stub/protocol/__init__.py
+++ b/dify-agent/src/dify_agent/agent_stub/protocol/__init__.py
@@ -2,8 +2,10 @@
 
 from .agent_stub import (
     AGENT_STUB_AUTH_JWE_ENV_VAR,
+    AGENT_STUB_DRIVE_BASE_ENV_VAR,
     AGENT_STUB_PROTOCOL_VERSION,
-    AGENT_STUB_URL_ENV_VAR,
+    AGENT_STUB_API_BASE_URL_ENV_VAR,
+    DEFAULT_AGENT_STUB_DRIVE_BASE,
     AgentStubConnectRequest,
     AgentStubConnectResponse,
     AgentStubDriveCommitItem,
@@ -20,19 +22,22 @@ from .agent_stub import (
     AgentStubFileUploadResponse,
     AgentStubURLScheme,
     agent_stub_connections_url,
+    agent_stub_drive_base_for_ref,
     agent_stub_drive_commit_url,
     agent_stub_drive_manifest_url,
     agent_stub_file_download_request_url,
     agent_stub_file_upload_request_url,
     is_canonical_dify_file_reference,
-    normalize_agent_stub_url,
+    normalize_agent_stub_api_base_url,
     parse_agent_stub_endpoint,
 )
 
 __all__ = [
     "AGENT_STUB_AUTH_JWE_ENV_VAR",
+    "AGENT_STUB_DRIVE_BASE_ENV_VAR",
     "AGENT_STUB_PROTOCOL_VERSION",
-    "AGENT_STUB_URL_ENV_VAR",
+    "AGENT_STUB_API_BASE_URL_ENV_VAR",
+    "DEFAULT_AGENT_STUB_DRIVE_BASE",
     "AgentStubConnectRequest",
     "AgentStubConnectResponse",
     "AgentStubDriveCommitItem",
@@ -49,11 +54,12 @@ __all__ = [
     "AgentStubFileUploadResponse",
     "AgentStubURLScheme",
     "agent_stub_connections_url",
+    "agent_stub_drive_base_for_ref",
     "agent_stub_drive_commit_url",
     "agent_stub_drive_manifest_url",
     "agent_stub_file_download_request_url",
     "agent_stub_file_upload_request_url",
     "is_canonical_dify_file_reference",
-    "normalize_agent_stub_url",
+    "normalize_agent_stub_api_base_url",
     "parse_agent_stub_endpoint",
 ]
diff --git a/dify-agent/src/dify_agent/agent_stub/protocol/agent_stub.py b/dify-agent/src/dify_agent/agent_stub/protocol/agent_stub.py
index 16d5fa79532..a6a0d4793fe 100644
--- a/dify-agent/src/dify_agent/agent_stub/protocol/agent_stub.py
+++ b/dify-agent/src/dify_agent/agent_stub/protocol/agent_stub.py
@@ -19,8 +19,10 @@ from pydantic import BaseModel, ConfigDict, Field, JsonValue, model_validator
 
 
 AGENT_STUB_PROTOCOL_VERSION: Final[int] = 1
-AGENT_STUB_URL_ENV_VAR: Final[str] = "DIFY_AGENT_STUB_URL"
+AGENT_STUB_API_BASE_URL_ENV_VAR: Final[str] = "DIFY_AGENT_STUB_API_BASE_URL"
 AGENT_STUB_AUTH_JWE_ENV_VAR: Final[str] = "DIFY_AGENT_STUB_AUTH_JWE"
+AGENT_STUB_DRIVE_BASE_ENV_VAR: Final[str] = "DIFY_AGENT_STUB_DRIVE_BASE"
+DEFAULT_AGENT_STUB_DRIVE_BASE: Final[str] = "/mnt/drive"
 
 type AgentStubURLScheme = Literal["http", "https", "grpc"]
 
@@ -44,14 +46,25 @@ class AgentStubEndpoint:
         return self.scheme == "grpc"
 
 
+def agent_stub_drive_base_for_ref(drive_ref: str | None) -> str:
+    """Return the fixed sandbox-local Agent Stub drive base for one drive ref."""
+    normalized_ref = (drive_ref or "").strip()
+    if not normalized_ref:
+        return DEFAULT_AGENT_STUB_DRIVE_BASE
+    drive_ref_parts = normalized_ref.split("/")
+    if normalized_ref.startswith("/") or any(part in {"", ".", ".."} for part in drive_ref_parts):
+        raise ValueError("Agent Stub drive_ref must be a safe relative path")
+    return f"{DEFAULT_AGENT_STUB_DRIVE_BASE.rstrip('/')}/{'/'.join(drive_ref_parts)}"
+
+
 def parse_agent_stub_endpoint(url: str) -> AgentStubEndpoint:
     """Parse one Agent Stub endpoint URL for HTTP or gRPC transport selection.
 
-    HTTP(S) endpoints are normalized by trimming whitespace and removing a final
-    trailing slash from the path while preserving the configured base path.
-    gRPC endpoints must be plain ``grpc://host:port`` targets with no path,
-    query string, or fragment because transport routing happens on the gRPC
-    service name instead of an HTTP URL path.
+    HTTP(S) endpoints accept either the service root or the explicit
+    ``/agent-stub`` API root and normalize to the latter. gRPC endpoints must be
+    plain ``grpc://host:port`` targets with no path, query string, or fragment
+    because transport routing happens on the gRPC service name instead of an
+    HTTP URL path.
     """
     stripped = url.strip()
     if not stripped:
@@ -85,6 +98,10 @@ def parse_agent_stub_endpoint(url: str) -> AgentStubEndpoint:
         )
 
     normalized_path = parsed.path.rstrip("/")
+    if normalized_path in {"", "/"}:
+        normalized_path = "/agent-stub"
+    elif normalized_path != "/agent-stub":
+        raise ValueError("HTTP Agent Stub API base URL path must be empty or /agent-stub")
     normalized_url = urlunsplit((scheme, parsed.netloc, normalized_path, "", ""))
     return AgentStubEndpoint(
         url=normalized_url,
@@ -95,8 +112,8 @@ def parse_agent_stub_endpoint(url: str) -> AgentStubEndpoint:
     )
 
 
-def normalize_agent_stub_url(url: str) -> str:
-    """Return the normalized Agent Stub URL used across settings and CLI env."""
+def normalize_agent_stub_api_base_url(url: str) -> str:
+    """Return the normalized Agent Stub API base URL used across settings and CLI env."""
     return parse_agent_stub_endpoint(url).url
 
 
@@ -233,8 +250,10 @@ class AgentStubDriveCommitItem(BaseModel):
     """One drive key to file binding committed through the Agent Stub."""
 
     key: str
-    file_ref: AgentStubDriveFileRef
+    file_ref: AgentStubDriveFileRef | None = None
     value_owned_by_drive: bool = True
+    is_skill: bool = False
+    skill_metadata: dict[str, str] | None = None
 
     model_config: ClassVar[ConfigDict] = ConfigDict(extra="forbid")
 
@@ -254,11 +273,14 @@ class AgentStubDriveItem(BaseModel):
     size: int | None = None
     hash: str | None = None
     mime_type: str | None = None
-    file_kind: Literal["upload_file", "tool_file"]
-    file_id: str
+    file_kind: Literal["upload_file", "tool_file"] | None = None
+    file_id: str | None = None
     created_at: int | None = None
     download_url: str | None = None
     value_owned_by_drive: bool | None = None
+    removed: bool | None = None
+    is_skill: bool | None = None
+    skill_metadata: str | None = None
 
     model_config: ClassVar[ConfigDict] = ConfigDict(extra="forbid")
 
@@ -292,8 +314,10 @@ def _format_url_host(host: str) -> str:
 
 __all__ = [
     "AGENT_STUB_AUTH_JWE_ENV_VAR",
+    "AGENT_STUB_DRIVE_BASE_ENV_VAR",
     "AGENT_STUB_PROTOCOL_VERSION",
-    "AGENT_STUB_URL_ENV_VAR",
+    "AGENT_STUB_API_BASE_URL_ENV_VAR",
+    "DEFAULT_AGENT_STUB_DRIVE_BASE",
     "AgentStubConnectRequest",
     "AgentStubConnectResponse",
     "AgentStubEndpoint",
@@ -310,11 +334,12 @@ __all__ = [
     "AgentStubFileUploadResponse",
     "AgentStubURLScheme",
     "agent_stub_connections_url",
+    "agent_stub_drive_base_for_ref",
     "agent_stub_drive_commit_url",
     "agent_stub_drive_manifest_url",
     "agent_stub_file_download_request_url",
     "agent_stub_file_upload_request_url",
     "is_canonical_dify_file_reference",
-    "normalize_agent_stub_url",
+    "normalize_agent_stub_api_base_url",
     "parse_agent_stub_endpoint",
 ]
diff --git a/dify-agent/src/dify_agent/agent_stub/server/__init__.py b/dify-agent/src/dify_agent/agent_stub/server/__init__.py
index 4521aa7bc01..b820cd0101c 100644
--- a/dify-agent/src/dify_agent/agent_stub/server/__init__.py
+++ b/dify-agent/src/dify_agent/agent_stub/server/__init__.py
@@ -1,12 +1 @@
 """Server-only helpers for running or embedding the Dify Agent Stub server."""
-
-from .app import app, create_agent_stub_app
-from .grpc_runtime import start_agent_stub_grpc_server
-from .router import create_agent_stub_router
-
-__all__ = [
-    "app",
-    "create_agent_stub_app",
-    "create_agent_stub_router",
-    "start_agent_stub_grpc_server",
-]
diff --git a/dify-agent/src/dify_agent/agent_stub/server/agent_stub_drive.py b/dify-agent/src/dify_agent/agent_stub/server/agent_stub_drive.py
index 463cbd4a706..8c86e5bc806 100644
--- a/dify-agent/src/dify_agent/agent_stub/server/agent_stub_drive.py
+++ b/dify-agent/src/dify_agent/agent_stub/server/agent_stub_drive.py
@@ -70,8 +70,8 @@ class DifyApiAgentStubDriveRequestHandler:
     so this module validates the raw success payload directly.
     """
 
-    dify_api_base_url: str
-    dify_api_inner_api_key: str
+    inner_api_url: str
+    inner_api_key: str
     timeout: httpx.Timeout | float = 30.0
 
     async def get_manifest(
@@ -139,13 +139,13 @@ class DifyApiAgentStubDriveRequestHandler:
         return f"agent-{agent_id}"
 
     async def _get_inner_api(self, path: str, params: Mapping[str, str]) -> object:
-        url = f"{self.dify_api_base_url.rstrip('/')}{path}"
+        url = f"{self.inner_api_url.rstrip('/')}{path}"
         async with httpx.AsyncClient(timeout=self.timeout, follow_redirects=True, trust_env=False) as client:
             try:
                 response = await client.get(
                     url,
                     params=dict(params),
-                    headers={"X-Inner-Api-Key": self.dify_api_inner_api_key},
+                    headers={"X-Inner-Api-Key": self.inner_api_key},
                 )
             except httpx.TimeoutException as exc:
                 raise AgentStubDriveRequestError(504, "Dify API drive request timed out") from exc
@@ -154,13 +154,13 @@ class DifyApiAgentStubDriveRequestHandler:
         return self._normalize_payload(response)
 
     async def _post_inner_api(self, path: str, payload: Mapping[str, Any]) -> object:
-        url = f"{self.dify_api_base_url.rstrip('/')}{path}"
+        url = f"{self.inner_api_url.rstrip('/')}{path}"
         async with httpx.AsyncClient(timeout=self.timeout, follow_redirects=True, trust_env=False) as client:
             try:
                 response = await client.post(
                     url,
                     json=dict(payload),
-                    headers={"X-Inner-Api-Key": self.dify_api_inner_api_key},
+                    headers={"X-Inner-Api-Key": self.inner_api_key},
                 )
             except httpx.TimeoutException as exc:
                 raise AgentStubDriveRequestError(504, "Dify API drive request timed out") from exc
diff --git a/dify-agent/src/dify_agent/agent_stub/server/agent_stub_files.py b/dify-agent/src/dify_agent/agent_stub/server/agent_stub_files.py
index 06765f0897e..cedbb6e862d 100644
--- a/dify-agent/src/dify_agent/agent_stub/server/agent_stub_files.py
+++ b/dify-agent/src/dify_agent/agent_stub/server/agent_stub_files.py
@@ -98,8 +98,8 @@ class DifyApiAgentStubFileRequestHandler:
     contract without exposing raw ``httpx`` or Pydantic exceptions.
     """
 
-    dify_api_base_url: str
-    dify_api_inner_api_key: str
+    inner_api_url: str
+    inner_api_key: str
     timeout: httpx.Timeout | float = 30.0
 
     async def create_upload_request(
@@ -174,13 +174,13 @@ class DifyApiAgentStubFileRequestHandler:
         return execution_context
 
     async def _post_inner_api(self, path: str, payload: Mapping[str, Any]) -> dict[str, Any]:
-        url = f"{self.dify_api_base_url.rstrip('/')}{path}"
+        url = f"{self.inner_api_url.rstrip('/')}{path}"
         async with httpx.AsyncClient(timeout=self.timeout, follow_redirects=True, trust_env=False) as client:
             try:
                 response = await client.post(
                     url,
                     json=dict(payload),
-                    headers={"X-Inner-Api-Key": self.dify_api_inner_api_key},
+                    headers={"X-Inner-Api-Key": self.inner_api_key},
                 )
             except httpx.TimeoutException as exc:
                 raise AgentStubFileRequestError(504, "Dify API file request timed out") from exc
diff --git a/dify-agent/src/dify_agent/agent_stub/server/cli.py b/dify-agent/src/dify_agent/agent_stub/server/cli.py
index 734a66f20aa..ed16c1fc43a 100644
--- a/dify-agent/src/dify_agent/agent_stub/server/cli.py
+++ b/dify-agent/src/dify_agent/agent_stub/server/cli.py
@@ -28,7 +28,7 @@ def main(argv: list[str] | None = None) -> None:
     Side effects:
         Starts either ``dify_agent.agent_stub.server.app:app`` via
         ``uvicorn.run`` or the grpclib Agent Stub server depending on the
-        configured ``DIFY_AGENT_STUB_URL`` scheme.
+        configured ``DIFY_AGENT_STUB_API_BASE_URL`` scheme.
     """
     parser = argparse.ArgumentParser(prog="dify-agent-stub-server")
     parser.add_argument("--host", default=None)
@@ -36,7 +36,10 @@ def main(argv: list[str] | None = None) -> None:
     parser.add_argument("--reload", action="store_true")
     args = parser.parse_args(argv)
     settings = ServerSettings()
-    if settings.agent_stub_url is not None and parse_agent_stub_endpoint(settings.agent_stub_url).is_grpc:
+    if (
+        settings.agent_stub_api_base_url is not None
+        and parse_agent_stub_endpoint(settings.agent_stub_api_base_url).is_grpc
+    ):
         asyncio.run(_serve_grpc(settings=settings, host=args.host, port=args.port))
         return
     uvicorn.run(
@@ -49,14 +52,14 @@ def main(argv: list[str] | None = None) -> None:
 
 async def _serve_grpc(*, settings: ServerSettings, host: str | None, port: int | None) -> None:
     bind_target = derive_agent_stub_grpc_bind_target(
-        public_url=settings.agent_stub_url or "",
+        public_url=settings.agent_stub_api_base_url or "",
         bind_address=settings.agent_stub_grpc_bind_address,
     )
     if host is not None or port is not None:
         bind_target = AgentStubGRPCBindTarget(host=host or bind_target.host, port=port or bind_target.port)
 
     server = await start_agent_stub_grpc_server(
-        public_url=settings.agent_stub_url or "",
+        public_url=settings.agent_stub_api_base_url or "",
         bind_address=bind_target.address,
         token_codec=settings.create_agent_stub_token_codec(),
         file_request_handler=settings.create_agent_stub_file_request_handler(),
diff --git a/dify-agent/src/dify_agent/agent_stub/server/shell_agent_stub_env.py b/dify-agent/src/dify_agent/agent_stub/server/shell_agent_stub_env.py
index 1ed72213e86..b4711c213ac 100644
--- a/dify-agent/src/dify_agent/agent_stub/server/shell_agent_stub_env.py
+++ b/dify-agent/src/dify_agent/agent_stub/server/shell_agent_stub_env.py
@@ -1,8 +1,9 @@
 """Server-side environment injection helpers for Agent Stub forwarding.
 
 Only user-visible ``shell.run`` commands receive these variables. Internal
-lifecycle commands remain free of Agent Stub credentials so workspace setup and
-cleanup cannot accidentally inherit user-facing forwarding state.
+lifecycle commands remain free of Agent Stub credentials and drive-base defaults
+so workspace setup and cleanup cannot accidentally inherit user-facing forwarding
+state.
 """
 
 from __future__ import annotations
@@ -11,8 +12,10 @@ from typing import Protocol
 
 from dify_agent.agent_stub.protocol.agent_stub import (
     AGENT_STUB_AUTH_JWE_ENV_VAR,
-    AGENT_STUB_URL_ENV_VAR,
-    normalize_agent_stub_url,
+    AGENT_STUB_DRIVE_BASE_ENV_VAR,
+    AGENT_STUB_API_BASE_URL_ENV_VAR,
+    agent_stub_drive_base_for_ref,
+    normalize_agent_stub_api_base_url,
 )
 from dify_agent.layers.execution_context import DifyExecutionContextLayerConfig
 
@@ -25,23 +28,31 @@ class ShellAgentStubTokenFactory(Protocol):
 
 def build_shell_agent_stub_env(
     *,
-    agent_stub_url: str | None,
+    agent_stub_api_base_url: str | None,
+    agent_stub_drive_ref: str | None = None,
     execution_context: DifyExecutionContextLayerConfig | None,
     token_factory: ShellAgentStubTokenFactory | None,
     session_id: str | None,
 ) -> dict[str, str] | None:
-    """Build the shell-visible Agent Stub environment for one user command."""
-    if agent_stub_url is None or execution_context is None or token_factory is None:
+    """Build the shell-visible Agent Stub environment for one user command.
+
+    ``agent_stub_drive_ref`` is the storage reference from the bound
+    ``dify.drive`` layer. The sandbox-local base is fixed by the Agent Stub
+    contract and derived here at shell-run injection time.
+    """
+    if agent_stub_api_base_url is None or execution_context is None or token_factory is None:
         return None
     return {
-        AGENT_STUB_URL_ENV_VAR: normalize_agent_stub_url(agent_stub_url),
+        AGENT_STUB_API_BASE_URL_ENV_VAR: normalize_agent_stub_api_base_url(agent_stub_api_base_url),
         AGENT_STUB_AUTH_JWE_ENV_VAR: token_factory(execution_context, session_id=session_id),
+        AGENT_STUB_DRIVE_BASE_ENV_VAR: agent_stub_drive_base_for_ref(agent_stub_drive_ref),
     }
 
 
 __all__ = [
     "AGENT_STUB_AUTH_JWE_ENV_VAR",
-    "AGENT_STUB_URL_ENV_VAR",
+    "AGENT_STUB_DRIVE_BASE_ENV_VAR",
+    "AGENT_STUB_API_BASE_URL_ENV_VAR",
     "ShellAgentStubTokenFactory",
     "build_shell_agent_stub_env",
 ]
diff --git a/dify-agent/src/dify_agent/layers/drive/__init__.py b/dify-agent/src/dify_agent/layers/drive/__init__.py
index 38ef6e66664..a38f77ed65a 100644
--- a/dify-agent/src/dify_agent/layers/drive/__init__.py
+++ b/dify-agent/src/dify_agent/layers/drive/__init__.py
@@ -1,4 +1,4 @@
-"""Client-safe exports for the Dify drive declaration layer DTOs.
+"""Client-safe exports for the Dify drive runtime catalog DTOs.
 
 The layer implementation lives in the sibling ``layer`` module. Keep this
 package root import-safe for client code that only builds run requests.
@@ -6,14 +6,12 @@ package root import-safe for client code that only builds run requests.
 
 from dify_agent.layers.drive.configs import (
     DIFY_DRIVE_LAYER_TYPE_ID,
-    DifyDriveFileConfig,
     DifyDriveLayerConfig,
     DifyDriveSkillConfig,
 )
 
 __all__ = [
     "DIFY_DRIVE_LAYER_TYPE_ID",
-    "DifyDriveFileConfig",
     "DifyDriveLayerConfig",
     "DifyDriveSkillConfig",
 ]
diff --git a/dify-agent/src/dify_agent/layers/drive/configs.py b/dify-agent/src/dify_agent/layers/drive/configs.py
index d07dbcb7cfb..f74a24298fd 100644
--- a/dify-agent/src/dify_agent/layers/drive/configs.py
+++ b/dify-agent/src/dify_agent/layers/drive/configs.py
@@ -1,11 +1,9 @@
 """Client-safe DTOs for the Dify drive declaration layer.
 
-The drive layer is a config-only manifest of the Skills & Files an agent has
-in its drive. It is an index, never the content: each entry carries only a
-display name, a model-facing description, and the drive key needed to fetch
-the real bytes through the back proxy (``GET /inner/api/drive/<drive_ref>/
-manifest`` → internal download URL). Inlining SKILL.md bodies here would break
-the PRD's dynamic-loading principle and bloat every run request.
+The drive layer carries the runtime drive catalog plus the prompt-mentioned
+targets that must be pulled eagerly when the layer enters. It is still config
+only: skills are declared as metadata, not content, and plain files are listed
+only when the prompt explicitly mentions their drive keys.
 
 The API backend catalogs and writes this config; the Agent backend consumes it
 (ENG-387: pull via back proxy, lazy-load SKILL.md, materialize files).
@@ -22,7 +20,7 @@ DIFY_DRIVE_LAYER_TYPE_ID: Final[str] = "dify.drive"
 
 
 class DifyDriveSkillConfig(BaseModel):
-    """Runtime declaration of one standardized skill — an index, not content."""
+    """Runtime declaration of one standardized skill — metadata, not content."""
 
     model_config = ConfigDict(extra="forbid")
 
@@ -33,35 +31,23 @@ class DifyDriveSkillConfig(BaseModel):
     skill_md_key: str
     # "<slug>/.DIFY-SKILL-FULL.zip" — full archive for restoring the complete skill.
     archive_key: str | None = None
-
-
-class DifyDriveFileConfig(BaseModel):
-    """Runtime declaration of one plain drive file."""
-
-    model_config = ConfigDict(extra="forbid")
-
-    name: str
-    # "files/<filename>" — the drive key of the file value.
-    key: str
-    size: int | None = None
-    mime_type: str | None = None
+    path: str
 
 
 class DifyDriveLayerConfig(LayerConfig):
-    """Config-only declaration layer: API writes the catalog, the agent pulls
-    the listed entries through the back proxy using ``drive_ref``."""
+    """Drive runtime catalog plus eager-pull instructions for mentioned targets."""
 
     # "agent-<agent_id>" — storage addressing, deliberately explicit instead of
     # derived from execution context so a shared (non-agent-bound) drive stays
     # possible later.
     drive_ref: str
     skills: list[DifyDriveSkillConfig] = Field(default_factory=list)
-    files: list[DifyDriveFileConfig] = Field(default_factory=list)
+    mentioned_skill_keys: list[str] = Field(default_factory=list)
+    mentioned_file_keys: list[str] = Field(default_factory=list)
 
 
 __all__ = [
     "DIFY_DRIVE_LAYER_TYPE_ID",
-    "DifyDriveFileConfig",
     "DifyDriveLayerConfig",
     "DifyDriveSkillConfig",
 ]
diff --git a/dify-agent/src/dify_agent/layers/drive/layer.py b/dify-agent/src/dify_agent/layers/drive/layer.py
index 42f7011a51c..e38704d2b9d 100644
--- a/dify-agent/src/dify_agent/layers/drive/layer.py
+++ b/dify-agent/src/dify_agent/layers/drive/layer.py
@@ -1,34 +1,328 @@
-"""Inert Dify drive declaration layer.
+"""Runtime Dify drive layer with eager pull for prompt-mentioned targets.
 
-Registering this layer makes ``dify.drive`` a known composition type id so a
-run that carries the declaration never fails as "unknown layer type", even
-before the consumption work (ENG-387) lands. It deliberately contributes no
-prompt and no tools: a model that can see skill names but cannot read SKILL.md
-would only hallucinate. The skills prompt (including the "pull SKILL.md via
-drive" guidance) ships together with the consumption implementation.
+The API backend sends the full drive skill catalog plus the ordered drive keys
+mentioned in the prompt. When the layer enters a run context it eagerly pulls
+those mentioned skills/files from the Dify inner drive bridge, materializes them
+under the fixed Agent Stub drive base for ``drive_ref``, and contributes a
+concise prompt block describing what was loaded and what other skills remain
+available for lazy pull.
 """
 
-from dataclasses import dataclass
-from typing import ClassVar
+from __future__ import annotations
 
+import asyncio
+from dataclasses import dataclass, field
+from pathlib import Path, PurePosixPath
+from tempfile import TemporaryDirectory
+from typing import Any, ClassVar, cast
+from uuid import uuid4
+from zipfile import BadZipFile, ZipFile, ZipInfo
+
+import httpx
 from typing_extensions import Self, override
 
-from agenton.layers import EmptyRuntimeState, NoLayerDeps, PlainLayer
+from agenton.layers import EmptyRuntimeState, Layer, LayerDeps, PlainLayer
+from dify_agent.agent_stub.protocol import agent_stub_drive_base_for_ref
 from dify_agent.layers.drive.configs import DIFY_DRIVE_LAYER_TYPE_ID, DifyDriveLayerConfig
 
+_SKILL_ARCHIVE_FILENAME = ".DIFY-SKILL-FULL.zip"
+_DOWNLOAD_CONCURRENCY = 4
+
+
+class DifyDriveLayerError(RuntimeError):
+    """Raised when one eager-pull drive operation fails."""
+
+
+class DifyDriveDeps(LayerDeps):
+    execution_context: Layer[Any, Any, Any, Any, Any, Any]  # pyright: ignore[reportUninitializedInstanceVariable]
+
+
+@dataclass(frozen=True, slots=True)
+class _DriveManifestItem:
+    key: str
+    download_url: str
+    size: int | None = None
+
 
 @dataclass(slots=True)
-class DifyDriveLayer(PlainLayer[NoLayerDeps, DifyDriveLayerConfig, EmptyRuntimeState]):
-    """Config-only carrier of the drive Skills & Files manifest."""
+class DifyDriveLayer(PlainLayer[DifyDriveDeps, DifyDriveLayerConfig, EmptyRuntimeState]):
+    """Drive runtime layer that eagerly materializes prompt-mentioned drive targets."""
 
     type_id: ClassVar[str | None] = DIFY_DRIVE_LAYER_TYPE_ID
 
     config: DifyDriveLayerConfig
+    inner_api_url: str
+    inner_api_key: str
+    _loaded_skill_bodies: dict[str, str] = field(default_factory=dict)
+    _pulled_file_paths: dict[str, str] = field(default_factory=dict)
 
     @classmethod
     @override
     def from_config(cls, config: DifyDriveLayerConfig) -> Self:
-        return cls(config=config)
+        del config
+        raise TypeError("DifyDriveLayer requires server-side Dify API settings and must use a provider factory.")
+
+    @classmethod
+    def from_config_with_settings(
+        cls,
+        config: DifyDriveLayerConfig,
+        *,
+        inner_api_url: str,
+        inner_api_key: str,
+    ) -> Self:
+        return cls(
+            config=DifyDriveLayerConfig.model_validate(config),
+            inner_api_url=inner_api_url.rstrip("/"),
+            inner_api_key=inner_api_key,
+        )
+
+    @property
+    @override
+    def prefix_prompts(self) -> list[str]:
+        return [self.build_prompt_context()]
+
+    @override
+    async def on_context_create(self) -> None:
+        await self._pull_mentioned_targets()
+
+    @override
+    async def on_context_resume(self) -> None:
+        await self._pull_mentioned_targets()
+
+    def build_prompt_context(self) -> str:
+        sections: list[str] = []
+
+        loaded_skill_sections: list[str] = []
+        for skill_key in self.config.mentioned_skill_keys:
+            body = self._loaded_skill_bodies.get(skill_key)
+            if body is None:
+                continue
+            skill = next((item for item in self.config.skills if item.skill_md_key == skill_key), None)
+            if skill is None:
+                continue
+            loaded_skill_sections.append(f"Path: {skill.path}\nName: {skill.name}\nSKILL.md:\n{body}")
+        if loaded_skill_sections:
+            sections.append("Loaded mentioned skills:\n\n" + "\n\n".join(loaded_skill_sections))
+
+        mentioned_files = [
+            f"- {key} -> {self._pulled_file_paths[key]}"
+            for key in self.config.mentioned_file_keys
+            if key in self._pulled_file_paths
+        ]
+        if mentioned_files:
+            sections.append("Mentioned files pulled to local drive:\n" + "\n".join(mentioned_files))
+
+        other_skills = [
+            f"- {skill.path}: {skill.name} — {skill.description}"
+            for skill in self.config.skills
+            if skill.skill_md_key not in set(self.config.mentioned_skill_keys)
+        ]
+        if other_skills:
+            sections.append("Other available skills:\n" + "\n".join(other_skills))
+
+        if not sections:
+            return ""
+        sections.append(
+            "Additional drive skills/files can be pulled lazily later with the Agent Stub drive commands if needed."
+        )
+        return "\n\n".join(sections)
+
+    async def _pull_mentioned_targets(self) -> None:
+        self._loaded_skill_bodies = {}
+        self._pulled_file_paths = {}
+        targets: list[tuple[str, bool]] = [
+            (self._skill_prefix(skill_key), False) for skill_key in self.config.mentioned_skill_keys
+        ] + [(file_key, True) for file_key in self.config.mentioned_file_keys]
+        if not targets:
+            return
+
+        tenant_id = self._require_tenant_id()
+        manifest_items = await self._fetch_manifest_items(tenant_id=tenant_id, targets=targets)
+        written_paths = await self._download_items(manifest_items)
+        self._pulled_file_paths = written_paths
+        for file_key in self.config.mentioned_file_keys:
+            if file_key not in written_paths:
+                raise DifyDriveLayerError(f"missing pulled file for mentioned drive key {file_key}")
+        for skill_key in self.config.mentioned_skill_keys:
+            skill_path = written_paths.get(skill_key)
+            if skill_path is None:
+                raise DifyDriveLayerError(f"missing pulled SKILL.md for mentioned skill {skill_key}")
+            try:
+                self._loaded_skill_bodies[skill_key] = Path(skill_path).read_text(encoding="utf-8")
+            except (OSError, UnicodeError) as exc:
+                raise DifyDriveLayerError(f"failed to load pulled SKILL.md for mentioned skill {skill_key}") from exc
+
+    async def _fetch_manifest_items(
+        self,
+        *,
+        tenant_id: str,
+        targets: list[tuple[str, bool]],
+    ) -> list[_DriveManifestItem]:
+        semaphore = asyncio.Semaphore(_DOWNLOAD_CONCURRENCY)
+
+        async with httpx.AsyncClient(timeout=30.0, follow_redirects=True, trust_env=False) as client:
+
+            async def fetch_one(target: tuple[str, bool]) -> list[_DriveManifestItem]:
+                prefix, exact = target
+                try:
+                    async with semaphore:
+                        response = await client.get(
+                            f"{self.inner_api_url}/inner/api/drive/{self.config.drive_ref}/manifest",
+                            params={
+                                "tenant_id": tenant_id,
+                                "prefix": prefix,
+                                "include_download_url": "true",
+                            },
+                            headers={"X-Inner-Api-Key": self.inner_api_key},
+                        )
+                except (httpx.InvalidURL, httpx.TimeoutException, httpx.RequestError) as exc:
+                    raise DifyDriveLayerError(f"drive manifest request failed for {prefix}") from exc
+                if response.is_error:
+                    raise DifyDriveLayerError(f"drive manifest request failed for {prefix}: {response.status_code}")
+                try:
+                    payload = response.json()
+                except ValueError as exc:
+                    raise DifyDriveLayerError(f"drive manifest response is invalid for {prefix}") from exc
+                items = payload.get("items") if isinstance(payload, dict) else None
+                if not isinstance(items, list):
+                    raise DifyDriveLayerError(f"drive manifest response is invalid for {prefix}")
+                manifest_items: list[_DriveManifestItem] = []
+                for item in items:
+                    if not isinstance(item, dict):
+                        continue
+                    key = item.get("key")
+                    download_url = item.get("download_url")
+                    if not isinstance(key, str) or not isinstance(download_url, str) or not download_url:
+                        raise DifyDriveLayerError(f"drive manifest item is missing download_url for {prefix}")
+                    if exact and key != prefix:
+                        continue
+                    manifest_items.append(_DriveManifestItem(key=key, download_url=download_url, size=item.get("size")))
+                return manifest_items
+
+            grouped_items = await asyncio.gather(*(fetch_one(target) for target in targets))
+
+        deduplicated: dict[str, _DriveManifestItem] = {}
+        for items in grouped_items:
+            for item in items:
+                deduplicated.setdefault(item.key, item)
+        return [deduplicated[key] for key in sorted(deduplicated)]
+
+    async def _download_items(self, items: list[_DriveManifestItem]) -> dict[str, str]:
+        base_path = Path(agent_stub_drive_base_for_ref(self.config.drive_ref))
+        try:
+            base_path.mkdir(parents=True, exist_ok=True)
+        except OSError as exc:
+            raise DifyDriveLayerError(f"failed to prepare drive base {base_path}") from exc
+        semaphore = asyncio.Semaphore(_DOWNLOAD_CONCURRENCY)
+        archive_paths: list[Path] = []
+        canonical_skill_dirs = {item.key.rsplit("/", 1)[0] for item in items if item.key.endswith("/SKILL.md")}
+
+        async with httpx.AsyncClient(timeout=30.0, follow_redirects=True, trust_env=False) as client:
+
+            async def download_one(item: _DriveManifestItem) -> tuple[str, str]:
+                try:
+                    async with semaphore:
+                        response = await client.get(item.download_url)
+                except (httpx.InvalidURL, httpx.TimeoutException, httpx.RequestError) as exc:
+                    raise DifyDriveLayerError(f"drive download failed for {item.key}") from exc
+                if response.is_error:
+                    raise DifyDriveLayerError(f"drive download failed for {item.key}: {response.status_code}")
+                payload = response.content
+                if item.size is not None and len(payload) != item.size:
+                    raise DifyDriveLayerError(f"downloaded drive file size mismatch for {item.key}")
+                try:
+                    destination = _resolve_drive_destination(base_path, item.key)
+                    destination.parent.mkdir(parents=True, exist_ok=True)
+                    temp_path = destination.with_name(f"{destination.name}.tmp-{uuid4().hex}")
+                    temp_path.write_bytes(payload)
+                    temp_path.replace(destination)
+                except OSError as exc:
+                    raise DifyDriveLayerError(f"failed to materialize drive file {item.key}") from exc
+                if destination.name == _SKILL_ARCHIVE_FILENAME:
+                    archive_paths.append(destination)
+                return item.key, str(destination)
+
+            pairs = await asyncio.gather(*(download_one(item) for item in items))
+        for archive_path in sorted(archive_paths):
+            archive_skill_dir = archive_path.parent.relative_to(base_path).as_posix()
+            skip_entry_names = {"SKILL.md"} if archive_skill_dir in canonical_skill_dirs else set()
+            _extract_skill_archive(archive_path, skip_entry_names=skip_entry_names)
+        return {key: path for key, path in pairs}
+
+    def _require_tenant_id(self) -> str:
+        execution_context = self.deps.execution_context.config
+        tenant_id = getattr(execution_context, "tenant_id", None)
+        if not isinstance(tenant_id, str) or not tenant_id.strip():
+            raise DifyDriveLayerError("DifyDriveLayer requires execution_context.tenant_id")
+        return cast(str, tenant_id).strip()
+
+    @staticmethod
+    def _skill_prefix(skill_key: str) -> str:
+        return f"{skill_key.rsplit('/', 1)[0]}/"
 
 
-__all__ = ["DifyDriveLayer"]
+def _resolve_drive_destination(base_path: Path, drive_key: str) -> Path:
+    destination = (base_path / Path(drive_key)).resolve()
+    try:
+        destination.relative_to(base_path)
+    except ValueError as exc:
+        raise DifyDriveLayerError(f"drive key resolves outside the drive base: {drive_key}") from exc
+    return destination
+
+
+def _extract_skill_archive(archive_path: Path, *, skip_entry_names: set[str]) -> None:
+    target_dir = archive_path.parent.resolve()
+    try:
+        with TemporaryDirectory(dir=target_dir, prefix=".dify-skill-extract-") as staging_dir_name:
+            staging_dir = Path(staging_dir_name).resolve()
+            with ZipFile(archive_path) as archive:
+                for zip_info in archive.infolist():
+                    if zip_info.filename.replace("\\", "/").rstrip("/") in skip_entry_names:
+                        continue
+                    destination = _resolve_zip_entry_destination(staging_dir, zip_info.filename)
+                    if _is_zip_symlink(zip_info):
+                        raise DifyDriveLayerError(
+                            f"skill archive contains unsupported symlink entry: {zip_info.filename}"
+                        )
+                    if zip_info.is_dir():
+                        destination.mkdir(parents=True, exist_ok=True)
+                        continue
+                    destination.parent.mkdir(parents=True, exist_ok=True)
+                    with archive.open(zip_info) as source_file:
+                        temp_path = destination.with_name(f"{destination.name}.tmp-{uuid4().hex}")
+                        temp_path.write_bytes(source_file.read())
+                        temp_path.replace(destination)
+            for staged_path in sorted(staging_dir.rglob("*")):
+                if staged_path.is_dir():
+                    continue
+                relative_path = staged_path.relative_to(staging_dir)
+                destination = (target_dir / relative_path).resolve()
+                destination.parent.mkdir(parents=True, exist_ok=True)
+                staged_path.replace(destination)
+    except DifyDriveLayerError:
+        raise
+    except (BadZipFile, OSError) as exc:
+        raise DifyDriveLayerError(f"downloaded skill archive is invalid: {archive_path.name}") from exc
+
+
+def _resolve_zip_entry_destination(target_dir: Path, entry_name: str) -> Path:
+    normalized_name = entry_name.replace("\\", "/")
+    pure_path = PurePosixPath(normalized_name)
+    if not normalized_name or normalized_name.startswith("/") or pure_path.is_absolute():
+        raise DifyDriveLayerError(f"skill archive contains unsafe absolute path: {entry_name}")
+    if any(part in {"", ".", ".."} for part in pure_path.parts):
+        raise DifyDriveLayerError(f"skill archive contains unsafe path traversal entry: {entry_name}")
+    destination = (target_dir / Path(*pure_path.parts)).resolve()
+    try:
+        destination.relative_to(target_dir)
+    except ValueError as exc:
+        raise DifyDriveLayerError(f"skill archive entry resolves outside the skill directory: {entry_name}") from exc
+    return destination
+
+
+def _is_zip_symlink(zip_info: ZipInfo) -> bool:
+    file_mode = zip_info.external_attr >> 16
+    return (file_mode & 0o170000) == 0o120000
+
+
+__all__ = ["DifyDriveLayer", "DifyDriveLayerError"]
diff --git a/dify-agent/src/dify_agent/layers/knowledge/layer.py b/dify-agent/src/dify_agent/layers/knowledge/layer.py
index 16605a9ceb3..02c9f07dd56 100644
--- a/dify-agent/src/dify_agent/layers/knowledge/layer.py
+++ b/dify-agent/src/dify_agent/layers/knowledge/layer.py
@@ -67,8 +67,8 @@ class DifyKnowledgeBaseLayer(PlainLayer[DifyKnowledgeBaseDeps, DifyKnowledgeBase
     type_id: ClassVar[str | None] = DIFY_KNOWLEDGE_BASE_LAYER_TYPE_ID
 
     config: DifyKnowledgeBaseLayerConfig
-    dify_api_inner_url: str
-    dify_api_inner_api_key: str
+    inner_api_url: str
+    inner_api_key: str
 
     @classmethod
     @override
@@ -84,14 +84,14 @@ class DifyKnowledgeBaseLayer(PlainLayer[DifyKnowledgeBaseDeps, DifyKnowledgeBase
         cls,
         config: DifyKnowledgeBaseLayerConfig,
         *,
-        dify_api_inner_url: str,
-        dify_api_inner_api_key: str,
+        inner_api_url: str,
+        inner_api_key: str,
     ) -> Self:
         """Create the layer from public config plus server-only API settings."""
         return cls(
             config=DifyKnowledgeBaseLayerConfig.model_validate(config),
-            dify_api_inner_url=dify_api_inner_url,
-            dify_api_inner_api_key=dify_api_inner_api_key,
+            inner_api_url=inner_api_url,
+            inner_api_key=inner_api_key,
         )
 
     async def get_tools(self, *, http_client: httpx.AsyncClient) -> list[Tool[object]]:
@@ -114,8 +114,8 @@ class DifyKnowledgeBaseLayer(PlainLayer[DifyKnowledgeBaseDeps, DifyKnowledgeBase
         execution_context = self.deps.execution_context.config
         caller = _build_caller_context(execution_context)
         client = DifyKnowledgeBaseClient(
-            base_url=self.dify_api_inner_url,
-            api_key=self.dify_api_inner_api_key,
+            base_url=self.inner_api_url,
+            api_key=self.inner_api_key,
             http_client=http_client,
         )
 
diff --git a/dify-agent/src/dify_agent/layers/shell/layer.py b/dify-agent/src/dify_agent/layers/shell/layer.py
index 52824e20050..5db17d68499 100644
--- a/dify-agent/src/dify_agent/layers/shell/layer.py
+++ b/dify-agent/src/dify_agent/layers/shell/layer.py
@@ -49,6 +49,7 @@ from typing_extensions import Self, override
 
 from agenton.layers import LayerDeps, PydanticAILayer, PydanticAIPrompt, PydanticAITool
 from dify_agent.agent_stub.server.shell_agent_stub_env import ShellAgentStubTokenFactory, build_shell_agent_stub_env
+from dify_agent.layers.drive.layer import DifyDriveLayer
 from dify_agent.layers.execution_context.layer import DifyExecutionContextLayer
 from dify_agent.layers.shell.configs import DIFY_SHELL_LAYER_TYPE_ID, DifyShellLayerConfig
 
@@ -168,8 +169,13 @@ type ShellInterruptToolResult = ShellJobStatusObservation | ShellToolErrorObserv
 
 
 class DifyShellLayerDeps(LayerDeps):
-    """Optional direct-layer dependencies used by the shell runtime layer."""
+    """Optional direct-layer dependencies used by the shell runtime layer.
 
+    The drive dependency supplies the drive ref for injected
+    Agent Stub CLI commands; the execution context supplies the token principal.
+    """
+
+    drive: DifyDriveLayer | None  # pyright: ignore[reportUninitializedInstanceVariable]
     execution_context: DifyExecutionContextLayer | None  # pyright: ignore[reportUninitializedInstanceVariable]
 
 
@@ -307,7 +313,7 @@ class DifyShellLayer(PydanticAILayer[DifyShellLayerDeps, object, DifyShellLayerC
     config: DifyShellLayerConfig
     shellctl_entrypoint: str
     shellctl_client_factory: ShellctlClientFactory
-    agent_stub_url: str | None = None
+    agent_stub_api_base_url: str | None = None
     agent_stub_token_factory: ShellAgentStubTokenFactory | None = None
     _shellctl_client: ShellctlClientProtocol | None = None
 
@@ -325,7 +331,7 @@ class DifyShellLayer(PydanticAILayer[DifyShellLayerDeps, object, DifyShellLayerC
         *,
         shellctl_entrypoint: str | None,
         shellctl_client_factory: ShellctlClientFactory,
-        agent_stub_url: str | None = None,
+        agent_stub_api_base_url: str | None = None,
         agent_stub_token_factory: ShellAgentStubTokenFactory | None = None,
     ) -> Self:
         """Create the layer from public config plus server-only shell settings."""
@@ -338,7 +344,7 @@ class DifyShellLayer(PydanticAILayer[DifyShellLayerDeps, object, DifyShellLayerC
             config=config,
             shellctl_entrypoint=normalized_entrypoint,
             shellctl_client_factory=shellctl_client_factory,
-            agent_stub_url=agent_stub_url,
+            agent_stub_api_base_url=agent_stub_api_base_url,
             agent_stub_token_factory=agent_stub_token_factory,
         )
         layer.bind_deps({})
@@ -760,8 +766,10 @@ class DifyShellLayer(PydanticAILayer[DifyShellLayerDeps, object, DifyShellLayerC
         """Build per-command Agent Stub env only for user-visible ``shell.run``."""
         execution_context_layer = self.deps.execution_context
         execution_context = execution_context_layer.config if execution_context_layer is not None else None
+        drive_layer = self.deps.drive
         return build_shell_agent_stub_env(
-            agent_stub_url=self.agent_stub_url,
+            agent_stub_api_base_url=self.agent_stub_api_base_url,
+            agent_stub_drive_ref=drive_layer.config.drive_ref if drive_layer is not None else None,
             execution_context=execution_context,
             token_factory=self.agent_stub_token_factory,
             session_id=self.runtime_state.session_id,
diff --git a/dify-agent/src/dify_agent/runtime/compositor_factory.py b/dify-agent/src/dify_agent/runtime/compositor_factory.py
index a637dce7767..0cfab33ad0d 100644
--- a/dify-agent/src/dify_agent/runtime/compositor_factory.py
+++ b/dify-agent/src/dify_agent/runtime/compositor_factory.py
@@ -6,7 +6,7 @@ state-free Dify structured output layer, the optional Dify ask-human layer, the
 Dify execution-context layer, the stateful Dify shell layer, and the Dify
 plugin/knowledge business-layer family:
 
-- ``dify.drive`` for the inert Skills & Files drive declaration,
+- ``dify.drive`` for drive-backed skill catalog + eager pull,
 - ``dify.execution_context`` for shared tenant/user/run daemon context,
 - ``dify.shell`` for shellctl-backed shell job control,
 - ``dify.plugin.llm`` for plugin-backed model selection,
@@ -38,6 +38,7 @@ from dify_agent.agent_stub.server.tokens.agent_stub import AgentStubTokenCodec
 from dify_agent.layers.ask_human.layer import DifyAskHumanLayer
 from dify_agent.layers.dify_plugin.llm_layer import DifyPluginLLMLayer
 from dify_agent.layers.dify_plugin.tools_layer import DifyPluginToolsLayer
+from dify_agent.layers.drive import DifyDriveLayerConfig
 from dify_agent.layers.drive.layer import DifyDriveLayer
 from dify_agent.layers.execution_context.configs import DifyExecutionContextLayerConfig
 from dify_agent.layers.execution_context.layer import DifyExecutionContextLayer
@@ -54,11 +55,11 @@ def create_default_layer_providers(
     *,
     plugin_daemon_url: str = "http://localhost:5002",
     plugin_daemon_api_key: str = "",
-    dify_api_inner_url: str = "http://localhost:5001",
-    dify_api_inner_api_key: str = "",
+    inner_api_url: str = "http://localhost:5001",
+    inner_api_key: str = "",
     shellctl_entrypoint: str | None = None,
     shellctl_auth_token: str | None = None,
-    agent_stub_url: str | None = None,
+    agent_stub_api_base_url: str | None = None,
     agent_stub_token_codec: AgentStubTokenCodec | None = None,
 ) -> tuple[DifyAgentLayerProvider, ...]:
     """Return the server provider set of safe config-constructible layers.
@@ -89,10 +90,14 @@ def create_default_layer_providers(
         LayerProvider.from_layer_type(PydanticAIHistoryLayer),
         LayerProvider.from_layer_type(DifyOutputLayer),
         LayerProvider.from_layer_type(DifyAskHumanLayer),
-        # Inert declaration layer: makes ``dify.drive`` a known type id so runs
-        # carrying the Skills & Files manifest never fail before the consumption
-        # work (ENG-387) lands. Deliberately contributes no prompt and no tools.
-        LayerProvider.from_layer_type(DifyDriveLayer),
+        LayerProvider.from_factory(
+            layer_type=DifyDriveLayer,
+            create=lambda config: DifyDriveLayer.from_config_with_settings(
+                DifyDriveLayerConfig.model_validate(config),
+                inner_api_url=inner_api_url,
+                inner_api_key=inner_api_key,
+            ),
+        ),
         LayerProvider.from_factory(
             layer_type=DifyExecutionContextLayer,
             create=lambda config: DifyExecutionContextLayer.from_config_with_settings(
@@ -107,7 +112,7 @@ def create_default_layer_providers(
                 DifyShellLayerConfig.model_validate(config),
                 shellctl_entrypoint=shellctl_entrypoint,
                 shellctl_client_factory=create_shellctl_client_factory(token=shellctl_token),
-                agent_stub_url=agent_stub_url,
+                agent_stub_api_base_url=agent_stub_api_base_url,
                 agent_stub_token_factory=agent_stub_token_factory,
             ),
         ),
@@ -117,8 +122,8 @@ def create_default_layer_providers(
             layer_type=DifyKnowledgeBaseLayer,
             create=lambda config: DifyKnowledgeBaseLayer.from_config_with_settings(
                 DifyKnowledgeBaseLayerConfig.model_validate(config),
-                dify_api_inner_url=dify_api_inner_url,
-                dify_api_inner_api_key=dify_api_inner_api_key,
+                inner_api_url=inner_api_url,
+                inner_api_key=inner_api_key,
             ),
         ),
     )
diff --git a/dify-agent/src/dify_agent/server/app.py b/dify-agent/src/dify_agent/server/app.py
index 42b406799bb..cc3760da393 100644
--- a/dify-agent/src/dify_agent/server/app.py
+++ b/dify-agent/src/dify_agent/server/app.py
@@ -10,7 +10,7 @@ stay state-only: they borrow the lifespan-owned clients through the runner and
 receive shell-layer server settings through provider construction rather than
 reading environment variables themselves. The standard server always mounts the
 HTTP Agent Stub router and additionally starts the optional grpclib Agent Stub
-server when ``DIFY_AGENT_STUB_URL`` uses ``grpc://``.
+server when ``DIFY_AGENT_STUB_API_BASE_URL`` uses ``grpc://``.
 """
 
 from collections.abc import AsyncGenerator
@@ -41,11 +41,11 @@ def create_app(settings: ServerSettings | None = None) -> FastAPI:
     layer_providers = create_default_layer_providers(
         plugin_daemon_url=resolved_settings.plugin_daemon_url,
         plugin_daemon_api_key=resolved_settings.plugin_daemon_api_key,
-        dify_api_inner_url=resolved_settings.dify_api_inner_url,
-        dify_api_inner_api_key=resolved_settings.dify_api_inner_api_key or "",
+        inner_api_url=resolved_settings.inner_api_url,
+        inner_api_key=resolved_settings.inner_api_key or "",
         shellctl_entrypoint=resolved_settings.shellctl_entrypoint,
         shellctl_auth_token=resolved_settings.shellctl_auth_token,
-        agent_stub_url=resolved_settings.agent_stub_url,
+        agent_stub_api_base_url=resolved_settings.agent_stub_api_base_url,
         agent_stub_token_codec=agent_stub_token_codec,
     )
     sandbox_file_service = (
@@ -72,11 +72,11 @@ def create_app(settings: ServerSettings | None = None) -> FastAPI:
         )
         grpc_server = None
         if (
-            resolved_settings.agent_stub_url is not None
-            and parse_agent_stub_endpoint(resolved_settings.agent_stub_url).is_grpc
+            resolved_settings.agent_stub_api_base_url is not None
+            and parse_agent_stub_endpoint(resolved_settings.agent_stub_api_base_url).is_grpc
         ):
             grpc_server = await start_agent_stub_grpc_server(
-                public_url=resolved_settings.agent_stub_url,
+                public_url=resolved_settings.agent_stub_api_base_url,
                 bind_address=resolved_settings.agent_stub_grpc_bind_address,
                 token_codec=agent_stub_token_codec,
                 file_request_handler=agent_stub_file_request_handler,
diff --git a/dify-agent/src/dify_agent/server/settings.py b/dify-agent/src/dify_agent/server/settings.py
index b85fcffdc36..7c16a8e50b1 100644
--- a/dify-agent/src/dify_agent/server/settings.py
+++ b/dify-agent/src/dify_agent/server/settings.py
@@ -5,9 +5,9 @@ Outbound HTTP client settings describe the FastAPI lifespan-owned
 Dify API inner calls. Layers and Agenton providers do not own those clients, so
 these settings are process resource limits rather than per-run lifecycle knobs.
 Endpoint URLs and API keys stay service-specific. The Agent Stub also uses this
-settings model directly: the public Agent Stub URL, server secret, optional gRPC
-bind override, and optional Dify inner API file/drive request settings all live
-here under the longstanding ``DIFY_AGENT_...`` environment-variable namespace.
+settings model directly: the public Agent Stub API base URL, server secret,
+optional gRPC bind override, and optional Dify inner API bridge settings all
+live here under the ``DIFY_AGENT_...`` environment-variable namespace.
 """
 
 import httpx
@@ -17,7 +17,7 @@ from typing import ClassVar
 from pydantic import AnyHttpUrl, Field, TypeAdapter, field_validator, model_validator
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
-from dify_agent.agent_stub.protocol.agent_stub import normalize_agent_stub_url, parse_agent_stub_endpoint
+from dify_agent.agent_stub.protocol.agent_stub import normalize_agent_stub_api_base_url, parse_agent_stub_endpoint
 from dify_agent.agent_stub.server.agent_stub_drive import DifyApiAgentStubDriveRequestHandler
 from dify_agent.agent_stub.server.agent_stub_files import DifyApiAgentStubFileRequestHandler
 from dify_agent.agent_stub.server.grpc_bind import normalize_agent_stub_grpc_bind_address
@@ -35,12 +35,11 @@ class ServerSettings(BaseSettings):
     run_retention_seconds: int = Field(default=DEFAULT_RUN_RETENTION_SECONDS, ge=1)
     plugin_daemon_url: str = "http://localhost:5002"
     plugin_daemon_api_key: str = ""
-    dify_api_inner_url: str = "http://localhost:5001"
-    dify_api_base_url: str | None = None
-    dify_api_inner_api_key: str | None = None
+    inner_api_url: str = "http://localhost:5001"
+    inner_api_key: str | None = None
     shellctl_entrypoint: str | None = None
     shellctl_auth_token: str | None = None
-    agent_stub_url: str | None = Field(default=None, validation_alias="DIFY_AGENT_STUB_URL")
+    agent_stub_api_base_url: str | None = Field(default=None, validation_alias="DIFY_AGENT_STUB_API_BASE_URL")
     agent_stub_grpc_bind_address: str | None = Field(default=None, validation_alias="DIFY_AGENT_STUB_GRPC_BIND_ADDRESS")
     server_secret_key: str | None = None
     outbound_http_connect_timeout: float = Field(default=10.0, ge=0)
@@ -58,9 +57,9 @@ class ServerSettings(BaseSettings):
         populate_by_name=True,
     )
 
-    @field_validator("agent_stub_url")
+    @field_validator("agent_stub_api_base_url")
     @classmethod
-    def normalize_agent_stub_url_value(cls, value: str | None) -> str | None:
+    def normalize_agent_stub_api_base_url_value(cls, value: str | None) -> str | None:
         """Normalize the public Agent Stub URL while still validating its scheme."""
         if value is None:
             return None
@@ -69,8 +68,8 @@ class ServerSettings(BaseSettings):
             return None
         if stripped.startswith(("http://", "https://")):
             validated = str(TypeAdapter(AnyHttpUrl).validate_python(stripped))
-            return normalize_agent_stub_url(validated)
-        return normalize_agent_stub_url(stripped)
+            return normalize_agent_stub_api_base_url(validated)
+        return normalize_agent_stub_api_base_url(stripped)
 
     @field_validator("agent_stub_grpc_bind_address")
     @classmethod
@@ -95,24 +94,22 @@ class ServerSettings(BaseSettings):
         _ = decode_server_secret_key(stripped)
         return stripped
 
-    @field_validator("dify_api_base_url")
+    @field_validator("inner_api_url")
     @classmethod
-    def normalize_dify_api_base_url(cls, value: str | None) -> str | None:
-        """Normalize the trusted Dify API base URL used for file request calls."""
-        if value is None:
-            return None
+    def normalize_inner_api_url(cls, value: str) -> str:
+        """Normalize the trusted Dify API base URL used for inner API calls."""
         stripped = value.strip()
         if not stripped:
-            return None
+            raise ValueError("DIFY_AGENT_INNER_API_URL must not be empty")
         validated = str(TypeAdapter(AnyHttpUrl).validate_python(stripped))
         parsed = validated.rstrip("/")
         if "?" in parsed or "#" in parsed:
-            raise ValueError("DIFY_AGENT_DIFY_API_BASE_URL must not include a query string or fragment")
+            raise ValueError("DIFY_AGENT_INNER_API_URL must not include a query string or fragment")
         return parsed
 
-    @field_validator("dify_api_inner_api_key")
+    @field_validator("inner_api_key")
     @classmethod
-    def normalize_dify_api_inner_api_key(cls, value: str | None) -> str | None:
+    def normalize_inner_api_key(cls, value: str | None) -> str | None:
         """Normalize the optional trusted Dify inner API key."""
         if value is None:
             return None
@@ -121,16 +118,16 @@ class ServerSettings(BaseSettings):
 
     @model_validator(mode="after")
     def validate_agent_stub_requirements(self) -> "ServerSettings":
-        """Require Agent Stub settings while allowing knowledge-only inner API keys."""
-        if self.agent_stub_url is not None and self.server_secret_key is None:
-            raise ValueError("DIFY_AGENT_SERVER_SECRET_KEY is required when DIFY_AGENT_STUB_URL is set.")
+        """Require Agent Stub settings while allowing deployments without inner API calls."""
+        if self.agent_stub_api_base_url is not None and self.server_secret_key is None:
+            raise ValueError("DIFY_AGENT_SERVER_SECRET_KEY is required when DIFY_AGENT_STUB_API_BASE_URL is set.")
         if self.agent_stub_grpc_bind_address is not None:
-            if self.agent_stub_url is None:
-                raise ValueError("DIFY_AGENT_STUB_URL is required when DIFY_AGENT_STUB_GRPC_BIND_ADDRESS is set.")
-            if not parse_agent_stub_endpoint(self.agent_stub_url).is_grpc:
-                raise ValueError("DIFY_AGENT_STUB_GRPC_BIND_ADDRESS requires a grpc:// DIFY_AGENT_STUB_URL.")
-        if self.dify_api_base_url is not None and self.dify_api_inner_api_key is None:
-            raise ValueError("DIFY_AGENT_DIFY_API_INNER_API_KEY is required when DIFY_AGENT_DIFY_API_BASE_URL is set.")
+            if self.agent_stub_api_base_url is None:
+                raise ValueError(
+                    "DIFY_AGENT_STUB_API_BASE_URL is required when DIFY_AGENT_STUB_GRPC_BIND_ADDRESS is set."
+                )
+            if not parse_agent_stub_endpoint(self.agent_stub_api_base_url).is_grpc:
+                raise ValueError("DIFY_AGENT_STUB_GRPC_BIND_ADDRESS requires a grpc:// DIFY_AGENT_STUB_API_BASE_URL.")
         return self
 
     def create_agent_stub_token_codec(self) -> AgentStubTokenCodec | None:
@@ -141,11 +138,11 @@ class ServerSettings(BaseSettings):
 
     def create_agent_stub_file_request_handler(self) -> DifyApiAgentStubFileRequestHandler | None:
         """Return the Dify API file bridge when both Dify API settings are configured."""
-        if self.dify_api_base_url is None or self.dify_api_inner_api_key is None:
+        if self.inner_api_key is None:
             return None
         return DifyApiAgentStubFileRequestHandler(
-            dify_api_base_url=self.dify_api_base_url,
-            dify_api_inner_api_key=self.dify_api_inner_api_key,
+            inner_api_url=self.inner_api_url,
+            inner_api_key=self.inner_api_key,
         )
 
     def create_agent_stub_drive_request_handler(self) -> DifyApiAgentStubDriveRequestHandler | None:
@@ -154,11 +151,11 @@ class ServerSettings(BaseSettings):
         Drive manifest and commit requests should honor the same outbound timeout
         settings as the server's other trusted Dify API HTTP calls.
         """
-        if self.dify_api_base_url is None or self.dify_api_inner_api_key is None:
+        if self.inner_api_key is None:
             return None
         return DifyApiAgentStubDriveRequestHandler(
-            dify_api_base_url=self.dify_api_base_url,
-            dify_api_inner_api_key=self.dify_api_inner_api_key,
+            inner_api_url=self.inner_api_url,
+            inner_api_key=self.inner_api_key,
             timeout=self.create_outbound_http_timeout(),
         )
 
diff --git a/dify-agent/tests/local/dify_agent/agent_stub/cli/test_drive.py b/dify-agent/tests/local/dify_agent/agent_stub/cli/test_drive.py
index ff52bb6b4f8..6e45e14a034 100644
--- a/dify-agent/tests/local/dify_agent/agent_stub/cli/test_drive.py
+++ b/dify-agent/tests/local/dify_agent/agent_stub/cli/test_drive.py
@@ -23,7 +23,7 @@ from dify_agent.agent_stub.protocol.agent_stub import (
 
 
 def test_list_drive_from_environment_returns_manifest_json_model(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_API_BASE_URL", "https://agent.example.com/agent-stub")
     monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
     captured: dict[str, object] = {}
 
@@ -56,7 +56,7 @@ def test_list_drive_from_environment_returns_manifest_json_model(monkeypatch: py
 
 
 def test_list_drive_from_environment_returns_human_readable_listing(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_API_BASE_URL", "https://agent.example.com/agent-stub")
     monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
     captured: dict[str, object] = {}
 
@@ -99,7 +99,7 @@ def test_pull_drive_from_environment_writes_files_under_drive_base(
     monkeypatch: pytest.MonkeyPatch,
     tmp_path: Path,
 ) -> None:
-    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_API_BASE_URL", "https://agent.example.com/agent-stub")
     monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
     captured: dict[str, object] = {}
 
@@ -128,7 +128,7 @@ def test_pull_drive_from_environment_writes_files_under_drive_base(
         lambda **_kwargs: b"hello world",
     )
 
-    results = pull_drive_from_environment(prefix="skills/", drive_base=str(tmp_path))
+    results = pull_drive_from_environment(targets=["skills/"], drive_base=str(tmp_path))
 
     assert results == [tmp_path / "skills" / "example" / "SKILL.md"]
     assert results[0].read_bytes() == b"hello world"
@@ -146,7 +146,7 @@ def test_pull_drive_from_environment_auto_extracts_skill_archive(
         archive.writestr("nested/helper.py", "print('x')\n")
     archive_bytes = archive_buffer.getvalue()
 
-    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_API_BASE_URL", "https://agent.example.com/agent-stub")
     monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
     monkeypatch.setattr(
         "dify_agent.agent_stub.cli._drive.request_agent_stub_drive_manifest_sync",
@@ -169,7 +169,7 @@ def test_pull_drive_from_environment_auto_extracts_skill_archive(
         lambda **_kwargs: archive_bytes,
     )
 
-    results = pull_drive_from_environment(prefix="skills/foo", drive_base=str(tmp_path))
+    results = pull_drive_from_environment(targets=["skills/foo"], drive_base=str(tmp_path))
 
     archive_path = tmp_path / "skills" / "foo" / ".DIFY-SKILL-FULL.zip"
     assert results == [archive_path]
@@ -182,7 +182,7 @@ def test_pull_drive_from_environment_rejects_traversal_keys(
     monkeypatch: pytest.MonkeyPatch,
     tmp_path: Path,
 ) -> None:
-    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_API_BASE_URL", "https://agent.example.com/agent-stub")
     monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
     monkeypatch.setattr(
         "dify_agent.agent_stub.cli._drive.request_agent_stub_drive_manifest_sync",
@@ -202,7 +202,7 @@ def test_pull_drive_from_environment_rejects_traversal_keys(
     )
 
     with pytest.raises(AgentStubValidationError, match="outside the drive base"):
-        _ = pull_drive_from_environment(prefix="", drive_base=str(tmp_path))
+        _ = pull_drive_from_environment(targets=[""], drive_base=str(tmp_path))
 
 
 def test_pull_drive_from_environment_rejects_skill_archive_path_traversal(
@@ -215,7 +215,7 @@ def test_pull_drive_from_environment_rejects_skill_archive_path_traversal(
         archive.writestr("../escape.txt", "escape")
     archive_bytes = archive_buffer.getvalue()
 
-    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_API_BASE_URL", "https://agent.example.com/agent-stub")
     monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
     monkeypatch.setattr(
         "dify_agent.agent_stub.cli._drive.request_agent_stub_drive_manifest_sync",
@@ -239,7 +239,7 @@ def test_pull_drive_from_environment_rejects_skill_archive_path_traversal(
     )
 
     with pytest.raises(AgentStubValidationError, match="path traversal"):
-        _ = pull_drive_from_environment(prefix="skills/foo", drive_base=str(tmp_path))
+        _ = pull_drive_from_environment(targets=["skills/foo"], drive_base=str(tmp_path))
     assert not (tmp_path / "skills" / "foo" / "SKILL.md").exists()
 
 
@@ -252,7 +252,7 @@ def test_pull_drive_from_environment_rejects_skill_archive_absolute_entry(
         archive.writestr("/escape.txt", "escape")
     archive_bytes = archive_buffer.getvalue()
 
-    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_API_BASE_URL", "https://agent.example.com/agent-stub")
     monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
     monkeypatch.setattr(
         "dify_agent.agent_stub.cli._drive.request_agent_stub_drive_manifest_sync",
@@ -276,7 +276,7 @@ def test_pull_drive_from_environment_rejects_skill_archive_absolute_entry(
     )
 
     with pytest.raises(AgentStubValidationError, match="absolute path"):
-        _ = pull_drive_from_environment(prefix="skills/foo", drive_base=str(tmp_path))
+        _ = pull_drive_from_environment(targets=["skills/foo"], drive_base=str(tmp_path))
 
 
 def test_pull_drive_from_environment_rejects_skill_archive_symlink_entry(
@@ -290,7 +290,7 @@ def test_pull_drive_from_environment_rejects_skill_archive_symlink_entry(
         archive.writestr(symlink_info, "outside.txt")
     archive_bytes = archive_buffer.getvalue()
 
-    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_API_BASE_URL", "https://agent.example.com/agent-stub")
     monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
     monkeypatch.setattr(
         "dify_agent.agent_stub.cli._drive.request_agent_stub_drive_manifest_sync",
@@ -314,7 +314,7 @@ def test_pull_drive_from_environment_rejects_skill_archive_symlink_entry(
     )
 
     with pytest.raises(AgentStubValidationError, match="symlink entry"):
-        _ = pull_drive_from_environment(prefix="skills/foo", drive_base=str(tmp_path))
+        _ = pull_drive_from_environment(targets=["skills/foo"], drive_base=str(tmp_path))
 
 
 def test_pull_drive_from_environment_rejects_invalid_skill_archive(
@@ -323,7 +323,7 @@ def test_pull_drive_from_environment_rejects_invalid_skill_archive(
 ) -> None:
     archive_bytes = b"not-a-zip"
 
-    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_API_BASE_URL", "https://agent.example.com/agent-stub")
     monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
     monkeypatch.setattr(
         "dify_agent.agent_stub.cli._drive.request_agent_stub_drive_manifest_sync",
@@ -347,14 +347,14 @@ def test_pull_drive_from_environment_rejects_invalid_skill_archive(
     )
 
     with pytest.raises(AgentStubTransferError, match="downloaded skill archive is invalid"):
-        _ = pull_drive_from_environment(prefix="skills/foo", drive_base=str(tmp_path))
+        _ = pull_drive_from_environment(targets=["skills/foo"], drive_base=str(tmp_path))
 
 
 def test_pull_drive_from_environment_rejects_missing_download_url(
     monkeypatch: pytest.MonkeyPatch,
     tmp_path: Path,
 ) -> None:
-    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_API_BASE_URL", "https://agent.example.com/agent-stub")
     monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
     monkeypatch.setattr(
         "dify_agent.agent_stub.cli._drive.request_agent_stub_drive_manifest_sync",
@@ -373,14 +373,14 @@ def test_pull_drive_from_environment_rejects_missing_download_url(
     )
 
     with pytest.raises(AgentStubValidationError, match="missing download_url"):
-        _ = pull_drive_from_environment(prefix="skills/", drive_base=str(tmp_path))
+        _ = pull_drive_from_environment(targets=["skills/"], drive_base=str(tmp_path))
 
 
 def test_pull_drive_from_environment_rejects_size_mismatch(
     monkeypatch: pytest.MonkeyPatch,
     tmp_path: Path,
 ) -> None:
-    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_API_BASE_URL", "https://agent.example.com/agent-stub")
     monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
     monkeypatch.setattr(
         "dify_agent.agent_stub.cli._drive.request_agent_stub_drive_manifest_sync",
@@ -404,13 +404,92 @@ def test_pull_drive_from_environment_rejects_size_mismatch(
     )
 
     with pytest.raises(AgentStubTransferError, match="size mismatch"):
-        _ = pull_drive_from_environment(prefix="skills/", drive_base=str(tmp_path))
+        _ = pull_drive_from_environment(targets=["skills/"], drive_base=str(tmp_path))
+
+
+def test_pull_drive_from_environment_requests_multiple_targets_and_deduplicates_overlaps(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    monkeypatch.setenv("DIFY_AGENT_STUB_API_BASE_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
+    captured_prefixes: list[str] = []
+
+    def fake_manifest(**kwargs):
+        captured_prefixes.append(kwargs["prefix"])
+        if kwargs["prefix"] == "skills/foo":
+            return AgentStubDriveManifestResponse(
+                items=[
+                    AgentStubDriveItem(
+                        key="skills/foo/SKILL.md",
+                        size=5,
+                        hash=None,
+                        mime_type="text/markdown",
+                        file_kind="tool_file",
+                        file_id="tool-file-1",
+                        download_url="https://files.example.com/skill-md",
+                    )
+                ]
+            )
+        return AgentStubDriveManifestResponse(
+            items=[
+                AgentStubDriveItem(
+                    key="skills/foo/SKILL.md",
+                    size=5,
+                    hash=None,
+                    mime_type="text/markdown",
+                    file_kind="tool_file",
+                    file_id="tool-file-1",
+                    download_url="https://files.example.com/skill-md",
+                ),
+                AgentStubDriveItem(
+                    key="files/a.txt",
+                    size=1,
+                    hash=None,
+                    mime_type="text/plain",
+                    file_kind="tool_file",
+                    file_id="tool-file-2",
+                    download_url="https://files.example.com/a-txt",
+                ),
+            ]
+        )
+
+    downloaded_urls: list[str] = []
+    monkeypatch.setattr("dify_agent.agent_stub.cli._drive.request_agent_stub_drive_manifest_sync", fake_manifest)
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli._drive.download_file_bytes_from_signed_url_sync",
+        lambda *, download_url: (
+            downloaded_urls.append(download_url) or (b"hello" if download_url.endswith("skill-md") else b"a")
+        ),
+    )
+
+    results = pull_drive_from_environment(targets=["skills/foo", "files/a.txt"], drive_base=str(tmp_path))
+
+    assert captured_prefixes == ["skills/foo", "files/a.txt"]
+    assert results == [tmp_path / "files" / "a.txt", tmp_path / "skills" / "foo" / "SKILL.md"]
+    assert downloaded_urls == ["https://files.example.com/a-txt", "https://files.example.com/skill-md"]
+
+
+def test_pull_drive_from_environment_without_targets_preserves_whole_drive_pull(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    monkeypatch.setenv("DIFY_AGENT_STUB_API_BASE_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
+    captured_prefixes: list[str] = []
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli._drive.request_agent_stub_drive_manifest_sync",
+        lambda **kwargs: captured_prefixes.append(kwargs["prefix"]) or AgentStubDriveManifestResponse(items=[]),
+    )
+
+    assert pull_drive_from_environment(drive_base=str(tmp_path)) == []
+    assert captured_prefixes == [""]
 
 
 def test_push_drive_from_environment_commits_single_file(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
     source = tmp_path / "report.pdf"
     source.write_bytes(b"report")
-    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_API_BASE_URL", "https://agent.example.com/agent-stub")
     monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
     monkeypatch.setattr(
         "dify_agent.agent_stub.cli._drive.upload_tool_file_resource_from_environment",
@@ -448,6 +527,8 @@ def test_push_drive_from_environment_commits_single_file(monkeypatch: pytest.Mon
         "key": "files/report.pdf",
         "file_ref": {"kind": "tool_file", "id": "tool-file-1"},
         "value_owned_by_drive": True,
+        "is_skill": False,
+        "skill_metadata": None,
     }
 
 
@@ -457,7 +538,7 @@ def test_push_drive_from_environment_requires_skill_md_for_non_recursive_directo
 ) -> None:
     skill_dir = tmp_path / "skill"
     skill_dir.mkdir()
-    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_API_BASE_URL", "https://agent.example.com/agent-stub")
     monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
 
     with pytest.raises(AgentStubValidationError, match="SKILL.md"):
@@ -472,7 +553,7 @@ def test_push_drive_from_environment_standardizes_non_recursive_skill_directory(
     skill_dir.mkdir()
     (skill_dir / "SKILL.md").write_text("# Example\n", encoding="utf-8")
     (skill_dir / "helper.py").write_text("print('x')\n", encoding="utf-8")
-    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_API_BASE_URL", "https://agent.example.com/agent-stub")
     monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
 
     uploaded_paths: list[str] = []
@@ -527,7 +608,7 @@ def test_push_drive_from_environment_non_recursive_archive_excludes_transient_en
     pycache_dir = skill_dir / "__pycache__"
     pycache_dir.mkdir()
     (pycache_dir / "helper.pyc").write_bytes(b"compiled")
-    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_API_BASE_URL", "https://agent.example.com/agent-stub")
     monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
 
     archive_entries: list[str] = []
@@ -578,7 +659,7 @@ def test_push_drive_from_environment_non_recursive_rejects_symlinked_archive_ent
     outside = tmp_path / "outside.txt"
     outside.write_text("outside", encoding="utf-8")
     (skill_dir / "linked.txt").symlink_to(outside)
-    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_API_BASE_URL", "https://agent.example.com/agent-stub")
     monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
 
     with pytest.raises(AgentStubValidationError, match="symlink"):
@@ -594,7 +675,7 @@ def test_push_drive_from_environment_rejects_symlinked_recursive_files(
     outside = tmp_path / "outside.txt"
     outside.write_text("outside", encoding="utf-8")
     (root / "linked.txt").symlink_to(outside)
-    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_API_BASE_URL", "https://agent.example.com/agent-stub")
     monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
 
     with pytest.raises(AgentStubValidationError, match="symlink"):
@@ -611,7 +692,7 @@ def test_push_drive_from_environment_recursive_keeps_user_files_that_skill_packa
     node_modules_dir = root / "node_modules"
     node_modules_dir.mkdir()
     (node_modules_dir / "module.js").write_text("export default 1\n", encoding="utf-8")
-    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_API_BASE_URL", "https://agent.example.com/agent-stub")
     monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
 
     uploaded_paths: list[str] = []
diff --git a/dify-agent/tests/local/dify_agent/agent_stub/cli/test_files.py b/dify-agent/tests/local/dify_agent/agent_stub/cli/test_files.py
index c5b093128fd..f2de6e8edc5 100644
--- a/dify-agent/tests/local/dify_agent/agent_stub/cli/test_files.py
+++ b/dify-agent/tests/local/dify_agent/agent_stub/cli/test_files.py
@@ -25,7 +25,7 @@ def test_upload_file_from_environment_requests_signed_url_and_normalizes_output(
 ) -> None:
     source = tmp_path / "report.pdf"
     source.write_bytes(b"report-bytes")
-    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_API_BASE_URL", "https://agent.example.com/agent-stub")
     monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
 
     monkeypatch.setattr(
@@ -68,7 +68,7 @@ def test_upload_tool_file_resource_from_environment_preserves_tool_file_id(
 ) -> None:
     source = tmp_path / "report.pdf"
     source.write_bytes(b"report-bytes")
-    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_API_BASE_URL", "https://agent.example.com/agent-stub")
     monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
 
     monkeypatch.setattr(
@@ -96,7 +96,7 @@ def test_download_file_from_environment_saves_bytes_and_renames_on_collision(
     target_dir = tmp_path / "downloads"
     target_dir.mkdir()
     (target_dir / "report.pdf").write_bytes(b"existing")
-    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_API_BASE_URL", "https://agent.example.com/agent-stub")
     monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
 
     monkeypatch.setattr(
@@ -133,7 +133,7 @@ def test_download_file_from_environment_sanitizes_server_filename(
 ) -> None:
     target_dir = tmp_path / "downloads"
     target_dir.mkdir()
-    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_API_BASE_URL", "https://agent.example.com/agent-stub")
     monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
 
     monkeypatch.setattr(
@@ -171,7 +171,7 @@ def test_upload_file_from_environment_rejects_non_canonical_reference(
 ) -> None:
     source = tmp_path / "report.pdf"
     source.write_bytes(b"report-bytes")
-    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_API_BASE_URL", "https://agent.example.com/agent-stub")
     monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
 
     monkeypatch.setattr(
@@ -193,7 +193,7 @@ def test_upload_tool_file_resource_from_environment_rejects_missing_id(
 ) -> None:
     source = tmp_path / "report.pdf"
     source.write_bytes(b"report-bytes")
-    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_API_BASE_URL", "https://agent.example.com/agent-stub")
     monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
 
     monkeypatch.setattr(
diff --git a/dify-agent/tests/local/dify_agent/agent_stub/cli/test_main.py b/dify-agent/tests/local/dify_agent/agent_stub/cli/test_main.py
index 8699ac99e13..d66b801778c 100644
--- a/dify-agent/tests/local/dify_agent/agent_stub/cli/test_main.py
+++ b/dify-agent/tests/local/dify_agent/agent_stub/cli/test_main.py
@@ -26,7 +26,7 @@ def test_cli_connect_reports_missing_environment_variables(capsys: pytest.Captur
 
     captured = capsys.readouterr()
     assert exc_info.value.code == 2
-    assert "DIFY_AGENT_STUB_URL" in captured.err
+    assert "DIFY_AGENT_STUB_API_BASE_URL" in captured.err
     assert "DIFY_AGENT_STUB_AUTH_JWE" in captured.err
 
 
@@ -34,7 +34,7 @@ def test_cli_connect_supports_json_output(
     monkeypatch: pytest.MonkeyPatch,
     capsys: pytest.CaptureFixture[str],
 ) -> None:
-    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_API_BASE_URL", "https://agent.example.com/agent-stub")
     monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
 
     def fake_connect_from_environment(*, argv: list[str]) -> AgentStubConnectResponse:
@@ -53,7 +53,7 @@ def test_cli_unknown_command_auto_forwards_when_agent_stub_env_is_present(
     monkeypatch: pytest.MonkeyPatch,
     capsys: pytest.CaptureFixture[str],
 ) -> None:
-    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub")
+    monkeypatch.setenv("DIFY_AGENT_STUB_API_BASE_URL", "https://agent.example.com/agent-stub")
     monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
 
     def fake_connect_from_environment(*, argv: list[str]) -> AgentStubConnectResponse:
@@ -78,7 +78,7 @@ def test_cli_unknown_command_reports_missing_environment_variables(
     assert exc_info.value.code == 2
     assert "Usage: dify-agent" in captured.out
     assert "connect" in captured.out
-    assert "DIFY_AGENT_STUB_URL" in captured.err
+    assert "DIFY_AGENT_STUB_API_BASE_URL" in captured.err
     assert "DIFY_AGENT_STUB_AUTH_JWE" in captured.err
 
 
@@ -92,11 +92,11 @@ def test_cli_connect_help_routes_to_typer_help(capsys: pytest.CaptureFixture[str
     assert "--json" in captured.out
 
 
-def test_cli_reports_invalid_agent_stub_url_environment_value(
+def test_cli_reports_invalid_agent_stub_api_base_url_environment_value(
     monkeypatch: pytest.MonkeyPatch,
     capsys: pytest.CaptureFixture[str],
 ) -> None:
-    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub?x=1")
+    monkeypatch.setenv("DIFY_AGENT_STUB_API_BASE_URL", "https://agent.example.com/agent-stub?x=1")
     monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
 
     with pytest.raises(SystemExit) as exc_info:
@@ -104,7 +104,7 @@ def test_cli_reports_invalid_agent_stub_url_environment_value(
 
     captured = capsys.readouterr()
     assert exc_info.value.code == 2
-    assert "invalid DIFY_AGENT_STUB_URL" in captured.err
+    assert "invalid DIFY_AGENT_STUB_API_BASE_URL" in captured.err
     assert "query string or fragment" in captured.err
 
 
@@ -117,13 +117,13 @@ def test_cli_reports_invalid_agent_stub_url_environment_value(
         ("grpc://agent.example.com", "explicit port"),
     ],
 )
-def test_cli_reports_structurally_invalid_agent_stub_url_environment_value(
+def test_cli_reports_structurally_invalid_agent_stub_api_base_url_environment_value(
     monkeypatch: pytest.MonkeyPatch,
     capsys: pytest.CaptureFixture[str],
     invalid_url: str,
     expected_message: str,
 ) -> None:
-    monkeypatch.setenv("DIFY_AGENT_STUB_URL", invalid_url)
+    monkeypatch.setenv("DIFY_AGENT_STUB_API_BASE_URL", invalid_url)
     monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
 
     with pytest.raises(SystemExit) as exc_info:
@@ -131,14 +131,14 @@ def test_cli_reports_structurally_invalid_agent_stub_url_environment_value(
 
     captured = capsys.readouterr()
     assert exc_info.value.code == 2
-    assert "invalid DIFY_AGENT_STUB_URL" in captured.err
+    assert "invalid DIFY_AGENT_STUB_API_BASE_URL" in captured.err
     assert expected_message in captured.err
 
 
-def test_cli_connect_accepts_grpc_agent_stub_url(
+def test_cli_connect_accepts_grpc_agent_stub_api_base_url(
     monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
 ) -> None:
-    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "grpc://agent.example.com:9091")
+    monkeypatch.setenv("DIFY_AGENT_STUB_API_BASE_URL", "grpc://agent.example.com:9091")
     monkeypatch.setenv("DIFY_AGENT_STUB_AUTH_JWE", "test-jwe")
 
     def fake_connect_from_environment(*, argv: list[str]) -> AgentStubConnectResponse:
@@ -252,7 +252,10 @@ def test_cli_drive_pull_prints_downloaded_paths(
 ) -> None:
     monkeypatch.setattr(
         "dify_agent.agent_stub.cli.main.pull_drive_from_environment",
-        lambda *, prefix, drive_base: [Path(drive_base) / prefix / "SKILL.md", Path(drive_base) / prefix / "helper.py"],
+        lambda *, targets, drive_base: [
+            Path(drive_base) / targets[0] / "SKILL.md",
+            Path(drive_base) / targets[0] / "helper.py",
+        ],
     )
 
     with pytest.raises(SystemExit) as exc_info:
@@ -266,6 +269,83 @@ def test_cli_drive_pull_prints_downloaded_paths(
     ]
 
 
+def test_cli_drive_pull_forwards_multiple_targets(
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    captured_kwargs: dict[str, object] = {}
+
+    def fake_pull_drive_from_environment(*, targets, drive_base):
+        captured_kwargs["targets"] = targets
+        captured_kwargs["drive_base"] = drive_base
+        return [Path(drive_base) / "skills" / "foo" / "SKILL.md"]
+
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli.main.pull_drive_from_environment",
+        fake_pull_drive_from_environment,
+    )
+
+    with pytest.raises(SystemExit) as exc_info:
+        main(["drive", "pull", "skills/foo", "files/a.txt", "--drive-base", "/tmp/drive"])
+
+    captured = capsys.readouterr()
+    assert exc_info.value.code == 0
+    assert captured_kwargs == {"targets": ["skills/foo", "files/a.txt"], "drive_base": "/tmp/drive"}
+    assert captured.out.strip() == "/tmp/drive/skills/foo/SKILL.md"
+
+
+def test_cli_drive_pull_uses_environment_drive_base_default(
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    monkeypatch.setenv("DIFY_AGENT_STUB_DRIVE_BASE", "/env/drive")
+    captured_kwargs: dict[str, object] = {}
+
+    def fake_pull_drive_from_environment(*, targets, drive_base):
+        captured_kwargs["targets"] = targets
+        captured_kwargs["drive_base"] = drive_base
+        return [Path(drive_base) / "skills" / "foo" / "SKILL.md"]
+
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli.main.pull_drive_from_environment",
+        fake_pull_drive_from_environment,
+    )
+
+    with pytest.raises(SystemExit) as exc_info:
+        main(["drive", "pull", "skills/foo"])
+
+    captured = capsys.readouterr()
+    assert exc_info.value.code == 0
+    assert captured_kwargs == {"targets": ["skills/foo"], "drive_base": "/env/drive"}
+    assert captured.out.strip() == "/env/drive/skills/foo/SKILL.md"
+
+
+def test_cli_drive_pull_keeps_historical_drive_base_when_env_is_missing(
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    monkeypatch.delenv("DIFY_AGENT_STUB_DRIVE_BASE", raising=False)
+    captured_kwargs: dict[str, object] = {}
+
+    def fake_pull_drive_from_environment(*, targets, drive_base):
+        captured_kwargs["targets"] = targets
+        captured_kwargs["drive_base"] = drive_base
+        return [Path(drive_base) / "skills" / "foo" / "SKILL.md"]
+
+    monkeypatch.setattr(
+        "dify_agent.agent_stub.cli.main.pull_drive_from_environment",
+        fake_pull_drive_from_environment,
+    )
+
+    with pytest.raises(SystemExit) as exc_info:
+        main(["drive", "pull", "skills/foo"])
+
+    captured = capsys.readouterr()
+    assert exc_info.value.code == 0
+    assert captured_kwargs == {"targets": ["skills/foo"], "drive_base": "/mnt/drive"}
+    assert captured.out.strip() == "/mnt/drive/skills/foo/SKILL.md"
+
+
 def test_cli_drive_push_prints_commit_json(
     monkeypatch: pytest.MonkeyPatch,
     capsys: pytest.CaptureFixture[str],
diff --git a/dify-agent/tests/local/dify_agent/agent_stub/client/test_agent_stub_client.py b/dify-agent/tests/local/dify_agent/agent_stub/client/test_agent_stub_client.py
index f62cc4564e9..dcca5144607 100644
--- a/dify-agent/tests/local/dify_agent/agent_stub/client/test_agent_stub_client.py
+++ b/dify-agent/tests/local/dify_agent/agent_stub/client/test_agent_stub_client.py
@@ -66,7 +66,9 @@ def test_connect_agent_stub_sync_posts_connections_request_with_authorization()
 
 
 def test_connect_agent_stub_sync_rejects_invalid_base_url() -> None:
-    with pytest.raises(AgentStubValidationError, match="invalid DIFY_AGENT_STUB_URL|invalid Agent Stub base URL"):
+    with pytest.raises(
+        AgentStubValidationError, match="invalid DIFY_AGENT_STUB_API_BASE_URL|invalid Agent Stub base URL"
+    ):
         _ = connect_agent_stub_sync(
             url="https://agent.example.com/agent-stub?x=1",
             auth_jwe="test-jwe",
diff --git a/dify-agent/tests/local/dify_agent/agent_stub/protocol/test_agent_stub_protocol.py b/dify-agent/tests/local/dify_agent/agent_stub/protocol/test_agent_stub_protocol.py
index dccde1b42b5..f4bc75291fc 100644
--- a/dify-agent/tests/local/dify_agent/agent_stub/protocol/test_agent_stub_protocol.py
+++ b/dify-agent/tests/local/dify_agent/agent_stub/protocol/test_agent_stub_protocol.py
@@ -13,11 +13,12 @@ from dify_agent.agent_stub.protocol.agent_stub import (
     AgentStubDriveFileRef,
     AgentStubFileMapping,
     agent_stub_connections_url,
+    agent_stub_drive_base_for_ref,
     agent_stub_drive_commit_url,
     agent_stub_drive_manifest_url,
     agent_stub_file_download_request_url,
     agent_stub_file_upload_request_url,
-    normalize_agent_stub_url,
+    normalize_agent_stub_api_base_url,
     parse_agent_stub_endpoint,
 )
 
@@ -36,6 +37,12 @@ def test_agent_stub_connections_url_handles_trailing_slash_and_no_trailing_slash
     )
 
 
+def test_agent_stub_connections_url_normalizes_service_root_to_agent_stub_base() -> None:
+    assert agent_stub_connections_url("https://agent.example.com") == (
+        "https://agent.example.com/agent-stub/connections"
+    )
+
+
 def test_agent_stub_file_request_urls_handle_trailing_slash() -> None:
     assert agent_stub_file_upload_request_url("https://agent.example.com/agent-stub/") == (
         "https://agent.example.com/agent-stub/files/upload-request"
@@ -54,23 +61,52 @@ def test_agent_stub_drive_request_urls_handle_trailing_slash() -> None:
     )
 
 
-def test_normalize_agent_stub_url_rejects_query_and_fragment() -> None:
+def test_agent_stub_drive_base_for_ref_uses_fixed_mount_with_drive_ref() -> None:
+    assert agent_stub_drive_base_for_ref("agent-1") == "/mnt/drive/agent-1"
+    assert agent_stub_drive_base_for_ref("shared/drive") == "/mnt/drive/shared/drive"
+
+
+def test_agent_stub_drive_base_for_ref_uses_default_without_drive_ref() -> None:
+    assert agent_stub_drive_base_for_ref(None) == "/mnt/drive"
+    assert agent_stub_drive_base_for_ref("  ") == "/mnt/drive"
+
+
+@pytest.mark.parametrize(
+    "drive_ref",
+    ["/agent-1", "../agent-1", "agent-1/..", "agent-1/./files", "agent-1//files"],
+)
+def test_agent_stub_drive_base_for_ref_rejects_unsafe_refs(drive_ref: str) -> None:
+    with pytest.raises(ValueError, match="safe relative path"):
+        _ = agent_stub_drive_base_for_ref(drive_ref)
+
+
+def test_normalize_agent_stub_api_base_url_rejects_query_and_fragment() -> None:
     with pytest.raises(ValueError, match="query string or fragment"):
-        _ = normalize_agent_stub_url("https://agent.example.com/agent-stub?x=1")
+        _ = normalize_agent_stub_api_base_url("https://agent.example.com/agent-stub?x=1")
 
     with pytest.raises(ValueError, match="query string or fragment"):
-        _ = normalize_agent_stub_url("https://agent.example.com/agent-stub#fragment")
+        _ = normalize_agent_stub_api_base_url("https://agent.example.com/agent-stub#fragment")
+
+
+def test_normalize_agent_stub_api_base_url_accepts_service_root_or_agent_stub_root_only() -> None:
+    assert normalize_agent_stub_api_base_url("https://agent.example.com") == "https://agent.example.com/agent-stub"
+    assert normalize_agent_stub_api_base_url("https://agent.example.com/agent-stub/") == (
+        "https://agent.example.com/agent-stub"
+    )
+
+    with pytest.raises(ValueError, match="empty or /agent-stub"):
+        _ = normalize_agent_stub_api_base_url("https://agent.example.com/foo")
 
 
 def test_parse_agent_stub_endpoint_rejects_invalid_schemes_and_missing_host() -> None:
     with pytest.raises(ValueError, match="http, https, or grpc"):
-        _ = normalize_agent_stub_url("not-a-url")
+        _ = normalize_agent_stub_api_base_url("not-a-url")
 
     with pytest.raises(ValueError, match="http, https, or grpc"):
-        _ = normalize_agent_stub_url("ftp://agent.example.com/agent-stub")
+        _ = normalize_agent_stub_api_base_url("ftp://agent.example.com/agent-stub")
 
     with pytest.raises(ValueError, match="include a host"):
-        _ = normalize_agent_stub_url("https:///agent-stub")
+        _ = normalize_agent_stub_api_base_url("https:///agent-stub")
 
 
 def test_parse_agent_stub_endpoint_accepts_grpc_host_and_port() -> None:
@@ -128,8 +164,8 @@ def test_agent_stub_drive_commit_request_validates_file_refs() -> None:
     with pytest.raises(ValidationError, match="tool_file"):
         _ = AgentStubDriveFileRef(kind="bad_kind", id="tool-file-1")  # pyright: ignore[reportArgumentType]
 
-    with pytest.raises(ValidationError, match="file_ref"):
-        _ = AgentStubDriveCommitItem.model_validate({"key": "skills/example/SKILL.md"})
+    item_without_file_ref = AgentStubDriveCommitItem.model_validate({"key": "skills/example/SKILL.md"})
+    assert item_without_file_ref.file_ref is None
 
 
 @pytest.mark.parametrize("transfer_method", ["tool_file", "local_file", "datasource_file"])
diff --git a/dify-agent/tests/local/dify_agent/agent_stub/server/test_agent_stub_app.py b/dify-agent/tests/local/dify_agent/agent_stub/server/test_agent_stub_app.py
index e1a53a11bb4..e683a7ea6db 100644
--- a/dify-agent/tests/local/dify_agent/agent_stub/server/test_agent_stub_app.py
+++ b/dify-agent/tests/local/dify_agent/agent_stub/server/test_agent_stub_app.py
@@ -29,7 +29,7 @@ def _execution_context() -> DifyExecutionContextLayerConfig:
 def test_create_agent_stub_app_exposes_same_stub_routes_as_module_app() -> None:
     stub_app_module = importlib.import_module("dify_agent.agent_stub.server.app")
     settings = ServerSettings(
-        agent_stub_url="https://agent.example.com/agent-stub",
+        agent_stub_api_base_url="https://agent.example.com/agent-stub",
         server_secret_key=_base64url_secret(b"1" * 32),
     )
 
@@ -60,10 +60,10 @@ def test_create_agent_stub_app_can_serve_requests() -> None:
 
 def test_create_agent_stub_app_wires_configured_file_handler_for_upload_requests(monkeypatch) -> None:
     settings = ServerSettings(
-        agent_stub_url="https://agent.example.com/agent-stub",
+        agent_stub_api_base_url="https://agent.example.com/agent-stub",
         server_secret_key=_base64url_secret(b"1" * 32),
-        dify_api_base_url="https://api.example.com",
-        dify_api_inner_api_key="inner-secret",
+        inner_api_url="https://api.example.com",
+        inner_api_key="inner-secret",
     )
     token_codec = settings.create_agent_stub_token_codec()
     assert token_codec is not None
@@ -94,10 +94,10 @@ def test_create_agent_stub_app_wires_configured_file_handler_for_upload_requests
 
 def test_create_agent_stub_app_wires_configured_drive_handler_for_manifest_requests(monkeypatch) -> None:
     settings = ServerSettings(
-        agent_stub_url="https://agent.example.com/agent-stub",
+        agent_stub_api_base_url="https://agent.example.com/agent-stub",
         server_secret_key=_base64url_secret(b"1" * 32),
-        dify_api_base_url="https://api.example.com",
-        dify_api_inner_api_key="inner-secret",
+        inner_api_url="https://api.example.com",
+        inner_api_key="inner-secret",
     )
     token_codec = settings.create_agent_stub_token_codec()
     assert token_codec is not None
diff --git a/dify-agent/tests/local/dify_agent/agent_stub/server/test_agent_stub_drive.py b/dify-agent/tests/local/dify_agent/agent_stub/server/test_agent_stub_drive.py
index b0d07f68e00..7de8faa8d58 100644
--- a/dify-agent/tests/local/dify_agent/agent_stub/server/test_agent_stub_drive.py
+++ b/dify-agent/tests/local/dify_agent/agent_stub/server/test_agent_stub_drive.py
@@ -71,8 +71,8 @@ def test_dify_api_agent_stub_drive_handler_injects_execution_context_for_manifes
 
     _patch_async_client(monkeypatch, handler)
     drive_handler = DifyApiAgentStubDriveRequestHandler(
-        dify_api_base_url="https://api.example.com",
-        dify_api_inner_api_key="inner-secret",
+        inner_api_url="https://api.example.com",
+        inner_api_key="inner-secret",
     )
 
     async def scenario() -> None:
@@ -119,8 +119,8 @@ def test_dify_api_agent_stub_drive_handler_injects_execution_context_for_commit(
 
     _patch_async_client(monkeypatch, handler)
     drive_handler = DifyApiAgentStubDriveRequestHandler(
-        dify_api_base_url="https://api.example.com",
-        dify_api_inner_api_key="inner-secret",
+        inner_api_url="https://api.example.com",
+        inner_api_key="inner-secret",
     )
 
     async def scenario() -> None:
@@ -142,8 +142,8 @@ def test_dify_api_agent_stub_drive_handler_injects_execution_context_for_commit(
 
 def test_dify_api_agent_stub_drive_handler_rejects_missing_agent_id() -> None:
     drive_handler = DifyApiAgentStubDriveRequestHandler(
-        dify_api_base_url="https://api.example.com",
-        dify_api_inner_api_key="inner-secret",
+        inner_api_url="https://api.example.com",
+        inner_api_key="inner-secret",
     )
     principal = _principal()
     principal.execution_context = principal.execution_context.model_copy(update={"agent_id": None})
@@ -162,8 +162,8 @@ def test_dify_api_agent_stub_drive_handler_rejects_missing_agent_id() -> None:
 
 def test_dify_api_agent_stub_drive_handler_rejects_missing_user_id_for_commit() -> None:
     drive_handler = DifyApiAgentStubDriveRequestHandler(
-        dify_api_base_url="https://api.example.com",
-        dify_api_inner_api_key="inner-secret",
+        inner_api_url="https://api.example.com",
+        inner_api_key="inner-secret",
     )
     principal = _principal()
     principal.execution_context = principal.execution_context.model_copy(update={"user_id": None})
@@ -196,8 +196,8 @@ def test_dify_api_agent_stub_drive_handler_maps_invalid_json_response(monkeypatc
 
     _patch_async_client(monkeypatch, handler)
     drive_handler = DifyApiAgentStubDriveRequestHandler(
-        dify_api_base_url="https://api.example.com",
-        dify_api_inner_api_key="inner-secret",
+        inner_api_url="https://api.example.com",
+        inner_api_key="inner-secret",
     )
 
     async def scenario() -> None:
@@ -218,8 +218,8 @@ def test_dify_api_agent_stub_drive_handler_rejects_malformed_success_payload(mon
 
     _patch_async_client(monkeypatch, handler)
     drive_handler = DifyApiAgentStubDriveRequestHandler(
-        dify_api_base_url="https://api.example.com",
-        dify_api_inner_api_key="inner-secret",
+        inner_api_url="https://api.example.com",
+        inner_api_key="inner-secret",
     )
 
     async def scenario() -> None:
@@ -240,8 +240,8 @@ def test_dify_api_agent_stub_drive_handler_preserves_non_2xx_detail(monkeypatch)
 
     _patch_async_client(monkeypatch, handler)
     drive_handler = DifyApiAgentStubDriveRequestHandler(
-        dify_api_base_url="https://api.example.com",
-        dify_api_inner_api_key="inner-secret",
+        inner_api_url="https://api.example.com",
+        inner_api_key="inner-secret",
     )
 
     async def scenario() -> None:
diff --git a/dify-agent/tests/local/dify_agent/agent_stub/server/test_agent_stub_files.py b/dify-agent/tests/local/dify_agent/agent_stub/server/test_agent_stub_files.py
index c9b0c3fab6d..3c713aedc34 100644
--- a/dify-agent/tests/local/dify_agent/agent_stub/server/test_agent_stub_files.py
+++ b/dify-agent/tests/local/dify_agent/agent_stub/server/test_agent_stub_files.py
@@ -59,8 +59,8 @@ def test_dify_api_agent_stub_file_handler_injects_execution_context_for_upload(m
 
     _patch_async_client(monkeypatch, handler)
     file_handler = DifyApiAgentStubFileRequestHandler(
-        dify_api_base_url="https://api.example.com",
-        dify_api_inner_api_key="inner-secret",
+        inner_api_url="https://api.example.com",
+        inner_api_key="inner-secret",
     )
 
     async def scenario() -> None:
@@ -97,8 +97,8 @@ def test_dify_api_agent_stub_file_handler_injects_execution_context_for_download
 
     _patch_async_client(monkeypatch, handler)
     file_handler = DifyApiAgentStubFileRequestHandler(
-        dify_api_base_url="https://api.example.com",
-        dify_api_inner_api_key="inner-secret",
+        inner_api_url="https://api.example.com",
+        inner_api_key="inner-secret",
     )
 
     async def scenario() -> None:
@@ -115,8 +115,8 @@ def test_dify_api_agent_stub_file_handler_injects_execution_context_for_download
 
 def test_dify_api_agent_stub_file_handler_rejects_missing_user_id() -> None:
     file_handler = DifyApiAgentStubFileRequestHandler(
-        dify_api_base_url="https://api.example.com",
-        dify_api_inner_api_key="inner-secret",
+        inner_api_url="https://api.example.com",
+        inner_api_key="inner-secret",
     )
     principal = _principal()
     principal.execution_context = principal.execution_context.model_copy(update={"user_id": None})
@@ -141,8 +141,8 @@ def test_dify_api_agent_stub_file_handler_maps_non_2xx_response(monkeypatch) ->
 
     _patch_async_client(monkeypatch, handler)
     file_handler = DifyApiAgentStubFileRequestHandler(
-        dify_api_base_url="https://api.example.com",
-        dify_api_inner_api_key="inner-secret",
+        inner_api_url="https://api.example.com",
+        inner_api_key="inner-secret",
     )
 
     async def scenario() -> None:
@@ -166,8 +166,8 @@ def test_dify_api_agent_stub_file_handler_maps_error_envelope(monkeypatch) -> No
 
     _patch_async_client(monkeypatch, handler)
     file_handler = DifyApiAgentStubFileRequestHandler(
-        dify_api_base_url="https://api.example.com",
-        dify_api_inner_api_key="inner-secret",
+        inner_api_url="https://api.example.com",
+        inner_api_key="inner-secret",
     )
 
     async def scenario() -> None:
@@ -193,8 +193,8 @@ def test_dify_api_agent_stub_file_handler_rejects_upload_response_missing_url(mo
 
     _patch_async_client(monkeypatch, handler)
     file_handler = DifyApiAgentStubFileRequestHandler(
-        dify_api_base_url="https://api.example.com",
-        dify_api_inner_api_key="inner-secret",
+        inner_api_url="https://api.example.com",
+        inner_api_key="inner-secret",
     )
 
     async def scenario() -> None:
@@ -218,8 +218,8 @@ def test_dify_api_agent_stub_file_handler_rejects_invalid_download_response_sche
 
     _patch_async_client(monkeypatch, handler)
     file_handler = DifyApiAgentStubFileRequestHandler(
-        dify_api_base_url="https://api.example.com",
-        dify_api_inner_api_key="inner-secret",
+        inner_api_url="https://api.example.com",
+        inner_api_key="inner-secret",
     )
 
     async def scenario() -> None:
diff --git a/dify-agent/tests/local/dify_agent/agent_stub/server/test_cli.py b/dify-agent/tests/local/dify_agent/agent_stub/server/test_cli.py
index 0d1f5b89c0e..cb40a3b583b 100644
--- a/dify-agent/tests/local/dify_agent/agent_stub/server/test_cli.py
+++ b/dify-agent/tests/local/dify_agent/agent_stub/server/test_cli.py
@@ -43,7 +43,7 @@ def test_stub_server_cli_passes_explicit_uvicorn_settings(monkeypatch) -> None:
     }
 
 
-def test_stub_server_cli_switches_to_grpc_when_agent_stub_url_uses_grpc(monkeypatch) -> None:
+def test_stub_server_cli_switches_to_grpc_when_agent_stub_api_base_url_uses_grpc(monkeypatch) -> None:
     captured: dict[str, object] = {}
 
     async def fake_serve_grpc(*, settings, host, port) -> None:
@@ -51,7 +51,7 @@ def test_stub_server_cli_switches_to_grpc_when_agent_stub_url_uses_grpc(monkeypa
 
     monkeypatch.setattr(cli_module, "_serve_grpc", fake_serve_grpc)
     monkeypatch.setattr(
-        cli_module, "ServerSettings", lambda: type("Settings", (), {"agent_stub_url": "grpc://agent:9091"})()
+        cli_module, "ServerSettings", lambda: type("Settings", (), {"agent_stub_api_base_url": "grpc://agent:9091"})()
     )
 
     cli_module.main(["--host", "0.0.0.0", "--port", "9092"])
@@ -84,7 +84,7 @@ def test_serve_grpc_derives_default_bind_target_and_closes_server(monkeypatch) -
         "Settings",
         (),
         {
-            "agent_stub_url": "grpc://agent.example.com:9091",
+            "agent_stub_api_base_url": "grpc://agent.example.com:9091",
             "agent_stub_grpc_bind_address": None,
             "create_agent_stub_token_codec": lambda self: "token-codec",
             "create_agent_stub_file_request_handler": lambda self: "file-handler",
@@ -124,7 +124,7 @@ def test_serve_grpc_applies_cli_host_port_overrides(monkeypatch) -> None:
         "Settings",
         (),
         {
-            "agent_stub_url": "grpc://agent.example.com:9091",
+            "agent_stub_api_base_url": "grpc://agent.example.com:9091",
             "agent_stub_grpc_bind_address": "127.0.0.1:9191",
             "create_agent_stub_token_codec": lambda self: None,
             "create_agent_stub_file_request_handler": lambda self: None,
diff --git a/dify-agent/tests/local/dify_agent/layers/drive/test_configs.py b/dify-agent/tests/local/dify_agent/layers/drive/test_configs.py
index 3052827c5b2..96d781caa72 100644
--- a/dify-agent/tests/local/dify_agent/layers/drive/test_configs.py
+++ b/dify-agent/tests/local/dify_agent/layers/drive/test_configs.py
@@ -5,12 +5,10 @@ from pydantic import ValidationError
 
 from dify_agent.layers.drive import (
     DIFY_DRIVE_LAYER_TYPE_ID,
-    DifyDriveFileConfig,
     DifyDriveLayerConfig,
     DifyDriveSkillConfig,
 )
 from dify_agent.layers.drive.layer import DifyDriveLayer
-from dify_agent.runtime.compositor_factory import create_default_layer_providers
 
 
 def test_type_id_is_frozen_contract() -> None:
@@ -24,23 +22,24 @@ def test_layer_config_round_trips_manifest_entries() -> None:
             "drive_ref": "agent-019e9112",
             "skills": [
                 {
+                    "path": "tender-analyzer",
                     "name": "Tender Analyzer",
                     "description": "Parses RFP documents step by step.",
                     "skill_md_key": "tender-analyzer/SKILL.md",
                     "archive_key": "tender-analyzer/.DIFY-SKILL-FULL.zip",
                 }
             ],
-            "files": [{"name": "sample.pdf", "key": "files/sample.pdf", "size": 1024, "mime_type": "application/pdf"}],
+            "mentioned_skill_keys": ["tender-analyzer/SKILL.md"],
+            "mentioned_file_keys": ["files/sample.pdf"],
         }
     )
 
     dumped = config.model_dump(mode="json")
     assert dumped["drive_ref"] == "agent-019e9112"
+    assert "drive_base" not in dumped
     assert dumped["skills"][0]["skill_md_key"] == "tender-analyzer/SKILL.md"
-    assert dumped["files"][0]["key"] == "files/sample.pdf"
-    # the declaration is an index only — there is no field that could carry file content
+    assert dumped["mentioned_file_keys"] == ["files/sample.pdf"]
     assert "content" not in DifyDriveSkillConfig.model_fields
-    assert "content" not in DifyDriveFileConfig.model_fields
 
 
 def test_layer_config_rejects_unknown_fields() -> None:
@@ -48,11 +47,13 @@ def test_layer_config_rejects_unknown_fields() -> None:
         DifyDriveLayerConfig.model_validate({"drive_ref": "agent-1", "skill_md_body": "# inline content"})
 
 
-def test_inert_layer_is_registered_and_constructible_from_config() -> None:
-    providers = create_default_layer_providers()
-    provider = next(p for p in providers if p.type_id == DIFY_DRIVE_LAYER_TYPE_ID)
-
-    layer = provider.create_layer({"drive_ref": "agent-1", "skills": [], "files": []})
+def test_drive_layer_is_registered_and_constructible_from_config() -> None:
+    layer = DifyDriveLayer.from_config_with_settings(
+        DifyDriveLayerConfig(drive_ref="agent-1", skills=[], mentioned_skill_keys=[], mentioned_file_keys=[]),
+        inner_api_url="https://api.example.com",
+        inner_api_key="secret",
+    )
 
     assert isinstance(layer, DifyDriveLayer)
     assert layer.config.drive_ref == "agent-1"
+    assert not hasattr(layer, "local_drive_base")
diff --git a/dify-agent/tests/local/dify_agent/layers/drive/test_layer.py b/dify-agent/tests/local/dify_agent/layers/drive/test_layer.py
new file mode 100644
index 00000000000..c95526f046d
--- /dev/null
+++ b/dify-agent/tests/local/dify_agent/layers/drive/test_layer.py
@@ -0,0 +1,200 @@
+"""Behavior tests for the runtime Dify drive layer."""
+
+from __future__ import annotations
+
+from pathlib import Path
+import pytest
+
+from agenton.layers import EmptyRuntimeState, LayerConfig, NoLayerDeps, PlainLayer
+from dify_agent.layers.drive import DifyDriveLayerConfig, DifyDriveSkillConfig
+from dify_agent.layers.drive.layer import DifyDriveLayer, DifyDriveLayerError, _DriveManifestItem
+
+
+class _FakeExecutionContextConfig(LayerConfig):
+    tenant_id: str
+
+
+class _FakeExecutionContextLayer(PlainLayer[NoLayerDeps, _FakeExecutionContextConfig, EmptyRuntimeState]):
+    type_id = None
+
+    def __init__(self, tenant_id: str) -> None:
+        self.config = _FakeExecutionContextConfig(tenant_id=tenant_id)
+
+
+def _build_layer(tmp_path: Path) -> DifyDriveLayer:
+    layer = DifyDriveLayer.from_config_with_settings(
+        DifyDriveLayerConfig(
+            drive_ref="agent-1",
+            skills=[
+                DifyDriveSkillConfig(
+                    path="tender-analyzer",
+                    name="Tender Analyzer",
+                    description="Parses RFPs.",
+                    skill_md_key="tender-analyzer/SKILL.md",
+                    archive_key="tender-analyzer/.DIFY-SKILL-FULL.zip",
+                ),
+                DifyDriveSkillConfig(
+                    path="other-skill",
+                    name="Other Skill",
+                    description="Fallback catalog entry.",
+                    skill_md_key="other-skill/SKILL.md",
+                    archive_key=None,
+                ),
+            ],
+            mentioned_skill_keys=["tender-analyzer/SKILL.md"],
+            mentioned_file_keys=["files/report.pdf"],
+        ),
+        inner_api_url="https://api.example.com",
+        inner_api_key="secret",
+    )
+    layer.bind_deps({"execution_context": _FakeExecutionContextLayer("tenant-1")})
+    return layer
+
+
+@pytest.mark.anyio
+async def test_on_context_create_loads_mentioned_targets_into_prompt(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    layer = _build_layer(tmp_path)
+
+    async def _fetch_manifest_items(*, tenant_id: str, targets: list[tuple[str, bool]]) -> list[_DriveManifestItem]:
+        assert tenant_id == "tenant-1"
+        assert targets == [("tender-analyzer/", False), ("files/report.pdf", True)]
+        return [
+            _DriveManifestItem(key="tender-analyzer/SKILL.md", download_url="https://files/skill-md"),
+            _DriveManifestItem(key="files/report.pdf", download_url="https://files/report"),
+        ]
+
+    async def _download_items(items: list[_DriveManifestItem]) -> dict[str, str]:
+        assert {item.key for item in items} == {"files/report.pdf", "tender-analyzer/SKILL.md"}
+        skill_path = tmp_path / "tender-analyzer" / "SKILL.md"
+        skill_path.parent.mkdir(parents=True, exist_ok=True)
+        skill_path.write_text("# Tender Analyzer\nUse carefully.\n", encoding="utf-8")
+        file_path = tmp_path / "files" / "report.pdf"
+        file_path.parent.mkdir(parents=True, exist_ok=True)
+        file_path.write_bytes(b"pdf")
+        return {
+            "tender-analyzer/SKILL.md": str(skill_path),
+            "files/report.pdf": str(file_path),
+        }
+
+    monkeypatch.setattr(layer, "_fetch_manifest_items", _fetch_manifest_items)
+    monkeypatch.setattr(layer, "_download_items", _download_items)
+
+    await layer.on_context_create()
+
+    prompt = layer.build_prompt_context()
+    assert "Loaded mentioned skills" in prompt
+    assert "# Tender Analyzer\nUse carefully." in prompt
+    assert f"files/report.pdf -> {tmp_path / 'files' / 'report.pdf'}" in prompt
+    assert "Other available skills" in prompt
+    assert "other-skill: Other Skill — Fallback catalog entry." in prompt
+
+
+@pytest.mark.anyio
+async def test_on_context_resume_loads_mentioned_targets_into_prompt(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    layer = _build_layer(tmp_path)
+
+    async def _fetch_manifest_items(*, tenant_id: str, targets: list[tuple[str, bool]]) -> list[_DriveManifestItem]:
+        assert tenant_id == "tenant-1"
+        assert targets == [("tender-analyzer/", False), ("files/report.pdf", True)]
+        return [
+            _DriveManifestItem(key="tender-analyzer/SKILL.md", download_url="https://files/skill-md"),
+            _DriveManifestItem(key="files/report.pdf", download_url="https://files/report"),
+        ]
+
+    async def _download_items(items: list[_DriveManifestItem]) -> dict[str, str]:
+        assert {item.key for item in items} == {"files/report.pdf", "tender-analyzer/SKILL.md"}
+        skill_path = tmp_path / "tender-analyzer" / "SKILL.md"
+        skill_path.parent.mkdir(parents=True, exist_ok=True)
+        skill_path.write_text("# Tender Analyzer\nUse carefully.\n", encoding="utf-8")
+        file_path = tmp_path / "files" / "report.pdf"
+        file_path.parent.mkdir(parents=True, exist_ok=True)
+        file_path.write_bytes(b"pdf")
+        return {
+            "tender-analyzer/SKILL.md": str(skill_path),
+            "files/report.pdf": str(file_path),
+        }
+
+    monkeypatch.setattr(layer, "_fetch_manifest_items", _fetch_manifest_items)
+    monkeypatch.setattr(layer, "_download_items", _download_items)
+
+    await layer.on_context_resume()
+
+    prompt = layer.build_prompt_context()
+    assert "Loaded mentioned skills" in prompt
+    assert "# Tender Analyzer\nUse carefully." in prompt
+    assert f"files/report.pdf -> {tmp_path / 'files' / 'report.pdf'}" in prompt
+    assert "Other available skills" in prompt
+    assert "other-skill: Other Skill — Fallback catalog entry." in prompt
+
+
+@pytest.mark.anyio
+async def test_on_context_create_raises_when_mentioned_file_is_missing(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    layer = _build_layer(tmp_path)
+
+    async def _fetch_manifest_items(*, tenant_id: str, targets: list[tuple[str, bool]]) -> list[_DriveManifestItem]:
+        del tenant_id, targets
+        return [_DriveManifestItem(key="tender-analyzer/SKILL.md", download_url="https://files/skill-md")]
+
+    async def _download_items(items: list[_DriveManifestItem]) -> dict[str, str]:
+        del items
+        skill_path = tmp_path / "tender-analyzer" / "SKILL.md"
+        skill_path.parent.mkdir(parents=True, exist_ok=True)
+        skill_path.write_text("# Tender Analyzer\nUse carefully.\n", encoding="utf-8")
+        return {"tender-analyzer/SKILL.md": str(skill_path)}
+
+    monkeypatch.setattr(layer, "_fetch_manifest_items", _fetch_manifest_items)
+    monkeypatch.setattr(layer, "_download_items", _download_items)
+
+    with pytest.raises(DifyDriveLayerError, match="missing pulled file"):
+        await layer.on_context_create()
+
+
+@pytest.mark.anyio
+async def test_on_context_resume_raises_when_mentioned_targets_are_missing(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    layer = _build_layer(tmp_path)
+
+    async def _fetch_manifest_items(*, tenant_id: str, targets: list[tuple[str, bool]]) -> list[_DriveManifestItem]:
+        del tenant_id, targets
+        return []
+
+    async def _download_items(items: list[_DriveManifestItem]) -> dict[str, str]:
+        assert items == []
+        return {}
+
+    monkeypatch.setattr(layer, "_fetch_manifest_items", _fetch_manifest_items)
+    monkeypatch.setattr(layer, "_download_items", _download_items)
+
+    with pytest.raises(DifyDriveLayerError, match="missing pulled file"):
+        await layer.on_context_resume()
+
+
+@pytest.mark.anyio
+async def test_on_context_create_raises_when_manifest_is_empty_for_mentioned_targets(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    layer = _build_layer(tmp_path)
+
+    async def _fetch_manifest_items(*, tenant_id: str, targets: list[tuple[str, bool]]) -> list[_DriveManifestItem]:
+        del tenant_id, targets
+        return []
+
+    async def _download_items(items: list[_DriveManifestItem]) -> dict[str, str]:
+        assert items == []
+        return {}
+
+    monkeypatch.setattr(layer, "_fetch_manifest_items", _fetch_manifest_items)
+    monkeypatch.setattr(layer, "_download_items", _download_items)
+
+    with pytest.raises(DifyDriveLayerError, match="missing pulled file"):
+        await layer.on_context_create()
diff --git a/dify-agent/tests/local/dify_agent/layers/knowledge/test_layer.py b/dify-agent/tests/local/dify_agent/layers/knowledge/test_layer.py
index 5db74d6f452..28fadcb903b 100644
--- a/dify-agent/tests/local/dify_agent/layers/knowledge/test_layer.py
+++ b/dify-agent/tests/local/dify_agent/layers/knowledge/test_layer.py
@@ -56,8 +56,8 @@ def _knowledge_provider() -> LayerProvider[DifyKnowledgeBaseLayer]:
         layer_type=DifyKnowledgeBaseLayer,
         create=lambda config: DifyKnowledgeBaseLayer.from_config_with_settings(
             DifyKnowledgeBaseLayerConfig.model_validate(config),
-            dify_api_inner_url="http://dify-api",
-            dify_api_inner_api_key="inner-secret",
+            inner_api_url="http://dify-api",
+            inner_api_key="inner-secret",
         ),
     )
 
diff --git a/dify-agent/tests/local/dify_agent/layers/shell/test_layer.py b/dify-agent/tests/local/dify_agent/layers/shell/test_layer.py
index 61368295fad..30352d87c5e 100644
--- a/dify-agent/tests/local/dify_agent/layers/shell/test_layer.py
+++ b/dify-agent/tests/local/dify_agent/layers/shell/test_layer.py
@@ -8,7 +8,13 @@ import pytest
 
 from agenton.compositor import Compositor, LayerNode, LayerProvider
 from agenton.layers import LifecycleState
-from dify_agent.agent_stub.server.shell_agent_stub_env import AGENT_STUB_AUTH_JWE_ENV_VAR, AGENT_STUB_URL_ENV_VAR
+from dify_agent.agent_stub.server.shell_agent_stub_env import (
+    AGENT_STUB_AUTH_JWE_ENV_VAR,
+    AGENT_STUB_DRIVE_BASE_ENV_VAR,
+    AGENT_STUB_API_BASE_URL_ENV_VAR,
+)
+from dify_agent.layers.drive import DifyDriveLayerConfig
+from dify_agent.layers.drive.layer import DifyDriveLayer
 from dify_agent.layers.execution_context import DifyExecutionContextLayerConfig
 from dify_agent.layers.execution_context.layer import DifyExecutionContextLayer
 from dify_agent.layers.shell import (
@@ -231,6 +237,14 @@ def _execution_context_layer() -> DifyExecutionContextLayer:
     )
 
 
+def _drive_layer() -> DifyDriveLayer:
+    return DifyDriveLayer.from_config_with_settings(
+        DifyDriveLayerConfig(drive_ref="agent-1"),
+        inner_api_url="https://api.example.com",
+        inner_api_key="secret",
+    )
+
+
 def _shell_provider(*, client_factory: ShellctlClientFactory) -> LayerProvider[DifyShellLayer]:
     return LayerProvider.from_factory(
         layer_type=DifyShellLayer,
@@ -606,12 +620,12 @@ def test_shell_layer_injects_agent_stub_env_only_for_user_visible_shell_run() ->
         DifyShellLayerConfig(),
         shellctl_entrypoint="http://shellctl",
         shellctl_client_factory=lambda _entrypoint: client,
-        agent_stub_url="https://agent.example.com/agent-stub",
+        agent_stub_api_base_url="https://agent.example.com/agent-stub",
         agent_stub_token_factory=lambda execution_context, *, session_id: (
             f"token-for:{execution_context.tenant_id}:{session_id}"
         ),
     )
-    layer.deps = layer.deps_type(execution_context=_execution_context_layer())
+    layer.deps = layer.deps_type(drive=_drive_layer(), execution_context=_execution_context_layer())
     tools = {tool.name: tool for tool in layer.tools}
 
     async def scenario() -> None:
@@ -629,8 +643,9 @@ def test_shell_layer_injects_agent_stub_env_only_for_user_visible_shell_run() ->
     internal_run_calls = [call for call in client.run_calls if not call.script.endswith("\npwd")]
 
     assert user_run_call.env == {
-        AGENT_STUB_URL_ENV_VAR: "https://agent.example.com/agent-stub",
+        AGENT_STUB_API_BASE_URL_ENV_VAR: "https://agent.example.com/agent-stub",
         AGENT_STUB_AUTH_JWE_ENV_VAR: f"token-for:tenant-1:{layer.runtime_state.session_id}",
+        AGENT_STUB_DRIVE_BASE_ENV_VAR: "/mnt/drive/agent-1",
     }
     assert internal_run_calls
     assert all(call.env is None for call in internal_run_calls)
@@ -721,8 +736,9 @@ def test_run_remote_script_can_inject_agent_stub_env_for_server_owned_uploads()
         del timeout
         assert cwd == "~/workspace/abc12ff"
         assert env == {
-            AGENT_STUB_URL_ENV_VAR: "https://agent.example.com/agent-stub",
+            AGENT_STUB_API_BASE_URL_ENV_VAR: "https://agent.example.com/agent-stub",
             AGENT_STUB_AUTH_JWE_ENV_VAR: "token-for:tenant-1:abc12ff",
+            AGENT_STUB_DRIVE_BASE_ENV_VAR: "/mnt/drive/agent-1",
         }
         return _job_result("remote-upload", status=JobStatusName.EXITED, done=True, exit_code=0, output="{}")
 
@@ -731,12 +747,12 @@ def test_run_remote_script_can_inject_agent_stub_env_for_server_owned_uploads()
         DifyShellLayerConfig(),
         shellctl_entrypoint="http://shellctl",
         shellctl_client_factory=lambda _entrypoint: client,
-        agent_stub_url="https://agent.example.com/agent-stub",
+        agent_stub_api_base_url="https://agent.example.com/agent-stub",
         agent_stub_token_factory=lambda execution_context, *, session_id: (
             f"token-for:{execution_context.tenant_id}:{session_id}"
         ),
     )
-    layer.deps = layer.deps_type(execution_context=_execution_context_layer())
+    layer.deps = layer.deps_type(drive=_drive_layer(), execution_context=_execution_context_layer())
 
     async def scenario() -> None:
         async with layer.resource_context():
@@ -761,7 +777,7 @@ def test_run_remote_script_raises_when_agent_stub_env_is_unavailable() -> None:
         DifyShellLayerConfig(),
         shellctl_entrypoint="http://shellctl",
         shellctl_client_factory=lambda _entrypoint: client,
-        agent_stub_url="https://agent.example.com/agent-stub",
+        agent_stub_api_base_url="https://agent.example.com/agent-stub",
         agent_stub_token_factory=lambda execution_context, *, session_id: (
             f"token-for:{execution_context.tenant_id}:{session_id}"
         ),
@@ -791,7 +807,7 @@ def test_shell_layer_skips_agent_stub_env_without_execution_context_dependency()
         DifyShellLayerConfig(),
         shellctl_entrypoint="http://shellctl",
         shellctl_client_factory=lambda _entrypoint: client,
-        agent_stub_url="https://agent.example.com/agent-stub",
+        agent_stub_api_base_url="https://agent.example.com/agent-stub",
         agent_stub_token_factory=lambda execution_context, *, session_id: (
             f"token-for:{execution_context.tenant_id}:{session_id}"
         ),
diff --git a/dify-agent/tests/local/dify_agent/runtime/test_compositor_factory.py b/dify-agent/tests/local/dify_agent/runtime/test_compositor_factory.py
index 687b03bcb27..87582e654e8 100644
--- a/dify-agent/tests/local/dify_agent/runtime/test_compositor_factory.py
+++ b/dify-agent/tests/local/dify_agent/runtime/test_compositor_factory.py
@@ -84,7 +84,7 @@ def test_default_layer_providers_build_agent_stub_token_factory_from_agent_stub_
 
     providers = create_default_layer_providers(
         shellctl_entrypoint="http://shellctl.example",
-        agent_stub_url="https://agent.example.com/agent-stub",
+        agent_stub_api_base_url="https://agent.example.com/agent-stub",
         agent_stub_token_codec=codec,
     )
     shell_provider = next(provider for provider in providers if provider.type_id == DIFY_SHELL_LAYER_TYPE_ID)
diff --git a/dify-agent/tests/local/dify_agent/server/test_app.py b/dify-agent/tests/local/dify_agent/server/test_app.py
index 3983ef43506..8e40bd683b9 100644
--- a/dify-agent/tests/local/dify_agent/server/test_app.py
+++ b/dify-agent/tests/local/dify_agent/server/test_app.py
@@ -189,13 +189,12 @@ def test_create_app_creates_scheduler_and_closes_after_shutdown(monkeypatch: pyt
         run_retention_seconds=7,
         plugin_daemon_url="http://plugin-daemon",
         plugin_daemon_api_key="daemon-secret",
-        dify_api_inner_url="http://dify-api",
+        inner_api_url="http://dify-api",
+        inner_api_key="inner-secret",
         shellctl_entrypoint="http://shellctl",
         shellctl_auth_token="shell-secret",
-        agent_stub_url="https://agent.example.com/agent-stub",
+        agent_stub_api_base_url="https://agent.example.com/agent-stub",
         server_secret_key=_base64url_secret(b"1" * 32),
-        dify_api_base_url="https://api.example.com",
-        dify_api_inner_api_key="inner-secret",
         outbound_http_connect_timeout=1,
         outbound_http_read_timeout=2,
         outbound_http_write_timeout=3,
@@ -238,10 +237,10 @@ def test_create_app_creates_scheduler_and_closes_after_shutdown(monkeypatch: pyt
             )
         )
         assert isinstance(knowledge_layer, DifyKnowledgeBaseLayer)
-        assert knowledge_layer.dify_api_inner_url == "http://dify-api"
-        assert knowledge_layer.dify_api_inner_api_key == "inner-secret"
+        assert knowledge_layer.inner_api_url == "http://dify-api"
+        assert knowledge_layer.inner_api_key == "inner-secret"
         assert shell_layer.shellctl_entrypoint == "http://shellctl"
-        assert shell_layer.agent_stub_url == "https://agent.example.com/agent-stub"
+        assert shell_layer.agent_stub_api_base_url == "https://agent.example.com/agent-stub"
         shellctl_client = shell_layer.shellctl_client_factory("http://shellctl")
         assert isinstance(shellctl_client, ShellctlClient)
         assert shellctl_client.token == "shell-secret"
@@ -277,7 +276,7 @@ def test_create_app_wires_authenticated_agent_stub_connection_route(monkeypatch:
     fake_redis, fake_http_client = _patch_app_lifecycle(monkeypatch)
     settings = ServerSettings(
         redis_url="redis://example.invalid/0",
-        agent_stub_url="https://agent.example.com/agent-stub",
+        agent_stub_api_base_url="https://agent.example.com/agent-stub",
         server_secret_key=_base64url_secret(b"1" * 32),
     )
     token_codec = settings.create_agent_stub_token_codec()
@@ -303,10 +302,10 @@ def test_create_app_wires_authenticated_agent_stub_file_upload_route(monkeypatch
     fake_redis, fake_http_client = _patch_app_lifecycle(monkeypatch)
     settings = ServerSettings(
         redis_url="redis://example.invalid/0",
-        agent_stub_url="https://agent.example.com/agent-stub",
+        agent_stub_api_base_url="https://agent.example.com/agent-stub",
         server_secret_key=_base64url_secret(b"1" * 32),
-        dify_api_base_url="https://api.example.com",
-        dify_api_inner_api_key="inner-secret",
+        inner_api_url="https://api.example.com",
+        inner_api_key="inner-secret",
     )
     token_codec = settings.create_agent_stub_token_codec()
     assert token_codec is not None
@@ -342,10 +341,10 @@ def test_create_app_wires_authenticated_agent_stub_drive_manifest_route(monkeypa
     fake_redis, fake_http_client = _patch_app_lifecycle(monkeypatch)
     settings = ServerSettings(
         redis_url="redis://example.invalid/0",
-        agent_stub_url="https://agent.example.com/agent-stub",
+        agent_stub_api_base_url="https://agent.example.com/agent-stub",
         server_secret_key=_base64url_secret(b"1" * 32),
-        dify_api_base_url="https://api.example.com",
-        dify_api_inner_api_key="inner-secret",
+        inner_api_url="https://api.example.com",
+        inner_api_key="inner-secret",
     )
     token_codec = settings.create_agent_stub_token_codec()
     assert token_codec is not None
@@ -409,7 +408,7 @@ def test_create_app_starts_and_stops_agent_stub_grpc_server_for_grpc_url(monkeyp
 
     settings = ServerSettings(
         redis_url="redis://example.invalid/0",
-        agent_stub_url="grpc://agent.example.com:9091",
+        agent_stub_api_base_url="grpc://agent.example.com:9091",
         agent_stub_grpc_bind_address="0.0.0.0:9191",
         server_secret_key=_base64url_secret(b"1" * 32),
     )
@@ -485,8 +484,8 @@ def test_create_dify_api_inner_http_client_uses_generic_outbound_httpx_construct
 def test_server_settings_use_generic_outbound_http_args_for_shared_clients() -> None:
     model_fields = ServerSettings.model_fields
 
-    assert "dify_api_inner_url" in model_fields
-    assert "dify_api_inner_api_key" in model_fields
+    assert "inner_api_url" in model_fields
+    assert "inner_api_key" in model_fields
     assert "outbound_http_connect_timeout" in model_fields
     assert "outbound_http_read_timeout" in model_fields
     assert "outbound_http_write_timeout" in model_fields
diff --git a/dify-agent/tests/local/dify_agent/server/test_sandbox_files.py b/dify-agent/tests/local/dify_agent/server/test_sandbox_files.py
index 35e83667d17..939e28f5309 100644
--- a/dify-agent/tests/local/dify_agent/server/test_sandbox_files.py
+++ b/dify-agent/tests/local/dify_agent/server/test_sandbox_files.py
@@ -10,7 +10,11 @@ import pytest
 from agenton.compositor import CompositorSessionSnapshot, LayerProvider
 from agenton.compositor.schemas import LayerSessionSnapshot
 from agenton.layers.base import LifecycleState
-from dify_agent.agent_stub.server.shell_agent_stub_env import AGENT_STUB_AUTH_JWE_ENV_VAR, AGENT_STUB_URL_ENV_VAR
+from dify_agent.agent_stub.server.shell_agent_stub_env import (
+    AGENT_STUB_AUTH_JWE_ENV_VAR,
+    AGENT_STUB_DRIVE_BASE_ENV_VAR,
+    AGENT_STUB_API_BASE_URL_ENV_VAR,
+)
 from dify_agent.layers.execution_context import DifyExecutionContextLayerConfig
 from dify_agent.layers.execution_context.layer import DifyExecutionContextLayer
 from dify_agent.layers.shell import DifyShellLayerConfig
@@ -189,7 +193,7 @@ def _service(
             DifyShellLayerConfig.model_validate(config),
             shellctl_entrypoint="http://shellctl",
             shellctl_client_factory=lambda _entrypoint: client,
-            agent_stub_url="https://agent.example.com/agent-stub",
+            agent_stub_api_base_url="https://agent.example.com/agent-stub",
             agent_stub_token_factory=lambda execution_context, *, session_id: (
                 f"token-for:{execution_context.tenant_id}:{session_id}"
             ),
@@ -335,8 +339,9 @@ def test_upload_file_injects_agent_stub_env_and_returns_mapping() -> None:
         assert cwd == "~/workspace/abc12ff"
         assert timeout == 30.0
         assert env == {
-            AGENT_STUB_URL_ENV_VAR: "https://agent.example.com/agent-stub",
+            AGENT_STUB_API_BASE_URL_ENV_VAR: "https://agent.example.com/agent-stub",
             AGENT_STUB_AUTH_JWE_ENV_VAR: "token-for:tenant-1:abc12ff",
+            AGENT_STUB_DRIVE_BASE_ENV_VAR: "/mnt/drive",
         }
         assert 'dify-agent", "file", "upload"' in script
         return _job_result(
diff --git a/dify-agent/tests/local/dify_agent/server/test_settings.py b/dify-agent/tests/local/dify_agent/server/test_settings.py
index 1862e5995e2..da37eb16747 100644
--- a/dify-agent/tests/local/dify_agent/server/test_settings.py
+++ b/dify-agent/tests/local/dify_agent/server/test_settings.py
@@ -49,12 +49,21 @@ def test_server_settings_defaults_shellctl_auth_token_to_none(
 
 
 def test_server_settings_reads_agent_stub_settings_from_env(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setenv("DIFY_AGENT_STUB_URL", "https://agent.example.com/agent-stub/")
+    monkeypatch.setenv("DIFY_AGENT_STUB_API_BASE_URL", "https://agent.example.com/agent-stub/")
     monkeypatch.setenv("DIFY_AGENT_SERVER_SECRET_KEY", _base64url_secret(secrets.token_bytes(32)))
 
     settings = ServerSettings()
 
-    assert settings.agent_stub_url == "https://agent.example.com/agent-stub"
+    assert settings.agent_stub_api_base_url == "https://agent.example.com/agent-stub"
+
+
+def test_server_settings_normalizes_agent_stub_service_root_from_env(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("DIFY_AGENT_STUB_API_BASE_URL", "https://agent.example.com")
+    monkeypatch.setenv("DIFY_AGENT_SERVER_SECRET_KEY", _base64url_secret(secrets.token_bytes(32)))
+
+    settings = ServerSettings()
+
+    assert settings.agent_stub_api_base_url == "https://agent.example.com/agent-stub"
 
 
 def test_server_settings_ignores_obsolete_legacy_settings_namespace(monkeypatch: pytest.MonkeyPatch) -> None:
@@ -63,45 +72,53 @@ def test_server_settings_ignores_obsolete_legacy_settings_namespace(monkeypatch:
 
     settings = ServerSettings()
 
-    assert settings.agent_stub_url is None
+    assert settings.agent_stub_api_base_url is None
 
 
-def test_server_settings_rejects_agent_stub_url_with_query_or_fragment() -> None:
+def test_server_settings_rejects_agent_stub_api_base_url_with_query_or_fragment() -> None:
     secret = _base64url_secret(secrets.token_bytes(32))
 
     with pytest.raises(ValidationError, match="query string or fragment"):
         _ = ServerSettings(
-            agent_stub_url="https://agent.example.com/agent-stub?x=1",
+            agent_stub_api_base_url="https://agent.example.com/agent-stub?x=1",
             server_secret_key=secret,
         )
 
     with pytest.raises(ValidationError, match="query string or fragment"):
         _ = ServerSettings(
-            agent_stub_url="https://agent.example.com/agent-stub#fragment",
+            agent_stub_api_base_url="https://agent.example.com/agent-stub#fragment",
             server_secret_key=secret,
         )
 
 
-def test_server_settings_rejects_public_agent_stub_url_without_secret_key() -> None:
+def test_server_settings_rejects_agent_stub_api_base_url_with_unexpected_path() -> None:
+    with pytest.raises(ValidationError, match="empty or /agent-stub"):
+        _ = ServerSettings(
+            agent_stub_api_base_url="https://agent.example.com/foo",
+            server_secret_key=_base64url_secret(secrets.token_bytes(32)),
+        )
+
+
+def test_server_settings_rejects_public_agent_stub_api_base_url_without_secret_key() -> None:
     with pytest.raises(ValidationError, match="DIFY_AGENT_SERVER_SECRET_KEY"):
-        _ = ServerSettings(agent_stub_url="https://agent.example.com/agent-stub")
+        _ = ServerSettings(agent_stub_api_base_url="https://agent.example.com/agent-stub")
 
 
-def test_server_settings_accepts_grpc_agent_stub_url_and_bind_override() -> None:
+def test_server_settings_accepts_grpc_agent_stub_api_base_url_and_bind_override() -> None:
     settings = ServerSettings(
-        agent_stub_url="grpc://agent.example.com:9091",
+        agent_stub_api_base_url="grpc://agent.example.com:9091",
         agent_stub_grpc_bind_address="0.0.0.0:9191",
         server_secret_key=_base64url_secret(secrets.token_bytes(32)),
     )
 
-    assert settings.agent_stub_url == "grpc://agent.example.com:9091"
+    assert settings.agent_stub_api_base_url == "grpc://agent.example.com:9091"
     assert settings.agent_stub_grpc_bind_address == "0.0.0.0:9191"
 
 
 def test_server_settings_rejects_grpc_bind_override_without_grpc_url() -> None:
     with pytest.raises(ValidationError, match="grpc://"):
         _ = ServerSettings(
-            agent_stub_url="https://agent.example.com/agent-stub",
+            agent_stub_api_base_url="https://agent.example.com/agent-stub",
             agent_stub_grpc_bind_address="0.0.0.0:9191",
             server_secret_key=_base64url_secret(secrets.token_bytes(32)),
         )
@@ -122,36 +139,33 @@ def test_server_settings_rejects_padded_or_quoted_server_secret_key() -> None:
         _ = ServerSettings(server_secret_key=f'"{secret}"')
 
 
-def test_server_settings_normalizes_dify_api_base_url_from_env(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setenv("DIFY_AGENT_DIFY_API_BASE_URL", "https://api.example.com/")
-    monkeypatch.setenv("DIFY_AGENT_DIFY_API_INNER_API_KEY", "inner-secret")
+def test_server_settings_normalizes_inner_api_url_from_env(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("DIFY_AGENT_INNER_API_URL", "https://api.example.com/")
+    monkeypatch.setenv("DIFY_AGENT_INNER_API_KEY", "inner-secret")
 
     settings = ServerSettings()
 
-    assert settings.dify_api_base_url == "https://api.example.com"
-    assert settings.dify_api_inner_api_key == "inner-secret"
+    assert settings.inner_api_url == "https://api.example.com"
+    assert settings.inner_api_key == "inner-secret"
 
 
-def test_server_settings_requires_inner_api_key_when_dify_api_base_url_is_set() -> None:
-    with pytest.raises(ValidationError, match="DIFY_AGENT_DIFY_API_INNER_API_KEY"):
-        _ = ServerSettings(dify_api_base_url="https://api.example.com")
-
-    settings = ServerSettings(dify_api_inner_api_key="inner-secret")
-    assert settings.dify_api_inner_api_key == "inner-secret"
-    assert settings.dify_api_base_url is None
+def test_server_settings_allows_inner_api_url_without_key_until_a_bridge_is_used() -> None:
+    settings = ServerSettings(inner_api_key="inner-secret")
+    assert settings.inner_api_key == "inner-secret"
+    assert settings.inner_api_url == "http://localhost:5001"
 
 
-def test_server_settings_rejects_dify_api_base_url_with_query_or_fragment() -> None:
+def test_server_settings_rejects_inner_api_url_with_query_or_fragment() -> None:
     with pytest.raises(ValidationError, match="query string or fragment"):
         _ = ServerSettings(
-            dify_api_base_url="https://api.example.com?x=1",
-            dify_api_inner_api_key="inner-secret",
+            inner_api_url="https://api.example.com?x=1",
+            inner_api_key="inner-secret",
         )
 
     with pytest.raises(ValidationError, match="query string or fragment"):
         _ = ServerSettings(
-            dify_api_base_url="https://api.example.com#frag",
-            dify_api_inner_api_key="inner-secret",
+            inner_api_url="https://api.example.com#frag",
+            inner_api_key="inner-secret",
         )
 
 
@@ -173,15 +187,15 @@ def test_server_settings_create_agent_stub_file_request_handler_returns_none_wit
 
 def test_server_settings_create_agent_stub_file_request_handler_returns_handler_when_configured() -> None:
     settings = ServerSettings(
-        dify_api_base_url="https://api.example.com",
-        dify_api_inner_api_key="inner-secret",
+        inner_api_url="https://api.example.com",
+        inner_api_key="inner-secret",
     )
 
     handler = settings.create_agent_stub_file_request_handler()
 
     assert isinstance(handler, DifyApiAgentStubFileRequestHandler)
-    assert handler.dify_api_base_url == "https://api.example.com"
-    assert handler.dify_api_inner_api_key == "inner-secret"
+    assert handler.inner_api_url == "https://api.example.com"
+    assert handler.inner_api_key == "inner-secret"
 
 
 def test_server_settings_create_agent_stub_drive_request_handler_returns_none_without_full_settings() -> None:
@@ -190,8 +204,8 @@ def test_server_settings_create_agent_stub_drive_request_handler_returns_none_wi
 
 def test_server_settings_create_agent_stub_drive_request_handler_returns_handler_when_configured() -> None:
     settings = ServerSettings(
-        dify_api_base_url="https://api.example.com",
-        dify_api_inner_api_key="inner-secret",
+        inner_api_url="https://api.example.com",
+        inner_api_key="inner-secret",
         outbound_http_connect_timeout=11,
         outbound_http_read_timeout=22,
         outbound_http_write_timeout=33,
@@ -201,8 +215,8 @@ def test_server_settings_create_agent_stub_drive_request_handler_returns_handler
     handler = settings.create_agent_stub_drive_request_handler()
 
     assert isinstance(handler, DifyApiAgentStubDriveRequestHandler)
-    assert handler.dify_api_base_url == "https://api.example.com"
-    assert handler.dify_api_inner_api_key == "inner-secret"
+    assert handler.inner_api_url == "https://api.example.com"
+    assert handler.inner_api_key == "inner-secret"
     timeout = cast(httpx.Timeout, handler.timeout)
     assert timeout.connect == 11
     assert timeout.read == 22
diff --git a/dify-agent/tests/local/dify_agent/test_import_boundaries.py b/dify-agent/tests/local/dify_agent/test_import_boundaries.py
index ecc2d548574..104f12031f0 100644
--- a/dify-agent/tests/local/dify_agent/test_import_boundaries.py
+++ b/dify-agent/tests/local/dify_agent/test_import_boundaries.py
@@ -111,7 +111,7 @@ def test_protocol_and_dify_plugin_exports_do_not_import_server_only_modules() ->
         ],
         assertions=[
             "assert hasattr(dify_agent_protocol, 'PydanticAIStreamRunEvent')",
-            "assert dify_agent_layers_drive.__all__ == ['DIFY_DRIVE_LAYER_TYPE_ID', 'DifyDriveFileConfig', 'DifyDriveLayerConfig', 'DifyDriveSkillConfig']",
+            "assert dify_agent_layers_drive.__all__ == ['DIFY_DRIVE_LAYER_TYPE_ID', 'DifyDriveLayerConfig', 'DifyDriveSkillConfig']",
             "assert dify_agent_layers_execution_context.__all__ == ['DIFY_EXECUTION_CONTEXT_LAYER_TYPE_ID', 'DifyExecutionContextAgentMode', 'DifyExecutionContextInvokeFrom', 'DifyExecutionContextLayerConfig', 'DifyExecutionContextUserFrom']",
             "assert dify_agent_layers_ask_human.__all__ == ['AskHumanAction', 'AskHumanActionStyle', 'AskHumanField', 'AskHumanFieldType', 'AskHumanFileField', 'AskHumanFileListField', 'AskHumanParagraphField', 'AskHumanResultStatus', 'AskHumanSelectField', 'AskHumanSelectOption', 'AskHumanSelectedAction', 'AskHumanToolArgs', 'AskHumanToolResult', 'AskHumanUrgency', 'DEFAULT_ASK_HUMAN_TOOL_DESCRIPTION', 'DIFY_ASK_HUMAN_LAYER_TYPE_ID', 'DifyAskHumanLayerConfig']",
             "assert dify_agent_layers_dify_plugin.__all__ == ['DIFY_PLUGIN_LLM_LAYER_TYPE_ID', 'DIFY_PLUGIN_TOOLS_LAYER_TYPE_ID', 'DifyPluginCredentialValue', 'DifyPluginLLMLayerConfig', 'DifyPluginToolCredentialType', 'DifyPluginToolConfig', 'DifyPluginToolOption', 'DifyPluginToolParameter', 'DifyPluginToolParameterForm', 'DifyPluginToolParameterType', 'DifyPluginToolsLayerConfig', 'DifyPluginToolValue']",
@@ -159,6 +159,14 @@ def test_agent_stub_client_and_protocol_imports_are_client_safe() -> None:
     )
 
 
+def test_server_settings_import_does_not_import_agent_stub_app() -> None:
+    _run_import_check(
+        blocked_imports=["dify_agent.agent_stub.server.app"],
+        imports=["dify_agent.server.settings"],
+        assertions=["assert hasattr(dify_agent_server_settings, 'ServerSettings')"],
+    )
+
+
 def test_agenton_collection_roots_do_not_eagerly_import_pydantic_ai_implementations() -> None:
     _run_import_check(
         blocked_imports=[
diff --git a/dify-agent/tests/local/test_packaging.py b/dify-agent/tests/local/test_packaging.py
index bc76ede8ed7..b2e6b24dc38 100644
--- a/dify-agent/tests/local/test_packaging.py
+++ b/dify-agent/tests/local/test_packaging.py
@@ -22,7 +22,7 @@ SERVER_RUNTIME_DEPENDENCIES = {
     "pydantic-ai-slim[anthropic,google,openai]>=1.85.1,<2.0.0",
     "pydantic-settings>=2.12.0,<3.0.0",
     "redis>=7.4.0,<8.0.0",
-    "shell-session-manager==2.2.0",
+    "shell-session-manager==2.2.1",
     "uvicorn[standard]==0.46.0",
 }
 
@@ -65,11 +65,24 @@ def test_default_package_discovery_excludes_example_packages() -> None:
     assert "dify_agent_examples*" not in find_config["include"]
 
 
-def test_project_declares_console_script_and_shellctl_docker_version() -> None:
+def test_project_declares_console_script_and_local_sandbox_docker_version() -> None:
     pyproject = _read_pyproject()
     scripts = pyproject["project"]["scripts"]
-    dockerfile = (PROJECT_ROOT / "docker" / "shellctl" / "Dockerfile").read_text(encoding="utf-8")
+    dockerfile = (PROJECT_ROOT / "docker" / "local-sandbox" / "Dockerfile").read_text(encoding="utf-8")
 
     assert scripts["dify-agent"] == "dify_agent.agent_stub.cli.main:main"
     assert scripts["dify-agent-stub-server"] == "dify_agent.agent_stub.server.cli:main"
-    assert "shell-session-manager==2.2.0" in dockerfile
+    assert "SHELL_SESSION_MANAGER_VERSION=2.2.1" in dockerfile
+
+
+def test_local_sandbox_dockerfile_installs_stub_client_and_shellctl() -> None:
+    dockerfile = (PROJECT_ROOT / "docker" / "local-sandbox" / "Dockerfile").read_text(encoding="utf-8")
+
+    assert "uv sync --frozen --no-dev --no-editable --extra grpc" in dockerfile
+    assert "SHELL_SESSION_MANAGER_VERSION=2.2.1" in dockerfile
+    assert "shell-session-manager==${SHELL_SESSION_MANAGER_VERSION}" in dockerfile
+    assert "DIFY_AGENT_STUB_DRIVE_BASE=/mnt/drive" in dockerfile
+    assert "ln -s ${VIRTUAL_ENV}/bin/dify-agent /usr/local/bin/dify-agent" in dockerfile
+    assert "ln -s ${VIRTUAL_ENV}/bin/shellctl /usr/local/bin/shellctl" in dockerfile
+    assert "mkdir -p /mnt/drive" in dockerfile
+    assert '["shellctl", "serve", "--listen", "0.0.0.0:5004"]' in dockerfile
diff --git a/dify-agent/uv.lock b/dify-agent/uv.lock
index bd99e89a439..bc20927b44e 100644
--- a/dify-agent/uv.lock
+++ b/dify-agent/uv.lock
@@ -639,7 +639,7 @@ requires-dist = [
     { name = "pydantic-ai-slim", extras = ["anthropic", "google", "openai"], marker = "extra == 'server'", specifier = ">=1.85.1,<2.0.0" },
     { name = "pydantic-settings", marker = "extra == 'server'", specifier = ">=2.12.0,<3.0.0" },
     { name = "redis", marker = "extra == 'server'", specifier = ">=7.4.0,<8.0.0" },
-    { name = "shell-session-manager", marker = "extra == 'server'", specifier = "==2.2.0" },
+    { name = "shell-session-manager", marker = "extra == 'server'", specifier = "==2.2.1" },
     { name = "typer", specifier = ">=0.16.1,<0.17" },
     { name = "typing-extensions", specifier = ">=4.12.2,<5.0.0" },
     { name = "uvicorn", extras = ["standard"], marker = "extra == 'server'", specifier = "==0.46.0" },
@@ -3286,7 +3286,7 @@ wheels = [
 
 [[package]]
 name = "shell-session-manager"
-version = "2.2.0"
+version = "2.2.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "aiosqlite" },
@@ -3298,9 +3298,9 @@ dependencies = [
     { name = "typer" },
     { name = "uvicorn" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/c5/84/aa6a86e7686b0c1e67b17ce4f5db6a42f115f1269d1f85362e22416b5829/shell_session_manager-2.2.0.tar.gz", hash = "sha256:ed31f12eecd30ad342dab9713651e2cb259b9beea6a6043842b73616c21b3070", size = 49479, upload-time = "2026-06-02T12:49:34.988Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/54/c3/83701914c5194e0390b93a05685ddfceda425348523254f43fdcb5024a37/shell_session_manager-2.2.1.tar.gz", hash = "sha256:421531c8bca5a586e9245282e13fdbe2566fca34e72a7320749c745cc2a935ee", size = 51380, upload-time = "2026-06-19T12:21:58.67Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/82/cc/71fa09d0d865ee652312067d9d13c51b7800cdc0e54afe0e076ad1a29520/shell_session_manager-2.2.0-py3-none-any.whl", hash = "sha256:338cca9716facec60cc3985c1d88837c2f23abbc17ff2b61e58b4e4a0f9f19ad", size = 47240, upload-time = "2026-06-02T12:49:33.585Z" },
+    { url = "https://files.pythonhosted.org/packages/5f/b6/b8d84ff7e59661cef85a1f021f500c798451121775f5aafd7b670ba63117/shell_session_manager-2.2.1-py3-none-any.whl", hash = "sha256:b7452dd5d50b5f55d2a108a2c422ed9883a817e2145f884844d072ec95dcaff8", size = 48895, upload-time = "2026-06-19T12:21:57.183Z" },
 ]
 
 [[package]]
diff --git a/docker/.env.example b/docker/.env.example
index 5e13db9cbc4..78ebc3e4df1 100644
--- a/docker/.env.example
+++ b/docker/.env.example
@@ -120,7 +120,6 @@ CELERY_TASK_ANNOTATIONS=null
 EVENT_BUS_REDIS_URL=
 EVENT_BUS_REDIS_CHANNEL_TYPE=pubsub
 EVENT_BUS_REDIS_USE_CLUSTERS=false
-EVENT_BUS_LISTENER_JOIN_TIMEOUT_MS=2000
 
 # Web and app limits
 WEB_API_CORS_ALLOW_ORIGINS=*
diff --git a/eslint-suppressions.json b/eslint-suppressions.json
index 7e4521f51cb..a9975b4476e 100644
--- a/eslint-suppressions.json
+++ b/eslint-suppressions.json
@@ -986,6 +986,9 @@
     "jsx-a11y/click-events-have-key-events": {
       "count": 1
     },
+    "jsx-a11y/no-noninteractive-element-to-interactive-role": {
+      "count": 1
+    },
     "jsx-a11y/no-static-element-interactions": {
       "count": 1
     }
@@ -1003,6 +1006,11 @@
       "count": 3
     }
   },
+  "web/app/components/apps/starred-app-card.tsx": {
+    "jsx-a11y/no-noninteractive-element-to-interactive-role": {
+      "count": 1
+    }
+  },
   "web/app/components/base/action-button/index.tsx": {
     "erasable-syntax-only/enums": {
       "count": 1
@@ -2602,11 +2610,6 @@
       "count": 1
     }
   },
-  "web/app/components/base/zendesk/utils.ts": {
-    "ts/no-explicit-any": {
-      "count": 4
-    }
-  },
   "web/app/components/billing/header-billing-btn/index.tsx": {
     "jsx-a11y/click-events-have-key-events": {
       "count": 1
@@ -3364,14 +3367,6 @@
       "count": 1
     }
   },
-  "web/app/components/datasets/list/dataset-card/index.tsx": {
-    "jsx-a11y/click-events-have-key-events": {
-      "count": 1
-    },
-    "jsx-a11y/no-static-element-interactions": {
-      "count": 1
-    }
-  },
   "web/app/components/datasets/list/dataset-card/operation-item.tsx": {
     "jsx-a11y/click-events-have-key-events": {
       "count": 1
diff --git a/package.json b/package.json
index b9cb1274a2b..1b9c8c67954 100644
--- a/package.json
+++ b/package.json
@@ -2,7 +2,7 @@
   "name": "dify",
   "type": "module",
   "private": true,
-  "packageManager": "pnpm@11.6.0",
+  "packageManager": "pnpm@11.8.0",
   "devEngines": {
     "runtime": {
       "name": "node",
diff --git a/packages/contracts/generated/api/console/agent/orpc.gen.ts b/packages/contracts/generated/api/console/agent/orpc.gen.ts
index fbfca3be118..5e4a692f244 100644
--- a/packages/contracts/generated/api/console/agent/orpc.gen.ts
+++ b/packages/contracts/generated/api/console/agent/orpc.gen.ts
@@ -4,6 +4,8 @@ import { oc } from '@orpc/contract'
 import * as z from 'zod'
 
 import {
+  zDeleteAgentByAgentIdApiKeysByApiKeyIdPath,
+  zDeleteAgentByAgentIdApiKeysByApiKeyIdResponse,
   zDeleteAgentByAgentIdFilesPath,
   zDeleteAgentByAgentIdFilesQuery,
   zDeleteAgentByAgentIdFilesResponse,
@@ -11,6 +13,10 @@ import {
   zDeleteAgentByAgentIdResponse,
   zDeleteAgentByAgentIdSkillsBySlugPath,
   zDeleteAgentByAgentIdSkillsBySlugResponse,
+  zGetAgentByAgentIdApiAccessPath,
+  zGetAgentByAgentIdApiAccessResponse,
+  zGetAgentByAgentIdApiKeysPath,
+  zGetAgentByAgentIdApiKeysResponse,
   zGetAgentByAgentIdChatMessagesByMessageIdSuggestedQuestionsPath,
   zGetAgentByAgentIdChatMessagesByMessageIdSuggestedQuestionsResponse,
   zGetAgentByAgentIdChatMessagesPath,
@@ -29,6 +35,10 @@ import {
   zGetAgentByAgentIdDriveFilesPreviewResponse,
   zGetAgentByAgentIdDriveFilesQuery,
   zGetAgentByAgentIdDriveFilesResponse,
+  zGetAgentByAgentIdDriveSkillsBySkillPathInspectPath,
+  zGetAgentByAgentIdDriveSkillsBySkillPathInspectResponse,
+  zGetAgentByAgentIdDriveSkillsPath,
+  zGetAgentByAgentIdDriveSkillsResponse,
   zGetAgentByAgentIdLogsByConversationIdMessagesPath,
   zGetAgentByAgentIdLogsByConversationIdMessagesQuery,
   zGetAgentByAgentIdLogsByConversationIdMessagesResponse,
@@ -61,6 +71,11 @@ import {
   zGetAgentQuery,
   zGetAgentResponse,
   zPostAgentBody,
+  zPostAgentByAgentIdApiEnableBody,
+  zPostAgentByAgentIdApiEnablePath,
+  zPostAgentByAgentIdApiEnableResponse,
+  zPostAgentByAgentIdApiKeysPath,
+  zPostAgentByAgentIdApiKeysResponse,
   zPostAgentByAgentIdChatMessagesByTaskIdStopPath,
   zPostAgentByAgentIdChatMessagesByTaskIdStopResponse,
   zPostAgentByAgentIdComposerValidateBody,
@@ -69,6 +84,8 @@ import {
   zPostAgentByAgentIdCopyBody,
   zPostAgentByAgentIdCopyPath,
   zPostAgentByAgentIdCopyResponse,
+  zPostAgentByAgentIdDebugConversationRefreshPath,
+  zPostAgentByAgentIdDebugConversationRefreshResponse,
   zPostAgentByAgentIdFeaturesBody,
   zPostAgentByAgentIdFeaturesPath,
   zPostAgentByAgentIdFeaturesResponse,
@@ -86,6 +103,8 @@ import {
   zPostAgentByAgentIdSkillsUploadBody,
   zPostAgentByAgentIdSkillsUploadPath,
   zPostAgentByAgentIdSkillsUploadResponse,
+  zPostAgentByAgentIdVersionsByVersionIdRestorePath,
+  zPostAgentByAgentIdVersionsByVersionIdRestoreResponse,
   zPostAgentResponse,
   zPutAgentByAgentIdBody,
   zPutAgentByAgentIdComposerBody,
@@ -110,10 +129,87 @@ export const inviteOptions = {
   get,
 }
 
+export const get2 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getAgentByAgentIdApiAccess',
+    path: '/agent/{agent_id}/api-access',
+    tags: ['console'],
+  })
+  .input(z.object({ params: zGetAgentByAgentIdApiAccessPath }))
+  .output(zGetAgentByAgentIdApiAccessResponse)
+
+export const apiAccess = {
+  get: get2,
+}
+
+export const post = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'POST',
+    operationId: 'postAgentByAgentIdApiEnable',
+    path: '/agent/{agent_id}/api-enable',
+    tags: ['console'],
+  })
+  .input(
+    z.object({ body: zPostAgentByAgentIdApiEnableBody, params: zPostAgentByAgentIdApiEnablePath }),
+  )
+  .output(zPostAgentByAgentIdApiEnableResponse)
+
+export const apiEnable = {
+  post,
+}
+
+export const delete_ = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'DELETE',
+    operationId: 'deleteAgentByAgentIdApiKeysByApiKeyId',
+    path: '/agent/{agent_id}/api-keys/{api_key_id}',
+    successStatus: 204,
+    tags: ['console'],
+  })
+  .input(z.object({ params: zDeleteAgentByAgentIdApiKeysByApiKeyIdPath }))
+  .output(zDeleteAgentByAgentIdApiKeysByApiKeyIdResponse)
+
+export const byApiKeyId = {
+  delete: delete_,
+}
+
+export const get3 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getAgentByAgentIdApiKeys',
+    path: '/agent/{agent_id}/api-keys',
+    tags: ['console'],
+  })
+  .input(z.object({ params: zGetAgentByAgentIdApiKeysPath }))
+  .output(zGetAgentByAgentIdApiKeysResponse)
+
+export const post2 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'POST',
+    operationId: 'postAgentByAgentIdApiKeys',
+    path: '/agent/{agent_id}/api-keys',
+    successStatus: 201,
+    tags: ['console'],
+  })
+  .input(z.object({ params: zPostAgentByAgentIdApiKeysPath }))
+  .output(zPostAgentByAgentIdApiKeysResponse)
+
+export const apiKeys = {
+  get: get3,
+  post: post2,
+  byApiKeyId,
+}
+
 /**
  * Get suggested questions for an Agent App message
  */
-export const get2 = oc
+export const get4 = oc
   .route({
     description: 'Get suggested questions for an Agent App message',
     inputStructure: 'detailed',
@@ -126,7 +222,7 @@ export const get2 = oc
   .output(zGetAgentByAgentIdChatMessagesByMessageIdSuggestedQuestionsResponse)
 
 export const suggestedQuestions = {
-  get: get2,
+  get: get4,
 }
 
 export const byMessageId = {
@@ -136,7 +232,7 @@ export const byMessageId = {
 /**
  * Stop a running Agent App chat message generation
  */
-export const post = oc
+export const post3 = oc
   .route({
     description: 'Stop a running Agent App chat message generation',
     inputStructure: 'detailed',
@@ -149,7 +245,7 @@ export const post = oc
   .output(zPostAgentByAgentIdChatMessagesByTaskIdStopResponse)
 
 export const stop = {
-  post,
+  post: post3,
 }
 
 export const byTaskId = {
@@ -159,7 +255,7 @@ export const byTaskId = {
 /**
  * Get Agent App chat messages for a conversation with pagination
  */
-export const get3 = oc
+export const get5 = oc
   .route({
     description: 'Get Agent App chat messages for a conversation with pagination',
     inputStructure: 'detailed',
@@ -177,12 +273,12 @@ export const get3 = oc
   .output(zGetAgentByAgentIdChatMessagesResponse)
 
 export const chatMessages = {
-  get: get3,
+  get: get5,
   byMessageId,
   byTaskId,
 }
 
-export const get4 = oc
+export const get6 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -194,10 +290,10 @@ export const get4 = oc
   .output(zGetAgentByAgentIdComposerCandidatesResponse)
 
 export const candidates = {
-  get: get4,
+  get: get6,
 }
 
-export const post2 = oc
+export const post4 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -214,10 +310,10 @@ export const post2 = oc
   .output(zPostAgentByAgentIdComposerValidateResponse)
 
 export const validate = {
-  post: post2,
+  post: post4,
 }
 
-export const get5 = oc
+export const get7 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -240,13 +336,13 @@ export const put = oc
   .output(zPutAgentByAgentIdComposerResponse)
 
 export const composer = {
-  get: get5,
+  get: get7,
   put,
   candidates,
   validate,
 }
 
-export const post3 = oc
+export const post5 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -259,13 +355,32 @@ export const post3 = oc
   .output(zPostAgentByAgentIdCopyResponse)
 
 export const copy = {
-  post: post3,
+  post: post5,
+}
+
+export const post6 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'POST',
+    operationId: 'postAgentByAgentIdDebugConversationRefresh',
+    path: '/agent/{agent_id}/debug-conversation/refresh',
+    tags: ['console'],
+  })
+  .input(z.object({ params: zPostAgentByAgentIdDebugConversationRefreshPath }))
+  .output(zPostAgentByAgentIdDebugConversationRefreshResponse)
+
+export const refresh = {
+  post: post6,
+}
+
+export const debugConversation = {
+  refresh,
 }
 
 /**
  * Time-limited external signed URL for one Agent App drive value
  */
-export const get6 = oc
+export const get8 = oc
   .route({
     description: 'Time-limited external signed URL for one Agent App drive value',
     inputStructure: 'detailed',
@@ -283,13 +398,13 @@ export const get6 = oc
   .output(zGetAgentByAgentIdDriveFilesDownloadResponse)
 
 export const download = {
-  get: get6,
+  get: get8,
 }
 
 /**
  * Truncated text preview of one Agent App drive value
  */
-export const get7 = oc
+export const get9 = oc
   .route({
     description: 'Truncated text preview of one Agent App drive value',
     inputStructure: 'detailed',
@@ -307,13 +422,13 @@ export const get7 = oc
   .output(zGetAgentByAgentIdDriveFilesPreviewResponse)
 
 export const preview = {
-  get: get7,
+  get: get9,
 }
 
 /**
  * List agent drive entries for an Agent App
  */
-export const get8 = oc
+export const get10 = oc
   .route({
     description: 'List agent drive entries for an Agent App',
     inputStructure: 'detailed',
@@ -331,19 +446,63 @@ export const get8 = oc
   .output(zGetAgentByAgentIdDriveFilesResponse)
 
 export const files = {
-  get: get8,
+  get: get10,
   download,
   preview,
 }
 
+/**
+ * Inspect one drive-backed skill for slash-menu hover/detail UI
+ */
+export const get11 = oc
+  .route({
+    description: 'Inspect one drive-backed skill for slash-menu hover/detail UI',
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getAgentByAgentIdDriveSkillsBySkillPathInspect',
+    path: '/agent/{agent_id}/drive/skills/{skill_path}/inspect',
+    tags: ['console'],
+  })
+  .input(z.object({ params: zGetAgentByAgentIdDriveSkillsBySkillPathInspectPath }))
+  .output(zGetAgentByAgentIdDriveSkillsBySkillPathInspectResponse)
+
+export const inspect = {
+  get: get11,
+}
+
+export const bySkillPath = {
+  inspect,
+}
+
+/**
+ * List drive-backed skills for an Agent App
+ */
+export const get12 = oc
+  .route({
+    description: 'List drive-backed skills for an Agent App',
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getAgentByAgentIdDriveSkills',
+    path: '/agent/{agent_id}/drive/skills',
+    tags: ['console'],
+  })
+  .input(z.object({ params: zGetAgentByAgentIdDriveSkillsPath }))
+  .output(zGetAgentByAgentIdDriveSkillsResponse)
+
+export const skills = {
+  get: get12,
+  bySkillPath,
+}
+
 export const drive = {
   files,
+  skills,
 }
 
 /**
  * Update an Agent App's presentation features (opener, follow-up, citations, ...)
  */
-export const post4 = oc
+export const post7 = oc
   .route({
     description: 'Update an Agent App\'s presentation features (opener, follow-up, citations, ...)',
     inputStructure: 'detailed',
@@ -358,13 +517,13 @@ export const post4 = oc
   .output(zPostAgentByAgentIdFeaturesResponse)
 
 export const features = {
-  post: post4,
+  post: post7,
 }
 
 /**
  * Create or update Agent App message feedback
  */
-export const post5 = oc
+export const post8 = oc
   .route({
     description: 'Create or update Agent App message feedback',
     inputStructure: 'detailed',
@@ -379,13 +538,13 @@ export const post5 = oc
   .output(zPostAgentByAgentIdFeedbacksResponse)
 
 export const feedbacks = {
-  post: post5,
+  post: post8,
 }
 
 /**
  * Delete one Agent App drive file by key
  */
-export const delete_ = oc
+export const delete2 = oc
   .route({
     description: 'Delete one Agent App drive file by key',
     inputStructure: 'detailed',
@@ -402,7 +561,7 @@ export const delete_ = oc
 /**
  * Commit an uploaded file into the Agent App drive under files/<name>
  */
-export const post6 = oc
+export const post9 = oc
   .route({
     description: 'Commit an uploaded file into the Agent App drive under files/<name>',
     inputStructure: 'detailed',
@@ -416,11 +575,11 @@ export const post6 = oc
   .output(zPostAgentByAgentIdFilesResponse)
 
 export const files2 = {
-  delete: delete_,
-  post: post6,
+  delete: delete2,
+  post: post9,
 }
 
-export const get9 = oc
+export const get13 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -432,10 +591,10 @@ export const get9 = oc
   .output(zGetAgentByAgentIdLogSourcesResponse)
 
 export const logSources = {
-  get: get9,
+  get: get13,
 }
 
-export const get10 = oc
+export const get14 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -452,14 +611,14 @@ export const get10 = oc
   .output(zGetAgentByAgentIdLogsByConversationIdMessagesResponse)
 
 export const messages = {
-  get: get10,
+  get: get14,
 }
 
 export const byConversationId = {
   messages,
 }
 
-export const get11 = oc
+export const get15 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -473,14 +632,14 @@ export const get11 = oc
   .output(zGetAgentByAgentIdLogsResponse)
 
 export const logs = {
-  get: get11,
+  get: get15,
   byConversationId,
 }
 
 /**
  * Get Agent App message details by ID
  */
-export const get12 = oc
+export const get16 = oc
   .route({
     description: 'Get Agent App message details by ID',
     inputStructure: 'detailed',
@@ -493,7 +652,7 @@ export const get12 = oc
   .output(zGetAgentByAgentIdMessagesByMessageIdResponse)
 
 export const byMessageId2 = {
-  get: get12,
+  get: get16,
 }
 
 export const messages2 = {
@@ -503,7 +662,7 @@ export const messages2 = {
 /**
  * List workflow apps that reference this Agent App's bound Agent (read-only)
  */
-export const get13 = oc
+export const get17 = oc
   .route({
     description: 'List workflow apps that reference this Agent App\'s bound Agent (read-only)',
     inputStructure: 'detailed',
@@ -516,13 +675,13 @@ export const get13 = oc
   .output(zGetAgentByAgentIdReferencingWorkflowsResponse)
 
 export const referencingWorkflows = {
-  get: get13,
+  get: get17,
 }
 
 /**
  * Read a text/binary preview file in an Agent App conversation sandbox
  */
-export const get14 = oc
+export const get18 = oc
   .route({
     description: 'Read a text/binary preview file in an Agent App conversation sandbox',
     inputStructure: 'detailed',
@@ -540,13 +699,13 @@ export const get14 = oc
   .output(zGetAgentByAgentIdSandboxFilesReadResponse)
 
 export const read = {
-  get: get14,
+  get: get18,
 }
 
 /**
  * Upload one Agent App sandbox file as a Dify ToolFile mapping
  */
-export const post7 = oc
+export const post10 = oc
   .route({
     description: 'Upload one Agent App sandbox file as a Dify ToolFile mapping',
     inputStructure: 'detailed',
@@ -564,13 +723,13 @@ export const post7 = oc
   .output(zPostAgentByAgentIdSandboxFilesUploadResponse)
 
 export const upload = {
-  post: post7,
+  post: post10,
 }
 
 /**
  * List a directory in an Agent App conversation sandbox
  */
-export const get15 = oc
+export const get19 = oc
   .route({
     description: 'List a directory in an Agent App conversation sandbox',
     inputStructure: 'detailed',
@@ -588,7 +747,7 @@ export const get15 = oc
   .output(zGetAgentByAgentIdSandboxFilesResponse)
 
 export const files3 = {
-  get: get15,
+  get: get19,
   read,
   upload,
 }
@@ -600,7 +759,7 @@ export const sandbox = {
 /**
  * Upload + standardize a Skill into an Agent App drive
  */
-export const post8 = oc
+export const post11 = oc
   .route({
     description: 'Upload + standardize a Skill into an Agent App drive',
     inputStructure: 'detailed',
@@ -619,13 +778,13 @@ export const post8 = oc
   .output(zPostAgentByAgentIdSkillsUploadResponse)
 
 export const upload2 = {
-  post: post8,
+  post: post11,
 }
 
 /**
  * Infer CLI tool + ENV suggestions from a standardized Agent App skill
  */
-export const post9 = oc
+export const post12 = oc
   .route({
     description: 'Infer CLI tool + ENV suggestions from a standardized Agent App skill',
     inputStructure: 'detailed',
@@ -638,13 +797,13 @@ export const post9 = oc
   .output(zPostAgentByAgentIdSkillsBySlugInferToolsResponse)
 
 export const inferTools = {
-  post: post9,
+  post: post12,
 }
 
 /**
  * Delete a standardized skill from an Agent App drive
  */
-export const delete2 = oc
+export const delete3 = oc
   .route({
     description: 'Delete a standardized skill from an Agent App drive',
     inputStructure: 'detailed',
@@ -657,16 +816,16 @@ export const delete2 = oc
   .output(zDeleteAgentByAgentIdSkillsBySlugResponse)
 
 export const bySlug = {
-  delete: delete2,
+  delete: delete3,
   inferTools,
 }
 
-export const skills = {
+export const skills2 = {
   upload: upload2,
   bySlug,
 }
 
-export const get16 = oc
+export const get20 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -683,14 +842,29 @@ export const get16 = oc
   .output(zGetAgentByAgentIdStatisticsSummaryResponse)
 
 export const summary = {
-  get: get16,
+  get: get20,
 }
 
 export const statistics = {
   summary,
 }
 
-export const get17 = oc
+export const post13 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'POST',
+    operationId: 'postAgentByAgentIdVersionsByVersionIdRestore',
+    path: '/agent/{agent_id}/versions/{version_id}/restore',
+    tags: ['console'],
+  })
+  .input(z.object({ params: zPostAgentByAgentIdVersionsByVersionIdRestorePath }))
+  .output(zPostAgentByAgentIdVersionsByVersionIdRestoreResponse)
+
+export const restore = {
+  post: post13,
+}
+
+export const get21 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -702,10 +876,11 @@ export const get17 = oc
   .output(zGetAgentByAgentIdVersionsByVersionIdResponse)
 
 export const byVersionId = {
-  get: get17,
+  get: get21,
+  restore,
 }
 
-export const get18 = oc
+export const get22 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -717,11 +892,11 @@ export const get18 = oc
   .output(zGetAgentByAgentIdVersionsResponse)
 
 export const versions = {
-  get: get18,
+  get: get22,
   byVersionId,
 }
 
-export const delete3 = oc
+export const delete4 = oc
   .route({
     inputStructure: 'detailed',
     method: 'DELETE',
@@ -733,7 +908,7 @@ export const delete3 = oc
   .input(z.object({ params: zDeleteAgentByAgentIdPath }))
   .output(zDeleteAgentByAgentIdResponse)
 
-export const get19 = oc
+export const get23 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -756,12 +931,16 @@ export const put2 = oc
   .output(zPutAgentByAgentIdResponse)
 
 export const byAgentId = {
-  delete: delete3,
-  get: get19,
+  delete: delete4,
+  get: get23,
   put: put2,
+  apiAccess,
+  apiEnable,
+  apiKeys,
   chatMessages,
   composer,
   copy,
+  debugConversation,
   drive,
   features,
   feedbacks,
@@ -771,12 +950,12 @@ export const byAgentId = {
   messages: messages2,
   referencingWorkflows,
   sandbox,
-  skills,
+  skills: skills2,
   statistics,
   versions,
 }
 
-export const get20 = oc
+export const get24 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -787,7 +966,7 @@ export const get20 = oc
   .input(z.object({ query: zGetAgentQuery.optional() }))
   .output(zGetAgentResponse)
 
-export const post10 = oc
+export const post14 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -800,8 +979,8 @@ export const post10 = oc
   .output(zPostAgentResponse)
 
 export const agent = {
-  get: get20,
-  post: post10,
+  get: get24,
+  post: post14,
   inviteOptions,
   byAgentId,
 }
diff --git a/packages/contracts/generated/api/console/agent/types.gen.ts b/packages/contracts/generated/api/console/agent/types.gen.ts
index 64afc442406..aa21f2ce651 100644
--- a/packages/contracts/generated/api/console/agent/types.gen.ts
+++ b/packages/contracts/generated/api/console/agent/types.gen.ts
@@ -29,6 +29,7 @@ export type AgentAppDetailWithSite = {
   bound_agent_id?: string | null
   created_at?: number | null
   created_by?: string | null
+  debug_conversation_id?: string | null
   deleted_tools?: Array<DeletedTool>
   description?: string | null
   enable_api: boolean
@@ -73,6 +74,39 @@ export type AgentAppUpdatePayload = {
   use_icon_as_answer_icon?: boolean | null
 }
 
+export type AgentApiAccessResponse = {
+  api_key_count: number
+  api_rph: number
+  api_rpm: number
+  chat_endpoint: string
+  conversations_endpoint: string
+  enabled: boolean
+  files_upload_endpoint: string
+  info_endpoint: string
+  messages_endpoint: string
+  meta_endpoint: string
+  parameters_endpoint: string
+  service_api_base_url: string
+  stop_endpoint: string
+  streaming_only?: boolean
+}
+
+export type AgentApiStatusPayload = {
+  enable_api: boolean
+}
+
+export type ApiKeyList = {
+  data: Array<ApiKeyItem>
+}
+
+export type ApiKeyItem = {
+  created_at?: number | null
+  id: string
+  last_used_at?: number | null
+  token: string
+  type: string
+}
+
 export type MessageInfiniteScrollPaginationResponse = {
   data: Array<MessageDetailResponse>
   has_more: boolean
@@ -124,12 +158,17 @@ export type AgentComposerValidateResponse = {
   warnings?: Array<ComposerValidationWarningResponse>
 }
 
-export type CopyAppPayload = {
+export type AgentAppCopyPayload = {
   description?: string | null
   icon?: string | null
   icon_background?: string | null
   icon_type?: IconType | null
   name?: string | null
+  role?: string | null
+}
+
+export type AgentDebugConversationRefreshResponse = {
+  debug_conversation_id: string
 }
 
 export type AgentDriveListResponse = {
@@ -148,6 +187,29 @@ export type AgentDrivePreviewResponse = {
   truncated: boolean
 }
 
+export type AgentDriveSkillListResponse = {
+  items?: Array<AgentDriveSkillItemResponse>
+}
+
+export type AgentDriveSkillInspectResponse = {
+  archive_key?: string | null
+  created_at?: number | null
+  description: string
+  file_tree?: Array<{
+    [key: string]: unknown
+  }>
+  files?: Array<AgentDriveSkillFileResponse>
+  hash?: string | null
+  mime_type?: string | null
+  name: string
+  path: string
+  size?: number | null
+  skill_md: AgentDriveSkillMarkdownResponse
+  skill_md_key: string
+  source: string
+  warnings?: Array<string>
+}
+
 export type AgentAppFeaturesPayload = {
   opening_statement?: string | null
   retriever_resource?: AgentFeatureToggleConfig | null
@@ -165,7 +227,6 @@ export type MessageFeedbackPayload = {
 }
 
 export type AgentDriveDeleteResponse = {
-  config_version_id?: string | null
   removed_keys?: Array<string>
   result: string
 }
@@ -175,7 +236,6 @@ export type AgentDriveFilePayload = {
 }
 
 export type AgentDriveFileCommitResponse = {
-  config_version_id?: string | null
   file: AgentDriveFileResponse
 }
 
@@ -259,7 +319,7 @@ export type SandboxUploadResponse = {
 
 export type AgentSkillUploadResponse = {
   manifest: SkillManifest
-  skill: AgentSkillRefConfig
+  skill: AgentUploadedSkillResponse
 }
 
 export type SkillToolInferenceResult = {
@@ -292,6 +352,11 @@ export type AgentConfigSnapshotDetailResponse = {
   version_note?: string | null
 }
 
+export type AgentConfigSnapshotRestoreResponse = {
+  active_config_snapshot_id: string
+  result: 'success'
+}
+
 export type AgentAppPartial = {
   access_mode?: string | null
   active_config_is_published?: boolean
@@ -301,6 +366,7 @@ export type AgentAppPartial = {
   create_user_name?: string | null
   created_at?: number | null
   created_by?: string | null
+  debug_conversation_id?: string | null
   description?: string | null
   has_draft_trigger?: boolean | null
   icon?: string | null
@@ -449,7 +515,6 @@ export type AgentSoulConfig = {
   prompt?: AgentSoulPromptConfig
   sandbox?: AgentSoulSandboxConfig
   schema_version?: number
-  skills_files?: AgentSoulSkillsFilesConfig
   tools?: AgentSoulToolsConfig
 }
 
@@ -499,14 +564,6 @@ export type AgentComposerSoulCandidatesResponse = {
   dify_tools?: Array<AgentComposerDifyToolCandidateResponse>
   human_contacts?: Array<AgentHumanContactConfig>
   knowledge_datasets?: Array<AgentKnowledgeDatasetConfig>
-  skills_files?: Array<
-    | ({
-      kind: 'skill'
-    } & AgentComposerSkillCandidateResponse)
-    | ({
-      kind: 'file'
-    } & AgentComposerFileCandidateResponse)
-  >
 }
 
 export type ComposerCandidateCapabilities = {
@@ -530,9 +587,39 @@ export type AgentDriveItemResponse = {
   created_at?: number | null
   file_kind: string
   hash?: string | null
+  is_skill?: boolean | null
   key: string
   mime_type?: string | null
   size?: number | null
+  skill_metadata?: string | null
+}
+
+export type AgentDriveSkillItemResponse = {
+  archive_key?: string | null
+  created_at?: number | null
+  description: string
+  hash?: string | null
+  mime_type?: string | null
+  name: string
+  path: string
+  size?: number | null
+  skill_md_key: string
+}
+
+export type AgentDriveSkillFileResponse = {
+  available_in_drive: boolean
+  drive_key?: string | null
+  name: string
+  path: string
+  type: string
+}
+
+export type AgentDriveSkillMarkdownResponse = {
+  binary: boolean
+  key: string
+  size?: number | null
+  text?: string | null
+  truncated: boolean
 }
 
 export type AgentFeatureToggleConfig = {
@@ -715,18 +802,12 @@ export type SkillManifest = {
   size: number
 }
 
-export type AgentSkillRefConfig = {
-  description?: string | null
-  file_id?: string | null
-  full_archive_file_id?: string | null
-  full_archive_key?: string | null
-  id?: string | null
-  manifest_files?: Array<string> | null
-  name?: string | null
-  path?: string | null
-  skill_md_file_id?: string | null
-  skill_md_key?: string | null
-  [key: string]: unknown
+export type AgentUploadedSkillResponse = {
+  archive_key?: string | null
+  description: string
+  name: string
+  path: string
+  skill_md_key: string
 }
 
 export type CliToolSuggestion = {
@@ -873,11 +954,6 @@ export type AgentSoulSandboxConfig = {
   provider?: string | null
 }
 
-export type AgentSoulSkillsFilesConfig = {
-  files?: Array<AgentFileRefConfig>
-  skills?: Array<AgentSkillRefConfig>
-}
-
 export type AgentSoulToolsConfig = {
   cli_tools?: Array<AgentCliToolConfig>
   dify_tools?: Array<AgentSoulDifyToolConfig>
@@ -1000,37 +1076,6 @@ export type AgentKnowledgeDatasetConfig = {
   [key: string]: unknown
 }
 
-export type AgentComposerSkillCandidateResponse = {
-  description?: string | null
-  file_id?: string | null
-  full_archive_file_id?: string | null
-  full_archive_key?: string | null
-  id?: string | null
-  kind?: 'skill'
-  manifest_files?: Array<string> | null
-  name?: string | null
-  path?: string | null
-  skill_md_file_id?: string | null
-  skill_md_key?: string | null
-  [key: string]: unknown
-}
-
-export type AgentComposerFileCandidateResponse = {
-  drive_key?: string | null
-  file_id?: string | null
-  id?: string | null
-  kind?: 'file'
-  name?: string | null
-  reference?: string | null
-  remote_url?: string | null
-  tenant_id?: string | null
-  transfer_method?: string | null
-  type?: string | null
-  upload_file_id?: string | null
-  url?: string | null
-  [key: string]: unknown
-}
-
 export type AgentModerationProviderConfig = {
   api_based_extension_id?: string | null
   inputs_config?: AgentModerationIoConfig | null
@@ -1123,6 +1168,7 @@ export type AgentUserSatisfactionRateStatisticResponse = {
 
 export type AgentConfigRevisionOperation
   = | 'create_version'
+    | 'restore_version'
     | 'save_current_version'
     | 'save_new_agent'
     | 'save_new_version'
@@ -1224,21 +1270,6 @@ export type AgentSandboxProviderConfig = {
   [key: string]: unknown
 }
 
-export type AgentFileRefConfig = {
-  drive_key?: string | null
-  file_id?: string | null
-  id?: string | null
-  name?: string | null
-  reference?: string | null
-  remote_url?: string | null
-  tenant_id?: string | null
-  transfer_method?: string | null
-  type?: string | null
-  upload_file_id?: string | null
-  url?: string | null
-  [key: string]: unknown
-}
-
 export type AgentSoulDifyToolConfig = {
   credential_ref?: AgentSoulDifyToolCredentialRef | null
   credential_type?: 'api-key' | 'oauth2' | 'unauthorized'
@@ -1307,6 +1338,21 @@ export type DeclaredOutputFileConfig = {
   mime_types?: Array<string>
 }
 
+export type AgentFileRefConfig = {
+  drive_key?: string | null
+  file_id?: string | null
+  id?: string | null
+  name?: string | null
+  reference?: string | null
+  remote_url?: string | null
+  tenant_id?: string | null
+  transfer_method?: string | null
+  type?: string | null
+  upload_file_id?: string | null
+  url?: string | null
+  [key: string]: unknown
+}
+
 export type AgentCliToolAuthorizationStatus
   = | 'allowed'
     | 'authorized'
@@ -1442,6 +1488,7 @@ export type AgentAppDetailWithSiteWritable = {
   bound_agent_id?: string | null
   created_at?: number | null
   created_by?: string | null
+  debug_conversation_id?: string | null
   deleted_tools?: Array<DeletedTool>
   description?: string | null
   enable_api: boolean
@@ -1475,6 +1522,7 @@ export type AgentAppPartialWritable = {
   create_user_name?: string | null
   created_at?: number | null
   created_by?: string | null
+  debug_conversation_id?: string | null
   description?: string | null
   has_draft_trigger?: boolean | null
   icon?: string | null
@@ -1636,6 +1684,95 @@ export type PutAgentByAgentIdResponses = {
 
 export type PutAgentByAgentIdResponse = PutAgentByAgentIdResponses[keyof PutAgentByAgentIdResponses]
 
+export type GetAgentByAgentIdApiAccessData = {
+  body?: never
+  path: {
+    agent_id: string
+  }
+  query?: never
+  url: '/agent/{agent_id}/api-access'
+}
+
+export type GetAgentByAgentIdApiAccessResponses = {
+  200: AgentApiAccessResponse
+}
+
+export type GetAgentByAgentIdApiAccessResponse
+  = GetAgentByAgentIdApiAccessResponses[keyof GetAgentByAgentIdApiAccessResponses]
+
+export type PostAgentByAgentIdApiEnableData = {
+  body: AgentApiStatusPayload
+  path: {
+    agent_id: string
+  }
+  query?: never
+  url: '/agent/{agent_id}/api-enable'
+}
+
+export type PostAgentByAgentIdApiEnableErrors = {
+  403: unknown
+}
+
+export type PostAgentByAgentIdApiEnableResponses = {
+  200: AgentApiAccessResponse
+}
+
+export type PostAgentByAgentIdApiEnableResponse
+  = PostAgentByAgentIdApiEnableResponses[keyof PostAgentByAgentIdApiEnableResponses]
+
+export type GetAgentByAgentIdApiKeysData = {
+  body?: never
+  path: {
+    agent_id: string
+  }
+  query?: never
+  url: '/agent/{agent_id}/api-keys'
+}
+
+export type GetAgentByAgentIdApiKeysResponses = {
+  200: ApiKeyList
+}
+
+export type GetAgentByAgentIdApiKeysResponse
+  = GetAgentByAgentIdApiKeysResponses[keyof GetAgentByAgentIdApiKeysResponses]
+
+export type PostAgentByAgentIdApiKeysData = {
+  body?: never
+  path: {
+    agent_id: string
+  }
+  query?: never
+  url: '/agent/{agent_id}/api-keys'
+}
+
+export type PostAgentByAgentIdApiKeysErrors = {
+  400: unknown
+}
+
+export type PostAgentByAgentIdApiKeysResponses = {
+  201: ApiKeyItem
+}
+
+export type PostAgentByAgentIdApiKeysResponse
+  = PostAgentByAgentIdApiKeysResponses[keyof PostAgentByAgentIdApiKeysResponses]
+
+export type DeleteAgentByAgentIdApiKeysByApiKeyIdData = {
+  body?: never
+  path: {
+    agent_id: string
+    api_key_id: string
+  }
+  query?: never
+  url: '/agent/{agent_id}/api-keys/{api_key_id}'
+}
+
+export type DeleteAgentByAgentIdApiKeysByApiKeyIdResponses = {
+  204: void
+}
+
+export type DeleteAgentByAgentIdApiKeysByApiKeyIdResponse
+  = DeleteAgentByAgentIdApiKeysByApiKeyIdResponses[keyof DeleteAgentByAgentIdApiKeysByApiKeyIdResponses]
+
 export type GetAgentByAgentIdChatMessagesData = {
   body?: never
   path: {
@@ -1763,7 +1900,7 @@ export type PostAgentByAgentIdComposerValidateResponse
   = PostAgentByAgentIdComposerValidateResponses[keyof PostAgentByAgentIdComposerValidateResponses]
 
 export type PostAgentByAgentIdCopyData = {
-  body: CopyAppPayload
+  body: AgentAppCopyPayload
   path: {
     agent_id: string
   }
@@ -1783,6 +1920,26 @@ export type PostAgentByAgentIdCopyResponses = {
 export type PostAgentByAgentIdCopyResponse
   = PostAgentByAgentIdCopyResponses[keyof PostAgentByAgentIdCopyResponses]
 
+export type PostAgentByAgentIdDebugConversationRefreshData = {
+  body?: never
+  path: {
+    agent_id: string
+  }
+  query?: never
+  url: '/agent/{agent_id}/debug-conversation/refresh'
+}
+
+export type PostAgentByAgentIdDebugConversationRefreshErrors = {
+  403: unknown
+}
+
+export type PostAgentByAgentIdDebugConversationRefreshResponses = {
+  200: AgentDebugConversationRefreshResponse
+}
+
+export type PostAgentByAgentIdDebugConversationRefreshResponse
+  = PostAgentByAgentIdDebugConversationRefreshResponses[keyof PostAgentByAgentIdDebugConversationRefreshResponses]
+
 export type GetAgentByAgentIdDriveFilesData = {
   body?: never
   path: {
@@ -1837,6 +1994,39 @@ export type GetAgentByAgentIdDriveFilesPreviewResponses = {
 export type GetAgentByAgentIdDriveFilesPreviewResponse
   = GetAgentByAgentIdDriveFilesPreviewResponses[keyof GetAgentByAgentIdDriveFilesPreviewResponses]
 
+export type GetAgentByAgentIdDriveSkillsData = {
+  body?: never
+  path: {
+    agent_id: string
+  }
+  query?: never
+  url: '/agent/{agent_id}/drive/skills'
+}
+
+export type GetAgentByAgentIdDriveSkillsResponses = {
+  200: AgentDriveSkillListResponse
+}
+
+export type GetAgentByAgentIdDriveSkillsResponse
+  = GetAgentByAgentIdDriveSkillsResponses[keyof GetAgentByAgentIdDriveSkillsResponses]
+
+export type GetAgentByAgentIdDriveSkillsBySkillPathInspectData = {
+  body?: never
+  path: {
+    agent_id: string
+    skill_path: string
+  }
+  query?: never
+  url: '/agent/{agent_id}/drive/skills/{skill_path}/inspect'
+}
+
+export type GetAgentByAgentIdDriveSkillsBySkillPathInspectResponses = {
+  200: AgentDriveSkillInspectResponse
+}
+
+export type GetAgentByAgentIdDriveSkillsBySkillPathInspectResponse
+  = GetAgentByAgentIdDriveSkillsBySkillPathInspectResponses[keyof GetAgentByAgentIdDriveSkillsBySkillPathInspectResponses]
+
 export type PostAgentByAgentIdFeaturesData = {
   body: AgentAppFeaturesPayload
   path: {
@@ -2188,3 +2378,20 @@ export type GetAgentByAgentIdVersionsByVersionIdResponses = {
 
 export type GetAgentByAgentIdVersionsByVersionIdResponse
   = GetAgentByAgentIdVersionsByVersionIdResponses[keyof GetAgentByAgentIdVersionsByVersionIdResponses]
+
+export type PostAgentByAgentIdVersionsByVersionIdRestoreData = {
+  body?: never
+  path: {
+    agent_id: string
+    version_id: string
+  }
+  query?: never
+  url: '/agent/{agent_id}/versions/{version_id}/restore'
+}
+
+export type PostAgentByAgentIdVersionsByVersionIdRestoreResponses = {
+  200: AgentConfigSnapshotRestoreResponse
+}
+
+export type PostAgentByAgentIdVersionsByVersionIdRestoreResponse
+  = PostAgentByAgentIdVersionsByVersionIdRestoreResponses[keyof PostAgentByAgentIdVersionsByVersionIdRestoreResponses]
diff --git a/packages/contracts/generated/api/console/agent/zod.gen.ts b/packages/contracts/generated/api/console/agent/zod.gen.ts
index 7d6bd6f5eb2..cb4107f2d53 100644
--- a/packages/contracts/generated/api/console/agent/zod.gen.ts
+++ b/packages/contracts/generated/api/console/agent/zod.gen.ts
@@ -2,6 +2,51 @@
 
 import * as z from 'zod'
 
+/**
+ * AgentApiAccessResponse
+ */
+export const zAgentApiAccessResponse = z.object({
+  api_key_count: z.int(),
+  api_rph: z.int(),
+  api_rpm: z.int(),
+  chat_endpoint: z.string(),
+  conversations_endpoint: z.string(),
+  enabled: z.boolean(),
+  files_upload_endpoint: z.string(),
+  info_endpoint: z.string(),
+  messages_endpoint: z.string(),
+  meta_endpoint: z.string(),
+  parameters_endpoint: z.string(),
+  service_api_base_url: z.string(),
+  stop_endpoint: z.string(),
+  streaming_only: z.boolean().optional().default(true),
+})
+
+/**
+ * AgentApiStatusPayload
+ */
+export const zAgentApiStatusPayload = z.object({
+  enable_api: z.boolean(),
+})
+
+/**
+ * ApiKeyItem
+ */
+export const zApiKeyItem = z.object({
+  created_at: z.int().nullish(),
+  id: z.string(),
+  last_used_at: z.int().nullish(),
+  token: z.string(),
+  type: z.string(),
+})
+
+/**
+ * ApiKeyList
+ */
+export const zApiKeyList = z.object({
+  data: z.array(zApiKeyItem),
+})
+
 /**
  * SuggestedQuestionsResponse
  */
@@ -16,6 +61,13 @@ export const zSimpleResultResponse = z.object({
   result: z.string(),
 })
 
+/**
+ * AgentDebugConversationRefreshResponse
+ */
+export const zAgentDebugConversationRefreshResponse = z.object({
+  debug_conversation_id: z.string(),
+})
+
 /**
  * AgentDriveDownloadResponse
  */
@@ -47,7 +99,6 @@ export const zMessageFeedbackPayload = z.object({
  * AgentDriveDeleteResponse
  */
 export const zAgentDriveDeleteResponse = z.object({
-  config_version_id: z.string().nullish(),
   removed_keys: z.array(z.string()).optional(),
   result: z.string(),
 })
@@ -78,6 +129,14 @@ export const zAgentSandboxUploadPayload = z.object({
   path: z.string().min(1),
 })
 
+/**
+ * AgentConfigSnapshotRestoreResponse
+ */
+export const zAgentConfigSnapshotRestoreResponse = z.object({
+  active_config_snapshot_id: z.string(),
+  result: z.literal('success'),
+})
+
 /**
  * IconType
  */
@@ -110,14 +169,15 @@ export const zAgentAppUpdatePayload = z.object({
 })
 
 /**
- * CopyAppPayload
+ * AgentAppCopyPayload
  */
-export const zCopyAppPayload = z.object({
+export const zAgentAppCopyPayload = z.object({
   description: z.string().max(400).nullish(),
   icon: z.string().nullish(),
   icon_background: z.string().nullish(),
   icon_type: zIconType.nullish(),
   name: z.string().nullish(),
+  role: z.string().max(255).nullish(),
 })
 
 /**
@@ -286,9 +346,11 @@ export const zAgentDriveItemResponse = z.object({
   created_at: z.int().nullish(),
   file_kind: z.string(),
   hash: z.string().nullish(),
+  is_skill: z.boolean().nullish(),
   key: z.string(),
   mime_type: z.string().nullish(),
   size: z.int().nullish(),
+  skill_metadata: z.string().nullish(),
 })
 
 /**
@@ -298,6 +360,70 @@ export const zAgentDriveListResponse = z.object({
   items: z.array(zAgentDriveItemResponse).optional(),
 })
 
+/**
+ * AgentDriveSkillItemResponse
+ */
+export const zAgentDriveSkillItemResponse = z.object({
+  archive_key: z.string().nullish(),
+  created_at: z.int().nullish(),
+  description: z.string(),
+  hash: z.string().nullish(),
+  mime_type: z.string().nullish(),
+  name: z.string(),
+  path: z.string(),
+  size: z.int().nullish(),
+  skill_md_key: z.string(),
+})
+
+/**
+ * AgentDriveSkillListResponse
+ */
+export const zAgentDriveSkillListResponse = z.object({
+  items: z.array(zAgentDriveSkillItemResponse).optional(),
+})
+
+/**
+ * AgentDriveSkillFileResponse
+ */
+export const zAgentDriveSkillFileResponse = z.object({
+  available_in_drive: z.boolean(),
+  drive_key: z.string().nullish(),
+  name: z.string(),
+  path: z.string(),
+  type: z.string(),
+})
+
+/**
+ * AgentDriveSkillMarkdownResponse
+ */
+export const zAgentDriveSkillMarkdownResponse = z.object({
+  binary: z.boolean(),
+  key: z.string(),
+  size: z.int().nullish(),
+  text: z.string().nullish(),
+  truncated: z.boolean(),
+})
+
+/**
+ * AgentDriveSkillInspectResponse
+ */
+export const zAgentDriveSkillInspectResponse = z.object({
+  archive_key: z.string().nullish(),
+  created_at: z.int().nullish(),
+  description: z.string(),
+  file_tree: z.array(z.record(z.string(), z.unknown())).optional(),
+  files: z.array(zAgentDriveSkillFileResponse).optional(),
+  hash: z.string().nullish(),
+  mime_type: z.string().nullish(),
+  name: z.string(),
+  path: z.string(),
+  size: z.int().nullish(),
+  skill_md: zAgentDriveSkillMarkdownResponse,
+  skill_md_key: z.string(),
+  source: z.string(),
+  warnings: z.array(z.string()).optional(),
+})
+
 /**
  * AgentFeatureToggleConfig
  */
@@ -330,7 +456,6 @@ export const zAgentDriveFileResponse = z.object({
  * AgentDriveFileCommitResponse
  */
 export const zAgentDriveFileCommitResponse = z.object({
-  config_version_id: z.string().nullish(),
   file: zAgentDriveFileResponse,
 })
 
@@ -536,19 +661,14 @@ export const zSkillManifest = z.object({
 })
 
 /**
- * AgentSkillRefConfig
+ * AgentUploadedSkillResponse
  */
-export const zAgentSkillRefConfig = z.object({
-  description: z.string().nullish(),
-  file_id: z.string().max(255).nullish(),
-  full_archive_file_id: z.string().max(255).nullish(),
-  full_archive_key: z.string().max(512).nullish(),
-  id: z.string().max(255).nullish(),
-  manifest_files: z.array(z.string()).nullish(),
-  name: z.string().max(255).nullish(),
-  path: z.string().nullish(),
-  skill_md_file_id: z.string().max(255).nullish(),
-  skill_md_key: z.string().max(512).nullish(),
+export const zAgentUploadedSkillResponse = z.object({
+  archive_key: z.string().nullish(),
+  description: z.string(),
+  name: z.string(),
+  path: z.string(),
+  skill_md_key: z.string(),
 })
 
 /**
@@ -556,7 +676,7 @@ export const zAgentSkillRefConfig = z.object({
  */
 export const zAgentSkillUploadResponse = z.object({
   manifest: zSkillManifest,
-  skill: zAgentSkillRefConfig,
+  skill: zAgentUploadedSkillResponse,
 })
 
 /**
@@ -610,6 +730,7 @@ export const zAgentAppPartial = z.object({
   create_user_name: z.string().nullish(),
   created_at: z.int().nullish(),
   created_by: z.string().nullish(),
+  debug_conversation_id: z.string().nullish(),
   description: z.string().nullish(),
   has_draft_trigger: z.boolean().nullish(),
   icon: z.string().nullish(),
@@ -673,6 +794,7 @@ export const zAgentAppDetailWithSite = z.object({
   bound_agent_id: z.string().nullish(),
   created_at: z.int().nullish(),
   created_by: z.string().nullish(),
+  debug_conversation_id: z.string().nullish(),
   deleted_tools: z.array(zDeletedTool).optional(),
   description: z.string().nullish(),
   enable_api: z.boolean(),
@@ -909,41 +1031,6 @@ export const zAgentKnowledgeDatasetConfig = z.object({
   name: z.string().max(255).nullish(),
 })
 
-/**
- * AgentComposerSkillCandidateResponse
- */
-export const zAgentComposerSkillCandidateResponse = z.object({
-  description: z.string().nullish(),
-  file_id: z.string().max(255).nullish(),
-  full_archive_file_id: z.string().max(255).nullish(),
-  full_archive_key: z.string().max(512).nullish(),
-  id: z.string().max(255).nullish(),
-  kind: z.literal('skill').optional().default('skill'),
-  manifest_files: z.array(z.string()).nullish(),
-  name: z.string().max(255).nullish(),
-  path: z.string().nullish(),
-  skill_md_file_id: z.string().max(255).nullish(),
-  skill_md_key: z.string().max(512).nullish(),
-})
-
-/**
- * AgentComposerFileCandidateResponse
- */
-export const zAgentComposerFileCandidateResponse = z.object({
-  drive_key: z.string().max(512).nullish(),
-  file_id: z.string().max(255).nullish(),
-  id: z.string().max(255).nullish(),
-  kind: z.literal('file').optional().default('file'),
-  name: z.string().max(255).nullish(),
-  reference: z.string().max(255).nullish(),
-  remote_url: z.string().nullish(),
-  tenant_id: z.string().max(255).nullish(),
-  transfer_method: z.string().max(64).nullish(),
-  type: z.string().max(64).nullish(),
-  upload_file_id: z.string().max(255).nullish(),
-  url: z.string().nullish(),
-})
-
 /**
  * SimpleAccount
  */
@@ -1117,6 +1204,7 @@ export const zAgentStatisticSummaryEnvelopeResponse = z.object({
  */
 export const zAgentConfigRevisionOperation = z.enum([
   'create_version',
+  'restore_version',
   'save_current_version',
   'save_new_agent',
   'save_new_version',
@@ -1263,39 +1351,6 @@ export const zAgentSoulSandboxConfig = z.object({
   provider: z.string().nullish(),
 })
 
-/**
- * AgentFileRefConfig
- */
-export const zAgentFileRefConfig = z.object({
-  drive_key: z.string().max(512).nullish(),
-  file_id: z.string().max(255).nullish(),
-  id: z.string().max(255).nullish(),
-  name: z.string().max(255).nullish(),
-  reference: z.string().max(255).nullish(),
-  remote_url: z.string().nullish(),
-  tenant_id: z.string().max(255).nullish(),
-  transfer_method: z.string().max(64).nullish(),
-  type: z.string().max(64).nullish(),
-  upload_file_id: z.string().max(255).nullish(),
-  url: z.string().nullish(),
-})
-
-/**
- * AgentSoulSkillsFilesConfig
- */
-export const zAgentSoulSkillsFilesConfig = z.object({
-  files: z.array(zAgentFileRefConfig).optional(),
-  skills: z.array(zAgentSkillRefConfig).optional(),
-})
-
-/**
- * WorkflowNodeJobMetadata
- */
-export const zWorkflowNodeJobMetadata = z.object({
-  agent_soul: z.record(z.string(), z.unknown()).nullish(),
-  file_refs: z.array(zAgentFileRefConfig).nullish(),
-})
-
 /**
  * DeclaredArrayItem
  *
@@ -1339,6 +1394,31 @@ export const zDeclaredOutputFileConfig = z.object({
   mime_types: z.array(z.string()).optional(),
 })
 
+/**
+ * AgentFileRefConfig
+ */
+export const zAgentFileRefConfig = z.object({
+  drive_key: z.string().max(512).nullish(),
+  file_id: z.string().max(255).nullish(),
+  id: z.string().max(255).nullish(),
+  name: z.string().max(255).nullish(),
+  reference: z.string().max(255).nullish(),
+  remote_url: z.string().nullish(),
+  tenant_id: z.string().max(255).nullish(),
+  transfer_method: z.string().max(64).nullish(),
+  type: z.string().max(64).nullish(),
+  upload_file_id: z.string().max(255).nullish(),
+  url: z.string().nullish(),
+})
+
+/**
+ * WorkflowNodeJobMetadata
+ */
+export const zWorkflowNodeJobMetadata = z.object({
+  agent_soul: z.record(z.string(), z.unknown()).nullish(),
+  file_refs: z.array(zAgentFileRefConfig).nullish(),
+})
+
 /**
  * AgentCliToolAuthorizationStatus
  *
@@ -1449,22 +1529,6 @@ export const zAgentComposerSoulCandidatesResponse = z.object({
   dify_tools: z.array(zAgentComposerDifyToolCandidateResponse).optional(),
   human_contacts: z.array(zAgentHumanContactConfig).optional(),
   knowledge_datasets: z.array(zAgentKnowledgeDatasetConfig).optional(),
-  skills_files: z
-    .array(
-      z.union([
-        z
-          .object({
-            kind: z.literal('skill'),
-          })
-          .and(zAgentComposerSkillCandidateResponse),
-        z
-          .object({
-            kind: z.literal('file'),
-          })
-          .and(zAgentComposerFileCandidateResponse),
-      ]),
-    )
-    .optional(),
 })
 
 /**
@@ -1684,7 +1748,6 @@ export const zAgentSoulConfig = z.object({
   prompt: zAgentSoulPromptConfig.optional(),
   sandbox: zAgentSoulSandboxConfig.optional(),
   schema_version: z.int().optional().default(1),
-  skills_files: zAgentSoulSkillsFilesConfig.optional(),
   tools: zAgentSoulToolsConfig.optional(),
 })
 
@@ -2011,6 +2074,7 @@ export const zAgentAppPartialWritable = z.object({
   create_user_name: z.string().nullish(),
   created_at: z.int().nullish(),
   created_by: z.string().nullish(),
+  debug_conversation_id: z.string().nullish(),
   description: z.string().nullish(),
   has_draft_trigger: z.boolean().nullish(),
   icon: z.string().nullish(),
@@ -2075,6 +2139,7 @@ export const zAgentAppDetailWithSiteWritable = z.object({
   bound_agent_id: z.string().nullish(),
   created_at: z.int().nullish(),
   created_by: z.string().nullish(),
+  debug_conversation_id: z.string().nullish(),
   deleted_tools: z.array(zDeletedTool).optional(),
   description: z.string().nullish(),
   enable_api: z.boolean(),
@@ -2178,6 +2243,54 @@ export const zPutAgentByAgentIdPath = z.object({
  */
 export const zPutAgentByAgentIdResponse = zAgentAppDetailWithSite
 
+export const zGetAgentByAgentIdApiAccessPath = z.object({
+  agent_id: z.uuid(),
+})
+
+/**
+ * Agent service API access
+ */
+export const zGetAgentByAgentIdApiAccessResponse = zAgentApiAccessResponse
+
+export const zPostAgentByAgentIdApiEnableBody = zAgentApiStatusPayload
+
+export const zPostAgentByAgentIdApiEnablePath = z.object({
+  agent_id: z.uuid(),
+})
+
+/**
+ * Agent service API status updated
+ */
+export const zPostAgentByAgentIdApiEnableResponse = zAgentApiAccessResponse
+
+export const zGetAgentByAgentIdApiKeysPath = z.object({
+  agent_id: z.uuid(),
+})
+
+/**
+ * Agent service API keys
+ */
+export const zGetAgentByAgentIdApiKeysResponse = zApiKeyList
+
+export const zPostAgentByAgentIdApiKeysPath = z.object({
+  agent_id: z.uuid(),
+})
+
+/**
+ * Agent service API key created
+ */
+export const zPostAgentByAgentIdApiKeysResponse = zApiKeyItem
+
+export const zDeleteAgentByAgentIdApiKeysByApiKeyIdPath = z.object({
+  agent_id: z.uuid(),
+  api_key_id: z.uuid(),
+})
+
+/**
+ * Agent service API key deleted
+ */
+export const zDeleteAgentByAgentIdApiKeysByApiKeyIdResponse = z.void()
+
 export const zGetAgentByAgentIdChatMessagesPath = z.object({
   agent_id: z.uuid(),
 })
@@ -2254,7 +2367,7 @@ export const zPostAgentByAgentIdComposerValidatePath = z.object({
  */
 export const zPostAgentByAgentIdComposerValidateResponse = zAgentComposerValidateResponse
 
-export const zPostAgentByAgentIdCopyBody = zCopyAppPayload
+export const zPostAgentByAgentIdCopyBody = zAgentAppCopyPayload
 
 export const zPostAgentByAgentIdCopyPath = z.object({
   agent_id: z.uuid(),
@@ -2265,6 +2378,16 @@ export const zPostAgentByAgentIdCopyPath = z.object({
  */
 export const zPostAgentByAgentIdCopyResponse = zAgentAppDetailWithSite
 
+export const zPostAgentByAgentIdDebugConversationRefreshPath = z.object({
+  agent_id: z.uuid(),
+})
+
+/**
+ * Agent debug conversation refreshed
+ */
+export const zPostAgentByAgentIdDebugConversationRefreshResponse
+  = zAgentDebugConversationRefreshResponse
+
 export const zGetAgentByAgentIdDriveFilesPath = z.object({
   agent_id: z.uuid(),
 })
@@ -2304,6 +2427,26 @@ export const zGetAgentByAgentIdDriveFilesPreviewQuery = z.object({
  */
 export const zGetAgentByAgentIdDriveFilesPreviewResponse = zAgentDrivePreviewResponse
 
+export const zGetAgentByAgentIdDriveSkillsPath = z.object({
+  agent_id: z.uuid(),
+})
+
+/**
+ * Drive skills
+ */
+export const zGetAgentByAgentIdDriveSkillsResponse = zAgentDriveSkillListResponse
+
+export const zGetAgentByAgentIdDriveSkillsBySkillPathInspectPath = z.object({
+  agent_id: z.uuid(),
+  skill_path: z.string(),
+})
+
+/**
+ * Drive skill inspect view
+ */
+export const zGetAgentByAgentIdDriveSkillsBySkillPathInspectResponse
+  = zAgentDriveSkillInspectResponse
+
 export const zPostAgentByAgentIdFeaturesBody = zAgentAppFeaturesPayload
 
 export const zPostAgentByAgentIdFeaturesPath = z.object({
@@ -2530,3 +2673,14 @@ export const zGetAgentByAgentIdVersionsByVersionIdPath = z.object({
  * Agent version detail
  */
 export const zGetAgentByAgentIdVersionsByVersionIdResponse = zAgentConfigSnapshotDetailResponse
+
+export const zPostAgentByAgentIdVersionsByVersionIdRestorePath = z.object({
+  agent_id: z.uuid(),
+  version_id: z.uuid(),
+})
+
+/**
+ * Agent version restored
+ */
+export const zPostAgentByAgentIdVersionsByVersionIdRestoreResponse
+  = zAgentConfigSnapshotRestoreResponse
diff --git a/packages/contracts/generated/api/console/apps/orpc.gen.ts b/packages/contracts/generated/api/console/apps/orpc.gen.ts
index eab3c17eb43..7a93572885e 100644
--- a/packages/contracts/generated/api/console/apps/orpc.gen.ts
+++ b/packages/contracts/generated/api/console/apps/orpc.gen.ts
@@ -54,6 +54,12 @@ import {
   zGetAppsByAppIdAgentDriveFilesPreviewResponse,
   zGetAppsByAppIdAgentDriveFilesQuery,
   zGetAppsByAppIdAgentDriveFilesResponse,
+  zGetAppsByAppIdAgentDriveSkillsBySkillPathInspectPath,
+  zGetAppsByAppIdAgentDriveSkillsBySkillPathInspectQuery,
+  zGetAppsByAppIdAgentDriveSkillsBySkillPathInspectResponse,
+  zGetAppsByAppIdAgentDriveSkillsPath,
+  zGetAppsByAppIdAgentDriveSkillsQuery,
+  zGetAppsByAppIdAgentDriveSkillsResponse,
   zGetAppsByAppIdAgentLogsPath,
   zGetAppsByAppIdAgentLogsQuery,
   zGetAppsByAppIdAgentLogsResponse,
@@ -861,16 +867,70 @@ export const files = {
   preview: preview2,
 }
 
-export const drive = {
-  files,
+/**
+ * Inspect one drive-backed skill for slash-menu hover/detail UI
+ */
+export const get8 = oc
+  .route({
+    description: 'Inspect one drive-backed skill for slash-menu hover/detail UI',
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getAppsByAppIdAgentDriveSkillsBySkillPathInspect',
+    path: '/apps/{app_id}/agent/drive/skills/{skill_path}/inspect',
+    tags: ['console'],
+  })
+  .input(
+    z.object({
+      params: zGetAppsByAppIdAgentDriveSkillsBySkillPathInspectPath,
+      query: zGetAppsByAppIdAgentDriveSkillsBySkillPathInspectQuery.optional(),
+    }),
+  )
+  .output(zGetAppsByAppIdAgentDriveSkillsBySkillPathInspectResponse)
+
+export const inspect = {
+  get: get8,
+}
+
+export const bySkillPath = {
+  inspect,
 }
 
 /**
- * Delete one drive file by key; soul ref first, then the KV row (ENG-625 D5)
+ * List drive-backed skills for the bound agent
+ */
+export const get9 = oc
+  .route({
+    description: 'List drive-backed skills for the bound agent',
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getAppsByAppIdAgentDriveSkills',
+    path: '/apps/{app_id}/agent/drive/skills',
+    tags: ['console'],
+  })
+  .input(
+    z.object({
+      params: zGetAppsByAppIdAgentDriveSkillsPath,
+      query: zGetAppsByAppIdAgentDriveSkillsQuery.optional(),
+    }),
+  )
+  .output(zGetAppsByAppIdAgentDriveSkillsResponse)
+
+export const skills = {
+  get: get9,
+  bySkillPath,
+}
+
+export const drive = {
+  files,
+  skills,
+}
+
+/**
+ * Delete one drive file by key via drive commit-null semantics
  */
 export const delete_ = oc
   .route({
-    description: 'Delete one drive file by key; soul ref first, then the KV row (ENG-625 D5)',
+    description: 'Delete one drive file by key via drive commit-null semantics',
     inputStructure: 'detailed',
     method: 'DELETE',
     operationId: 'deleteAppsByAppIdAgentFiles',
@@ -920,7 +980,7 @@ export const files2 = {
  *
  * Get agent execution logs for an application
  */
-export const get8 = oc
+export const get10 = oc
   .route({
     description: 'Get agent execution logs for an application',
     inputStructure: 'detailed',
@@ -934,7 +994,7 @@ export const get8 = oc
   .output(zGetAppsByAppIdAgentLogsResponse)
 
 export const logs = {
-  get: get8,
+  get: get10,
 }
 
 /**
@@ -996,12 +1056,11 @@ export const inferTools = {
 }
 
 /**
- * Delete a standardized skill: soul ref first, then the <slug>/ drive prefix (ENG-625 D5)
+ * Delete a standardized skill by removing its known drive keys via commit-null
  */
 export const delete2 = oc
   .route({
-    description:
-      'Delete a standardized skill: soul ref first, then the <slug>/ drive prefix (ENG-625 D5)',
+    description: 'Delete a standardized skill by removing its known drive keys via commit-null',
     inputStructure: 'detailed',
     method: 'DELETE',
     operationId: 'deleteAppsByAppIdAgentSkillsBySlug',
@@ -1021,7 +1080,7 @@ export const bySlug = {
   inferTools,
 }
 
-export const skills = {
+export const skills2 = {
   upload,
   bySlug,
 }
@@ -1030,13 +1089,13 @@ export const agent = {
   drive,
   files: files2,
   logs,
-  skills,
+  skills: skills2,
 }
 
 /**
  * Get status of annotation reply action job
  */
-export const get9 = oc
+export const get11 = oc
   .route({
     description: 'Get status of annotation reply action job',
     inputStructure: 'detailed',
@@ -1049,7 +1108,7 @@ export const get9 = oc
   .output(zGetAppsByAppIdAnnotationReplyByActionStatusByJobIdResponse)
 
 export const byJobId = {
-  get: get9,
+  get: get11,
 }
 
 export const status = {
@@ -1088,7 +1147,7 @@ export const annotationReply = {
 /**
  * Get annotation settings for an app
  */
-export const get10 = oc
+export const get12 = oc
   .route({
     description: 'Get annotation settings for an app',
     inputStructure: 'detailed',
@@ -1101,7 +1160,7 @@ export const get10 = oc
   .output(zGetAppsByAppIdAnnotationSettingResponse)
 
 export const annotationSetting = {
-  get: get10,
+  get: get12,
 }
 
 /**
@@ -1154,7 +1213,7 @@ export const batchImport = {
 /**
  * Get status of batch import job
  */
-export const get11 = oc
+export const get13 = oc
   .route({
     description: 'Get status of batch import job',
     inputStructure: 'detailed',
@@ -1167,7 +1226,7 @@ export const get11 = oc
   .output(zGetAppsByAppIdAnnotationsBatchImportStatusByJobIdResponse)
 
 export const byJobId2 = {
-  get: get11,
+  get: get13,
 }
 
 export const batchImportStatus = {
@@ -1177,7 +1236,7 @@ export const batchImportStatus = {
 /**
  * Get count of message annotations for the app
  */
-export const get12 = oc
+export const get14 = oc
   .route({
     description: 'Get count of message annotations for the app',
     inputStructure: 'detailed',
@@ -1190,13 +1249,13 @@ export const get12 = oc
   .output(zGetAppsByAppIdAnnotationsCountResponse)
 
 export const count2 = {
-  get: get12,
+  get: get14,
 }
 
 /**
  * Export all annotations for an app with CSV injection protection
  */
-export const get13 = oc
+export const get15 = oc
   .route({
     description: 'Export all annotations for an app with CSV injection protection',
     inputStructure: 'detailed',
@@ -1209,13 +1268,13 @@ export const get13 = oc
   .output(zGetAppsByAppIdAnnotationsExportResponse)
 
 export const export_ = {
-  get: get13,
+  get: get15,
 }
 
 /**
  * Get hit histories for an annotation
  */
-export const get14 = oc
+export const get16 = oc
   .route({
     description: 'Get hit histories for an annotation',
     inputStructure: 'detailed',
@@ -1233,7 +1292,7 @@ export const get14 = oc
   .output(zGetAppsByAppIdAnnotationsByAnnotationIdHitHistoriesResponse)
 
 export const hitHistories = {
-  get: get14,
+  get: get16,
 }
 
 export const delete3 = oc
@@ -1289,7 +1348,7 @@ export const delete4 = oc
 /**
  * Get annotations for an app with pagination
  */
-export const get15 = oc
+export const get17 = oc
   .route({
     description: 'Get annotations for an app with pagination',
     inputStructure: 'detailed',
@@ -1326,7 +1385,7 @@ export const post16 = oc
 
 export const annotations = {
   delete: delete4,
-  get: get15,
+  get: get17,
   post: post16,
   batchImport,
   batchImportStatus,
@@ -1392,7 +1451,7 @@ export const delete5 = oc
 /**
  * Get chat conversation details
  */
-export const get16 = oc
+export const get18 = oc
   .route({
     description: 'Get chat conversation details',
     inputStructure: 'detailed',
@@ -1406,13 +1465,13 @@ export const get16 = oc
 
 export const byConversationId = {
   delete: delete5,
-  get: get16,
+  get: get18,
 }
 
 /**
  * Get chat conversations with pagination, filtering and summary
  */
-export const get17 = oc
+export const get19 = oc
   .route({
     description: 'Get chat conversations with pagination, filtering and summary',
     inputStructure: 'detailed',
@@ -1430,14 +1489,14 @@ export const get17 = oc
   .output(zGetAppsByAppIdChatConversationsResponse)
 
 export const chatConversations = {
-  get: get17,
+  get: get19,
   byConversationId,
 }
 
 /**
  * Get suggested questions for a message
  */
-export const get18 = oc
+export const get20 = oc
   .route({
     description: 'Get suggested questions for a message',
     inputStructure: 'detailed',
@@ -1450,7 +1509,7 @@ export const get18 = oc
   .output(zGetAppsByAppIdChatMessagesByMessageIdSuggestedQuestionsResponse)
 
 export const suggestedQuestions = {
-  get: get18,
+  get: get20,
 }
 
 export const byMessageId = {
@@ -1483,7 +1542,7 @@ export const byTaskId = {
 /**
  * Get chat messages for a conversation with pagination
  */
-export const get19 = oc
+export const get21 = oc
   .route({
     description: 'Get chat messages for a conversation with pagination',
     inputStructure: 'detailed',
@@ -1498,7 +1557,7 @@ export const get19 = oc
   .output(zGetAppsByAppIdChatMessagesResponse)
 
 export const chatMessages = {
-  get: get19,
+  get: get21,
   byMessageId,
   byTaskId,
 }
@@ -1522,7 +1581,7 @@ export const delete6 = oc
 /**
  * Get completion conversation details with messages
  */
-export const get20 = oc
+export const get22 = oc
   .route({
     description: 'Get completion conversation details with messages',
     inputStructure: 'detailed',
@@ -1536,13 +1595,13 @@ export const get20 = oc
 
 export const byConversationId2 = {
   delete: delete6,
-  get: get20,
+  get: get22,
 }
 
 /**
  * Get completion conversations with pagination and filtering
  */
-export const get21 = oc
+export const get23 = oc
   .route({
     description: 'Get completion conversations with pagination and filtering',
     inputStructure: 'detailed',
@@ -1560,7 +1619,7 @@ export const get21 = oc
   .output(zGetAppsByAppIdCompletionConversationsResponse)
 
 export const completionConversations = {
-  get: get21,
+  get: get23,
   byConversationId: byConversationId2,
 }
 
@@ -1615,7 +1674,7 @@ export const completionMessages = {
 /**
  * Get conversation variables for an application
  */
-export const get22 = oc
+export const get24 = oc
   .route({
     description: 'Get conversation variables for an application',
     inputStructure: 'detailed',
@@ -1633,7 +1692,7 @@ export const get22 = oc
   .output(zGetAppsByAppIdConversationVariablesResponse)
 
 export const conversationVariables = {
-  get: get22,
+  get: get24,
 }
 
 /**
@@ -1694,7 +1753,7 @@ export const copy = {
  *
  * Export application configuration as DSL
  */
-export const get23 = oc
+export const get25 = oc
   .route({
     description: 'Export application configuration as DSL',
     inputStructure: 'detailed',
@@ -1710,13 +1769,13 @@ export const get23 = oc
   .output(zGetAppsByAppIdExportResponse)
 
 export const export2 = {
-  get: get23,
+  get: get25,
 }
 
 /**
  * Export user feedback data for Google Sheets
  */
-export const get24 = oc
+export const get26 = oc
   .route({
     description: 'Export user feedback data for Google Sheets',
     inputStructure: 'detailed',
@@ -1734,7 +1793,7 @@ export const get24 = oc
   .output(zGetAppsByAppIdFeedbacksExportResponse)
 
 export const export3 = {
-  get: get24,
+  get: get26,
 }
 
 /**
@@ -1779,7 +1838,7 @@ export const icon = {
 /**
  * Get message details by ID
  */
-export const get25 = oc
+export const get27 = oc
   .route({
     description: 'Get message details by ID',
     inputStructure: 'detailed',
@@ -1792,7 +1851,7 @@ export const get25 = oc
   .output(zGetAppsByAppIdMessagesByMessageIdResponse)
 
 export const byMessageId2 = {
-  get: get25,
+  get: get27,
 }
 
 export const messages = {
@@ -1864,7 +1923,7 @@ export const publishToCreatorsPlatform = {
 /**
  * Get MCP server configuration for an application
  */
-export const get26 = oc
+export const get28 = oc
   .route({
     description: 'Get MCP server configuration for an application',
     inputStructure: 'detailed',
@@ -1908,7 +1967,7 @@ export const put = oc
   .output(zPutAppsByAppIdServerResponse)
 
 export const server = {
-  get: get26,
+  get: get28,
   post: post29,
   put,
 }
@@ -2009,7 +2068,7 @@ export const star = {
 /**
  * Get average response time statistics for an application
  */
-export const get27 = oc
+export const get29 = oc
   .route({
     description: 'Get average response time statistics for an application',
     inputStructure: 'detailed',
@@ -2027,13 +2086,13 @@ export const get27 = oc
   .output(zGetAppsByAppIdStatisticsAverageResponseTimeResponse)
 
 export const averageResponseTime = {
-  get: get27,
+  get: get29,
 }
 
 /**
  * Get average session interaction statistics for an application
  */
-export const get28 = oc
+export const get30 = oc
   .route({
     description: 'Get average session interaction statistics for an application',
     inputStructure: 'detailed',
@@ -2051,13 +2110,13 @@ export const get28 = oc
   .output(zGetAppsByAppIdStatisticsAverageSessionInteractionsResponse)
 
 export const averageSessionInteractions = {
-  get: get28,
+  get: get30,
 }
 
 /**
  * Get daily conversation statistics for an application
  */
-export const get29 = oc
+export const get31 = oc
   .route({
     description: 'Get daily conversation statistics for an application',
     inputStructure: 'detailed',
@@ -2075,13 +2134,13 @@ export const get29 = oc
   .output(zGetAppsByAppIdStatisticsDailyConversationsResponse)
 
 export const dailyConversations = {
-  get: get29,
+  get: get31,
 }
 
 /**
  * Get daily terminal/end-user statistics for an application
  */
-export const get30 = oc
+export const get32 = oc
   .route({
     description: 'Get daily terminal/end-user statistics for an application',
     inputStructure: 'detailed',
@@ -2099,13 +2158,13 @@ export const get30 = oc
   .output(zGetAppsByAppIdStatisticsDailyEndUsersResponse)
 
 export const dailyEndUsers = {
-  get: get30,
+  get: get32,
 }
 
 /**
  * Get daily message statistics for an application
  */
-export const get31 = oc
+export const get33 = oc
   .route({
     description: 'Get daily message statistics for an application',
     inputStructure: 'detailed',
@@ -2123,13 +2182,13 @@ export const get31 = oc
   .output(zGetAppsByAppIdStatisticsDailyMessagesResponse)
 
 export const dailyMessages = {
-  get: get31,
+  get: get33,
 }
 
 /**
  * Get daily token cost statistics for an application
  */
-export const get32 = oc
+export const get34 = oc
   .route({
     description: 'Get daily token cost statistics for an application',
     inputStructure: 'detailed',
@@ -2147,13 +2206,13 @@ export const get32 = oc
   .output(zGetAppsByAppIdStatisticsTokenCostsResponse)
 
 export const tokenCosts = {
-  get: get32,
+  get: get34,
 }
 
 /**
  * Get tokens per second statistics for an application
  */
-export const get33 = oc
+export const get35 = oc
   .route({
     description: 'Get tokens per second statistics for an application',
     inputStructure: 'detailed',
@@ -2171,13 +2230,13 @@ export const get33 = oc
   .output(zGetAppsByAppIdStatisticsTokensPerSecondResponse)
 
 export const tokensPerSecond = {
-  get: get33,
+  get: get35,
 }
 
 /**
  * Get user satisfaction rate statistics for an application
  */
-export const get34 = oc
+export const get36 = oc
   .route({
     description: 'Get user satisfaction rate statistics for an application',
     inputStructure: 'detailed',
@@ -2195,7 +2254,7 @@ export const get34 = oc
   .output(zGetAppsByAppIdStatisticsUserSatisfactionRateResponse)
 
 export const userSatisfactionRate = {
-  get: get34,
+  get: get36,
 }
 
 export const statistics = {
@@ -2212,7 +2271,7 @@ export const statistics = {
 /**
  * Get available TTS voices for a specific language
  */
-export const get35 = oc
+export const get37 = oc
   .route({
     description: 'Get available TTS voices for a specific language',
     inputStructure: 'detailed',
@@ -2230,7 +2289,7 @@ export const get35 = oc
   .output(zGetAppsByAppIdTextToAudioVoicesResponse)
 
 export const voices = {
-  get: get35,
+  get: get37,
 }
 
 /**
@@ -2260,7 +2319,7 @@ export const textToAudio = {
  *
  * Get app tracing configuration
  */
-export const get36 = oc
+export const get38 = oc
   .route({
     description: 'Get app tracing configuration',
     inputStructure: 'detailed',
@@ -2289,7 +2348,7 @@ export const post35 = oc
   .output(zPostAppsByAppIdTraceResponse)
 
 export const trace = {
-  get: get36,
+  get: get38,
   post: post35,
 }
 
@@ -2320,7 +2379,7 @@ export const delete8 = oc
 /**
  * Get tracing configuration for an application
  */
-export const get37 = oc
+export const get39 = oc
   .route({
     description: 'Get tracing configuration for an application',
     inputStructure: 'detailed',
@@ -2377,7 +2436,7 @@ export const post36 = oc
 
 export const traceConfig = {
   delete: delete8,
-  get: get37,
+  get: get39,
   patch,
   post: post36,
 }
@@ -2409,7 +2468,7 @@ export const triggerEnable = {
 /**
  * Get app triggers list
  */
-export const get38 = oc
+export const get40 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2422,7 +2481,7 @@ export const get38 = oc
   .output(zGetAppsByAppIdTriggersResponse)
 
 export const triggers = {
-  get: get38,
+  get: get40,
 }
 
 /**
@@ -2430,7 +2489,7 @@ export const triggers = {
  *
  * Get workflow application execution logs
  */
-export const get39 = oc
+export const get41 = oc
   .route({
     description: 'Get workflow application execution logs',
     inputStructure: 'detailed',
@@ -2449,7 +2508,7 @@ export const get39 = oc
   .output(zGetAppsByAppIdWorkflowAppLogsResponse)
 
 export const workflowAppLogs = {
-  get: get39,
+  get: get41,
 }
 
 /**
@@ -2457,7 +2516,7 @@ export const workflowAppLogs = {
  *
  * Get workflow archived execution logs
  */
-export const get40 = oc
+export const get42 = oc
   .route({
     description: 'Get workflow archived execution logs',
     inputStructure: 'detailed',
@@ -2476,7 +2535,7 @@ export const get40 = oc
   .output(zGetAppsByAppIdWorkflowArchivedLogsResponse)
 
 export const workflowArchivedLogs = {
-  get: get40,
+  get: get42,
 }
 
 /**
@@ -2484,7 +2543,7 @@ export const workflowArchivedLogs = {
  *
  * Get workflow runs count statistics
  */
-export const get41 = oc
+export const get43 = oc
   .route({
     description: 'Get workflow runs count statistics',
     inputStructure: 'detailed',
@@ -2503,7 +2562,7 @@ export const get41 = oc
   .output(zGetAppsByAppIdWorkflowRunsCountResponse)
 
 export const count3 = {
-  get: get41,
+  get: get43,
 }
 
 /**
@@ -2539,7 +2598,7 @@ export const tasks = {
 /**
  * Generate a download URL for an archived workflow run.
  */
-export const get42 = oc
+export const get44 = oc
   .route({
     description: 'Generate a download URL for an archived workflow run.',
     inputStructure: 'detailed',
@@ -2552,7 +2611,7 @@ export const get42 = oc
   .output(zGetAppsByAppIdWorkflowRunsByRunIdExportResponse)
 
 export const export4 = {
-  get: get42,
+  get: get44,
 }
 
 /**
@@ -2560,7 +2619,7 @@ export const export4 = {
  *
  * Get workflow run node execution list
  */
-export const get43 = oc
+export const get45 = oc
   .route({
     description: 'Get workflow run node execution list',
     inputStructure: 'detailed',
@@ -2574,7 +2633,7 @@ export const get43 = oc
   .output(zGetAppsByAppIdWorkflowRunsByRunIdNodeExecutionsResponse)
 
 export const nodeExecutions = {
-  get: get43,
+  get: get45,
 }
 
 /**
@@ -2582,7 +2641,7 @@ export const nodeExecutions = {
  *
  * Get workflow run detail
  */
-export const get44 = oc
+export const get46 = oc
   .route({
     description: 'Get workflow run detail',
     inputStructure: 'detailed',
@@ -2596,7 +2655,7 @@ export const get44 = oc
   .output(zGetAppsByAppIdWorkflowRunsByRunIdResponse)
 
 export const byRunId = {
-  get: get44,
+  get: get46,
   export: export4,
   nodeExecutions,
 }
@@ -2604,7 +2663,7 @@ export const byRunId = {
 /**
  * Read a text/binary preview file in a workflow Agent node sandbox
  */
-export const get45 = oc
+export const get47 = oc
   .route({
     description: 'Read a text/binary preview file in a workflow Agent node sandbox',
     inputStructure: 'detailed',
@@ -2622,7 +2681,7 @@ export const get45 = oc
   .output(zGetAppsByAppIdWorkflowRunsByWorkflowRunIdAgentNodesByNodeIdSandboxFilesReadResponse)
 
 export const read = {
-  get: get45,
+  get: get47,
 }
 
 /**
@@ -2652,7 +2711,7 @@ export const upload2 = {
 /**
  * List a directory in a workflow Agent node sandbox
  */
-export const get46 = oc
+export const get48 = oc
   .route({
     description: 'List a directory in a workflow Agent node sandbox',
     inputStructure: 'detailed',
@@ -2671,7 +2730,7 @@ export const get46 = oc
   .output(zGetAppsByAppIdWorkflowRunsByWorkflowRunIdAgentNodesByNodeIdSandboxFilesResponse)
 
 export const files3 = {
-  get: get46,
+  get: get48,
   read,
   upload: upload2,
 }
@@ -2697,7 +2756,7 @@ export const byWorkflowRunId = {
  *
  * Get workflow run list
  */
-export const get47 = oc
+export const get49 = oc
   .route({
     description: 'Get workflow run list',
     inputStructure: 'detailed',
@@ -2716,7 +2775,7 @@ export const get47 = oc
   .output(zGetAppsByAppIdWorkflowRunsResponse)
 
 export const workflowRuns2 = {
-  get: get47,
+  get: get49,
   count: count3,
   tasks,
   byRunId,
@@ -2728,7 +2787,7 @@ export const workflowRuns2 = {
  *
  * Get all users in current tenant for mentions
  */
-export const get48 = oc
+export const get50 = oc
   .route({
     description: 'Get all users in current tenant for mentions',
     inputStructure: 'detailed',
@@ -2742,7 +2801,7 @@ export const get48 = oc
   .output(zGetAppsByAppIdWorkflowCommentsMentionUsersResponse)
 
 export const mentionUsers = {
-  get: get48,
+  get: get50,
 }
 
 /**
@@ -2867,7 +2926,7 @@ export const delete10 = oc
  *
  * Get a specific workflow comment
  */
-export const get49 = oc
+export const get51 = oc
   .route({
     description: 'Get a specific workflow comment',
     inputStructure: 'detailed',
@@ -2905,7 +2964,7 @@ export const put3 = oc
 
 export const byCommentId = {
   delete: delete10,
-  get: get49,
+  get: get51,
   put: put3,
   replies,
   resolve,
@@ -2916,7 +2975,7 @@ export const byCommentId = {
  *
  * Get all comments for a workflow
  */
-export const get50 = oc
+export const get52 = oc
   .route({
     description: 'Get all comments for a workflow',
     inputStructure: 'detailed',
@@ -2954,7 +3013,7 @@ export const post42 = oc
   .output(zPostAppsByAppIdWorkflowCommentsResponse)
 
 export const comments = {
-  get: get50,
+  get: get52,
   post: post42,
   mentionUsers,
   byCommentId,
@@ -2963,7 +3022,7 @@ export const comments = {
 /**
  * Get workflow average app interaction statistics
  */
-export const get51 = oc
+export const get53 = oc
   .route({
     description: 'Get workflow average app interaction statistics',
     inputStructure: 'detailed',
@@ -2981,13 +3040,13 @@ export const get51 = oc
   .output(zGetAppsByAppIdWorkflowStatisticsAverageAppInteractionsResponse)
 
 export const averageAppInteractions = {
-  get: get51,
+  get: get53,
 }
 
 /**
  * Get workflow daily runs statistics
  */
-export const get52 = oc
+export const get54 = oc
   .route({
     description: 'Get workflow daily runs statistics',
     inputStructure: 'detailed',
@@ -3005,13 +3064,13 @@ export const get52 = oc
   .output(zGetAppsByAppIdWorkflowStatisticsDailyConversationsResponse)
 
 export const dailyConversations2 = {
-  get: get52,
+  get: get54,
 }
 
 /**
  * Get workflow daily terminals statistics
  */
-export const get53 = oc
+export const get55 = oc
   .route({
     description: 'Get workflow daily terminals statistics',
     inputStructure: 'detailed',
@@ -3029,13 +3088,13 @@ export const get53 = oc
   .output(zGetAppsByAppIdWorkflowStatisticsDailyTerminalsResponse)
 
 export const dailyTerminals = {
-  get: get53,
+  get: get55,
 }
 
 /**
  * Get workflow daily token cost statistics
  */
-export const get54 = oc
+export const get56 = oc
   .route({
     description: 'Get workflow daily token cost statistics',
     inputStructure: 'detailed',
@@ -3053,7 +3112,7 @@ export const get54 = oc
   .output(zGetAppsByAppIdWorkflowStatisticsTokenCostsResponse)
 
 export const tokenCosts2 = {
-  get: get54,
+  get: get56,
 }
 
 export const statistics2 = {
@@ -3073,7 +3132,7 @@ export const workflow = {
  *
  * Get default block configuration by type
  */
-export const get55 = oc
+export const get57 = oc
   .route({
     description: 'Get default block configuration by type',
     inputStructure: 'detailed',
@@ -3092,7 +3151,7 @@ export const get55 = oc
   .output(zGetAppsByAppIdWorkflowsDefaultWorkflowBlockConfigsByBlockTypeResponse)
 
 export const byBlockType = {
-  get: get55,
+  get: get57,
 }
 
 /**
@@ -3100,7 +3159,7 @@ export const byBlockType = {
  *
  * Get default block configurations for workflow
  */
-export const get56 = oc
+export const get58 = oc
   .route({
     description: 'Get default block configurations for workflow',
     inputStructure: 'detailed',
@@ -3114,14 +3173,14 @@ export const get56 = oc
   .output(zGetAppsByAppIdWorkflowsDefaultWorkflowBlockConfigsResponse)
 
 export const defaultWorkflowBlockConfigs = {
-  get: get56,
+  get: get58,
   byBlockType,
 }
 
 /**
  * Get conversation variables for workflow
  */
-export const get57 = oc
+export const get59 = oc
   .route({
     description: 'Get conversation variables for workflow',
     inputStructure: 'detailed',
@@ -3154,7 +3213,7 @@ export const post43 = oc
   .output(zPostAppsByAppIdWorkflowsDraftConversationVariablesResponse)
 
 export const conversationVariables2 = {
-  get: get57,
+  get: get59,
   post: post43,
 }
 
@@ -3163,7 +3222,7 @@ export const conversationVariables2 = {
  *
  * Get environment variables for workflow
  */
-export const get58 = oc
+export const get60 = oc
   .route({
     description: 'Get environment variables for workflow',
     inputStructure: 'detailed',
@@ -3197,7 +3256,7 @@ export const post44 = oc
   .output(zPostAppsByAppIdWorkflowsDraftEnvironmentVariablesResponse)
 
 export const environmentVariables = {
-  get: get58,
+  get: get60,
   post: post44,
 }
 
@@ -3402,7 +3461,7 @@ export const loop2 = {
   nodes: nodes6,
 }
 
-export const get59 = oc
+export const get61 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3416,7 +3475,7 @@ export const get59 = oc
   .output(zGetAppsByAppIdWorkflowsDraftNodesByNodeIdAgentComposerCandidatesResponse)
 
 export const candidates = {
-  get: get59,
+  get: get61,
 }
 
 export const post51 = oc
@@ -3479,7 +3538,7 @@ export const validate = {
   post: post53,
 }
 
-export const get60 = oc
+export const get62 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3507,7 +3566,7 @@ export const put4 = oc
   .output(zPutAppsByAppIdWorkflowsDraftNodesByNodeIdAgentComposerResponse)
 
 export const agentComposer = {
-  get: get60,
+  get: get62,
   put: put4,
   candidates,
   impact,
@@ -3518,7 +3577,7 @@ export const agentComposer = {
 /**
  * Get last run result for draft workflow node
  */
-export const get61 = oc
+export const get63 = oc
   .route({
     description: 'Get last run result for draft workflow node',
     inputStructure: 'detailed',
@@ -3531,7 +3590,7 @@ export const get61 = oc
   .output(zGetAppsByAppIdWorkflowsDraftNodesByNodeIdLastRunResponse)
 
 export const lastRun = {
-  get: get61,
+  get: get63,
 }
 
 /**
@@ -3606,7 +3665,7 @@ export const delete11 = oc
 /**
  * Get variables for a specific node
  */
-export const get62 = oc
+export const get64 = oc
   .route({
     description: 'Get variables for a specific node',
     inputStructure: 'detailed',
@@ -3620,7 +3679,7 @@ export const get62 = oc
 
 export const variables = {
   delete: delete11,
-  get: get62,
+  get: get64,
 }
 
 export const byNodeId8 = {
@@ -3665,7 +3724,7 @@ export const run10 = {
 /**
  * Server-Sent Events stream of inspector deltas for a draft workflow run.
  */
-export const get63 = oc
+export const get65 = oc
   .route({
     description: 'Server-Sent Events stream of inspector deltas for a draft workflow run.',
     inputStructure: 'detailed',
@@ -3678,13 +3737,13 @@ export const get63 = oc
   .output(zGetAppsByAppIdWorkflowsDraftRunsByRunIdNodeOutputsEventsResponse)
 
 export const events = {
-  get: get63,
+  get: get65,
 }
 
 /**
  * Full value for one declared output, including signed download URL for files.
  */
-export const get64 = oc
+export const get66 = oc
   .route({
     description: 'Full value for one declared output, including signed download URL for files.',
     inputStructure: 'detailed',
@@ -3701,7 +3760,7 @@ export const get64 = oc
   .output(zGetAppsByAppIdWorkflowsDraftRunsByRunIdNodeOutputsByNodeIdByOutputNamePreviewResponse)
 
 export const preview4 = {
-  get: get64,
+  get: get66,
 }
 
 export const byOutputName = {
@@ -3711,7 +3770,7 @@ export const byOutputName = {
 /**
  * One node's declared outputs for a draft workflow run.
  */
-export const get65 = oc
+export const get67 = oc
   .route({
     description: 'One node\'s declared outputs for a draft workflow run.',
     inputStructure: 'detailed',
@@ -3724,14 +3783,14 @@ export const get65 = oc
   .output(zGetAppsByAppIdWorkflowsDraftRunsByRunIdNodeOutputsByNodeIdResponse)
 
 export const byNodeId9 = {
-  get: get65,
+  get: get67,
   byOutputName,
 }
 
 /**
  * Snapshot of every node's declared outputs for a draft workflow run.
  */
-export const get66 = oc
+export const get68 = oc
   .route({
     description: 'Snapshot of every node\'s declared outputs for a draft workflow run.',
     inputStructure: 'detailed',
@@ -3744,7 +3803,7 @@ export const get66 = oc
   .output(zGetAppsByAppIdWorkflowsDraftRunsByRunIdNodeOutputsResponse)
 
 export const nodeOutputs = {
-  get: get66,
+  get: get68,
   events,
   byNodeId: byNodeId9,
 }
@@ -3760,7 +3819,7 @@ export const runs = {
 /**
  * Get system variables for workflow
  */
-export const get67 = oc
+export const get69 = oc
   .route({
     description: 'Get system variables for workflow',
     inputStructure: 'detailed',
@@ -3773,7 +3832,7 @@ export const get67 = oc
   .output(zGetAppsByAppIdWorkflowsDraftSystemVariablesResponse)
 
 export const systemVariables = {
-  get: get67,
+  get: get69,
 }
 
 /**
@@ -3873,7 +3932,7 @@ export const delete12 = oc
 /**
  * Get a specific workflow variable
  */
-export const get68 = oc
+export const get70 = oc
   .route({
     description: 'Get a specific workflow variable',
     inputStructure: 'detailed',
@@ -3907,7 +3966,7 @@ export const patch2 = oc
 
 export const byVariableId = {
   delete: delete12,
-  get: get68,
+  get: get70,
   patch: patch2,
   reset,
 }
@@ -3933,7 +3992,7 @@ export const delete13 = oc
  *
  * Get draft workflow variables
  */
-export const get69 = oc
+export const get71 = oc
   .route({
     description: 'Get draft workflow variables',
     inputStructure: 'detailed',
@@ -3953,7 +4012,7 @@ export const get69 = oc
 
 export const variables2 = {
   delete: delete13,
-  get: get69,
+  get: get71,
   byVariableId,
 }
 
@@ -3962,7 +4021,7 @@ export const variables2 = {
  *
  * Get draft workflow for an application
  */
-export const get70 = oc
+export const get72 = oc
   .route({
     description: 'Get draft workflow for an application',
     inputStructure: 'detailed',
@@ -3999,7 +4058,7 @@ export const post59 = oc
   .output(zPostAppsByAppIdWorkflowsDraftResponse)
 
 export const draft2 = {
-  get: get70,
+  get: get72,
   post: post59,
   conversationVariables: conversationVariables2,
   environmentVariables,
@@ -4020,7 +4079,7 @@ export const draft2 = {
  *
  * Get published workflow for an application
  */
-export const get71 = oc
+export const get73 = oc
   .route({
     description: 'Get published workflow for an application',
     inputStructure: 'detailed',
@@ -4054,14 +4113,14 @@ export const post60 = oc
   .output(zPostAppsByAppIdWorkflowsPublishResponse)
 
 export const publish = {
-  get: get71,
+  get: get73,
   post: post60,
 }
 
 /**
  * Server-Sent Events stream of inspector deltas for a published workflow run.
  */
-export const get72 = oc
+export const get74 = oc
   .route({
     description: 'Server-Sent Events stream of inspector deltas for a published workflow run.',
     inputStructure: 'detailed',
@@ -4074,13 +4133,13 @@ export const get72 = oc
   .output(zGetAppsByAppIdWorkflowsPublishedRunsByRunIdNodeOutputsEventsResponse)
 
 export const events2 = {
-  get: get72,
+  get: get74,
 }
 
 /**
  * Full value for one declared output of a published run.
  */
-export const get73 = oc
+export const get75 = oc
   .route({
     description: 'Full value for one declared output of a published run.',
     inputStructure: 'detailed',
@@ -4101,7 +4160,7 @@ export const get73 = oc
   )
 
 export const preview5 = {
-  get: get73,
+  get: get75,
 }
 
 export const byOutputName2 = {
@@ -4111,7 +4170,7 @@ export const byOutputName2 = {
 /**
  * One node's declared outputs for a published workflow run.
  */
-export const get74 = oc
+export const get76 = oc
   .route({
     description: 'One node\'s declared outputs for a published workflow run.',
     inputStructure: 'detailed',
@@ -4124,14 +4183,14 @@ export const get74 = oc
   .output(zGetAppsByAppIdWorkflowsPublishedRunsByRunIdNodeOutputsByNodeIdResponse)
 
 export const byNodeId10 = {
-  get: get74,
+  get: get76,
   byOutputName: byOutputName2,
 }
 
 /**
  * Snapshot of every node's declared outputs for a published workflow run.
  */
-export const get75 = oc
+export const get77 = oc
   .route({
     description: 'Snapshot of every node\'s declared outputs for a published workflow run.',
     inputStructure: 'detailed',
@@ -4144,7 +4203,7 @@ export const get75 = oc
   .output(zGetAppsByAppIdWorkflowsPublishedRunsByRunIdNodeOutputsResponse)
 
 export const nodeOutputs2 = {
-  get: get75,
+  get: get77,
   events: events2,
   byNodeId: byNodeId10,
 }
@@ -4164,7 +4223,7 @@ export const published = {
 /**
  * Get webhook trigger for a node
  */
-export const get76 = oc
+export const get78 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4182,7 +4241,7 @@ export const get76 = oc
   .output(zGetAppsByAppIdWorkflowsTriggersWebhookResponse)
 
 export const webhook = {
-  get: get76,
+  get: get78,
 }
 
 export const triggers2 = {
@@ -4258,7 +4317,7 @@ export const byWorkflowId = {
  *
  * Get all published workflows for an application
  */
-export const get77 = oc
+export const get79 = oc
   .route({
     description: 'Get all published workflows for an application',
     inputStructure: 'detailed',
@@ -4277,7 +4336,7 @@ export const get77 = oc
   .output(zGetAppsByAppIdWorkflowsResponse)
 
 export const workflows3 = {
-  get: get77,
+  get: get79,
   defaultWorkflowBlockConfigs,
   draft: draft2,
   publish,
@@ -4310,7 +4369,7 @@ export const delete15 = oc
  *
  * Get application details
  */
-export const get78 = oc
+export const get80 = oc
   .route({
     description: 'Get application details',
     inputStructure: 'detailed',
@@ -4343,7 +4402,7 @@ export const put6 = oc
 
 export const byAppId2 = {
   delete: delete15,
-  get: get78,
+  get: get80,
   put: put6,
   advancedChat,
   agent,
@@ -4412,7 +4471,7 @@ export const byApiKeyId = {
  *
  * Get all API keys for an app
  */
-export const get79 = oc
+export const get81 = oc
   .route({
     description: 'Get all API keys for an app',
     inputStructure: 'detailed',
@@ -4445,7 +4504,7 @@ export const post62 = oc
   .output(zPostAppsByResourceIdApiKeysResponse)
 
 export const apiKeys = {
-  get: get79,
+  get: get81,
   post: post62,
   byApiKeyId,
 }
@@ -4457,7 +4516,7 @@ export const byResourceId = {
 /**
  * Refresh MCP server configuration and regenerate server code
  */
-export const get80 = oc
+export const get82 = oc
   .route({
     description: 'Refresh MCP server configuration and regenerate server code',
     inputStructure: 'detailed',
@@ -4470,7 +4529,7 @@ export const get80 = oc
   .output(zGetAppsByServerIdServerRefreshResponse)
 
 export const refresh = {
-  get: get80,
+  get: get82,
 }
 
 export const server2 = {
@@ -4486,7 +4545,7 @@ export const byServerId = {
  *
  * Get list of applications with pagination and filtering
  */
-export const get81 = oc
+export const get83 = oc
   .route({
     description: 'Get list of applications with pagination and filtering',
     inputStructure: 'detailed',
@@ -4519,7 +4578,7 @@ export const post63 = oc
   .output(zPostAppsResponse)
 
 export const apps = {
-  get: get81,
+  get: get83,
   post: post63,
   imports,
   starred,
diff --git a/packages/contracts/generated/api/console/apps/types.gen.ts b/packages/contracts/generated/api/console/apps/types.gen.ts
index bba74f0346a..57dc55e1274 100644
--- a/packages/contracts/generated/api/console/apps/types.gen.ts
+++ b/packages/contracts/generated/api/console/apps/types.gen.ts
@@ -193,8 +193,30 @@ export type AgentDrivePreviewResponse = {
   truncated: boolean
 }
 
+export type AgentDriveSkillListResponse = {
+  items?: Array<AgentDriveSkillItemResponse>
+}
+
+export type AgentDriveSkillInspectResponse = {
+  archive_key?: string | null
+  created_at?: number | null
+  description: string
+  file_tree?: Array<{
+    [key: string]: unknown
+  }>
+  files?: Array<AgentDriveSkillFileResponse>
+  hash?: string | null
+  mime_type?: string | null
+  name: string
+  path: string
+  size?: number | null
+  skill_md: AgentDriveSkillMarkdownResponse
+  skill_md_key: string
+  source: string
+  warnings?: Array<string>
+}
+
 export type AgentDriveDeleteResponse = {
-  config_version_id?: string | null
   removed_keys?: Array<string>
   result: string
 }
@@ -204,7 +226,6 @@ export type AgentDriveFilePayload = {
 }
 
 export type AgentDriveFileCommitResponse = {
-  config_version_id?: string | null
   file: AgentDriveFileResponse
 }
 
@@ -216,7 +237,7 @@ export type AgentLogResponse = {
 
 export type AgentSkillUploadResponse = {
   manifest: SkillManifest
-  skill: AgentSkillRefConfig
+  skill: AgentUploadedSkillResponse
 }
 
 export type SkillToolInferenceResult = {
@@ -1275,9 +1296,39 @@ export type AgentDriveItemResponse = {
   created_at?: number | null
   file_kind: string
   hash?: string | null
+  is_skill?: boolean | null
   key: string
   mime_type?: string | null
   size?: number | null
+  skill_metadata?: string | null
+}
+
+export type AgentDriveSkillItemResponse = {
+  archive_key?: string | null
+  created_at?: number | null
+  description: string
+  hash?: string | null
+  mime_type?: string | null
+  name: string
+  path: string
+  size?: number | null
+  skill_md_key: string
+}
+
+export type AgentDriveSkillFileResponse = {
+  available_in_drive: boolean
+  drive_key?: string | null
+  name: string
+  path: string
+  type: string
+}
+
+export type AgentDriveSkillMarkdownResponse = {
+  binary: boolean
+  key: string
+  size?: number | null
+  text?: string | null
+  truncated: boolean
 }
 
 export type AgentDriveFileResponse = {
@@ -1318,18 +1369,12 @@ export type SkillManifest = {
   size: number
 }
 
-export type AgentSkillRefConfig = {
-  description?: string | null
-  file_id?: string | null
-  full_archive_file_id?: string | null
-  full_archive_key?: string | null
-  id?: string | null
-  manifest_files?: Array<string> | null
-  name?: string | null
-  path?: string | null
-  skill_md_file_id?: string | null
-  skill_md_key?: string | null
-  [key: string]: unknown
+export type AgentUploadedSkillResponse = {
+  archive_key?: string | null
+  description: string
+  name: string
+  path: string
+  skill_md_key: string
 }
 
 export type CliToolSuggestion = {
@@ -1751,7 +1796,6 @@ export type AgentSoulConfig = {
   prompt?: AgentSoulPromptConfig
   sandbox?: AgentSoulSandboxConfig
   schema_version?: number
-  skills_files?: AgentSoulSkillsFilesConfig
   tools?: AgentSoulToolsConfig
 }
 
@@ -1848,14 +1892,6 @@ export type AgentComposerSoulCandidatesResponse = {
   dify_tools?: Array<AgentComposerDifyToolCandidateResponse>
   human_contacts?: Array<AgentHumanContactConfig>
   knowledge_datasets?: Array<AgentKnowledgeDatasetConfig>
-  skills_files?: Array<
-    | ({
-      kind: 'skill'
-    } & AgentComposerSkillCandidateResponse)
-    | ({
-      kind: 'file'
-    } & AgentComposerFileCandidateResponse)
-  >
 }
 
 export type ComposerCandidateCapabilities = {
@@ -2117,11 +2153,6 @@ export type AgentSoulSandboxConfig = {
   provider?: string | null
 }
 
-export type AgentSoulSkillsFilesConfig = {
-  files?: Array<AgentFileRefConfig>
-  skills?: Array<AgentSkillRefConfig>
-}
-
 export type AgentSoulToolsConfig = {
   cli_tools?: Array<AgentCliToolConfig>
   dify_tools?: Array<AgentSoulDifyToolConfig>
@@ -2255,37 +2286,6 @@ export type AgentKnowledgeDatasetConfig = {
   [key: string]: unknown
 }
 
-export type AgentComposerSkillCandidateResponse = {
-  description?: string | null
-  file_id?: string | null
-  full_archive_file_id?: string | null
-  full_archive_key?: string | null
-  id?: string | null
-  kind?: 'skill'
-  manifest_files?: Array<string> | null
-  name?: string | null
-  path?: string | null
-  skill_md_file_id?: string | null
-  skill_md_key?: string | null
-  [key: string]: unknown
-}
-
-export type AgentComposerFileCandidateResponse = {
-  drive_key?: string | null
-  file_id?: string | null
-  id?: string | null
-  kind?: 'file'
-  name?: string | null
-  reference?: string | null
-  remote_url?: string | null
-  tenant_id?: string | null
-  transfer_method?: string | null
-  type?: string | null
-  upload_file_id?: string | null
-  url?: string | null
-  [key: string]: unknown
-}
-
 export type CheckResultView = {
   passed: boolean
   reason?: string | null
@@ -2436,21 +2436,6 @@ export type AgentSandboxProviderConfig = {
   [key: string]: unknown
 }
 
-export type AgentFileRefConfig = {
-  drive_key?: string | null
-  file_id?: string | null
-  id?: string | null
-  name?: string | null
-  reference?: string | null
-  remote_url?: string | null
-  tenant_id?: string | null
-  transfer_method?: string | null
-  type?: string | null
-  upload_file_id?: string | null
-  url?: string | null
-  [key: string]: unknown
-}
-
 export type AgentSoulDifyToolConfig = {
   credential_ref?: AgentSoulDifyToolCredentialRef | null
   credential_type?: 'api-key' | 'oauth2' | 'unauthorized'
@@ -2476,6 +2461,21 @@ export type AgentSoulDifyToolConfig = {
   tool_name?: string | null
 }
 
+export type AgentFileRefConfig = {
+  drive_key?: string | null
+  file_id?: string | null
+  id?: string | null
+  name?: string | null
+  reference?: string | null
+  remote_url?: string | null
+  tenant_id?: string | null
+  transfer_method?: string | null
+  type?: string | null
+  upload_file_id?: string | null
+  url?: string | null
+  [key: string]: unknown
+}
+
 export type OutputErrorStrategy = 'default_value' | 'fail_branch' | 'stop'
 
 export type DeclaredOutputRetryConfig = {
@@ -3126,6 +3126,44 @@ export type GetAppsByAppIdAgentDriveFilesPreviewResponses = {
 export type GetAppsByAppIdAgentDriveFilesPreviewResponse
   = GetAppsByAppIdAgentDriveFilesPreviewResponses[keyof GetAppsByAppIdAgentDriveFilesPreviewResponses]
 
+export type GetAppsByAppIdAgentDriveSkillsData = {
+  body?: never
+  path: {
+    app_id: string
+  }
+  query?: {
+    node_id?: string
+    prefix?: string
+  }
+  url: '/apps/{app_id}/agent/drive/skills'
+}
+
+export type GetAppsByAppIdAgentDriveSkillsResponses = {
+  200: AgentDriveSkillListResponse
+}
+
+export type GetAppsByAppIdAgentDriveSkillsResponse
+  = GetAppsByAppIdAgentDriveSkillsResponses[keyof GetAppsByAppIdAgentDriveSkillsResponses]
+
+export type GetAppsByAppIdAgentDriveSkillsBySkillPathInspectData = {
+  body?: never
+  path: {
+    app_id: string
+    skill_path: string
+  }
+  query?: {
+    node_id?: string
+  }
+  url: '/apps/{app_id}/agent/drive/skills/{skill_path}/inspect'
+}
+
+export type GetAppsByAppIdAgentDriveSkillsBySkillPathInspectResponses = {
+  200: AgentDriveSkillInspectResponse
+}
+
+export type GetAppsByAppIdAgentDriveSkillsBySkillPathInspectResponse
+  = GetAppsByAppIdAgentDriveSkillsBySkillPathInspectResponses[keyof GetAppsByAppIdAgentDriveSkillsBySkillPathInspectResponses]
+
 export type DeleteAppsByAppIdAgentFilesData = {
   body?: never
   path: {
diff --git a/packages/contracts/generated/api/console/apps/zod.gen.ts b/packages/contracts/generated/api/console/apps/zod.gen.ts
index d8c87bb8980..a7c3a0656e1 100644
--- a/packages/contracts/generated/api/console/apps/zod.gen.ts
+++ b/packages/contracts/generated/api/console/apps/zod.gen.ts
@@ -120,7 +120,6 @@ export const zAgentDrivePreviewResponse = z.object({
  * AgentDriveDeleteResponse
  */
 export const zAgentDriveDeleteResponse = z.object({
-  config_version_id: z.string().nullish(),
   removed_keys: z.array(z.string()).optional(),
   result: z.string(),
 })
@@ -919,9 +918,11 @@ export const zAgentDriveItemResponse = z.object({
   created_at: z.int().nullish(),
   file_kind: z.string(),
   hash: z.string().nullish(),
+  is_skill: z.boolean().nullish(),
   key: z.string(),
   mime_type: z.string().nullish(),
   size: z.int().nullish(),
+  skill_metadata: z.string().nullish(),
 })
 
 /**
@@ -931,6 +932,70 @@ export const zAgentDriveListResponse = z.object({
   items: z.array(zAgentDriveItemResponse).optional(),
 })
 
+/**
+ * AgentDriveSkillItemResponse
+ */
+export const zAgentDriveSkillItemResponse = z.object({
+  archive_key: z.string().nullish(),
+  created_at: z.int().nullish(),
+  description: z.string(),
+  hash: z.string().nullish(),
+  mime_type: z.string().nullish(),
+  name: z.string(),
+  path: z.string(),
+  size: z.int().nullish(),
+  skill_md_key: z.string(),
+})
+
+/**
+ * AgentDriveSkillListResponse
+ */
+export const zAgentDriveSkillListResponse = z.object({
+  items: z.array(zAgentDriveSkillItemResponse).optional(),
+})
+
+/**
+ * AgentDriveSkillFileResponse
+ */
+export const zAgentDriveSkillFileResponse = z.object({
+  available_in_drive: z.boolean(),
+  drive_key: z.string().nullish(),
+  name: z.string(),
+  path: z.string(),
+  type: z.string(),
+})
+
+/**
+ * AgentDriveSkillMarkdownResponse
+ */
+export const zAgentDriveSkillMarkdownResponse = z.object({
+  binary: z.boolean(),
+  key: z.string(),
+  size: z.int().nullish(),
+  text: z.string().nullish(),
+  truncated: z.boolean(),
+})
+
+/**
+ * AgentDriveSkillInspectResponse
+ */
+export const zAgentDriveSkillInspectResponse = z.object({
+  archive_key: z.string().nullish(),
+  created_at: z.int().nullish(),
+  description: z.string(),
+  file_tree: z.array(z.record(z.string(), z.unknown())).optional(),
+  files: z.array(zAgentDriveSkillFileResponse).optional(),
+  hash: z.string().nullish(),
+  mime_type: z.string().nullish(),
+  name: z.string(),
+  path: z.string(),
+  size: z.int().nullish(),
+  skill_md: zAgentDriveSkillMarkdownResponse,
+  skill_md_key: z.string(),
+  source: z.string(),
+  warnings: z.array(z.string()).optional(),
+})
+
 /**
  * AgentDriveFileResponse
  */
@@ -946,7 +1011,6 @@ export const zAgentDriveFileResponse = z.object({
  * AgentDriveFileCommitResponse
  */
 export const zAgentDriveFileCommitResponse = z.object({
-  config_version_id: z.string().nullish(),
   file: zAgentDriveFileResponse,
 })
 
@@ -978,19 +1042,14 @@ export const zSkillManifest = z.object({
 })
 
 /**
- * AgentSkillRefConfig
+ * AgentUploadedSkillResponse
  */
-export const zAgentSkillRefConfig = z.object({
-  description: z.string().nullish(),
-  file_id: z.string().max(255).nullish(),
-  full_archive_file_id: z.string().max(255).nullish(),
-  full_archive_key: z.string().max(512).nullish(),
-  id: z.string().max(255).nullish(),
-  manifest_files: z.array(z.string()).nullish(),
-  name: z.string().max(255).nullish(),
-  path: z.string().nullish(),
-  skill_md_file_id: z.string().max(255).nullish(),
-  skill_md_key: z.string().max(512).nullish(),
+export const zAgentUploadedSkillResponse = z.object({
+  archive_key: z.string().nullish(),
+  description: z.string(),
+  name: z.string(),
+  path: z.string(),
+  skill_md_key: z.string(),
 })
 
 /**
@@ -998,7 +1057,7 @@ export const zAgentSkillRefConfig = z.object({
  */
 export const zAgentSkillUploadResponse = z.object({
   manifest: zSkillManifest,
-  skill: zAgentSkillRefConfig,
+  skill: zAgentUploadedSkillResponse,
 })
 
 /**
@@ -2580,41 +2639,6 @@ export const zAgentKnowledgeDatasetConfig = z.object({
   name: z.string().max(255).nullish(),
 })
 
-/**
- * AgentComposerSkillCandidateResponse
- */
-export const zAgentComposerSkillCandidateResponse = z.object({
-  description: z.string().nullish(),
-  file_id: z.string().max(255).nullish(),
-  full_archive_file_id: z.string().max(255).nullish(),
-  full_archive_key: z.string().max(512).nullish(),
-  id: z.string().max(255).nullish(),
-  kind: z.literal('skill').optional().default('skill'),
-  manifest_files: z.array(z.string()).nullish(),
-  name: z.string().max(255).nullish(),
-  path: z.string().nullish(),
-  skill_md_file_id: z.string().max(255).nullish(),
-  skill_md_key: z.string().max(512).nullish(),
-})
-
-/**
- * AgentComposerFileCandidateResponse
- */
-export const zAgentComposerFileCandidateResponse = z.object({
-  drive_key: z.string().max(512).nullish(),
-  file_id: z.string().max(255).nullish(),
-  id: z.string().max(255).nullish(),
-  kind: z.literal('file').optional().default('file'),
-  name: z.string().max(255).nullish(),
-  reference: z.string().max(255).nullish(),
-  remote_url: z.string().nullish(),
-  tenant_id: z.string().max(255).nullish(),
-  transfer_method: z.string().max(64).nullish(),
-  type: z.string().max(64).nullish(),
-  upload_file_id: z.string().max(255).nullish(),
-  url: z.string().nullish(),
-})
-
 /**
  * CheckResultView
  *
@@ -2833,14 +2857,6 @@ export const zAgentFileRefConfig = z.object({
   url: z.string().nullish(),
 })
 
-/**
- * AgentSoulSkillsFilesConfig
- */
-export const zAgentSoulSkillsFilesConfig = z.object({
-  files: z.array(zAgentFileRefConfig).optional(),
-  skills: z.array(zAgentSkillRefConfig).optional(),
-})
-
 /**
  * WorkflowNodeJobMetadata
  */
@@ -2995,22 +3011,6 @@ export const zAgentComposerSoulCandidatesResponse = z.object({
   dify_tools: z.array(zAgentComposerDifyToolCandidateResponse).optional(),
   human_contacts: z.array(zAgentHumanContactConfig).optional(),
   knowledge_datasets: z.array(zAgentKnowledgeDatasetConfig).optional(),
-  skills_files: z
-    .array(
-      z.union([
-        z
-          .object({
-            kind: z.literal('skill'),
-          })
-          .and(zAgentComposerSkillCandidateResponse),
-        z
-          .object({
-            kind: z.literal('file'),
-          })
-          .and(zAgentComposerFileCandidateResponse),
-      ]),
-    )
-    .optional(),
 })
 
 /**
@@ -3307,7 +3307,6 @@ export const zAgentSoulConfig = z.object({
   prompt: zAgentSoulPromptConfig.optional(),
   sandbox: zAgentSoulSandboxConfig.optional(),
   schema_version: z.int().optional().default(1),
-  skills_files: zAgentSoulSkillsFilesConfig.optional(),
   tools: zAgentSoulToolsConfig.optional(),
 })
 
@@ -3917,6 +3916,35 @@ export const zGetAppsByAppIdAgentDriveFilesPreviewQuery = z.object({
  */
 export const zGetAppsByAppIdAgentDriveFilesPreviewResponse = zAgentDrivePreviewResponse
 
+export const zGetAppsByAppIdAgentDriveSkillsPath = z.object({
+  app_id: z.uuid(),
+})
+
+export const zGetAppsByAppIdAgentDriveSkillsQuery = z.object({
+  node_id: z.string().optional(),
+  prefix: z.string().optional().default(''),
+})
+
+/**
+ * Drive skills
+ */
+export const zGetAppsByAppIdAgentDriveSkillsResponse = zAgentDriveSkillListResponse
+
+export const zGetAppsByAppIdAgentDriveSkillsBySkillPathInspectPath = z.object({
+  app_id: z.uuid(),
+  skill_path: z.string(),
+})
+
+export const zGetAppsByAppIdAgentDriveSkillsBySkillPathInspectQuery = z.object({
+  node_id: z.string().optional(),
+})
+
+/**
+ * Drive skill inspect view
+ */
+export const zGetAppsByAppIdAgentDriveSkillsBySkillPathInspectResponse
+  = zAgentDriveSkillInspectResponse
+
 export const zDeleteAppsByAppIdAgentFilesPath = z.object({
   app_id: z.uuid(),
 })
diff --git a/packages/contracts/generated/api/console/snippets/types.gen.ts b/packages/contracts/generated/api/console/snippets/types.gen.ts
index d46a6389a52..631da7bace8 100644
--- a/packages/contracts/generated/api/console/snippets/types.gen.ts
+++ b/packages/contracts/generated/api/console/snippets/types.gen.ts
@@ -37,9 +37,9 @@ export type WorkflowRunNodeExecutionListResponse = {
   data: Array<WorkflowRunNodeExecutionResponse>
 }
 
-export type WorkflowPaginationResponse = {
+export type SnippetWorkflowPaginationResponse = {
   has_more: boolean
-  items: Array<WorkflowResponse>
+  items: Array<SnippetWorkflowResponse>
   limit: number
   page: number
 }
@@ -235,28 +235,6 @@ export type SimpleEndUser = {
   type: string
 }
 
-export type WorkflowResponse = {
-  conversation_variables: Array<WorkflowConversationVariableResponse>
-  created_at: number
-  created_by?: SimpleAccount | null
-  environment_variables: Array<WorkflowEnvironmentVariableResponse>
-  features: {
-    [key: string]: unknown
-  }
-  graph: {
-    [key: string]: unknown
-  }
-  hash: string
-  id: string
-  marked_comment: string
-  marked_name: string
-  rag_pipeline_variables: Array<PipelineVariableResponse>
-  tool_published: boolean
-  updated_at: number
-  updated_by?: SimpleAccount | null
-  version: string
-}
-
 export type WorkflowConversationVariableResponse = {
   description: string
   id: string
@@ -417,7 +395,7 @@ export type GetSnippetsBySnippetIdWorkflowsData = {
 }
 
 export type GetSnippetsBySnippetIdWorkflowsResponses = {
-  200: WorkflowPaginationResponse
+  200: SnippetWorkflowPaginationResponse
 }
 
 export type GetSnippetsBySnippetIdWorkflowsResponse
diff --git a/packages/contracts/generated/api/console/snippets/zod.gen.ts b/packages/contracts/generated/api/console/snippets/zod.gen.ts
index 1c861084434..85e5b961547 100644
--- a/packages/contracts/generated/api/console/snippets/zod.gen.ts
+++ b/packages/contracts/generated/api/console/snippets/zod.gen.ts
@@ -300,32 +300,11 @@ export const zSnippetWorkflowResponse = z.object({
 })
 
 /**
- * WorkflowResponse
+ * SnippetWorkflowPaginationResponse
  */
-export const zWorkflowResponse = z.object({
-  conversation_variables: z.array(zWorkflowConversationVariableResponse),
-  created_at: z.int(),
-  created_by: zSimpleAccount.nullish(),
-  environment_variables: z.array(zWorkflowEnvironmentVariableResponse),
-  features: z.record(z.string(), z.unknown()),
-  graph: z.record(z.string(), z.unknown()),
-  hash: z.string(),
-  id: z.string(),
-  marked_comment: z.string(),
-  marked_name: z.string(),
-  rag_pipeline_variables: z.array(zPipelineVariableResponse),
-  tool_published: z.boolean(),
-  updated_at: z.int(),
-  updated_by: zSimpleAccount.nullish(),
-  version: z.string(),
-})
-
-/**
- * WorkflowPaginationResponse
- */
-export const zWorkflowPaginationResponse = z.object({
+export const zSnippetWorkflowPaginationResponse = z.object({
   has_more: z.boolean(),
-  items: z.array(zWorkflowResponse),
+  items: z.array(zSnippetWorkflowResponse),
   limit: z.int(),
   page: z.int(),
 })
@@ -443,7 +422,7 @@ export const zGetSnippetsBySnippetIdWorkflowsQuery = z.object({
 /**
  * Published workflows retrieved successfully
  */
-export const zGetSnippetsBySnippetIdWorkflowsResponse = zWorkflowPaginationResponse
+export const zGetSnippetsBySnippetIdWorkflowsResponse = zSnippetWorkflowPaginationResponse
 
 export const zGetSnippetsBySnippetIdWorkflowsDefaultWorkflowBlockConfigsPath = z.object({
   snippet_id: z.uuid(),
diff --git a/packages/contracts/generated/api/openapi/orpc.gen.ts b/packages/contracts/generated/api/openapi/orpc.gen.ts
index bc7cbea340b..47aa1b90d6a 100644
--- a/packages/contracts/generated/api/openapi/orpc.gen.ts
+++ b/packages/contracts/generated/api/openapi/orpc.gen.ts
@@ -30,6 +30,9 @@ import {
   zGetHealthResponse,
   zGetOauthDeviceLookupQuery,
   zGetOauthDeviceLookupResponse,
+  zGetPermittedExternalAppsByAppIdDescribePath,
+  zGetPermittedExternalAppsByAppIdDescribeQuery,
+  zGetPermittedExternalAppsByAppIdDescribeResponse,
   zGetPermittedExternalAppsQuery,
   zGetPermittedExternalAppsResponse,
   zGetVersionResponse,
@@ -450,6 +453,30 @@ export const oauth = {
 }
 
 export const get12 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getPermittedExternalAppsByAppIdDescribe',
+    path: '/permitted-external-apps/{app_id}/describe',
+    tags: ['openapi'],
+  })
+  .input(
+    z.object({
+      params: zGetPermittedExternalAppsByAppIdDescribePath,
+      query: zGetPermittedExternalAppsByAppIdDescribeQuery.optional(),
+    }),
+  )
+  .output(zGetPermittedExternalAppsByAppIdDescribeResponse)
+
+export const describe2 = {
+  get: get12,
+}
+
+export const byAppId2 = {
+  describe: describe2,
+}
+
+export const get13 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -461,7 +488,8 @@ export const get12 = oc
   .output(zGetPermittedExternalAppsResponse)
 
 export const permittedExternalApps = {
-  get: get12,
+  get: get13,
+  byAppId: byAppId2,
 }
 
 export const post9 = oc
@@ -544,7 +572,7 @@ export const byMemberId = {
   role,
 }
 
-export const get13 = oc
+export const get14 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -578,7 +606,7 @@ export const post11 = oc
   .output(zPostWorkspacesByWorkspaceIdMembersResponse)
 
 export const members = {
-  get: get13,
+  get: get14,
   post: post11,
   byMemberId,
 }
@@ -598,7 +626,7 @@ export const switch_ = {
   post: post12,
 }
 
-export const get14 = oc
+export const get15 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -610,13 +638,13 @@ export const get14 = oc
   .output(zGetWorkspacesByWorkspaceIdResponse)
 
 export const byWorkspaceId = {
-  get: get14,
+  get: get15,
   apps: apps2,
   members,
   switch: switch_,
 }
 
-export const get15 = oc
+export const get16 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -627,7 +655,7 @@ export const get15 = oc
   .output(zGetWorkspacesResponse)
 
 export const workspaces = {
-  get: get15,
+  get: get16,
   byWorkspaceId,
 }
 
diff --git a/packages/contracts/generated/api/openapi/types.gen.ts b/packages/contracts/generated/api/openapi/types.gen.ts
index e1217f3f6d7..2d47f947247 100644
--- a/packages/contracts/generated/api/openapi/types.gen.ts
+++ b/packages/contracts/generated/api/openapi/types.gen.ts
@@ -20,14 +20,12 @@ export type AccountResponse = {
 }
 
 export type AppDescribeInfo = {
-  author?: string | null
   description?: string | null
   id: string
   is_agent?: boolean
   mode: string
   name: string
   service_api_enabled: boolean
-  tags?: Array<TagItem>
   updated_at?: string | null
 }
 
@@ -66,21 +64,18 @@ export type AppDslImportPayload = {
   yaml_url?: string | null
 }
 
-export type AppInfoResponse = {
-  author?: string | null
+export type AppInfo = {
   description?: string | null
   id: string
   mode: string
   name: string
-  tags?: Array<TagItem>
 }
 
 export type AppListQuery = {
   limit?: number
-  mode?: AppMode | null
+  mode?: SupportedAppType | null
   name?: string | null
   page?: number
-  tag?: string | null
   workspace_id: string
 }
 
@@ -93,12 +88,10 @@ export type AppListResponse = {
 }
 
 export type AppListRow = {
-  created_by_name?: string | null
   description?: string | null
   id: string
   mode: AppMode
   name: string
-  tags?: Array<TagItem>
   updated_at?: string | null
   workspace_id?: string | null
   workspace_name?: string | null
@@ -332,6 +325,7 @@ export type OpenApiErrorCode
     | 'file_too_large'
     | 'filename_not_exists'
     | 'forbidden'
+    | 'form_not_found'
     | 'internal_server_error'
     | 'invalid_param'
     | 'member_license_exceeded'
@@ -344,6 +338,7 @@ export type OpenApiErrorCode
     | 'provider_not_initialize'
     | 'provider_quota_exceeded'
     | 'rate_limit_error'
+    | 'recipient_surface_mismatch'
     | 'request_entity_too_large'
     | 'too_many_files'
     | 'too_many_requests'
@@ -359,7 +354,7 @@ export type Package = {
 
 export type PermittedExternalAppsListQuery = {
   limit?: number
-  mode?: AppMode | null
+  mode?: SupportedAppType | null
   name?: string | null
   page?: number
 }
@@ -410,9 +405,7 @@ export type SessionRow = {
   prefix: string
 }
 
-export type TagItem = {
-  name: string
-}
+export type SupportedAppType = 'advanced-chat' | 'agent-chat' | 'chat' | 'completion' | 'workflow'
 
 export type TaskStopResponse = {
   result: 'success'
@@ -598,18 +591,9 @@ export type GetAppsData = {
   path?: never
   query: {
     limit?: number
-    mode?:
-      | 'advanced-chat'
-      | 'agent'
-      | 'agent-chat'
-      | 'channel'
-      | 'chat'
-      | 'completion'
-      | 'rag-pipeline'
-      | 'workflow'
+    mode?: 'advanced-chat' | 'agent-chat' | 'chat' | 'completion' | 'workflow'
     name?: string
     page?: number
-    tag?: string
     workspace_id: string
   }
   url: '/apps'
@@ -915,15 +899,7 @@ export type GetPermittedExternalAppsData = {
   path?: never
   query?: {
     limit?: number
-    mode?:
-      | 'advanced-chat'
-      | 'agent'
-      | 'agent-chat'
-      | 'channel'
-      | 'chat'
-      | 'completion'
-      | 'rag-pipeline'
-      | 'workflow'
+    mode?: 'advanced-chat' | 'agent-chat' | 'chat' | 'completion' | 'workflow'
     name?: string
     page?: number
   }
@@ -945,6 +921,32 @@ export type GetPermittedExternalAppsResponses = {
 export type GetPermittedExternalAppsResponse
   = GetPermittedExternalAppsResponses[keyof GetPermittedExternalAppsResponses]
 
+export type GetPermittedExternalAppsByAppIdDescribeData = {
+  body?: never
+  path: {
+    app_id: string
+  }
+  query?: {
+    fields?: string
+  }
+  url: '/permitted-external-apps/{app_id}/describe'
+}
+
+export type GetPermittedExternalAppsByAppIdDescribeErrors = {
+  422: ErrorBody
+  default: ErrorBody
+}
+
+export type GetPermittedExternalAppsByAppIdDescribeError
+  = GetPermittedExternalAppsByAppIdDescribeErrors[keyof GetPermittedExternalAppsByAppIdDescribeErrors]
+
+export type GetPermittedExternalAppsByAppIdDescribeResponses = {
+  200: AppDescribeResponse
+}
+
+export type GetPermittedExternalAppsByAppIdDescribeResponse
+  = GetPermittedExternalAppsByAppIdDescribeResponses[keyof GetPermittedExternalAppsByAppIdDescribeResponses]
+
 export type GetWorkspacesData = {
   body?: never
   path?: never
diff --git a/packages/contracts/generated/api/openapi/zod.gen.ts b/packages/contracts/generated/api/openapi/zod.gen.ts
index 51a3cb8f480..557447cc769 100644
--- a/packages/contracts/generated/api/openapi/zod.gen.ts
+++ b/packages/contracts/generated/api/openapi/zod.gen.ts
@@ -11,6 +11,19 @@ export const zAccountPayload = z.object({
   name: z.string(),
 })
 
+/**
+ * AppDescribeInfo
+ */
+export const zAppDescribeInfo = z.object({
+  description: z.string().nullish(),
+  id: z.string(),
+  is_agent: z.boolean().optional().default(false),
+  mode: z.string(),
+  name: z.string(),
+  service_api_enabled: z.boolean(),
+  updated_at: z.string().nullish(),
+})
+
 /**
  * AppDescribeQuery
  *
@@ -22,6 +35,15 @@ export const zAppDescribeQuery = z.object({
   fields: z.string().optional(),
 })
 
+/**
+ * AppDescribeResponse
+ */
+export const zAppDescribeResponse = z.object({
+  info: zAppDescribeInfo.nullish(),
+  input_schema: z.record(z.string(), z.unknown()).nullish(),
+  parameters: z.record(z.string(), z.unknown()).nullish(),
+})
+
 /**
  * AppDslExportQuery
  *
@@ -58,6 +80,16 @@ export const zAppDslImportPayload = z.object({
   yaml_url: z.string().nullish(),
 })
 
+/**
+ * AppInfo
+ */
+export const zAppInfo = z.object({
+  description: z.string().nullish(),
+  id: z.string(),
+  mode: z.string(),
+  name: z.string(),
+})
+
 /**
  * AppMode
  */
@@ -73,17 +105,27 @@ export const zAppMode = z.enum([
 ])
 
 /**
- * AppListQuery
- *
- * mode is a closed enum.
+ * AppListRow
  */
-export const zAppListQuery = z.object({
-  limit: z.int().gte(1).lte(200).optional().default(20),
-  mode: zAppMode.nullish(),
-  name: z.string().max(200).nullish(),
-  page: z.int().gte(1).optional().default(1),
-  tag: z.string().max(100).nullish(),
-  workspace_id: z.string(),
+export const zAppListRow = z.object({
+  description: z.string().nullish(),
+  id: z.string(),
+  mode: zAppMode,
+  name: z.string(),
+  updated_at: z.string().nullish(),
+  workspace_id: z.string().nullish(),
+  workspace_name: z.string().nullish(),
+})
+
+/**
+ * AppListResponse
+ */
+export const zAppListResponse = z.object({
+  data: z.array(zAppListRow),
+  has_more: z.boolean(),
+  limit: z.int(),
+  page: z.int(),
+  total: z.int(),
 })
 
 /**
@@ -366,6 +408,7 @@ export const zOpenApiErrorCode = z.enum([
   'file_too_large',
   'filename_not_exists',
   'forbidden',
+  'form_not_found',
   'internal_server_error',
   'invalid_param',
   'member_license_exceeded',
@@ -378,6 +421,7 @@ export const zOpenApiErrorCode = z.enum([
   'provider_not_initialize',
   'provider_quota_exceeded',
   'rate_limit_error',
+  'recipient_surface_mismatch',
   'request_entity_too_large',
   'too_many_files',
   'too_many_requests',
@@ -396,15 +440,14 @@ export const zPackage = z.object({
 })
 
 /**
- * PermittedExternalAppsListQuery
- *
- * Strict (extra='forbid').
+ * PermittedExternalAppsListResponse
  */
-export const zPermittedExternalAppsListQuery = z.object({
-  limit: z.int().gte(1).lte(200).optional().default(20),
-  mode: zAppMode.nullish(),
-  name: z.string().max(200).nullish(),
-  page: z.int().gte(1).optional().default(1),
+export const zPermittedExternalAppsListResponse = z.object({
+  data: z.array(zAppListRow),
+  has_more: z.boolean(),
+  limit: z.int(),
+  page: z.int(),
+  total: z.int(),
 })
 
 /**
@@ -459,83 +502,51 @@ export const zSessionListResponse = z.object({
 })
 
 /**
- * TagItem
+ * SupportedAppType
+ *
+ * App types the ``app`` usage face (``get app``) lists and filters.
+ *
+ * A curated subset of :class:`AppMode`: the real, user-facing app categories.
+ * Excludes runtime-only mode tags that are not standalone apps
+ * (``rag-pipeline`` is a knowledge ``Pipeline``; ``channel`` is unused) and the
+ * roster-owned ``agent`` type (surfaced through the roster, not this list).
+ *
+ * Members reference ``AppMode.*.value`` so the subset relationship is
+ * type-checked: dropping a member from ``AppMode`` breaks this at import.
+ * This is the single source for the listable set — params, filters, and the
+ * generated CLI whitelist all derive from it.
  */
-export const zTagItem = z.object({
-  name: z.string(),
+export const zSupportedAppType = z.enum([
+  'advanced-chat',
+  'agent-chat',
+  'chat',
+  'completion',
+  'workflow',
+])
+
+/**
+ * AppListQuery
+ *
+ * mode is a closed enum of listable app types.
+ */
+export const zAppListQuery = z.object({
+  limit: z.int().gte(1).lte(200).optional().default(20),
+  mode: zSupportedAppType.nullish(),
+  name: z.string().max(200).nullish(),
+  page: z.int().gte(1).optional().default(1),
+  workspace_id: z.string(),
 })
 
 /**
- * AppDescribeInfo
+ * PermittedExternalAppsListQuery
+ *
+ * Strict (extra='forbid').
  */
-export const zAppDescribeInfo = z.object({
-  author: z.string().nullish(),
-  description: z.string().nullish(),
-  id: z.string(),
-  is_agent: z.boolean().optional().default(false),
-  mode: z.string(),
-  name: z.string(),
-  service_api_enabled: z.boolean(),
-  tags: z.array(zTagItem).optional().default([]),
-  updated_at: z.string().nullish(),
-})
-
-/**
- * AppDescribeResponse
- */
-export const zAppDescribeResponse = z.object({
-  info: zAppDescribeInfo.nullish(),
-  input_schema: z.record(z.string(), z.unknown()).nullish(),
-  parameters: z.record(z.string(), z.unknown()).nullish(),
-})
-
-/**
- * AppInfoResponse
- */
-export const zAppInfoResponse = z.object({
-  author: z.string().nullish(),
-  description: z.string().nullish(),
-  id: z.string(),
-  mode: z.string(),
-  name: z.string(),
-  tags: z.array(zTagItem).optional().default([]),
-})
-
-/**
- * AppListRow
- */
-export const zAppListRow = z.object({
-  created_by_name: z.string().nullish(),
-  description: z.string().nullish(),
-  id: z.string(),
-  mode: zAppMode,
-  name: z.string(),
-  tags: z.array(zTagItem).optional().default([]),
-  updated_at: z.string().nullish(),
-  workspace_id: z.string().nullish(),
-  workspace_name: z.string().nullish(),
-})
-
-/**
- * AppListResponse
- */
-export const zAppListResponse = z.object({
-  data: z.array(zAppListRow),
-  has_more: z.boolean(),
-  limit: z.int(),
-  page: z.int(),
-  total: z.int(),
-})
-
-/**
- * PermittedExternalAppsListResponse
- */
-export const zPermittedExternalAppsListResponse = z.object({
-  data: z.array(zAppListRow),
-  has_more: z.boolean(),
-  limit: z.int(),
-  page: z.int(),
-  total: z.int(),
+export const zPermittedExternalAppsListQuery = z.object({
+  limit: z.int().gte(1).lte(200).optional().default(20),
+  mode: zSupportedAppType.nullish(),
+  name: z.string().max(200).nullish(),
+  page: z.int().gte(1).optional().default(1),
 })
 
 /**
@@ -710,21 +721,9 @@ export const zDeleteAccountSessionsBySessionIdResponse = zRevokeResponse
 
 export const zGetAppsQuery = z.object({
   limit: z.int().gte(1).lte(200).optional().default(20),
-  mode: z
-    .enum([
-      'advanced-chat',
-      'agent',
-      'agent-chat',
-      'channel',
-      'chat',
-      'completion',
-      'rag-pipeline',
-      'workflow',
-    ])
-    .optional(),
+  mode: z.enum(['advanced-chat', 'agent-chat', 'chat', 'completion', 'workflow']).optional(),
   name: z.string().max(200).optional(),
   page: z.int().gte(1).optional().default(1),
-  tag: z.string().max(100).optional(),
   workspace_id: z.string(),
 })
 
@@ -875,18 +874,7 @@ export const zPostOauthDeviceTokenResponse = zDeviceTokenResponse
 
 export const zGetPermittedExternalAppsQuery = z.object({
   limit: z.int().gte(1).lte(200).optional().default(20),
-  mode: z
-    .enum([
-      'advanced-chat',
-      'agent',
-      'agent-chat',
-      'channel',
-      'chat',
-      'completion',
-      'rag-pipeline',
-      'workflow',
-    ])
-    .optional(),
+  mode: z.enum(['advanced-chat', 'agent-chat', 'chat', 'completion', 'workflow']).optional(),
   name: z.string().max(200).optional(),
   page: z.int().gte(1).optional().default(1),
 })
@@ -896,6 +884,19 @@ export const zGetPermittedExternalAppsQuery = z.object({
  */
 export const zGetPermittedExternalAppsResponse = zPermittedExternalAppsListResponse
 
+export const zGetPermittedExternalAppsByAppIdDescribePath = z.object({
+  app_id: z.string(),
+})
+
+export const zGetPermittedExternalAppsByAppIdDescribeQuery = z.object({
+  fields: z.string().optional(),
+})
+
+/**
+ * Permitted external app description
+ */
+export const zGetPermittedExternalAppsByAppIdDescribeResponse = zAppDescribeResponse
+
 /**
  * Workspace list
  */
diff --git a/packages/dify-ui/package.json b/packages/dify-ui/package.json
index 0d2e4d47359..9a05be1fc3c 100644
--- a/packages/dify-ui/package.json
+++ b/packages/dify-ui/package.json
@@ -193,6 +193,7 @@
     "@typescript/native-preview": "catalog:",
     "@vitejs/plugin-react": "catalog:",
     "@vitest/browser": "catalog:",
+    "@vitest/browser-playwright": "catalog:",
     "@vitest/coverage-v8": "catalog:",
     "class-variance-authority": "catalog:",
     "playwright": "catalog:",
diff --git a/packages/dify-ui/src/autocomplete/index.tsx b/packages/dify-ui/src/autocomplete/index.tsx
index b362a9450fd..4d115024ab1 100644
--- a/packages/dify-ui/src/autocomplete/index.tsx
+++ b/packages/dify-ui/src/autocomplete/index.tsx
@@ -145,9 +145,9 @@ const autocompleteControlVariants = cva(
   {
     variants: {
       size: {
-        small: 'mr-1 size-4',
-        medium: 'mr-1.5 size-5',
-        large: 'mr-2 size-5',
+        small: 'me-1 size-4',
+        medium: 'me-1.5 size-5',
+        large: 'me-2 size-5',
       },
     },
     defaultVariants: {
diff --git a/packages/dify-ui/src/button/__tests__/index.spec.tsx b/packages/dify-ui/src/button/__tests__/index.spec.tsx
index 08d622eb9ec..2fe1022d08d 100644
--- a/packages/dify-ui/src/button/__tests__/index.spec.tsx
+++ b/packages/dify-ui/src/button/__tests__/index.spec.tsx
@@ -1,6 +1,6 @@
 import type * as React from 'react'
+import { userEvent } from 'vite-plus/test/browser'
 import { render } from 'vitest-browser-react'
-import { userEvent } from 'vitest/browser'
 import { Button } from '../index'
 
 const asHTMLElement = (element: HTMLElement | SVGElement) => element as HTMLElement
diff --git a/packages/dify-ui/src/button/index.tsx b/packages/dify-ui/src/button/index.tsx
index 2181b880a55..0d36d7d1510 100644
--- a/packages/dify-ui/src/button/index.tsx
+++ b/packages/dify-ui/src/button/index.tsx
@@ -131,7 +131,7 @@ export function Button({
       {children}
       {loading && (
         <i
-          className="ml-1 i-ri-loader-2-line size-3 animate-spin motion-reduce:animate-none"
+          className="ms-1 i-ri-loader-2-line size-3 animate-spin motion-reduce:animate-none"
           aria-hidden="true"
         />
       )}
diff --git a/packages/dify-ui/src/collapsible/index.tsx b/packages/dify-ui/src/collapsible/index.tsx
index 550584d5da1..73f54c4d2cc 100644
--- a/packages/dify-ui/src/collapsible/index.tsx
+++ b/packages/dify-ui/src/collapsible/index.tsx
@@ -35,7 +35,7 @@ export function CollapsibleTrigger({
   return (
     <BaseCollapsible.Trigger
       className={cn(
-        'group flex min-h-8 w-full touch-manipulation items-center justify-between gap-2 rounded-lg px-2.5 text-left system-sm-medium text-text-secondary outline-hidden select-none',
+        'group flex min-h-8 w-full touch-manipulation items-center justify-between gap-2 rounded-lg px-2.5 text-start system-sm-medium text-text-secondary outline-hidden select-none',
         'hover:not-data-disabled:bg-components-panel-on-panel-item-bg-hover hover:not-data-disabled:text-text-primary',
         'focus-visible:ring-2 focus-visible:ring-state-accent-solid',
         'data-panel-open:text-text-primary',
diff --git a/packages/dify-ui/src/combobox/index.tsx b/packages/dify-ui/src/combobox/index.tsx
index 6931a2df7a8..c97abc7db32 100644
--- a/packages/dify-ui/src/combobox/index.tsx
+++ b/packages/dify-ui/src/combobox/index.tsx
@@ -50,7 +50,7 @@ const comboboxItemClassName = [
 
 const comboboxTriggerVariants = cva(
   [
-    'group/combobox-trigger flex w-full min-w-0 items-center border-0 bg-components-input-bg-normal text-left text-components-input-text-filled outline-hidden transition-colors',
+    'group/combobox-trigger flex w-full min-w-0 items-center border-0 bg-components-input-bg-normal text-start text-components-input-text-filled outline-hidden transition-colors',
     'hover:bg-state-base-hover-alt focus-visible:bg-state-base-hover-alt data-popup-open:bg-state-base-hover-alt',
     'focus-visible:ring-1 focus-visible:ring-components-input-border-active focus-visible:ring-inset',
     'data-placeholder:text-components-input-text-placeholder',
@@ -207,9 +207,9 @@ const comboboxControlVariants = cva(
   {
     variants: {
       size: {
-        small: 'mr-1 size-4',
-        medium: 'mr-1.5 size-5',
-        large: 'mr-2 size-5',
+        small: 'me-1 size-4',
+        medium: 'me-1.5 size-5',
+        large: 'me-2 size-5',
       },
     },
     defaultVariants: {
diff --git a/packages/dify-ui/src/context-menu/index.tsx b/packages/dify-ui/src/context-menu/index.tsx
index f10eea25a94..9c43402961a 100644
--- a/packages/dify-ui/src/context-menu/index.tsx
+++ b/packages/dify-ui/src/context-menu/index.tsx
@@ -219,7 +219,7 @@ export function ContextMenuSubTrigger({
       {...props}
     >
       {children}
-      <span aria-hidden className="ml-auto i-ri-arrow-right-s-line size-4 shrink-0 text-text-tertiary" />
+      <span aria-hidden className="ms-auto i-ri-arrow-right-s-line size-4 shrink-0 text-text-tertiary" />
     </BaseContextMenu.SubmenuTrigger>
   )
 }
diff --git a/packages/dify-ui/src/dialog/index.tsx b/packages/dify-ui/src/dialog/index.tsx
index 5162a1a35af..9e08da21e58 100644
--- a/packages/dify-ui/src/dialog/index.tsx
+++ b/packages/dify-ui/src/dialog/index.tsx
@@ -8,7 +8,6 @@ export const Dialog = BaseDialog.Root
 export const DialogTrigger = BaseDialog.Trigger
 export const DialogTitle = BaseDialog.Title
 export const DialogDescription = BaseDialog.Description
-export const DialogPortal = BaseDialog.Portal
 
 type DialogCloseButtonProps = Omit<BaseDialog.Close.Props, 'children'>
 
@@ -22,7 +21,7 @@ export function DialogCloseButton({
       aria-label={ariaLabel}
       {...props}
       className={cn(
-        'absolute top-6 right-6 z-10 flex h-5 w-5 cursor-pointer items-center justify-center rounded-2xl hover:bg-state-base-hover focus-visible:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden disabled:cursor-not-allowed disabled:opacity-50',
+        'absolute top-6 end-6 z-10 flex h-5 w-5 cursor-pointer items-center justify-center rounded-2xl hover:bg-state-base-hover focus-visible:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden disabled:cursor-not-allowed disabled:opacity-50',
         className,
       )}
     >
@@ -45,7 +44,7 @@ export function DialogContent({
   backdropProps,
 }: DialogContentProps) {
   return (
-    <DialogPortal>
+    <BaseDialog.Portal>
       <BaseDialog.Backdrop
         {...backdropProps}
         className={cn(
@@ -63,6 +62,6 @@ export function DialogContent({
       >
         {children}
       </BaseDialog.Popup>
-    </DialogPortal>
+    </BaseDialog.Portal>
   )
 }
diff --git a/packages/dify-ui/src/dropdown-menu/index.tsx b/packages/dify-ui/src/dropdown-menu/index.tsx
index 9f873a88ae1..7cb585dab3d 100644
--- a/packages/dify-ui/src/dropdown-menu/index.tsx
+++ b/packages/dify-ui/src/dropdown-menu/index.tsx
@@ -191,7 +191,7 @@ export function DropdownMenuSubTrigger({
       {...props}
     >
       {children}
-      <span aria-hidden className="ml-auto i-ri-arrow-right-s-line size-4 shrink-0 text-text-tertiary" />
+      <span aria-hidden className="ms-auto i-ri-arrow-right-s-line size-4 shrink-0 text-text-tertiary" />
     </Menu.SubmenuTrigger>
   )
 }
diff --git a/packages/dify-ui/src/file-tree/__tests__/index.spec.tsx b/packages/dify-ui/src/file-tree/__tests__/index.spec.tsx
index 1734189df1f..3475b2f5b1e 100644
--- a/packages/dify-ui/src/file-tree/__tests__/index.spec.tsx
+++ b/packages/dify-ui/src/file-tree/__tests__/index.spec.tsx
@@ -77,7 +77,7 @@ describe('FileTree', () => {
     const screen = await render(<TestFileTree />)
 
     await expect.element(screen.getByLabelText('Project files')).toHaveClass('gap-px', 'p-1')
-    await expect.element(screen.getByRole('button', { name: 'button.tsx' })).toHaveClass('h-6', 'rounded-md', 'pl-2', 'pr-1.5', 'data-[selected]:bg-state-base-active')
+    await expect.element(screen.getByRole('button', { name: 'button.tsx' })).toHaveClass('h-6', 'rounded-md', 'ps-2', 'pe-1.5', 'data-[selected]:bg-state-base-active')
     await expect.element(screen.getByText('button.tsx')).toHaveClass('group-data-[selected]/file-tree-row:system-sm-medium', 'group-data-[selected]/file-tree-row:text-text-primary')
     await expect.element(screen.getByText('README.md')).toHaveAttribute('data-label', 'README.md')
     await expect.element(screen.getByText('README.md')).toHaveClass('after:content-[attr(data-label)]')
diff --git a/packages/dify-ui/src/file-tree/index.tsx b/packages/dify-ui/src/file-tree/index.tsx
index f3e42e7a41f..b085fc5c79b 100644
--- a/packages/dify-ui/src/file-tree/index.tsx
+++ b/packages/dify-ui/src/file-tree/index.tsx
@@ -36,7 +36,7 @@ function fileTreeRowClassName({
   className?: string
 }) {
   return cn(
-    'group/file-tree-row relative flex h-6 w-full min-w-0 cursor-pointer items-center rounded-md pl-2 pr-1.5 text-left outline-hidden select-none',
+    'group/file-tree-row relative flex h-6 w-full min-w-0 cursor-pointer items-center rounded-md ps-2 pe-1.5 text-start outline-hidden select-none',
     'hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-state-accent-solid',
     'data-[selected]:bg-state-base-active',
     'data-disabled:cursor-not-allowed data-disabled:opacity-50 data-disabled:hover:bg-transparent',
@@ -361,7 +361,7 @@ export function FileTreeBadge({
 }: FileTreeBadgeProps) {
   const defaultProps: useRender.ElementProps<'span'> = {
     className: cn(
-      'ml-1 inline-flex min-w-4 shrink-0 items-center justify-center rounded-[5px] border border-divider-deep bg-components-badge-bg-dimm px-1 py-0.5 system-2xs-medium-uppercase text-text-tertiary',
+      'ms-1 inline-flex min-w-4 shrink-0 items-center justify-center rounded-[5px] border border-divider-deep bg-components-badge-bg-dimm px-1 py-0.5 system-2xs-medium-uppercase text-text-tertiary',
       className,
     ),
   }
diff --git a/packages/dify-ui/src/number-field/__tests__/index.spec.tsx b/packages/dify-ui/src/number-field/__tests__/index.spec.tsx
index c05b46eb900..d130be6413a 100644
--- a/packages/dify-ui/src/number-field/__tests__/index.spec.tsx
+++ b/packages/dify-ui/src/number-field/__tests__/index.spec.tsx
@@ -133,8 +133,8 @@ describe('NumberField wrapper', () => {
 
   describe('Unit and controls', () => {
     it.each([
-      ['medium', 'pr-2'],
-      ['large', 'pr-2.5'],
+      ['medium', 'pe-2'],
+      ['large', 'pe-2.5'],
     ] as const)('should apply the %s unit spacing variant', async (size, spacingClass) => {
       const screen = await renderNumberField({
         unitProps: {
diff --git a/packages/dify-ui/src/number-field/index.stories.tsx b/packages/dify-ui/src/number-field/index.stories.tsx
index 3d85b42c096..284148c56ff 100644
--- a/packages/dify-ui/src/number-field/index.stories.tsx
+++ b/packages/dify-ui/src/number-field/index.stories.tsx
@@ -207,11 +207,6 @@ export const States: Story = {
       </FieldRoot>
     </div>
   ),
-  parameters: {
-    a11y: {
-      test: 'todo',
-    },
-  },
 }
 
 function ControlledDemo() {
diff --git a/packages/dify-ui/src/number-field/index.tsx b/packages/dify-ui/src/number-field/index.tsx
index 2ff6fb53c08..f5babeea95e 100644
--- a/packages/dify-ui/src/number-field/index.tsx
+++ b/packages/dify-ui/src/number-field/index.tsx
@@ -100,8 +100,8 @@ export const numberFieldUnitVariants = cva(
   {
     variants: {
       size: {
-        medium: 'pr-2',
-        large: 'pr-2.5',
+        medium: 'pe-2',
+        large: 'pe-2.5',
       },
     },
     defaultVariants: {
diff --git a/packages/dify-ui/src/overlay-shared.ts b/packages/dify-ui/src/overlay-shared.ts
index d6d3a05b9d0..2d90dd372af 100644
--- a/packages/dify-ui/src/overlay-shared.ts
+++ b/packages/dify-ui/src/overlay-shared.ts
@@ -2,7 +2,7 @@ export type OverlayItemVariant = 'default' | 'destructive'
 
 export const overlayRowClassName = 'mx-1 flex h-8 cursor-pointer select-none items-center gap-1 rounded-lg px-2 outline-hidden data-highlighted:bg-state-base-hover data-disabled:cursor-not-allowed data-disabled:opacity-30'
 export const overlayDestructiveClassName = 'data-[variant=destructive]:text-text-destructive data-[variant=destructive]:data-highlighted:bg-state-destructive-hover'
-export const overlayIndicatorClassName = 'ml-auto flex shrink-0 items-center text-text-accent'
+export const overlayIndicatorClassName = 'ms-auto flex shrink-0 items-center text-text-accent'
 export const overlayLabelClassName = 'px-3 pb-0.5 pt-1 text-text-tertiary system-xs-medium-uppercase'
 export const overlaySeparatorClassName = 'my-1 h-px bg-divider-subtle'
 export const overlayPopupBaseClassName = 'max-h-(--available-height) overflow-y-auto overflow-x-hidden rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-bg-blur py-1 text-sm text-text-secondary shadow-lg outline-hidden focus:outline-hidden focus-visible:outline-hidden backdrop-blur-[5px]'
diff --git a/packages/dify-ui/src/pagination/index.stories.tsx b/packages/dify-ui/src/pagination/index.stories.tsx
index 6ffab6bfee9..47beccaf95f 100644
--- a/packages/dify-ui/src/pagination/index.stories.tsx
+++ b/packages/dify-ui/src/pagination/index.stories.tsx
@@ -87,19 +87,11 @@ export const Playground: Story = {
     await userEvent.click(canvas.getByRole('button', { name: '50' }))
     await expect(canvas.getByRole('button', { name: '50' })).toHaveAttribute('aria-pressed', 'true')
   },
-  parameters: {
-    a11y: {
-      test: 'todo',
-    },
-  },
 }
 
 export const DesignSpec: Story = {
   render: () => <DesignSpecDemo />,
   parameters: {
-    a11y: {
-      test: 'todo',
-    },
     docs: {
       description: {
         story: 'Pagination rows with default, hover-like, focused, page-size, and skeleton examples.',
diff --git a/packages/dify-ui/src/pagination/index.tsx b/packages/dify-ui/src/pagination/index.tsx
index 386017828cc..4e5ebf2877c 100644
--- a/packages/dify-ui/src/pagination/index.tsx
+++ b/packages/dify-ui/src/pagination/index.tsx
@@ -355,7 +355,7 @@ export function PaginationPageJump({
     return (
       <span
         data-page-summary={`${pagination.page}/${pagination.totalPages}`}
-        className="inline-grid h-7 system-xs-medium tabular-nums after:invisible after:col-start-1 after:row-start-1 after:py-1.5 after:pr-3 after:pl-2 after:content-[attr(data-page-summary)]"
+        className="inline-grid h-7 system-xs-medium tabular-nums after:invisible after:col-start-1 after:row-start-1 after:py-1.5 after:pe-3 after:ps-2 after:content-[attr(data-page-summary)]"
       >
         <NumberField
           key={pagination.page}
diff --git a/packages/dify-ui/src/scroll-area/__tests__/index.spec.tsx b/packages/dify-ui/src/scroll-area/__tests__/index.spec.tsx
index 73f2f90719f..bed831ba385 100644
--- a/packages/dify-ui/src/scroll-area/__tests__/index.spec.tsx
+++ b/packages/dify-ui/src/scroll-area/__tests__/index.spec.tsx
@@ -120,6 +120,7 @@ describe('scroll-area wrapper', () => {
       await expect.element(screen.getByTestId('scroll-area-vertical-scrollbar')).toHaveAttribute('data-orientation', 'vertical')
       await expect.element(screen.getByTestId('scroll-area-vertical-scrollbar')).toHaveAttribute('data-dify-scrollbar')
       await expect.element(screen.getByTestId('scroll-area-vertical-scrollbar')).toHaveClass(
+        'group/scrollbar',
         'flex',
         'overflow-clip',
         'p-1',
@@ -144,6 +145,9 @@ describe('scroll-area wrapper', () => {
         'transition-[background-color]',
         'motion-reduce:transition-none',
         'data-[orientation=vertical]:w-1',
+        'group-data-hovering/scrollbar:bg-state-base-handle-hover',
+        'data-scrolling:bg-state-base-handle-hover',
+        'active:bg-state-base-handle-hover',
       )
     })
 
@@ -153,6 +157,7 @@ describe('scroll-area wrapper', () => {
       await expect.element(screen.getByTestId('scroll-area-horizontal-scrollbar')).toHaveAttribute('data-orientation', 'horizontal')
       await expect.element(screen.getByTestId('scroll-area-horizontal-scrollbar')).toHaveAttribute('data-dify-scrollbar')
       await expect.element(screen.getByTestId('scroll-area-horizontal-scrollbar')).toHaveClass(
+        'group/scrollbar',
         'flex',
         'overflow-clip',
         'p-1',
@@ -177,6 +182,9 @@ describe('scroll-area wrapper', () => {
         'transition-[background-color]',
         'motion-reduce:transition-none',
         'data-[orientation=horizontal]:h-1',
+        'group-data-hovering/scrollbar:bg-state-base-handle-hover',
+        'data-scrolling:bg-state-base-handle-hover',
+        'active:bg-state-base-handle-hover',
       )
     })
   })
diff --git a/packages/dify-ui/src/scroll-area/index.stories.tsx b/packages/dify-ui/src/scroll-area/index.stories.tsx
index 27f427eb69f..fa32ae048ca 100644
--- a/packages/dify-ui/src/scroll-area/index.stories.tsx
+++ b/packages/dify-ui/src/scroll-area/index.stories.tsx
@@ -366,7 +366,7 @@ export const AppSidebar: Story = {
                     ))}
                   </VerticalContent>
                 </ScrollAreaViewport>
-                <ScrollAreaScrollbar className="data-[orientation=vertical]:my-2 data-[orientation=vertical]:me-1">
+                <ScrollAreaScrollbar>
                   <ScrollAreaThumb />
                 </ScrollAreaScrollbar>
               </ScrollAreaRoot>
diff --git a/packages/dify-ui/src/scroll-area/index.tsx b/packages/dify-ui/src/scroll-area/index.tsx
index 1adea78ee35..fec7daa574d 100644
--- a/packages/dify-ui/src/scroll-area/index.tsx
+++ b/packages/dify-ui/src/scroll-area/index.tsx
@@ -36,7 +36,7 @@ const scrollAreaThumbClassName = cn(
   'data-[orientation=vertical]:w-1',
   'data-[orientation=horizontal]:h-1',
   'group-data-hovering/scrollbar:bg-state-base-handle-hover',
-  'group-data-scrolling/scrollbar:bg-state-base-handle-hover',
+  'data-scrolling:bg-state-base-handle-hover',
   'active:bg-state-base-handle-hover',
 )
 
diff --git a/packages/dify-ui/src/segmented-control/index.stories.tsx b/packages/dify-ui/src/segmented-control/index.stories.tsx
index ead9931898b..f2b6f9cc1f5 100644
--- a/packages/dify-ui/src/segmented-control/index.stories.tsx
+++ b/packages/dify-ui/src/segmented-control/index.stories.tsx
@@ -113,9 +113,6 @@ export const DesignSpec: Story = {
     </div>
   ),
   parameters: {
-    a11y: {
-      test: 'todo',
-    },
     docs: {
       description: {
         story: 'Figma node 2473:9851: segmented control examples with text+icon and icon-only rows, with and without outer padding.',
@@ -171,9 +168,6 @@ export const DataAttributeStates: Story = {
     </div>
   ),
   parameters: {
-    a11y: {
-      test: 'todo',
-    },
     docs: {
       description: {
         story: '`SegmentedControlItem` gets `data-pressed` and `data-disabled` from Base UI Toggle. Accent, neutral, and multiple-selection examples are composed through props and className.',
diff --git a/packages/dify-ui/src/select/index.stories.tsx b/packages/dify-ui/src/select/index.stories.tsx
index 75602572019..f27180bbe08 100644
--- a/packages/dify-ui/src/select/index.stories.tsx
+++ b/packages/dify-ui/src/select/index.stories.tsx
@@ -14,6 +14,9 @@ import {
   SelectTrigger,
   SelectValue,
 } from '.'
+import { Button } from '../button'
+import { FieldDescription, FieldRoot } from '../field'
+import { Form } from '../form'
 
 const triggerWidth = 'w-64'
 
@@ -326,40 +329,33 @@ export const Controlled: Story = {
 
 export const InForm: Story = {
   render: () => (
-    <form
-      onSubmit={(event) => {
-        event.preventDefault()
-      }}
-      className="flex w-72 flex-col gap-3"
-    >
-      <label className="text-xs font-medium text-text-tertiary" htmlFor="timezone">
-        Timezone
-      </label>
-      <Select name="timezone" defaultValue="utc">
-        <SelectTrigger id="timezone" aria-label="Timezone">
-          <SelectValue />
-        </SelectTrigger>
-        <SelectContent>
-          <SelectItem value="utc">
-            <SelectItemText>UTC</SelectItemText>
-            <SelectItemIndicator />
-          </SelectItem>
-          <SelectItem value="pst">
-            <SelectItemText>Pacific (PST)</SelectItemText>
-            <SelectItemIndicator />
-          </SelectItem>
-          <SelectItem value="jst">
-            <SelectItemText>Japan (JST)</SelectItemText>
-            <SelectItemIndicator />
-          </SelectItem>
-        </SelectContent>
-      </Select>
-      <button
-        type="submit"
-        className="h-8 rounded-lg bg-components-button-primary-bg px-3 text-sm text-components-button-primary-text"
-      >
-        Submit
-      </button>
-    </form>
+    <Form aria-label="Timezone form" className="grid w-72 gap-3" onFormSubmit={() => undefined}>
+      <FieldRoot name="timezone">
+        <Select name="timezone" defaultValue="utc">
+          <SelectLabel>Timezone</SelectLabel>
+          <SelectTrigger>
+            <SelectValue />
+          </SelectTrigger>
+          <SelectContent>
+            <SelectItem value="utc">
+              <SelectItemText>UTC</SelectItemText>
+              <SelectItemIndicator />
+            </SelectItem>
+            <SelectItem value="pst">
+              <SelectItemText>Pacific (PST)</SelectItemText>
+              <SelectItemIndicator />
+            </SelectItem>
+            <SelectItem value="jst">
+              <SelectItemText>Japan (JST)</SelectItemText>
+              <SelectItemIndicator />
+            </SelectItem>
+          </SelectContent>
+        </Select>
+        <FieldDescription>Used to schedule workflow runs.</FieldDescription>
+      </FieldRoot>
+      <div className="flex justify-end">
+        <Button type="submit" variant="primary">Save</Button>
+      </div>
+    </Form>
   ),
 }
diff --git a/packages/dify-ui/src/select/index.tsx b/packages/dify-ui/src/select/index.tsx
index 046afccf3b3..6667f06770f 100644
--- a/packages/dify-ui/src/select/index.tsx
+++ b/packages/dify-ui/src/select/index.tsx
@@ -22,7 +22,7 @@ export const SelectGroup = BaseSelect.Group
 
 const selectTriggerVariants = cva(
   [
-    'group flex w-full items-center border-0 bg-components-input-bg-normal text-left text-components-input-text-filled outline-hidden',
+    'group flex w-full items-center border-0 bg-components-input-bg-normal text-start text-components-input-text-filled outline-hidden',
     'hover:bg-state-base-hover-alt focus-visible:bg-state-base-hover-alt data-popup-open:bg-state-base-hover-alt',
     'focus-visible:ring-1 focus-visible:ring-components-input-border-active focus-visible:ring-inset',
     'data-placeholder:text-components-input-text-placeholder',
@@ -195,7 +195,7 @@ export function SelectItemText({
 }: BaseSelect.ItemText.Props) {
   return (
     <BaseSelect.ItemText
-      className={cn('mr-1 min-w-0 grow truncate px-1', className)}
+      className={cn('me-1 min-w-0 grow truncate px-1', className)}
       {...props}
     />
   )
@@ -207,7 +207,7 @@ export function SelectItemIndicator({
 }: Omit<BaseSelect.ItemIndicator.Props, 'children'>) {
   return (
     <BaseSelect.ItemIndicator
-      className={cn('ml-auto flex shrink-0 items-center text-text-accent', className)}
+      className={cn('ms-auto flex shrink-0 items-center text-text-accent', className)}
       {...props}
     >
       <span className="i-ri-check-line h-4 w-4" aria-hidden />
diff --git a/packages/dify-ui/src/tooltip/index.tsx b/packages/dify-ui/src/tooltip/index.tsx
index 36f9fd0f51d..359fb532e83 100644
--- a/packages/dify-ui/src/tooltip/index.tsx
+++ b/packages/dify-ui/src/tooltip/index.tsx
@@ -62,7 +62,7 @@ export function TooltipContent({
       >
         <BaseTooltip.Popup
           className={cn(
-            'max-w-[300px] rounded-md bg-components-panel-bg px-3 py-2 text-left system-xs-regular wrap-break-word text-text-tertiary shadow-lg',
+            'max-w-[300px] rounded-md bg-components-panel-bg px-3 py-2 text-start system-xs-regular wrap-break-word text-text-tertiary shadow-lg',
             'origin-(--transform-origin) transition-opacity data-ending-style:opacity-0 data-instant:transition-none data-starting-style:opacity-0 motion-reduce:transition-none',
             className,
           )}
diff --git a/packages/dify-ui/tsconfig.json b/packages/dify-ui/tsconfig.json
index 11474f08645..55080c646c8 100644
--- a/packages/dify-ui/tsconfig.json
+++ b/packages/dify-ui/tsconfig.json
@@ -1,7 +1,7 @@
 {
   "extends": "@dify/tsconfig/react.json",
   "compilerOptions": {
-    "types": ["vite-plus/test/globals", "@vitest/browser/matchers"]
+    "types": ["vite-plus/test/globals", "vite-plus/test/matchers"]
   },
   "include": ["src/**/*.ts", "src/**/*.tsx", "vite.config.ts"],
   "exclude": ["node_modules", "dist", "storybook-static", "coverage"]
diff --git a/packages/dify-ui/vitest.config.ts b/packages/dify-ui/vitest.config.ts
index dfda908c563..d3ce7d88c02 100644
--- a/packages/dify-ui/vitest.config.ts
+++ b/packages/dify-ui/vitest.config.ts
@@ -19,6 +19,7 @@ export default defineConfig({
       '@base-ui/react/form',
       '@base-ui/react/merge-props',
       '@base-ui/react/use-render',
+      'vite-plus/test/browser',
     ],
   },
   test: {
diff --git a/packages/jotai-tanstack-form/package.json b/packages/jotai-tanstack-form/package.json
new file mode 100644
index 00000000000..5d663d00a48
--- /dev/null
+++ b/packages/jotai-tanstack-form/package.json
@@ -0,0 +1,30 @@
+{
+  "name": "jotai-tanstack-form",
+  "type": "module",
+  "version": "0.0.0-private",
+  "private": true,
+  "exports": {
+    ".": {
+      "types": "./src/index.ts",
+      "import": "./src/index.ts"
+    }
+  },
+  "scripts": {
+    "test": "vp test",
+    "type-check": "tsgo"
+  },
+  "peerDependencies": {
+    "@tanstack/form-core": "catalog:",
+    "jotai": "catalog:"
+  },
+  "devDependencies": {
+    "@dify/tsconfig": "workspace:*",
+    "@tanstack/form-core": "catalog:",
+    "@typescript/native-preview": "catalog:",
+    "jotai": "catalog:",
+    "typescript": "catalog:",
+    "vite": "catalog:",
+    "vite-plus": "catalog:",
+    "vitest": "catalog:"
+  }
+}
diff --git a/packages/jotai-tanstack-form/src/index.spec.ts b/packages/jotai-tanstack-form/src/index.spec.ts
new file mode 100644
index 00000000000..2af107fa324
--- /dev/null
+++ b/packages/jotai-tanstack-form/src/index.spec.ts
@@ -0,0 +1,306 @@
+import { createStore } from 'jotai'
+import { describe, expect, it, vi } from 'vitest'
+import {
+  atomWithForm,
+  createFormAtoms,
+} from './index'
+
+type TestFormValues = {
+  name: string
+  count: number
+}
+
+function createTestFormAtom(onSubmit = vi.fn()) {
+  const defaultValues: TestFormValues = {
+    name: '',
+    count: 0,
+  }
+
+  return atomWithForm({
+    defaultValues,
+    onSubmit: ({ value }) => {
+      onSubmit(value)
+    },
+  })
+}
+
+function createSubmitValidatedFormAtom(onSubmit = vi.fn()) {
+  const defaultValues: TestFormValues = {
+    name: '',
+    count: 0,
+  }
+
+  return atomWithForm({
+    defaultValues,
+    validators: {
+      onSubmit: ({ value }) => {
+        if (value.name.trim())
+          return undefined
+
+        return {
+          fields: {
+            name: 'required',
+          },
+        }
+      },
+    },
+    onSubmit: ({ value }) => {
+      onSubmit(value)
+    },
+  })
+}
+
+function createChangeAndSubmitValidatedFormAtom(onSubmit = vi.fn()) {
+  const defaultValues: TestFormValues = {
+    name: '',
+    count: 0,
+  }
+
+  return atomWithForm({
+    defaultValues,
+    validators: {
+      onChange: ({ value }) => {
+        if (value.name !== 'blocked')
+          return undefined
+
+        return {
+          fields: {
+            name: 'blocked',
+          },
+        }
+      },
+      onSubmit: ({ value }) => {
+        if (value.name.trim())
+          return undefined
+
+        return {
+          fields: {
+            name: 'required',
+          },
+        }
+      },
+    },
+    onSubmit: ({ value }) => {
+      onSubmit(value)
+    },
+  })
+}
+
+describe('jotai-tanstack-form', () => {
+  it('syncs a TanStack form store into Jotai atoms', () => {
+    const formAtom = createTestFormAtom()
+    const formAtoms = createFormAtoms(formAtom)
+    const store = createStore()
+    const unsubscribe = store.sub(formAtoms.stateAtom, () => undefined)
+
+    store.get(formAtom).api.setFieldValue('name', 'Ada')
+
+    expect(store.get(formAtoms.stateAtom).values.name).toBe('Ada')
+
+    unsubscribe()
+  })
+
+  it('creates scoped atoms for values, field updates, and submit', async () => {
+    const onSubmit = vi.fn()
+    const formAtoms = createFormAtoms(createTestFormAtom(onSubmit))
+    const countFieldAtom = formAtoms.fieldAtom('count')
+    const store = createStore()
+
+    const unsubscribe = store.sub(formAtoms.valuesAtom, () => undefined)
+
+    store.set(countFieldAtom, 3)
+    await store.set(formAtoms.validateAtom, 'change')
+    await store.set(formAtoms.submitAtom)
+
+    expect(store.get(countFieldAtom)).toMatchObject({
+      value: 3,
+    })
+    expect(store.get(formAtoms.valuesAtom)).toEqual({
+      name: '',
+      count: 3,
+    })
+    expect(onSubmit).toHaveBeenCalledWith({
+      name: '',
+      count: 3,
+    })
+
+    unsubscribe()
+  })
+
+  it('accepts FormApi options directly', async () => {
+    const onSubmit = vi.fn()
+    const formAtom = createTestFormAtom(onSubmit)
+    const formAtoms = createFormAtoms(formAtom)
+    const countFieldAtom = formAtoms.fieldAtom('count')
+    const store = createStore()
+    const unsubscribe = store.sub(formAtoms.valuesAtom, () => undefined)
+
+    store.set(countFieldAtom, 5)
+    await store.set(formAtoms.submitAtom)
+
+    expect(store.get(formAtoms.valuesAtom)).toEqual({
+      name: '',
+      count: 5,
+    })
+    expect(onSubmit).toHaveBeenCalledWith({
+      name: '',
+      count: 5,
+    })
+
+    unsubscribe()
+  })
+
+  it('clears stale submit errors when a field atom updates the field value', async () => {
+    const onSubmit = vi.fn()
+    const formAtoms = createFormAtoms(createSubmitValidatedFormAtom(onSubmit))
+    const nameFieldAtom = formAtoms.fieldAtom('name')
+    const store = createStore()
+    const unsubscribe = store.sub(formAtoms.stateAtom, () => undefined)
+
+    await store.set(formAtoms.submitAtom)
+
+    expect(store.get(nameFieldAtom).meta?.errors).toEqual(['required'])
+    expect(onSubmit).not.toHaveBeenCalled()
+
+    store.set(nameFieldAtom, 'Ada')
+    await store.set(formAtoms.submitAtom)
+
+    expect(onSubmit).toHaveBeenCalledWith({
+      name: 'Ada',
+      count: 0,
+    })
+
+    unsubscribe()
+  })
+
+  it('keeps stale submit errors when a field atom update has change errors', async () => {
+    const onSubmit = vi.fn()
+    const formAtoms = createFormAtoms(createChangeAndSubmitValidatedFormAtom(onSubmit))
+    const nameFieldAtom = formAtoms.fieldAtom('name')
+    const store = createStore()
+    const unsubscribe = store.sub(formAtoms.stateAtom, () => undefined)
+
+    await store.set(formAtoms.submitAtom)
+    store.set(nameFieldAtom, 'blocked')
+
+    expect(store.get(nameFieldAtom).meta?.errorMap).toMatchObject({
+      onChange: 'blocked',
+      onSubmit: 'required',
+    })
+    expect(onSubmit).not.toHaveBeenCalled()
+
+    unsubscribe()
+  })
+
+  it('clears stale submit errors when a field atom update only has existing blur errors', async () => {
+    const onSubmit = vi.fn()
+    const formAtoms = createFormAtoms(createSubmitValidatedFormAtom(onSubmit))
+    const nameFieldAtom = formAtoms.fieldAtom('name')
+    const store = createStore()
+    const unsubscribe = store.sub(formAtoms.stateAtom, () => undefined)
+
+    await store.set(formAtoms.submitAtom)
+    store.get(formAtoms.formAtom).api.setFieldMeta('name', prev => ({
+      ...prev,
+      errorMap: {
+        ...prev.errorMap,
+        onBlur: 'blurred',
+      },
+      errorSourceMap: {
+        ...prev.errorSourceMap,
+        onBlur: 'field',
+      },
+    }))
+
+    expect(store.get(nameFieldAtom).meta?.errorMap).toMatchObject({
+      onBlur: 'blurred',
+      onSubmit: 'required',
+    })
+
+    store.set(nameFieldAtom, 'ready')
+
+    expect(store.get(nameFieldAtom).meta?.errorMap).toMatchObject({
+      onBlur: 'blurred',
+      onSubmit: undefined,
+    })
+    expect(onSubmit).not.toHaveBeenCalled()
+
+    unsubscribe()
+  })
+
+  it('keeps stale submit errors when dontUpdateMeta keeps a field untouched', async () => {
+    const onSubmit = vi.fn()
+    const formAtoms = createFormAtoms(createSubmitValidatedFormAtom(onSubmit))
+    const nameFieldAtom = formAtoms.fieldAtom('name')
+    const store = createStore()
+    const unsubscribe = store.sub(formAtoms.stateAtom, () => undefined)
+
+    await store.set(formAtoms.submitAtom)
+    store.set(nameFieldAtom, 'Ada', { dontUpdateMeta: true })
+
+    expect(store.get(nameFieldAtom).meta).toMatchObject({
+      isTouched: false,
+      errorMap: {
+        onSubmit: 'required',
+      },
+    })
+    expect(onSubmit).not.toHaveBeenCalled()
+
+    unsubscribe()
+  })
+
+  it('clears stale submit errors with dontUpdateMeta when the field is already touched', async () => {
+    const onSubmit = vi.fn()
+    const formAtoms = createFormAtoms(createSubmitValidatedFormAtom(onSubmit))
+    const nameFieldAtom = formAtoms.fieldAtom('name')
+    const store = createStore()
+    const unsubscribe = store.sub(formAtoms.stateAtom, () => undefined)
+
+    store.set(nameFieldAtom, '')
+    await store.set(formAtoms.submitAtom)
+    store.set(nameFieldAtom, 'Ada', { dontUpdateMeta: true })
+
+    expect(store.get(nameFieldAtom).meta).toMatchObject({
+      isTouched: true,
+      errorMap: {
+        onSubmit: undefined,
+      },
+    })
+
+    unsubscribe()
+  })
+
+  it('creates and mounts form instances from atom lifecycle', () => {
+    const cleanup = vi.fn()
+    const formAtom = createTestFormAtom()
+    const formAtoms = createFormAtoms(formAtom)
+    const firstStore = createStore()
+    const secondStore = createStore()
+    const firstApi = firstStore.get(formAtom).api
+    const secondApi = secondStore.get(formAtom).api
+    const mount = vi.spyOn(firstApi, 'mount').mockReturnValue(cleanup)
+
+    expect(firstStore.get(formAtoms.valuesAtom)).toEqual({
+      name: '',
+      count: 0,
+    })
+    expect(firstStore.get(formAtoms.valuesAtom)).toEqual({
+      name: '',
+      count: 0,
+    })
+    expect(secondStore.get(formAtoms.valuesAtom)).toEqual({
+      name: '',
+      count: 0,
+    })
+    expect(firstApi).not.toBe(secondApi)
+
+    const unsubscribe = firstStore.sub(formAtoms.valuesAtom, () => undefined)
+
+    expect(mount).toHaveBeenCalledTimes(1)
+
+    unsubscribe()
+
+    expect(cleanup).toHaveBeenCalledTimes(1)
+    mount.mockRestore()
+  })
+})
diff --git a/packages/jotai-tanstack-form/src/index.ts b/packages/jotai-tanstack-form/src/index.ts
new file mode 100644
index 00000000000..4d5ea4bf325
--- /dev/null
+++ b/packages/jotai-tanstack-form/src/index.ts
@@ -0,0 +1,215 @@
+import type {
+  AnyFieldLikeMeta,
+  DeepKeys,
+  DeepValue,
+  FormAsyncValidateOrFn,
+  FormValidateOrFn,
+  UpdateMetaOptions,
+  Updater,
+  ValidationCause,
+} from '@tanstack/form-core'
+import type {
+  Atom,
+  WritableAtom,
+} from 'jotai'
+import { FormApi } from '@tanstack/form-core'
+import { atom } from 'jotai'
+import { atomWithLazy } from 'jotai/vanilla/utils'
+
+type FormValidator<TValues> = FormValidateOrFn<TValues> | undefined
+type FormAsyncValidator<TValues> = FormAsyncValidateOrFn<TValues> | undefined
+
+export type TanStackFormApi<
+  TValues,
+  TSubmitMeta = never,
+> = FormApi<
+  TValues,
+  FormValidator<TValues>,
+  FormValidator<TValues>,
+  FormAsyncValidator<TValues>,
+  FormValidator<TValues>,
+  FormAsyncValidator<TValues>,
+  FormValidator<TValues>,
+  FormAsyncValidator<TValues>,
+  FormValidator<TValues>,
+  FormAsyncValidator<TValues>,
+  FormAsyncValidator<TValues>,
+  TSubmitMeta
+>
+
+export type FormState<TValues, TSubmitMeta = never> = TanStackFormApi<TValues, TSubmitMeta>['state']
+
+type FormOptionsInput<TValues, TSubmitMeta = never> = TanStackFormApi<TValues, TSubmitMeta>['options']
+
+export type FormFieldAtomValue<TValue> = {
+  value: TValue
+  meta: AnyFieldLikeMeta | undefined
+}
+
+export type FormFieldUpdate<
+  TValues,
+  TField extends DeepKeys<TValues> = DeepKeys<TValues>,
+> = TField extends DeepKeys<TValues>
+  ? {
+      name: TField
+      value: Updater<DeepValue<TValues, TField>>
+      options?: UpdateMetaOptions
+    }
+  : never
+
+export type FormAtomInstance<TValues, TSubmitMeta = never> = {
+  api: TanStackFormApi<TValues, TSubmitMeta>
+  stateAtom: Atom<FormState<TValues, TSubmitMeta>>
+}
+
+export type FormAtom<TValues, TSubmitMeta = never> = Atom<FormAtomInstance<TValues, TSubmitMeta>>
+
+export type FormAtoms<TValues, TSubmitMeta = never> = {
+  formAtom: FormAtom<TValues, TSubmitMeta>
+  stateAtom: Atom<FormState<TValues, TSubmitMeta>>
+  valuesAtom: Atom<TValues>
+  isSubmittingAtom: Atom<boolean>
+  setFieldAtom: WritableAtom<null, [FormFieldUpdate<TValues>], void>
+  fieldAtom: <TField extends DeepKeys<TValues>>(
+    name: TField,
+  ) => WritableAtom<
+    FormFieldAtomValue<DeepValue<TValues, TField>>,
+    [Updater<DeepValue<TValues, TField>>, UpdateMetaOptions?],
+    void
+  >
+  validateAtom: WritableAtom<null, [ValidationCause], unknown | Promise<unknown>>
+  submitAtom: WritableAtom<null, [], Promise<void>>
+}
+
+function createFormInstance<TValues, TSubmitMeta = never>(
+  api: TanStackFormApi<TValues, TSubmitMeta>,
+): FormAtomInstance<TValues, TSubmitMeta> {
+  const stateAtom = atom(api.state)
+
+  stateAtom.onMount = (setFormState) => {
+    const mountCleanup = api.mount()
+    setFormState(api.state)
+
+    const subscription = api.store.subscribe(() => {
+      setFormState(api.state)
+    })
+
+    return () => {
+      subscription.unsubscribe()
+      mountCleanup()
+    }
+  }
+
+  return {
+    api,
+    stateAtom,
+  }
+}
+
+function setFormFieldValue<
+  TValues,
+  TSubmitMeta,
+  TField extends DeepKeys<TValues>,
+>(
+  form: FormAtomInstance<TValues, TSubmitMeta>,
+  name: TField,
+  value: Updater<DeepValue<TValues, TField>>,
+  options?: UpdateMetaOptions,
+) {
+  const shouldValidate = !options?.dontValidate
+    && !(options?.dontUpdateMeta && !form.api.getFieldMeta(name)?.isTouched)
+
+  form.api.setFieldValue(name, value, shouldValidate ? options : { ...(options ?? {}), dontValidate: true })
+
+  if (!shouldValidate)
+    return
+
+  const fieldMeta = form.api.getFieldMeta(name)
+  if (!fieldMeta?.errorMap.onSubmit)
+    return
+
+  if (fieldMeta.errorMap.onChange || fieldMeta.errorMap.onDynamic)
+    return
+
+  form.api.setFieldMeta(name, prev => ({
+    ...prev,
+    errorMap: {
+      ...prev.errorMap,
+      onSubmit: undefined,
+    },
+    errorSourceMap: {
+      ...prev.errorSourceMap,
+      onSubmit: undefined,
+    },
+  }))
+}
+
+export function atomWithForm<TValues, TSubmitMeta = never>(
+  options: FormOptionsInput<TValues, TSubmitMeta>,
+): FormAtom<TValues, TSubmitMeta> {
+  return atomWithLazy(() => createFormInstance(new FormApi(options)))
+}
+
+export function createFormAtoms<TValues, TSubmitMeta = never>(
+  formAtom: FormAtom<TValues, TSubmitMeta>,
+): FormAtoms<TValues, TSubmitMeta> {
+  const stateAtom = atom((get) => {
+    const form = get(formAtom)
+    return get(form.stateAtom)
+  })
+
+  const valuesAtom = atom((get) => {
+    return get(stateAtom).values
+  })
+
+  const isSubmittingAtom = atom((get) => {
+    return get(stateAtom).isSubmitting
+  })
+
+  const setFieldAtom = atom<null, [FormFieldUpdate<TValues>], void>(null, (get, _set, update) => {
+    setFormFieldValue(get(formAtom), update.name, update.value, update.options)
+  })
+
+  function fieldAtom<TField extends DeepKeys<TValues>>(
+    name: TField,
+  ): WritableAtom<
+    FormFieldAtomValue<DeepValue<TValues, TField>>,
+    [Updater<DeepValue<TValues, TField>>, UpdateMetaOptions?],
+    void
+  > {
+    return atom(
+      (get) => {
+        const form = get(formAtom)
+        const state = get(form.stateAtom)
+        const api = form.api
+
+        return {
+          value: api.getFieldValue(name),
+          meta: state.fieldMeta[name],
+        }
+      },
+      (get, _set, value, options) => {
+        setFormFieldValue(get(formAtom), name, value, options)
+      },
+    )
+  }
+
+  const validateAtom = atom<null, [ValidationCause], unknown | Promise<unknown>>(null, (get, _set, cause) => {
+    return get(formAtom).api.validate(cause)
+  })
+
+  const submitAtom = atom<null, [], Promise<void>>(null, (get) => {
+    return get(formAtom).api.handleSubmit()
+  })
+
+  return {
+    formAtom,
+    stateAtom,
+    valuesAtom,
+    isSubmittingAtom,
+    setFieldAtom,
+    fieldAtom,
+    validateAtom,
+    submitAtom,
+  }
+}
diff --git a/packages/jotai-tanstack-form/tsconfig.json b/packages/jotai-tanstack-form/tsconfig.json
new file mode 100644
index 00000000000..f00b52991ea
--- /dev/null
+++ b/packages/jotai-tanstack-form/tsconfig.json
@@ -0,0 +1,8 @@
+{
+  "extends": "@dify/tsconfig/base.json",
+  "compilerOptions": {
+    "types": ["vite-plus/test/globals", "vite-plus/test/matchers"]
+  },
+  "include": ["src/**/*.ts", "vite.config.ts"],
+  "exclude": ["node_modules", "dist"]
+}
diff --git a/packages/jotai-tanstack-form/vite.config.ts b/packages/jotai-tanstack-form/vite.config.ts
new file mode 100644
index 00000000000..c329426d536
--- /dev/null
+++ b/packages/jotai-tanstack-form/vite.config.ts
@@ -0,0 +1,7 @@
+import { defineConfig } from 'vite-plus'
+
+export default defineConfig({
+  test: {
+    environment: 'node',
+  },
+})
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 3932cb6d87a..72aab2bf8b0 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -16,8 +16,8 @@ catalogs:
       specifier: 9.0.0
       version: 9.0.0
     '@base-ui/react':
-      specifier: 1.5.0
-      version: 1.5.0
+      specifier: 1.6.0
+      version: 1.6.0
     '@chromatic-com/storybook':
       specifier: 5.2.1
       version: 5.2.1
@@ -49,8 +49,8 @@ catalogs:
       specifier: 0.98.2
       version: 0.98.2
     '@hono/node-server':
-      specifier: 2.0.4
-      version: 2.0.4
+      specifier: 2.0.5
+      version: 2.0.5
     '@iconify-json/heroicons':
       specifier: 1.2.3
       version: 1.2.3
@@ -109,8 +109,8 @@ catalogs:
       specifier: 1.14.6
       version: 1.14.6
     '@playwright/test':
-      specifier: 1.60.0
-      version: 1.60.0
+      specifier: 1.61.0
+      version: 1.61.0
     '@remixicon/react':
       specifier: 4.9.0
       version: 4.9.0
@@ -118,35 +118,35 @@ catalogs:
       specifier: 4.2.0
       version: 4.2.0
     '@sentry/react':
-      specifier: 10.57.0
-      version: 10.57.0
+      specifier: 10.59.0
+      version: 10.59.0
     '@storybook/addon-a11y':
-      specifier: 10.4.4
-      version: 10.4.4
+      specifier: 10.4.6
+      version: 10.4.6
     '@storybook/addon-docs':
-      specifier: 10.4.4
-      version: 10.4.4
+      specifier: 10.4.6
+      version: 10.4.6
     '@storybook/addon-links':
-      specifier: 10.4.4
-      version: 10.4.4
+      specifier: 10.4.6
+      version: 10.4.6
     '@storybook/addon-onboarding':
-      specifier: 10.4.4
-      version: 10.4.4
+      specifier: 10.4.6
+      version: 10.4.6
     '@storybook/addon-themes':
-      specifier: 10.4.4
-      version: 10.4.4
+      specifier: 10.4.6
+      version: 10.4.6
     '@storybook/addon-vitest':
-      specifier: 10.4.4
-      version: 10.4.4
+      specifier: 10.4.6
+      version: 10.4.6
     '@storybook/nextjs-vite':
-      specifier: 10.4.4
-      version: 10.4.4
+      specifier: 10.4.6
+      version: 10.4.6
     '@storybook/react':
-      specifier: 10.4.4
-      version: 10.4.4
+      specifier: 10.4.6
+      version: 10.4.6
     '@storybook/react-vite':
-      specifier: 10.4.4
-      version: 10.4.4
+      specifier: 10.4.6
+      version: 10.4.6
     '@streamdown/math':
       specifier: 1.0.2
       version: 1.0.2
@@ -168,6 +168,9 @@ catalogs:
     '@tanstack/eslint-plugin-query':
       specifier: 5.101.0
       version: 5.101.0
+    '@tanstack/form-core':
+      specifier: 1.33.0
+      version: 1.33.0
     '@tanstack/query-core':
       specifier: 5.101.0
       version: 5.101.0
@@ -181,8 +184,8 @@ catalogs:
       specifier: 5.101.0
       version: 5.101.0
     '@tanstack/react-virtual':
-      specifier: 3.14.2
-      version: 3.14.2
+      specifier: 3.14.3
+      version: 3.14.3
     '@testing-library/dom':
       specifier: 10.4.1
       version: 10.4.1
@@ -196,14 +199,14 @@ catalogs:
       specifier: 14.6.1
       version: 14.6.1
     '@tsslint/cli':
-      specifier: 3.1.3
-      version: 3.1.3
+      specifier: 3.1.4
+      version: 3.1.4
     '@tsslint/compat-eslint':
-      specifier: 3.1.3
-      version: 3.1.3
+      specifier: 3.1.4
+      version: 3.1.4
     '@tsslint/config':
-      specifier: 3.1.3
-      version: 3.1.3
+      specifier: 3.1.4
+      version: 3.1.4
     '@types/js-cookie':
       specifier: 3.0.6
       version: 3.0.6
@@ -217,8 +220,8 @@ catalogs:
       specifier: 0.6.4
       version: 0.6.4
     '@types/node':
-      specifier: 25.9.3
-      version: 25.9.3
+      specifier: 25.9.4
+      version: 25.9.4
     '@types/qs':
       specifier: 6.15.1
       version: 6.15.1
@@ -232,14 +235,14 @@ catalogs:
       specifier: 1.15.9
       version: 1.15.9
     '@typescript-eslint/eslint-plugin':
-      specifier: 8.61.0
-      version: 8.61.0
+      specifier: 8.61.1
+      version: 8.61.1
     '@typescript-eslint/parser':
-      specifier: 8.61.0
-      version: 8.61.0
+      specifier: 8.61.1
+      version: 8.61.1
     '@typescript/native-preview':
-      specifier: 7.0.0-dev.20260613.1
-      version: 7.0.0-dev.20260613.1
+      specifier: 7.0.0-dev.20260620.1
+      version: 7.0.0-dev.20260620.1
     '@vitejs/plugin-react':
       specifier: 6.0.2
       version: 6.0.2
@@ -247,11 +250,14 @@ catalogs:
       specifier: 0.5.27
       version: 0.5.27
     '@vitest/browser':
-      specifier: 4.1.8
-      version: 4.1.8
+      specifier: 4.1.9
+      version: 4.1.9
+    '@vitest/browser-playwright':
+      specifier: 4.1.9
+      version: 4.1.9
     '@vitest/coverage-v8':
-      specifier: 4.1.8
-      version: 4.1.8
+      specifier: 4.1.9
+      version: 4.1.9
     abcjs:
       specifier: 6.6.3
       version: 6.6.3
@@ -280,8 +286,8 @@ catalogs:
       specifier: 1.1.1
       version: 1.1.1
     code-inspector-plugin:
-      specifier: 1.6.0
-      version: 1.6.0
+      specifier: 1.6.1
+      version: 1.6.1
     concurrently:
       specifier: ^10.0.3
       version: 10.0.3
@@ -289,8 +295,8 @@ catalogs:
       specifier: 4.0.2
       version: 4.0.2
     cron-parser:
-      specifier: 5.5.0
-      version: 5.5.0
+      specifier: 5.6.0
+      version: 5.6.0
     dayjs:
       specifier: 1.11.21
       version: 1.11.21
@@ -298,8 +304,8 @@ catalogs:
       specifier: 10.6.0
       version: 10.6.0
     dompurify:
-      specifier: 3.4.10
-      version: 3.4.10
+      specifier: 3.4.11
+      version: 3.4.11
     echarts:
       specifier: 6.1.0
       version: 6.1.0
@@ -349,11 +355,11 @@ catalogs:
       specifier: 0.5.3
       version: 0.5.3
     eslint-plugin-sonarjs:
-      specifier: 4.0.3
-      version: 4.0.3
+      specifier: 4.1.0
+      version: 4.1.0
     eslint-plugin-storybook:
-      specifier: 10.4.4
-      version: 10.4.4
+      specifier: 10.4.6
+      version: 10.4.6
     eventsource-parser:
       specifier: 3.1.0
       version: 3.1.0
@@ -361,20 +367,20 @@ catalogs:
       specifier: 3.1.3
       version: 3.1.3
     foxact:
-      specifier: 0.3.5
-      version: 0.3.5
+      specifier: 0.3.7
+      version: 0.3.7
     fuse.js:
       specifier: 7.4.2
       version: 7.4.2
     happy-dom:
-      specifier: 20.10.3
-      version: 20.10.3
+      specifier: 20.10.6
+      version: 20.10.6
     hast-util-to-jsx-runtime:
       specifier: 2.3.6
       version: 2.3.6
     hono:
-      specifier: 4.12.25
-      version: 4.12.25
+      specifier: 4.12.26
+      version: 4.12.26
     html-entities:
       specifier: 2.6.0
       version: 2.6.0
@@ -418,8 +424,8 @@ catalogs:
       specifier: 0.17.0
       version: 0.17.0
     knip:
-      specifier: 6.16.1
-      version: 6.16.1
+      specifier: 6.17.1
+      version: 6.17.1
     ky:
       specifier: 2.0.2
       version: 2.0.2
@@ -433,8 +439,8 @@ catalogs:
       specifier: 1.0.4
       version: 1.0.4
     loro-crdt:
-      specifier: 1.13.2
-      version: 1.13.2
+      specifier: 1.13.5
+      version: 1.13.5
     mermaid:
       specifier: 11.15.0
       version: 11.15.0
@@ -472,8 +478,8 @@ catalogs:
       specifier: 3.28.1
       version: 3.28.1
     playwright:
-      specifier: 1.60.0
-      version: 1.60.0
+      specifier: 1.61.0
+      version: 1.61.0
     postcss:
       specifier: 8.5.15
       version: 8.5.15
@@ -529,8 +535,8 @@ catalogs:
       specifier: 0.0.1
       version: 0.0.1
     sharp:
-      specifier: 0.35.1
-      version: 0.35.1
+      specifier: 0.35.2
+      version: 0.35.2
     shiki:
       specifier: 4.2.0
       version: 4.2.0
@@ -544,8 +550,8 @@ catalogs:
       specifier: 1.0.8
       version: 1.0.8
     storybook:
-      specifier: 10.4.4
-      version: 10.4.4
+      specifier: 10.4.6
+      version: 10.4.6
     streamdown:
       specifier: 2.5.0
       version: 2.5.0
@@ -559,8 +565,8 @@ catalogs:
       specifier: 4.3.1
       version: 4.3.1
     tldts:
-      specifier: 7.4.2
-      version: 7.4.2
+      specifier: 7.4.3
+      version: 7.4.3
     tsx:
       specifier: 4.22.4
       version: 4.22.4
@@ -571,8 +577,8 @@ catalogs:
       specifier: 3.19.3
       version: 3.19.3
     undici:
-      specifier: 7.27.2
-      version: 7.27.2
+      specifier: 7.28.0
+      version: 7.28.0
     unist-util-visit:
       specifier: 5.1.0
       version: 5.1.0
@@ -580,17 +586,17 @@ catalogs:
       specifier: 2.0.0
       version: 2.0.0
     uuid:
-      specifier: 14.0.0
-      version: 14.0.0
+      specifier: 14.0.1
+      version: 14.0.1
     vinext:
-      specifier: 0.1.2
-      version: 0.1.2
+      specifier: 0.1.6
+      version: 0.1.6
     vite-plugin-inspect:
       specifier: 12.0.0-beta.3
       version: 12.0.0-beta.3
     vite-plus:
-      specifier: 0.1.24
-      version: 0.1.24
+      specifier: 0.2.1
+      version: 0.2.1
     vitest-browser-react:
       specifier: 2.2.0
       version: 2.2.0
@@ -608,29 +614,29 @@ catalogs:
       version: 5.0.14
 
 overrides:
+  '@babel/core@<=7.29.0': ^7.29.1
   '@lexical/code': npm:lexical-code-no-prism@0.41.0
   canvas: ^3.2.3
   esbuild@<0.27.2: 0.27.2
   esbuild@>=0.17.0 <0.28.1: ^0.28.1
   esbuild@>=0.27.3 <0.28.1: ^0.28.1
   is-core-module: npm:@nolyfill/is-core-module@^1.0.39
+  js-yaml@<=4.1.1: ^4.1.2
   picomatch@>=4.0.0 <4.0.4: 4.0.4
-  postcss@<8.5.10: ^8.5.10
   postcss-selector-parser@>=6.0.0 <6.1.3: 6.1.4
   postcss-selector-parser@>=7.0.0 <7.1.3: 7.1.4
-  rollup@>=4.0.0 <4.59.0: 4.61.1
+  postcss@<8.5.10: ^8.5.10
+  rollup@>=4.0.0 <4.59.0: 4.62.2
   safer-buffer: npm:@nolyfill/safer-buffer@^1.0.44
   side-channel: npm:@nolyfill/side-channel@^1.0.44
   solid-js: 1.9.13
   string-width: ~8.2.1
-  vite: npm:@voidzero-dev/vite-plus-core@0.1.24
-  vitest: npm:@voidzero-dev/vite-plus-test@0.1.24
+  tar@<=7.5.15: ^7.5.16
+  vite: npm:@voidzero-dev/vite-plus-core@0.2.1
+  vitest: 4.1.9
   ws@>=8.0.0 <8.20.1: ^8.21.0
   yaml@>=2.0.0 <2.8.3: 2.9.0
   yauzl@<3.2.1: 3.2.1
-  '@babel/core@<=7.29.0': ^7.29.1
-  js-yaml@<=4.1.1: ^4.1.2
-  tar@<=7.5.15: ^7.5.16
 
 importers:
 
@@ -638,7 +644,7 @@ importers:
     devDependencies:
       '@antfu/eslint-config':
         specifier: 'catalog:'
-        version: 9.0.0(b376e15be293d4e014f0f69f32d1fb4a)
+        version: 9.0.0(@eslint-react/eslint-plugin@5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3))(@next/eslint-plugin-next@16.2.9)(@typescript-eslint/typescript-estree@8.61.1(typescript@6.0.3))(@typescript-eslint/utils@8.61.1(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3))(eslint-plugin-jsx-a11y@6.10.2(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2)))(eslint-plugin-react-refresh@0.5.3(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2)))(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(oxlint@1.70.0(oxlint-tsgolint@0.23.0)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(supports-color@10.2.2)(typescript@6.0.3)(vitest@4.1.9)
       concurrently:
         specifier: 'catalog:'
         version: 10.0.3
@@ -658,11 +664,11 @@ importers:
         specifier: runtime:^22.22.1
         version: runtime:22.22.3
       vite:
-        specifier: npm:@voidzero-dev/vite-plus-core@0.1.24
-        version: '@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+        specifier: npm:@voidzero-dev/vite-plus-core@0.2.1
+        version: '@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
       vite-plus:
         specifier: 'catalog:'
-        version: 0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8(@vitest/browser@4.1.8(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))))(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
+        version: 0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
 
   cli:
     dependencies:
@@ -707,7 +713,7 @@ importers:
         version: 1.0.8
       undici:
         specifier: 'catalog:'
-        version: 7.27.2
+        version: 7.28.0
       zod:
         specifier: 'catalog:'
         version: 4.4.3
@@ -717,7 +723,7 @@ importers:
         version: link:../packages/tsconfig
       '@hono/node-server':
         specifier: 'catalog:'
-        version: 2.0.4(hono@4.12.25)
+        version: 2.0.5(hono@4.12.26)
       '@types/js-yaml':
         specifier: 'catalog:'
         version: 4.0.9
@@ -726,31 +732,31 @@ importers:
         version: 1.0.4
       '@types/node':
         specifier: 'catalog:'
-        version: 25.9.3
+        version: 25.9.4
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260613.1
+        version: 7.0.0-dev.20260620.1
       '@vitest/coverage-v8':
         specifier: 'catalog:'
-        version: 4.1.8(@vitest/browser@4.1.8)(@voidzero-dev/vite-plus-test@0.1.24)
+        version: 4.1.9(@vitest/browser@4.1.9)(vitest@4.1.9)
       eslint:
         specifier: 'catalog:'
         version: 10.5.0(jiti@2.7.0)
       hono:
         specifier: 'catalog:'
-        version: 4.12.25
+        version: 4.12.26
       typescript:
         specifier: 'catalog:'
         version: 6.0.3
       vite:
-        specifier: npm:@voidzero-dev/vite-plus-core@0.1.24
-        version: '@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+        specifier: npm:@voidzero-dev/vite-plus-core@0.2.1
+        version: '@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
       vite-plus:
         specifier: 'catalog:'
-        version: 0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
+        version: 0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
       vitest:
-        specifier: npm:@voidzero-dev/vite-plus-test@0.1.24
-        version: '@voidzero-dev/vite-plus-test@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+        specifier: 4.1.9
+        version: 4.1.9(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/browser-preview@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(happy-dom@20.10.6)
 
   e2e:
     devDependencies:
@@ -762,13 +768,13 @@ importers:
         version: link:../packages/tsconfig
       '@playwright/test':
         specifier: 'catalog:'
-        version: 1.60.0
+        version: 1.61.0
       '@types/node':
         specifier: 'catalog:'
-        version: 25.9.3
+        version: 25.9.4
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260613.1
+        version: 7.0.0-dev.20260620.1
       tsx:
         specifier: 'catalog:'
         version: 4.22.4
@@ -776,11 +782,11 @@ importers:
         specifier: 'catalog:'
         version: 6.0.3
       vite:
-        specifier: npm:@voidzero-dev/vite-plus-core@0.1.24
-        version: '@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+        specifier: npm:@voidzero-dev/vite-plus-core@0.2.1
+        version: '@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
       vite-plus:
         specifier: 'catalog:'
-        version: 0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8(@vitest/browser@4.1.8(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))))(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
+        version: 0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
 
   packages/contracts:
     dependencies:
@@ -802,10 +808,10 @@ importers:
         version: 4.0.9
       '@types/node':
         specifier: 'catalog:'
-        version: 25.9.3
+        version: 25.9.4
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260613.1
+        version: 7.0.0-dev.20260620.1
       eslint:
         specifier: 'catalog:'
         version: 10.5.0(jiti@2.7.0)
@@ -817,13 +823,13 @@ importers:
         version: 6.0.3
       vite-plus:
         specifier: 'catalog:'
-        version: 0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8(@vitest/browser@4.1.8(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))))(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
+        version: 0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
 
   packages/dev-proxy:
     dependencies:
       '@hono/node-server':
         specifier: 'catalog:'
-        version: 2.0.4(hono@4.12.25)
+        version: 2.0.5(hono@4.12.26)
       c12:
         specifier: 'catalog:'
         version: 4.0.0-beta.5(chokidar@5.0.0)(dotenv@17.4.2)(giget@3.2.0)(jiti@2.7.0)(magicast@0.5.2)
@@ -832,26 +838,26 @@ importers:
         version: 5.0.0
       hono:
         specifier: 'catalog:'
-        version: 4.12.25
+        version: 4.12.26
     devDependencies:
       '@dify/tsconfig':
         specifier: workspace:*
         version: link:../tsconfig
       '@types/node':
         specifier: 'catalog:'
-        version: 25.9.3
+        version: 25.9.4
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260613.1
+        version: 7.0.0-dev.20260620.1
       vite:
-        specifier: npm:@voidzero-dev/vite-plus-core@0.1.24
-        version: '@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+        specifier: npm:@voidzero-dev/vite-plus-core@0.2.1
+        version: '@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
       vite-plus:
         specifier: 'catalog:'
-        version: 0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
+        version: 0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
       vitest:
-        specifier: npm:@voidzero-dev/vite-plus-test@0.1.24
-        version: '@voidzero-dev/vite-plus-test@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+        specifier: 4.1.9
+        version: 4.1.9(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/browser-preview@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(happy-dom@20.10.6)
 
   packages/dify-ui:
     dependencies:
@@ -864,10 +870,10 @@ importers:
     devDependencies:
       '@base-ui/react':
         specifier: 'catalog:'
-        version: 1.5.0(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 1.6.0(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@chromatic-com/storybook':
         specifier: 'catalog:'
-        version: 5.2.1(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
+        version: 5.2.1(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
       '@dify/tsconfig':
         specifier: workspace:*
         version: link:../tsconfig
@@ -879,31 +885,31 @@ importers:
         version: 1.2.10
       '@storybook/addon-a11y':
         specifier: 'catalog:'
-        version: 10.4.4(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
+        version: 10.4.6(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
       '@storybook/addon-docs':
         specifier: 'catalog:'
-        version: 10.4.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
+        version: 10.4.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
       '@storybook/addon-links':
         specifier: 'catalog:'
-        version: 10.4.4(@types/react@19.2.17)(react@19.2.7)(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
+        version: 10.4.6(@types/react@19.2.17)(react@19.2.7)(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
       '@storybook/addon-themes':
         specifier: 'catalog:'
-        version: 10.4.4(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
+        version: 10.4.6(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
       '@storybook/addon-vitest':
         specifier: 'catalog:'
-        version: 10.4.4(@vitest/browser@4.1.8)(@voidzero-dev/vite-plus-test@0.1.24)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
+        version: 10.4.6(@vitest/browser-playwright@4.1.9)(@vitest/browser@4.1.9)(@vitest/runner@4.1.9)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(vitest@4.1.9)
       '@storybook/react-vite':
         specifier: 'catalog:'
-        version: 10.4.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(typescript@6.0.3)
+        version: 10.4.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(typescript@6.0.3)
       '@tailwindcss/vite':
         specifier: 'catalog:'
-        version: 4.3.1(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
+        version: 4.3.1(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
       '@tanstack/react-hotkeys':
         specifier: 'catalog:'
         version: 0.10.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@tanstack/react-virtual':
         specifier: 'catalog:'
-        version: 3.14.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 3.14.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@types/react':
         specifier: 'catalog:'
         version: 19.2.17
@@ -912,22 +918,25 @@ importers:
         version: 19.2.3(@types/react@19.2.17)
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260613.1
+        version: 7.0.0-dev.20260620.1
       '@vitejs/plugin-react':
         specifier: 'catalog:'
-        version: 6.0.2(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
+        version: 6.0.2(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
       '@vitest/browser':
         specifier: 'catalog:'
-        version: 4.1.8(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(@voidzero-dev/vite-plus-test@0.1.24)
+        version: 4.1.9(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(vitest@4.1.9)
+      '@vitest/browser-playwright':
+        specifier: 'catalog:'
+        version: 4.1.9(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(playwright@1.61.0)(vitest@4.1.9)
       '@vitest/coverage-v8':
         specifier: 'catalog:'
-        version: 4.1.8(@vitest/browser@4.1.8)(@voidzero-dev/vite-plus-test@0.1.24)
+        version: 4.1.9(@vitest/browser@4.1.9)(vitest@4.1.9)
       class-variance-authority:
         specifier: 'catalog:'
         version: 0.7.1
       playwright:
         specifier: 'catalog:'
-        version: 1.60.0
+        version: 1.61.0
       react:
         specifier: 'catalog:'
         version: 19.2.7
@@ -936,7 +945,7 @@ importers:
         version: 19.2.7(react@19.2.7)
       storybook:
         specifier: 'catalog:'
-        version: 10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
+        version: 10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
       tailwindcss:
         specifier: 'catalog:'
         version: 4.3.1
@@ -944,17 +953,17 @@ importers:
         specifier: 'catalog:'
         version: 6.0.3
       vite:
-        specifier: npm:@voidzero-dev/vite-plus-core@0.1.24
-        version: '@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+        specifier: npm:@voidzero-dev/vite-plus-core@0.2.1
+        version: '@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
       vite-plus:
         specifier: 'catalog:'
-        version: 0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
+        version: 0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
       vitest:
-        specifier: npm:@voidzero-dev/vite-plus-test@0.1.24
-        version: '@voidzero-dev/vite-plus-test@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+        specifier: 4.1.9
+        version: 4.1.9(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/browser-preview@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(happy-dom@20.10.6)
       vitest-browser-react:
         specifier: 'catalog:'
-        version: 2.2.0(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(@voidzero-dev/vite-plus-test@0.1.24)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 2.2.0(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vitest@4.1.9)
 
   packages/iconify-collections:
     devDependencies:
@@ -965,11 +974,38 @@ importers:
         specifier: 'catalog:'
         version: 4.22.4
 
+  packages/jotai-tanstack-form:
+    devDependencies:
+      '@dify/tsconfig':
+        specifier: workspace:*
+        version: link:../tsconfig
+      '@tanstack/form-core':
+        specifier: 'catalog:'
+        version: 1.33.0
+      '@typescript/native-preview':
+        specifier: 'catalog:'
+        version: 7.0.0-dev.20260620.1
+      jotai:
+        specifier: 'catalog:'
+        version: 2.20.1(@babel/core@7.29.7)(@babel/template@7.29.7)(@types/react@19.2.17)(react@19.2.7)
+      typescript:
+        specifier: 'catalog:'
+        version: 6.0.3
+      vite:
+        specifier: npm:@voidzero-dev/vite-plus-core@0.2.1
+        version: '@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+      vite-plus:
+        specifier: 'catalog:'
+        version: 0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
+      vitest:
+        specifier: 4.1.9
+        version: 4.1.9(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/browser-preview@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(happy-dom@20.10.6)
+
   packages/migrate-no-unchecked-indexed-access:
     dependencies:
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260613.1
+        version: 7.0.0-dev.20260620.1
       typescript:
         specifier: 'catalog:'
         version: 6.0.3
@@ -979,13 +1015,13 @@ importers:
         version: link:../tsconfig
       '@types/node':
         specifier: 'catalog:'
-        version: 25.9.3
+        version: 25.9.4
       vite:
-        specifier: npm:@voidzero-dev/vite-plus-core@0.1.24
-        version: '@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+        specifier: npm:@voidzero-dev/vite-plus-core@0.2.1
+        version: '@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
       vite-plus:
         specifier: 'catalog:'
-        version: 0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8(@vitest/browser@4.1.8(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))))(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
+        version: 0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
 
   packages/tsconfig: {}
 
@@ -999,19 +1035,19 @@ importers:
         version: 10.0.1(eslint@10.5.0(jiti@2.7.0))
       '@types/node':
         specifier: 'catalog:'
-        version: 25.9.3
+        version: 25.9.4
       '@typescript-eslint/eslint-plugin':
         specifier: 'catalog:'
-        version: 8.61.0(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0))(supports-color@10.2.2)(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0))(supports-color@10.2.2)(typescript@6.0.3)
+        version: 8.61.1(@typescript-eslint/parser@8.61.1(eslint@10.5.0(jiti@2.7.0))(supports-color@10.2.2)(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0))(supports-color@10.2.2)(typescript@6.0.3)
       '@typescript-eslint/parser':
         specifier: 'catalog:'
-        version: 8.61.0(eslint@10.5.0(jiti@2.7.0))(supports-color@10.2.2)(typescript@6.0.3)
+        version: 8.61.1(eslint@10.5.0(jiti@2.7.0))(supports-color@10.2.2)(typescript@6.0.3)
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260613.1
+        version: 7.0.0-dev.20260620.1
       '@vitest/coverage-v8':
         specifier: 'catalog:'
-        version: 4.1.8(@vitest/browser@4.1.8)(@voidzero-dev/vite-plus-test@0.1.24)
+        version: 4.1.9(@vitest/browser@4.1.9)(vitest@4.1.9)
       eslint:
         specifier: 'catalog:'
         version: 10.5.0(jiti@2.7.0)
@@ -1019,14 +1055,14 @@ importers:
         specifier: 'catalog:'
         version: 6.0.3
       vite:
-        specifier: npm:@voidzero-dev/vite-plus-core@0.1.24
-        version: '@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+        specifier: npm:@voidzero-dev/vite-plus-core@0.2.1
+        version: '@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
       vite-plus:
         specifier: 'catalog:'
-        version: 0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
+        version: 0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
       vitest:
-        specifier: npm:@voidzero-dev/vite-plus-test@0.1.24
-        version: '@voidzero-dev/vite-plus-test@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+        specifier: 4.1.9
+        version: 4.1.9(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/browser-preview@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(happy-dom@20.10.6)
 
   web:
     dependencies:
@@ -1038,7 +1074,7 @@ importers:
         version: 1.32.1(@amplitude/rrweb@2.0.0-alpha.40)
       '@base-ui/react':
         specifier: 'catalog:'
-        version: 1.5.0(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 1.6.0(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@emoji-mart/data':
         specifier: 'catalog:'
         version: 1.2.1
@@ -1092,7 +1128,7 @@ importers:
         version: 4.9.0(react@19.2.7)
       '@sentry/react':
         specifier: 'catalog:'
-        version: 10.57.0(react@19.2.7)
+        version: 10.59.0(react@19.2.7)
       '@streamdown/math':
         specifier: 'catalog:'
         version: 1.0.2(react@19.2.7)
@@ -1105,6 +1141,9 @@ importers:
       '@tailwindcss/typography':
         specifier: 'catalog:'
         version: 0.5.20(tailwindcss@4.3.1)
+      '@tanstack/form-core':
+        specifier: 'catalog:'
+        version: 1.33.0
       '@tanstack/query-core':
         specifier: 'catalog:'
         version: 5.101.0
@@ -1119,7 +1158,7 @@ importers:
         version: 5.101.0(react@19.2.7)
       '@tanstack/react-virtual':
         specifier: 'catalog:'
-        version: 3.14.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 3.14.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       abcjs:
         specifier: 'catalog:'
         version: 6.6.3
@@ -1137,7 +1176,7 @@ importers:
         version: 4.0.2
       cron-parser:
         specifier: 'catalog:'
-        version: 5.5.0
+        version: 5.6.0
       dayjs:
         specifier: 'catalog:'
         version: 1.11.21
@@ -1146,7 +1185,7 @@ importers:
         version: 10.6.0
       dompurify:
         specifier: 'catalog:'
-        version: 3.4.10
+        version: 3.4.11
       echarts:
         specifier: 'catalog:'
         version: 6.1.0
@@ -1176,7 +1215,7 @@ importers:
         version: 3.1.3
       foxact:
         specifier: 'catalog:'
-        version: 0.3.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 0.3.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       fuse.js:
         specifier: 'catalog:'
         version: 7.4.2
@@ -1204,6 +1243,9 @@ importers:
       jotai-scope:
         specifier: 'catalog:'
         version: 0.11.0(jotai@2.20.1(@babel/core@7.29.7)(@babel/template@7.29.7)(@types/react@19.2.17)(react@19.2.7))(react@19.2.7)
+      jotai-tanstack-form:
+        specifier: workspace:*
+        version: link:../packages/jotai-tanstack-form
       jotai-tanstack-query:
         specifier: 'catalog:'
         version: 0.11.0(@tanstack/query-core@5.101.0)(@tanstack/react-query@5.101.0(react@19.2.7))(jotai@2.20.1(@babel/core@7.29.7)(@babel/template@7.29.7)(@types/react@19.2.17)(react@19.2.7))(react@19.2.7)
@@ -1233,7 +1275,7 @@ importers:
         version: 0.45.0
       loro-crdt:
         specifier: 'catalog:'
-        version: 1.13.2
+        version: 1.13.5
       mermaid:
         specifier: 'catalog:'
         version: 11.15.0
@@ -1251,13 +1293,13 @@ importers:
         version: 1.0.0
       next:
         specifier: 'catalog:'
-        version: 16.2.9(@babel/core@7.29.7)(@playwright/test@1.60.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 16.2.9(@babel/core@7.29.7)(@playwright/test@1.61.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       next-themes:
         specifier: 'catalog:'
         version: 0.4.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       nuqs:
         specifier: 'catalog:'
-        version: 2.8.9(next@16.2.9(@babel/core@7.29.7)(@playwright/test@1.60.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)
+        version: 2.8.9(next@16.2.9(@babel/core@7.29.7)(@playwright/test@1.61.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)
       pinyin-pro:
         specifier: 'catalog:'
         version: 3.28.1
@@ -1311,7 +1353,7 @@ importers:
         version: 0.0.1
       sharp:
         specifier: 'catalog:'
-        version: 0.35.1
+        version: 0.35.2
       shiki:
         specifier: 'catalog:'
         version: 4.2.0
@@ -1332,7 +1374,7 @@ importers:
         version: 2.3.1
       tldts:
         specifier: 'catalog:'
-        version: 7.4.2
+        version: 7.4.3
       unist-util-visit:
         specifier: 'catalog:'
         version: 5.1.0
@@ -1341,7 +1383,7 @@ importers:
         version: 2.0.0(react@19.2.7)(scheduler@0.27.0)
       uuid:
         specifier: 'catalog:'
-        version: 14.0.0
+        version: 14.0.1
       zod:
         specifier: 'catalog:'
         version: 4.4.3
@@ -1354,10 +1396,10 @@ importers:
     devDependencies:
       '@antfu/eslint-config':
         specifier: 'catalog:'
-        version: 9.0.0(@eslint-react/eslint-plugin@5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3))(@next/eslint-plugin-next@16.2.9)(@types/node@25.9.3)(@typescript-eslint/typescript-estree@8.61.0(typescript@6.0.3))(@typescript-eslint/utils@8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3))(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(eslint-plugin-jsx-a11y@6.10.2(eslint@10.5.0(jiti@2.7.0)))(eslint-plugin-react-refresh@0.5.3(eslint@10.5.0(jiti@2.7.0)))(eslint@10.5.0(jiti@2.7.0))(happy-dom@20.10.3)(jiti@2.7.0)(oxlint@1.67.0(oxlint-tsgolint@0.23.0)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
+        version: 9.0.0(@eslint-react/eslint-plugin@5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3))(@next/eslint-plugin-next@16.2.9)(@typescript-eslint/typescript-estree@8.61.1(typescript@6.0.3))(@typescript-eslint/utils@8.61.1(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3))(eslint-plugin-jsx-a11y@6.10.2(eslint@10.5.0(jiti@2.7.0)))(eslint-plugin-react-refresh@0.5.3(eslint@10.5.0(jiti@2.7.0)))(eslint@10.5.0(jiti@2.7.0))(oxlint@1.70.0(oxlint-tsgolint@0.23.0)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(typescript@6.0.3)(vitest@4.1.9)
       '@chromatic-com/storybook':
         specifier: 'catalog:'
-        version: 5.2.1(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
+        version: 5.2.1(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
       '@dify/contracts':
         specifier: workspace:*
         version: link:../packages/contracts
@@ -1405,28 +1447,28 @@ importers:
         version: 4.2.0
       '@storybook/addon-docs':
         specifier: 'catalog:'
-        version: 10.4.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
+        version: 10.4.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
       '@storybook/addon-links':
         specifier: 'catalog:'
-        version: 10.4.4(@types/react@19.2.17)(react@19.2.7)(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
+        version: 10.4.6(@types/react@19.2.17)(react@19.2.7)(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
       '@storybook/addon-onboarding':
         specifier: 'catalog:'
-        version: 10.4.4(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
+        version: 10.4.6(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
       '@storybook/addon-themes':
         specifier: 'catalog:'
-        version: 10.4.4(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
+        version: 10.4.6(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
       '@storybook/nextjs-vite':
         specifier: 'catalog:'
-        version: 10.4.4(@babel/core@7.29.7)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(next@16.2.9(@babel/core@7.29.7)(@playwright/test@1.60.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(supports-color@10.2.2)(typescript@6.0.3)
+        version: 10.4.6(@babel/core@7.29.7)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(next@16.2.9(@babel/core@7.29.7)(@playwright/test@1.61.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(supports-color@10.2.2)(typescript@6.0.3)
       '@storybook/react':
         specifier: 'catalog:'
-        version: 10.4.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(typescript@6.0.3)
+        version: 10.4.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(typescript@6.0.3)
       '@tailwindcss/postcss':
         specifier: 'catalog:'
         version: 4.3.1
       '@tailwindcss/vite':
         specifier: 'catalog:'
-        version: 4.3.1(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
+        version: 4.3.1(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
       '@tanstack/eslint-plugin-query':
         specifier: 'catalog:'
         version: 5.101.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
@@ -1444,13 +1486,13 @@ importers:
         version: 14.6.1(@testing-library/dom@10.4.1)
       '@tsslint/cli':
         specifier: 'catalog:'
-        version: 3.1.3(@tsslint/compat-eslint@3.1.3(typescript@6.0.3))(typescript@6.0.3)
+        version: 3.1.4(@tsslint/compat-eslint@3.1.4(typescript@6.0.3))(typescript@6.0.3)
       '@tsslint/compat-eslint':
         specifier: 'catalog:'
-        version: 3.1.3(typescript@6.0.3)
+        version: 3.1.4(typescript@6.0.3)
       '@tsslint/config':
         specifier: 'catalog:'
-        version: 3.1.3(@tsslint/compat-eslint@3.1.3(typescript@6.0.3))
+        version: 3.1.4(@tsslint/compat-eslint@3.1.4(typescript@6.0.3))
       '@types/js-cookie':
         specifier: 'catalog:'
         version: 3.0.6
@@ -1462,7 +1504,7 @@ importers:
         version: 0.6.4
       '@types/node':
         specifier: 'catalog:'
-        version: 25.9.3
+        version: 25.9.4
       '@types/qs':
         specifier: 'catalog:'
         version: 6.15.1
@@ -1477,25 +1519,25 @@ importers:
         version: 1.15.9
       '@typescript-eslint/parser':
         specifier: 'catalog:'
-        version: 8.61.0(eslint@10.5.0(jiti@2.7.0))(supports-color@10.2.2)(typescript@6.0.3)
+        version: 8.61.1(eslint@10.5.0(jiti@2.7.0))(supports-color@10.2.2)(typescript@6.0.3)
       '@typescript/native-preview':
         specifier: 'catalog:'
-        version: 7.0.0-dev.20260613.1
+        version: 7.0.0-dev.20260620.1
       '@vitejs/plugin-react':
         specifier: 'catalog:'
-        version: 6.0.2(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
+        version: 6.0.2(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
       '@vitejs/plugin-rsc':
         specifier: 'catalog:'
-        version: 0.5.27(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(react-dom@19.2.7(react@19.2.7))(react-server-dom-webpack@19.2.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)
+        version: 0.5.27(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(react-dom@19.2.7(react@19.2.7))(react-server-dom-webpack@19.2.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)
       '@vitest/coverage-v8':
         specifier: 'catalog:'
-        version: 4.1.8(@vitest/browser@4.1.8)(@voidzero-dev/vite-plus-test@0.1.24)
+        version: 4.1.9(@vitest/browser@4.1.9)(vitest@4.1.9)
       agentation:
         specifier: 'catalog:'
         version: 3.0.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       code-inspector-plugin:
         specifier: 'catalog:'
-        version: 1.6.0(supports-color@10.2.2)
+        version: 1.6.1(supports-color@10.2.2)
       eslint:
         specifier: 'catalog:'
         version: 10.5.0(jiti@2.7.0)
@@ -1504,7 +1546,7 @@ importers:
         version: 0.11.0(eslint@10.5.0(jiti@2.7.0))
       eslint-plugin-better-tailwindcss:
         specifier: 'catalog:'
-        version: 4.6.0(eslint@10.5.0(jiti@2.7.0))(oxlint@1.67.0(oxlint-tsgolint@0.23.0)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(tailwindcss@4.3.1)(typescript@6.0.3)
+        version: 4.6.0(eslint@10.5.0(jiti@2.7.0))(oxlint@1.70.0(oxlint-tsgolint@0.23.0)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(tailwindcss@4.3.1)(typescript@6.0.3)
       eslint-plugin-hyoban:
         specifier: 'catalog:'
         version: 0.14.1(eslint@10.5.0(jiti@2.7.0))
@@ -1522,16 +1564,16 @@ importers:
         version: 0.5.3(eslint@10.5.0(jiti@2.7.0))
       eslint-plugin-sonarjs:
         specifier: 'catalog:'
-        version: 4.0.3(eslint@10.5.0(jiti@2.7.0))
+        version: 4.1.0(eslint@10.5.0(jiti@2.7.0))
       eslint-plugin-storybook:
         specifier: 'catalog:'
-        version: 10.4.4(eslint@10.5.0(jiti@2.7.0))(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(typescript@6.0.3)
+        version: 10.4.6(eslint@10.5.0(jiti@2.7.0))(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(typescript@6.0.3)
       happy-dom:
         specifier: 'catalog:'
-        version: 20.10.3
+        version: 20.10.6
       knip:
         specifier: 'catalog:'
-        version: 6.16.1
+        version: 6.17.1
       postcss:
         specifier: 'catalog:'
         version: 8.5.15
@@ -1540,7 +1582,7 @@ importers:
         version: 19.2.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       storybook:
         specifier: 'catalog:'
-        version: 10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
+        version: 10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
       tailwindcss:
         specifier: 'catalog:'
         version: 4.3.1
@@ -1555,22 +1597,22 @@ importers:
         version: 3.19.3
       vinext:
         specifier: 'catalog:'
-        version: 0.1.2(@mdx-js/rollup@3.1.1)(@vitejs/plugin-react@6.0.2(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(@vitejs/plugin-rsc@0.5.27(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(react-dom@19.2.7(react@19.2.7))(react-server-dom-webpack@19.2.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7))(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(next@16.2.9(@babel/core@7.29.7)(@playwright/test@1.60.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react-server-dom-webpack@19.2.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)(supports-color@10.2.2)(typescript@6.0.3)
+        version: 0.1.6(@mdx-js/rollup@3.1.1)(@vitejs/plugin-react@6.0.2(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(@vitejs/plugin-rsc@0.5.27(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(react-dom@19.2.7(react@19.2.7))(react-server-dom-webpack@19.2.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7))(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(next@16.2.9(@babel/core@7.29.7)(@playwright/test@1.61.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react-server-dom-webpack@19.2.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)(supports-color@10.2.2)(typescript@6.0.3)
       vite:
-        specifier: npm:@voidzero-dev/vite-plus-core@0.1.24
-        version: '@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+        specifier: npm:@voidzero-dev/vite-plus-core@0.2.1
+        version: '@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
       vite-plugin-inspect:
         specifier: 'catalog:'
-        version: 12.0.0-beta.3(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(typescript@6.0.3)
+        version: 12.0.0-beta.3(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(typescript@6.0.3)
       vite-plus:
         specifier: 'catalog:'
-        version: 0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
+        version: 0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
       vitest:
-        specifier: npm:@voidzero-dev/vite-plus-test@0.1.24
-        version: '@voidzero-dev/vite-plus-test@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+        specifier: 4.1.9
+        version: 4.1.9(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/browser-preview@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(happy-dom@20.10.6)
       vitest-canvas-mock:
         specifier: 'catalog:'
-        version: 1.1.4(@voidzero-dev/vite-plus-test@0.1.24)
+        version: 1.1.4(vitest@4.1.9)
 
 packages:
 
@@ -1738,10 +1780,6 @@ packages:
     resolution: {integrity: sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/generator@7.29.1':
-    resolution: {integrity: sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw==}
-    engines: {node: '>=6.9.0'}
-
   '@babel/generator@7.29.7':
     resolution: {integrity: sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ==}
     engines: {node: '>=6.9.0'}
@@ -1750,10 +1788,6 @@ packages:
     resolution: {integrity: sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/helper-globals@7.28.0':
-    resolution: {integrity: sha512-+W6cISkXFa1jXsDEdYA8HeevQT/FULhxzR99pxphltZcVaugps53THCeiWA8SguxxpSp3gKPiuYfSWopkLQ4hw==}
-    engines: {node: '>=6.9.0'}
-
   '@babel/helper-globals@7.29.7':
     resolution: {integrity: sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA==}
     engines: {node: '>=6.9.0'}
@@ -1768,10 +1802,6 @@ packages:
     peerDependencies:
       '@babel/core': ^7.29.1
 
-  '@babel/helper-string-parser@7.27.1':
-    resolution: {integrity: sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==}
-    engines: {node: '>=6.9.0'}
-
   '@babel/helper-string-parser@7.29.7':
     resolution: {integrity: sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==}
     engines: {node: '>=6.9.0'}
@@ -1792,10 +1822,6 @@ packages:
     resolution: {integrity: sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/parser@7.29.2':
-    resolution: {integrity: sha512-4GgRzy/+fsBa72/RZVJmGKPmZu9Byn8o4MoLpmNe1m8ZfYnz5emHLQz3U4gLud6Zwl0RZIcgiLD7Uq7ySFuDLA==}
-    engines: {node: '>=6.0.0'}
-
   '@babel/parser@7.29.7':
     resolution: {integrity: sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg==}
     engines: {node: '>=6.0.0'}
@@ -1805,32 +1831,20 @@ packages:
     resolution: {integrity: sha512-JiDShH45zKHWyGe4ZNVRrCjBz8Nh9TMmZG1kh4QTK8hCBTWBi8Da+i7s1fJw7/lYpM4ccepSNfqzZ/QvABBi5g==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/template@7.28.6':
-    resolution: {integrity: sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==}
-    engines: {node: '>=6.9.0'}
-
   '@babel/template@7.29.7':
     resolution: {integrity: sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/traverse@7.29.0':
-    resolution: {integrity: sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA==}
-    engines: {node: '>=6.9.0'}
-
   '@babel/traverse@7.29.7':
     resolution: {integrity: sha512-EhlfNQtZ+NK22w5BM61ciuiq1m58ed33Wr1Xan//ZRTy6hgjnwyCffRYwzsGXdASJSUJ1guZILsErh1eQcl+zw==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/types@7.29.0':
-    resolution: {integrity: sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==}
-    engines: {node: '>=6.9.0'}
-
   '@babel/types@7.29.7':
     resolution: {integrity: sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==}
     engines: {node: '>=6.9.0'}
 
-  '@base-ui/react@1.5.0':
-    resolution: {integrity: sha512-z1gSAlced1yY+iM+mHDEtIkD8UI3Ebs52MuBPxvV6f5hRutk+xvCH/wuB7hDqDzK9JG5FoMz5nhrqtSs1wjt1A==}
+  '@base-ui/react@1.6.0':
+    resolution: {integrity: sha512-/jzjTWJYXhRFO45Bev9lc3cHbmjzCMpUqbMZ2AgKy/z25mY9B6shGSNcXcjQar9n5doM0KYW1W8fcFv2jZBuMw==}
     engines: {node: '>=14.0.0'}
     peerDependencies:
       '@date-fns/tz': ^1.2.0
@@ -1846,8 +1860,8 @@ packages:
       date-fns:
         optional: true
 
-  '@base-ui/utils@0.2.9':
-    resolution: {integrity: sha512-x/PDDCYzoqPpjrdyb3VcyylTI2IjUXEtYDGi5foh7KsnmNJIIaVwA2GLgDH1dps1GgXiJbA60hM+AyuTfQzIvw==}
+  '@base-ui/utils@0.3.1':
+    resolution: {integrity: sha512-gFFiltORVmW/N6IILTGxizP3PBpVpysqML1ALY5Vk0mH+7faVkCknOU31goYHN5Aoek2dkjxva1XOD2Ce9WuIg==}
     peerDependencies:
       '@types/react': ^17 || ^18 || ^19
       react: ^17 || ^18 || ^19
@@ -1883,23 +1897,23 @@ packages:
     resolution: {integrity: sha512-S0My7XPGIgpRWMDG8uRqalbgT+a6FmCUdOW+HaIOVVpUPHOb7RrpvjTjiODadKp06fsrVDJZlIzc6yCTp4AnxA==}
     engines: {node: '>= 20.12.0'}
 
-  '@code-inspector/core@1.6.0':
-    resolution: {integrity: sha512-RMJA9RQVpU12L5Df32lhOC7kh0CwBbydaqr/dQmTEX9rjcr2cyEAalWSaglcMber6+iOHDZSiyaFIJCGKOSV3w==}
+  '@code-inspector/core@1.6.1':
+    resolution: {integrity: sha512-jlRjItyW7AlcEAi3oqxq11NsGdtfvG2ZOCs8mJQAlRhIKGEIWSECgN5oNzuOICOF+eRVHxUfBL4gd0FiFfaDuQ==}
 
-  '@code-inspector/esbuild@1.6.0':
-    resolution: {integrity: sha512-IDSOrQUaKDecklfd5wNqgU3j4TSlcqLspWw5+xGS8n5cFACy2kA4aM+vE4xWK3OXiooLB9sOGbVcOaZzda2hhA==}
+  '@code-inspector/esbuild@1.6.1':
+    resolution: {integrity: sha512-inZSNq+ZsbgZX48u/O9kwVNnr6RiMpBTlOhmfVx/bxCIs+GkGalVuY6AZ5+epg5QiNbL9RdHBkckEZpPAFDHgg==}
 
-  '@code-inspector/mako@1.6.0':
-    resolution: {integrity: sha512-99fPSBfbEiYMpZWHc2NSShzxDecNgn8ykziqeYjSqnNZTdCjhlEmMR/KymOMoI/Ott1wLM3H5fqa7Lpehx9NxQ==}
+  '@code-inspector/mako@1.6.1':
+    resolution: {integrity: sha512-mk8qfMOhEaGwvxruIudv2edZ5xaREaoMDmaiou4qEkfxfpiQ+8oKKGCQhNw8ML2wgVLUEeizCQO60IWpBJnWxg==}
 
-  '@code-inspector/turbopack@1.6.0':
-    resolution: {integrity: sha512-hhJGozLBa53NNi4Apn27Di0DAdfGzjFB5/iVsklQHKOxnGSJ7VviPO01Bi2W6sfOc6tY27wvsys1I1kc42KOLw==}
+  '@code-inspector/turbopack@1.6.1':
+    resolution: {integrity: sha512-4jY89hyU4p7DtTqEyr4qYnnaQSGvtZvrWr8PEaYYR0EDK+qHDl6ndupZBYU2zzKMv87gnWqZ271rPA+0YXfEBg==}
 
-  '@code-inspector/vite@1.6.0':
-    resolution: {integrity: sha512-P406JrDxZ8iGr26X3YzRwuR/jeYtrAhhjJu9BH0FpXRVcMolyp3a4kvMYzZ2IfulAxNMvcEAZsfr4DHLBFNktg==}
+  '@code-inspector/vite@1.6.1':
+    resolution: {integrity: sha512-ZlfS23t9naunoA8xBAlaEgEAFWq6YV1frKgE42fXZUNYOmcZlpaV/8EdqBJt/JZu6MJkceEVmgGRSJc5kYXIag==}
 
-  '@code-inspector/webpack@1.6.0':
-    resolution: {integrity: sha512-TVEYQ/hgWpyNTibUQh/nf/01ipDdP9/VGJJhL2eVpyBKlP4k8ipKusXaCEbC4hvUQsak6T11rwPQIXIf+WONRQ==}
+  '@code-inspector/webpack@1.6.1':
+    resolution: {integrity: sha512-pgrqzBja1FBk0WWXodmbfOnpLX4rbofBPk4INHc9UWnDlv1Ypfhn9pX7N5zJ0pBRHjrBF6ow4xfm0GGb7eUG2w==}
 
   '@colors/colors@1.5.0':
     resolution: {integrity: sha512-ooWCrlZP11i8GImSjTHYHLkvFDP48nS4+204nGb1RiX/WXYHmJA2III9/e2DWVabCESdW7hBAEzHRqUn9OUVvQ==}
@@ -2362,8 +2376,8 @@ packages:
   '@hey-api/types@0.1.4':
     resolution: {integrity: sha512-thWfawrDIP7wSI9ioT13I5soaaqB5vAPIiZmgD8PbeEVKNrkonc0N/Sjj97ezl7oQgusZmaNphGdMKipPO6IBg==}
 
-  '@hono/node-server@2.0.4':
-    resolution: {integrity: sha512-Ut3y0dMMPWy6bZ2kVfx25EOVbZlm15dhF4mOsezMlhpNHy+4MkU1qN9Y6lnruYi4wPmFzimGX2X7LF/FwHli4A==}
+  '@hono/node-server@2.0.5':
+    resolution: {integrity: sha512-yQFvDmyDo3y6rEOJZDUYPJ49DIKTPpIk4kGvm40xx4Ejne0Pu9a1+exxPN+C1UppWK/WGZX9F++/Xs231tE86g==}
     engines: {node: '>=20'}
     peerDependencies:
       hono: ^4
@@ -2412,8 +2426,8 @@ packages:
     cpu: [arm64]
     os: [darwin]
 
-  '@img/sharp-darwin-arm64@0.35.1':
-    resolution: {integrity: sha512-T15JRWOubQ3f5+GxnWeIvo47u5qV0M9HBgJhT+f2gE1e9e6OhR6K73Re52Hm80qWcu1DNb3GweKmpr/MnuP2Ow==}
+  '@img/sharp-darwin-arm64@0.35.2':
+    resolution: {integrity: sha512-eEieHsMksAW4IiO5NzauESRl2D2qz3J/kwUxUrSfV06A93eEaRfMpHXyUb1mAqrR7i8U9A0GRqE9pjn6u1Jjpg==}
     engines: {node: '>=20.9.0'}
     cpu: [arm64]
     os: [darwin]
@@ -2424,14 +2438,14 @@ packages:
     cpu: [x64]
     os: [darwin]
 
-  '@img/sharp-darwin-x64@0.35.1':
-    resolution: {integrity: sha512-t1CPD0cr7XCHjwUj6tQ5MC0pCi866I+gUW6zbUX4aFPnKd1DFBtk0M+gWcjX8VeEzgfCNiSiNTVFZ6b7kvdbnQ==}
+  '@img/sharp-darwin-x64@0.35.2':
+    resolution: {integrity: sha512-BaktuGPCeHJMARpodR8jK4uKiZrPAy9WrfQW0sdI37clracq8Bp01AYS3SZgi5FS/y5twa9t4+LIuuxQjqRrWw==}
     engines: {node: '>=20.9.0'}
     cpu: [x64]
     os: [darwin]
 
-  '@img/sharp-freebsd-wasm32@0.35.1':
-    resolution: {integrity: sha512-MBSQXqNPThW9EcZ905H6N4sEdX5EwZEYzGx5EBq9ncDCGJALMiY1xPFJxNdzuB1iBjLOpIfxajM6YxdvwmQSLA==}
+  '@img/sharp-freebsd-wasm32@0.35.2':
+    resolution: {integrity: sha512-YoAxdnd8hPUkvLHd3bWY+YA8nw3xM/RyRopYucNsWHVSan8NLVM3X2volsfoRDcXdUJPg6tXahSd7HXPK7lRnw==}
     engines: {node: '>=20.9.0'}
     os: [freebsd]
 
@@ -2440,8 +2454,8 @@ packages:
     cpu: [arm64]
     os: [darwin]
 
-  '@img/sharp-libvips-darwin-arm64@1.3.0':
-    resolution: {integrity: sha512-EKbmBKtyTH+GPFDRw2TgK2oV6hyxxlJVIar4hoTYSNmIwipgMFdxPQqR392GmfdsPGWga0mCFN1cCKjRb9cljw==}
+  '@img/sharp-libvips-darwin-arm64@1.3.1':
+    resolution: {integrity: sha512-4V/M3roRMTYjiwZY9IOVQOE8OyeCxFAkYmyZDrZl51uOKjibm3oeEJ4WAmLxutAfzFbC9jqUiPs2gbnGflH+7g==}
     cpu: [arm64]
     os: [darwin]
 
@@ -2450,8 +2464,8 @@ packages:
     cpu: [x64]
     os: [darwin]
 
-  '@img/sharp-libvips-darwin-x64@1.3.0':
-    resolution: {integrity: sha512-Pl2OmOvrJ42adUllESxBsG54PfXLo1OYg9i3c5/5Ln/qJ0gZuTM9YMhQJPIbXqwidLRc/c2zuHt4RsrymmNv7A==}
+  '@img/sharp-libvips-darwin-x64@1.3.1':
+    resolution: {integrity: sha512-c0/DxItpJv2+dGhgycJBBgotdqruGYDvA79drdh0MD1dFpy7JzJ/PlXwi1H4rFf0eTy8tgbI91aHDnZIceY3jQ==}
     cpu: [x64]
     os: [darwin]
 
@@ -2461,8 +2475,8 @@ packages:
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-libvips-linux-arm64@1.3.0':
-    resolution: {integrity: sha512-C0SqjoFKnszqa44EQ7xoaT48nnO0lOyXEULfXMWi8krrjOPGYkeK30Okzla6ATbBYsyZ0ySinK0FVkpv3DwzfQ==}
+  '@img/sharp-libvips-linux-arm64@1.3.1':
+    resolution: {integrity: sha512-JznefmcK9j1JKPz8AkQDh89kjojubyfOasWBPKfzMIhPwsgDy9evpE/naJTXXXmghS1iFwR8u/kTwh/I2/+GCw==}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
@@ -2473,8 +2487,8 @@ packages:
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-libvips-linux-arm@1.3.0':
-    resolution: {integrity: sha512-A8UpHoUDW4DwnXoV6+q3C1s7QLRAHtPDEjWuNZjwHMyoCNZnm0GeNN8ls9f/bsEYTRQRW96C/n34XJQHJ2fT7A==}
+  '@img/sharp-libvips-linux-arm@1.3.1':
+    resolution: {integrity: sha512-aGGy9aWzXgHBG7HNyQPWorZthlp7+x6fDRoPAQbGO3ThcttuTyKIx3NuSHb6zb4gBNq6/yNn9f1cy9nFKS/Vmg==}
     cpu: [arm]
     os: [linux]
     libc: [glibc]
@@ -2485,8 +2499,8 @@ packages:
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-libvips-linux-ppc64@1.3.0':
-    resolution: {integrity: sha512-WOpkVxAjFd369iaIzEgNRreFD+gWdUMIGD5zplhNKNeqS6mm5dac3q2AFyCBmzYoAdouzZvRBgxy4z8QHZb4/A==}
+  '@img/sharp-libvips-linux-ppc64@1.3.1':
+    resolution: {integrity: sha512-1EkwGNCZk6iWNCMWqrvdJ+r1j0PT1zIz60CNPhYnJlK/zyeWqlsPZIe+ocBVqPF8k/Ssee/NCk+tE9Ryrko6ng==}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
@@ -2497,8 +2511,8 @@ packages:
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-libvips-linux-riscv64@1.3.0':
-    resolution: {integrity: sha512-DRWw0mOHusrCCuw2rqP87oLg6PGlkomVDFqw2hIwsSfwWpu4k3XLcBPaKKl6ct/GtL/cwNkgwjV/tc0Mqht3VA==}
+  '@img/sharp-libvips-linux-riscv64@1.3.1':
+    resolution: {integrity: sha512-Ilays+w2bXdnxzxtQdmXR62u8o8GYa3eL4+Gr+1KiE4xperMZUslRaVPJwwPkzlHEjGfXAfRVAa/7CYCtSqsBw==}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
@@ -2509,8 +2523,8 @@ packages:
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-libvips-linux-s390x@1.3.0':
-    resolution: {integrity: sha512-9APy+nFWhHS+kzLgWZfLcyrUd7YqnAQVa4BPOo4xkoHpdoktOAPG4cEr9+Jpl0TtqfVmcMJimNL5qNTyyOHZNA==}
+  '@img/sharp-libvips-linux-s390x@1.3.1':
+    resolution: {integrity: sha512-VfBwVHQTbRoj4XlpA/KLZ7ltgMpz+4WSejFzQ+GnoImjo1PtEJ59QB2qR1xQEeRPYIkNrPIm2L4cICMvz4C2ew==}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
@@ -2521,8 +2535,8 @@ packages:
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-libvips-linux-x64@1.3.0':
-    resolution: {integrity: sha512-y9RNUYDe2A1UAdhLyfeOodGRszQdaEoe4nfOpp/sNVPl2CWIcUyFaDoCh4vPLPxu19803j2naLqZup2WxDXCLA==}
+  '@img/sharp-libvips-linux-x64@1.3.1':
+    resolution: {integrity: sha512-+c8ukgwU62DS54nCAjw7keOfHUkmr0B5QHEdcOqRnodF/MNXJbVI8Eopoj4B/0H8Asr65I+A4Amrn7a85/md6A==}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
@@ -2533,8 +2547,8 @@ packages:
     os: [linux]
     libc: [musl]
 
-  '@img/sharp-libvips-linuxmusl-arm64@1.3.0':
-    resolution: {integrity: sha512-cC1wkC0Mlucd0KSiGrLkJnB/ZqPvZCntc/Lk7ZnYO5ZSbF2euNek4Xvxafojq+wN1q/W0eprdpUIjUr/EV2PBg==}
+  '@img/sharp-libvips-linuxmusl-arm64@1.3.1':
+    resolution: {integrity: sha512-qlKb/pwbkAi1WMsJrYHk7CuDrd12s27U2QnRhFYUoJNrRCmkosMTttuRFat/DDB3IlDm5qE1TJgZ4JDnHX8Ldw==}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
@@ -2545,8 +2559,8 @@ packages:
     os: [linux]
     libc: [musl]
 
-  '@img/sharp-libvips-linuxmusl-x64@1.3.0':
-    resolution: {integrity: sha512-LiYMhUZicB1QG//+RvmYZpXJO8fYRENfp+MZUCnG9aw+AKvGAy9gPaCnuwsPcBFs8EV66M0NNxj9VHcNklE8zw==}
+  '@img/sharp-libvips-linuxmusl-x64@1.3.1':
+    resolution: {integrity: sha512-yO21HwoUVLN8Qa+/SBjQLMYwBWAVJjeGPNe+hc0OUeMeifEtJqu5a1c4HayE1nNpDih9y3/KkoltfkDodmKAlg==}
     cpu: [x64]
     os: [linux]
     libc: [musl]
@@ -2558,8 +2572,8 @@ packages:
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-linux-arm64@0.35.1':
-    resolution: {integrity: sha512-ErCRyGU7LeoaFBZ0xW8hhLlXzhAg80sc4vxePB86qvtEvW1jEhhmbiNBP4oEzZfPMnu6HwHXfzD2W2kBU+RnCw==}
+  '@img/sharp-linux-arm64@0.35.2':
+    resolution: {integrity: sha512-af12Pnd0ZGu2HfP8NayB0kk6eC/lrfbQE6HlR4jD+34wdJ1Vw9TF6TMn6ZvffT+WgqVsl0hRbmNvz2u/23VmwA==}
     engines: {node: '>=20.9.0'}
     cpu: [arm64]
     os: [linux]
@@ -2572,8 +2586,8 @@ packages:
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-linux-arm@0.35.1':
-    resolution: {integrity: sha512-jygmR02PpCYypt7xB7nst1vqjZp/BpRA/Kf9nK7qRponJ/KrLPaZWEG4G15z1d2FZ6XqI+T0350ha3RSnKx24A==}
+  '@img/sharp-linux-arm@0.35.2':
+    resolution: {integrity: sha512-SE4kzF2mepn6z+6E7L6lsV8FzuLL6IPQdyX8ZiwROAG/G8td+hP/m7FsFPwidtrF19gvajuC9l6TxAVcsA4S7A==}
     engines: {node: '>=20.9.0'}
     cpu: [arm]
     os: [linux]
@@ -2586,8 +2600,8 @@ packages:
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-linux-ppc64@0.35.1':
-    resolution: {integrity: sha512-LUWZ2+r2UoLCd8j0RLCwQ4gL6w47+Y7igxtVnPIDXOOEjV86LpBkAHq5VpJeg+GHbw0KN/JWlPJOdZjyZnFqFQ==}
+  '@img/sharp-linux-ppc64@0.35.2':
+    resolution: {integrity: sha512-hYSBm7zcNtDCozCxQHYZJiu63b/bXsgRZuOxCIBZsStMM9Vap47iFHdbX4kCvQsblPB/k+clhELpdQJHQLSHvg==}
     engines: {node: '>=20.9.0'}
     cpu: [ppc64]
     os: [linux]
@@ -2600,8 +2614,8 @@ packages:
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-linux-riscv64@0.35.1':
-    resolution: {integrity: sha512-i7x6J3mwF4JgT0sM4V4WlAWdJ0bucPtA9rzO1bTji1n5qgBq/W5nn87RvOQPleuuxahNoLdTngByD8/vDDLArw==}
+  '@img/sharp-linux-riscv64@0.35.2':
+    resolution: {integrity: sha512-qQt0Kc13+Hoan/Awq/qMSQw3L+RI1NCRPgD5cUJ/1WSSmIoysLOc72jlRM3E0OHN9Yr313jgeQ2T+zW+F03QFA==}
     engines: {node: '>=20.9.0'}
     cpu: [riscv64]
     os: [linux]
@@ -2614,8 +2628,8 @@ packages:
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-linux-s390x@0.35.1':
-    resolution: {integrity: sha512-0zSaTUjTF0kIWTSYxD4EG/nvCU4jez53+3RdURtoY3HvbXtIQ98W90JnrGz/oLRFuEnfIy9+7xeq883euc0ZWw==}
+  '@img/sharp-linux-s390x@0.35.2':
+    resolution: {integrity: sha512-E4fLLfRPzDLlEeDaTzI98OFLcv++WL5ChLLMwPoVd0CIoZQqupBSNbOisPL5am9XsbQ9T84+iiMpUvbFtkunbA==}
     engines: {node: '>=20.9.0'}
     cpu: [s390x]
     os: [linux]
@@ -2628,8 +2642,8 @@ packages:
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-linux-x64@0.35.1':
-    resolution: {integrity: sha512-NbJD4mWdeyrNQKluO/tR/wBDOelcowSVGNBWxI0e3ZtlXc6F/UOVKDj1MLD4zl3oHTuvKW3s+MA9N54YTldAYw==}
+  '@img/sharp-linux-x64@0.35.2':
+    resolution: {integrity: sha512-gi0zFJJRLswfCZmHtJdikXPOc5u7qamSOS3NHedLqLd4W8Q0NqjdBr6TTRIgsfFjqfTsHFgdfvJ9LwqSgcHiAA==}
     engines: {node: '>=20.9.0'}
     cpu: [x64]
     os: [linux]
@@ -2642,8 +2656,8 @@ packages:
     os: [linux]
     libc: [musl]
 
-  '@img/sharp-linuxmusl-arm64@0.35.1':
-    resolution: {integrity: sha512-VoW2sQCWI+0YIKQEmWJ8vzaQjTg9wIyfkFpvEfAS2h43X6iHu7GTk1hhOgB4IpSzCHe8UwQZIcx7b81VTaOrJA==}
+  '@img/sharp-linuxmusl-arm64@0.35.2':
+    resolution: {integrity: sha512-siWbOW1u6HFnFLrp0waKyW7VEf7jYvcDWdrXEFa8AkdAQgEvuu5Fz8/Y70w9EeqAdwDtfU012BhEHHaDqvQNzg==}
     engines: {node: '>=20.9.0'}
     cpu: [arm64]
     os: [linux]
@@ -2656,8 +2670,8 @@ packages:
     os: [linux]
     libc: [musl]
 
-  '@img/sharp-linuxmusl-x64@0.35.1':
-    resolution: {integrity: sha512-LjBoSd/c5JU0/K5MwzDMlgsSRP2bPn98JQGFFQAOLQ0bU/1z4ekxUdSKY9BmlwSh/cA+OrvpgsWqfZyYfVHBRw==}
+  '@img/sharp-linuxmusl-x64@0.35.2':
+    resolution: {integrity: sha512-YBqMMcjDi4QGYiSn4vNOYBhmlC4z5AXqkOUUqI2e0AFA4urNv4ESgOgwNl3K+4etQhha0twXlzeF20bbULm9Yg==}
     engines: {node: '>=20.9.0'}
     cpu: [x64]
     os: [linux]
@@ -2668,12 +2682,12 @@ packages:
     engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
     cpu: [wasm32]
 
-  '@img/sharp-wasm32@0.35.1':
-    resolution: {integrity: sha512-PCQUoQdZyE8tp3HpbevuihfUmgSP4qWI0FGEPWoeXqaS+cUrFfemabHQiebUmUmlUhCuNnQMxGrQ+CPqK4hnxg==}
+  '@img/sharp-wasm32@0.35.2':
+    resolution: {integrity: sha512-Mrv4JQNYVQ94xH+jzZ9r+gowleN8mv2FTgKT+PI6bx5C0G8TdNYndu161pg2i7uoBwxy2ImPMHrJOM2LZef7Bw==}
     engines: {node: '>=20.9.0'}
 
-  '@img/sharp-webcontainers-wasm32@0.35.1':
-    resolution: {integrity: sha512-xU2ml2bU2OPxYVvW2A6ae4M1g5QKyhKG06P4FAt+YEaFQQO0919Qx+XxIZEUuWTMoDViLpMws2/dQwoe/VcA6A==}
+  '@img/sharp-webcontainers-wasm32@0.35.2':
+    resolution: {integrity: sha512-QNV27pxs9wpApEiCfvHM1RDoP1w1+2KrUWWDPEhEwg+latvOrfuhWrHWZKwdSFwU6jh3myjw/yOCRsUIuOft3g==}
     engines: {node: '>=20.9.0'}
     cpu: [wasm32]
 
@@ -2683,8 +2697,8 @@ packages:
     cpu: [arm64]
     os: [win32]
 
-  '@img/sharp-win32-arm64@0.35.1':
-    resolution: {integrity: sha512-IkmHwuFhYpd3bTsN5SAahjwhiAcyXPooBt8vEUgxY3T0IP70sSJ0nU1xiPzZY8AH/OB1XpV3j8aZSVSOSfTbdA==}
+  '@img/sharp-win32-arm64@0.35.2':
+    resolution: {integrity: sha512-BiVRYc/t6/Vl3e1hBx0hugG4oN9Pydf4fgMSpxTQJmwGUg/YoXTWHiFeRymHfCZzifxu4F4rpk/I67D0LQ20wQ==}
     engines: {node: '>=20.9.0'}
     cpu: [arm64]
     os: [win32]
@@ -2695,8 +2709,8 @@ packages:
     cpu: [ia32]
     os: [win32]
 
-  '@img/sharp-win32-ia32@0.35.1':
-    resolution: {integrity: sha512-wQahqCi9MD8Yxzg4gVM4fNrZxh+r6vD55PyIg+WJPaM5ZRUyF35iQpwJCuma3r6viU9/8Pxlc+XHV+woVa6nCQ==}
+  '@img/sharp-win32-ia32@0.35.2':
+    resolution: {integrity: sha512-YYEhx9PImCC7T0tI8JDMi4DB9LwLCXCU5OWNYEXAxh5Q1ShKkyC6byxzoBJ3gEFDnH2lQckWuDe70G7mB2XJog==}
     engines: {node: ^20.9.0}
     cpu: [ia32]
     os: [win32]
@@ -2707,8 +2721,8 @@ packages:
     cpu: [x64]
     os: [win32]
 
-  '@img/sharp-win32-x64@0.35.1':
-    resolution: {integrity: sha512-WzBtkYtZHATLPe8XRharxZXxQ9cdLrQWHiwxt+BJ5rBsisQrKeeV86ErxPSVhcG6xCEuNhs0SqLpWr7XDa2k6w==}
+  '@img/sharp-win32-x64@0.35.2':
+    resolution: {integrity: sha512-imoOyBcoM/iiUr4J6VPpCNjPnjvP/Gks95898yB8YqoGGYmHYbOyCuNv9FMhFgtaiHFGbHW8bxKqRV6VjtXThQ==}
     engines: {node: '>=20.9.0'}
     cpu: [x64]
     os: [win32]
@@ -2847,7 +2861,7 @@ packages:
   '@mdx-js/rollup@3.1.1':
     resolution: {integrity: sha512-v8satFmBB+DqDzYohnm1u2JOvxx6Hl3pUvqzJvfs2Zk/ngZ1aRUhsWpXvwPkNeGN9c2NCm/38H29ZqXQUjf8dw==}
     peerDependencies:
-      rollup: 4.61.1
+      rollup: 4.62.2
 
   '@mermaid-js/parser@1.1.1':
     resolution: {integrity: sha512-VuHdsYMK1bT6X2JbcAaWAhugTRvRBRyuZgd+c22swUeI9g/ntaxF7CY7dYarhZovofCbUNO0G7JesfmNtjYOCw==}
@@ -3096,8 +3110,8 @@ packages:
     cpu: [arm]
     os: [android]
 
-  '@oxc-parser/binding-android-arm-eabi@0.133.0':
-    resolution: {integrity: sha512-l/44caGse+VpnY9gx0yvvc5QnnG3yG1FO3KZgYvNL1GZrfK86zIwAOgGEVlxDyRymzrU/KHiblPFpevKOmJmUA==}
+  '@oxc-parser/binding-android-arm-eabi@0.135.0':
+    resolution: {integrity: sha512-sHeZItACNcA5WRAWqF6ixriR4GkZDyY10gVgnZU7pXku1DjHFATSqnwZM809jl0gXPHxb6fKzYQCK7bNK5cACQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [android]
@@ -3114,8 +3128,8 @@ packages:
     cpu: [arm64]
     os: [android]
 
-  '@oxc-parser/binding-android-arm64@0.133.0':
-    resolution: {integrity: sha512-KUHmPMziLBp4u+zbrLdB7iWS7KshuZe+RAp7ELnY9SI9nNXBZ+dp8fiBqWOxhXqn+FQg3a4UcQhwmsJOKV8Jjg==}
+  '@oxc-parser/binding-android-arm64@0.135.0':
+    resolution: {integrity: sha512-wPte+SzgzWWFgMSF8YZDNM+tBXtJg0AXBi7+tU3yS2z1f2Af9kRLZLKuJojADmuD/cZexmnMHHC3SDItTW77Iw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [android]
@@ -3132,8 +3146,8 @@ packages:
     cpu: [arm64]
     os: [darwin]
 
-  '@oxc-parser/binding-darwin-arm64@0.133.0':
-    resolution: {integrity: sha512-q8dWmnU/8ea2tga9w2f1PinQ5rcMPDUGkF64T189b65YMjUomET4oy5oRldOr4AwOQkneOG/Zttnz1Dvrc62wg==}
+  '@oxc-parser/binding-darwin-arm64@0.135.0':
+    resolution: {integrity: sha512-BmKz3lHIsqVos+9aPcdYCT9MG3APoUyM43KlEFhJMWNVDOGG8FKyiFz81Bc+mGz2o0hpuQ3PfXLfVWJrKXjo2g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [darwin]
@@ -3150,8 +3164,8 @@ packages:
     cpu: [x64]
     os: [darwin]
 
-  '@oxc-parser/binding-darwin-x64@0.133.0':
-    resolution: {integrity: sha512-cOKeIELIB2bJnCKwqx4Rdj+1Lss/U6uCbLxRySZrhyOOQa1flKhwZFjEHRHxk8fU1NKmhK5OnTdPQ4CpjuFuVw==}
+  '@oxc-parser/binding-darwin-x64@0.135.0':
+    resolution: {integrity: sha512-dM8BS+8+Br1fNvmh2QZbGiHaYttwLebRa6J4Uz9vuFzMNmvsdRYwf7993ptOaV0JTrR63AaoVLjX7nhWbijxjQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [darwin]
@@ -3168,8 +3182,8 @@ packages:
     cpu: [x64]
     os: [freebsd]
 
-  '@oxc-parser/binding-freebsd-x64@0.133.0':
-    resolution: {integrity: sha512-OpaSv4pW3KgFrMYQxTaS0aOE4T1DQF3qZE/4B6uqqv1KgPWWd4UQhJALi8PJPX1RRV5K7ThKXRfF7qGg2+3l1A==}
+  '@oxc-parser/binding-freebsd-x64@0.135.0':
+    resolution: {integrity: sha512-xlZnvvJdR9bGu2pOhvR5hMuKPHCE6Sa9owK5A484mzjHdm75VRV5nCs5w/jkmGODMMTFc+KN7EnZqEieM813kw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [freebsd]
@@ -3186,8 +3200,8 @@ packages:
     cpu: [arm]
     os: [linux]
 
-  '@oxc-parser/binding-linux-arm-gnueabihf@0.133.0':
-    resolution: {integrity: sha512-JGK1wlGrGwxBIlVSF7KWTX1/ru6BEtf28fRROztDRkLfiW+Kxa4onnriezMIiogfn9hVw2KzYcKiLjkLR2ns8A==}
+  '@oxc-parser/binding-linux-arm-gnueabihf@0.135.0':
+    resolution: {integrity: sha512-PSR8LmBK/H/PQRiN8g7RebQgZX/ntVCrdT/JBfNxE5ezdHG1s2i4rbazsRJYD83TTI1MmgTpC0MGL42PLtskQQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
@@ -3204,8 +3218,8 @@ packages:
     cpu: [arm]
     os: [linux]
 
-  '@oxc-parser/binding-linux-arm-musleabihf@0.133.0':
-    resolution: {integrity: sha512-yuZO533Ftonxn/iyoqQzURzLQHMspvsIyfiCSNi1t/ER4eIQaR0SsmUOUm5b/lmSig7IWIUa5/BrbEkAPwcilQ==}
+  '@oxc-parser/binding-linux-arm-musleabihf@0.135.0':
+    resolution: {integrity: sha512-I85GJXzfUsigkkk7Ngdz95C217M4FdUi1Z2HrX5UyPmURobwQZ7m2bbUvwFkz4VGZd+lymFGKHvDZ3RQC9qOzA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
@@ -3224,8 +3238,8 @@ packages:
     os: [linux]
     libc: [glibc]
 
-  '@oxc-parser/binding-linux-arm64-gnu@0.133.0':
-    resolution: {integrity: sha512-hvpbqT5pN2rR+3+xtWeizwfR/aZ0vGceg6TqYMl+ToxMpk9/tmnX7kSvQnfEUkoua8mhogzvIKsAkn0wxgblBA==}
+  '@oxc-parser/binding-linux-arm64-gnu@0.135.0':
+    resolution: {integrity: sha512-zqEY0npz0g0aGZj/8a5BclunjVDytsBQHYtIC10Gd26HcrLwbVF6YDbqRQjunMGYdSo97u6xOBl05aTDI2diDQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
@@ -3245,8 +3259,8 @@ packages:
     os: [linux]
     libc: [musl]
 
-  '@oxc-parser/binding-linux-arm64-musl@0.133.0':
-    resolution: {integrity: sha512-wJQGamIosQBoJHW9+S5XxrtKRo3eyJxsnS1XCPrqN0LHi8uw1pTqqTfn3t/NVuvbBg7Pumn4ez9Eidgcn0xbEg==}
+  '@oxc-parser/binding-linux-arm64-musl@0.135.0':
+    resolution: {integrity: sha512-mWAfprP819gQ2qYst1RxgTI8b/z0b29OpoKfRflIXLHde2dZLihQD4g47Onuvtpo5GPIkMYPRlX9QoeZfs/GnQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
@@ -3266,8 +3280,8 @@ packages:
     os: [linux]
     libc: [glibc]
 
-  '@oxc-parser/binding-linux-ppc64-gnu@0.133.0':
-    resolution: {integrity: sha512-Koaz32/O5+abIfrNGdyndgRvdOZ9jEf5/z3Ep9h3h2QWpdDiUQpVwgH0OcMXCs+l9aXxPLtkupqyVig9W6FDKw==}
+  '@oxc-parser/binding-linux-ppc64-gnu@0.135.0':
+    resolution: {integrity: sha512-gri8c2AOmJKJwOux2KTHFBfUaXoJURuVMKhmKEi/2hTF55cQteTDV2XNfTiE5oCC+Tnem1Y4/MWzcyDadtsSag==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ppc64]
     os: [linux]
@@ -3287,8 +3301,8 @@ packages:
     os: [linux]
     libc: [glibc]
 
-  '@oxc-parser/binding-linux-riscv64-gnu@0.133.0':
-    resolution: {integrity: sha512-R4vOjWzxhnNWHnVLeiB6jNuIifdy9vcMXZGPc7StXcxBovI+U2zg1QhZ9o8OjV80oGivs1lX5NfPLzk4IPqlRA==}
+  '@oxc-parser/binding-linux-riscv64-gnu@0.135.0':
+    resolution: {integrity: sha512-Y2tkupCG5wo0SxH2rMLG4d4Kmv6DaM3sBp+GuM5lox0S8Za6VxKgQrY2Mut088QQxKkEE89n/4CCCgmw2o0e3Q==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
@@ -3308,8 +3322,8 @@ packages:
     os: [linux]
     libc: [musl]
 
-  '@oxc-parser/binding-linux-riscv64-musl@0.133.0':
-    resolution: {integrity: sha512-iwgBNUTHiMdxARLYuM0SBlnYeb19iw1Ea5M+4ERZupCsBMLArti6FyZ6UfFjJxIiTDr2oW2DGQFxlQVQ/dW9rA==}
+  '@oxc-parser/binding-linux-riscv64-musl@0.135.0':
+    resolution: {integrity: sha512-xDRJq6i6WTynjeP+ISbDpyH4p9BaJ0wuQcL0lCSDkt9qOXC9dmwpOu1VG/TlwmPI3KpYntmO9nJCuc3TMTsNBA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
@@ -3329,8 +3343,8 @@ packages:
     os: [linux]
     libc: [glibc]
 
-  '@oxc-parser/binding-linux-s390x-gnu@0.133.0':
-    resolution: {integrity: sha512-ZwZNo8FZmB/gVfboQl+wXilBigGl+6nQQs+nITOeAP/HcAOjiHl6XZJL9F/KXNEspODQcbjAiyjUbeCJd9a0fA==}
+  '@oxc-parser/binding-linux-s390x-gnu@0.135.0':
+    resolution: {integrity: sha512-V4MoUuiCRNvihxhIufRxvK+ka013V4joTSK0FAGA1KEjLuNprfH6N/Qw2uxQEVIFuNYMhD/hV6xJ/ptbzlKdHg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [s390x]
     os: [linux]
@@ -3350,8 +3364,8 @@ packages:
     os: [linux]
     libc: [glibc]
 
-  '@oxc-parser/binding-linux-x64-gnu@0.133.0':
-    resolution: {integrity: sha512-govCvWx1dBlED3uu4qXctxpRcouu9I8Kn+DBktGCl760JtlGJzc9l/OmPJKlYWSbrRqKkMZehNeZ/4Wfma7uSA==}
+  '@oxc-parser/binding-linux-x64-gnu@0.135.0':
+    resolution: {integrity: sha512-JCFZ7zM7KXOKoPAbK/ZB4wY0M1jxRECiem2UQuiXLjzGqS9+hno7mtX+qyK2F7HWK2xPhyJb+frpcOtk5DKOtg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
@@ -3371,8 +3385,8 @@ packages:
     os: [linux]
     libc: [musl]
 
-  '@oxc-parser/binding-linux-x64-musl@0.133.0':
-    resolution: {integrity: sha512-ssTlpXD5Mq9uCssDJPzlRWqBt4Y7Zzd9i+XZhWmK/9Y6KUIuAxVYTYiI8lxcGWi0+3/Cz4A8q9UrD4NK9Y2j7g==}
+  '@oxc-parser/binding-linux-x64-musl@0.135.0':
+    resolution: {integrity: sha512-9jSVS1b3hOV7sdKH4aA2DFfnTz0RgQd0v2BefR+LYbH8yIlmSM22JJZbAAjVeVXmFgUAk3zJQ1tpE/Nd+Vi2YQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
@@ -3390,8 +3404,8 @@ packages:
     cpu: [arm64]
     os: [openharmony]
 
-  '@oxc-parser/binding-openharmony-arm64@0.133.0':
-    resolution: {integrity: sha512-51aByfXhPtLEdWG4a2Ihdw6cPWV1ei1AarALpFdDP8MLWDLE2NuUMgbo3DERR2Kt8fT/ok1GUvBiLxVGke9uUQ==}
+  '@oxc-parser/binding-openharmony-arm64@0.135.0':
+    resolution: {integrity: sha512-M857ZLBSdn1Uy/SJJz5zh0qGu67B4P9omCgXGBU2LLqTzraX6ZjVNaKq5yW1PDw/LgJXDXR/dbZfgmB310f11Q==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [openharmony]
@@ -3406,8 +3420,8 @@ packages:
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [wasm32]
 
-  '@oxc-parser/binding-wasm32-wasi@0.133.0':
-    resolution: {integrity: sha512-2e16tkKp+wDO2GTAmXfxbBcCmGEaFPIJEIRBBmVKNVXSc8/fJsSIaBGyFTPHM9ST5GNWgJcYIt94rDTks+PLwA==}
+  '@oxc-parser/binding-wasm32-wasi@0.135.0':
+    resolution: {integrity: sha512-2w6DVcntQZX9U5RhXtgiWb3FLWFB5EcwI1U8yr3htOCJUJjagN4BFUHz/Y/d9ZsumndZ6ByxxWEtbUZNE1bfFw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [wasm32]
 
@@ -3423,8 +3437,8 @@ packages:
     cpu: [arm64]
     os: [win32]
 
-  '@oxc-parser/binding-win32-arm64-msvc@0.133.0':
-    resolution: {integrity: sha512-KPTNDKbxH1cglrqTyVeXHb4Pk4oksz8EcE1/v8zqU7N4UXbiHfA/IwtXZ2U77fnRAWBbgVkl/lZbL7o3hRdejg==}
+  '@oxc-parser/binding-win32-arm64-msvc@0.135.0':
+    resolution: {integrity: sha512-rX1U8+IH2Z37EJjDXKa1iifvUQAdba+vZ4Ewj1iaG5eA/QaSybzclCOwtWa0/5BuUQnnK/T2JHUEFrwhL6Ck2Q==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [win32]
@@ -3441,8 +3455,8 @@ packages:
     cpu: [ia32]
     os: [win32]
 
-  '@oxc-parser/binding-win32-ia32-msvc@0.133.0':
-    resolution: {integrity: sha512-Una1bNYv9zCavQrfnDR9wuZVB3itLjCEH4Oz7i6CwAJN/Xq9b+zbbcxmvdkKvvJt4Ngc/MBmIYlbLo3zS4TQ0A==}
+  '@oxc-parser/binding-win32-ia32-msvc@0.135.0':
+    resolution: {integrity: sha512-9FAisBbH1QICGAjlJobiuKGd/jOuVmyqniWdQMwTa5SkCl6hhuotBCJf1n46B0flYbSOR5TzfV9HZCWSyb3c/Q==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ia32]
     os: [win32]
@@ -3459,14 +3473,14 @@ packages:
     cpu: [x64]
     os: [win32]
 
-  '@oxc-parser/binding-win32-x64-msvc@0.133.0':
-    resolution: {integrity: sha512-kjBhCiOGSYTwDJQuuZa7a94JbP8htWu7J0X1KwH74kV2K5eYf6eyJRYmkpCDvr0XEL8tMxYI4WU1VekblFCLgg==}
+  '@oxc-parser/binding-win32-x64-msvc@0.135.0':
+    resolution: {integrity: sha512-wYF+A2AzJ2n7ul6q+Z2G/ia0S2+8cUp0AgWZzoFvF4WmUcl1P7p+o6se1Gdr5wGnWuF0iAMIkGddrjCarNr2yA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [win32]
 
-  '@oxc-project/runtime@0.133.0':
-    resolution: {integrity: sha512-PkvjA1Lq5++V5S1E6Patr92ZVcieE6EalDr1VJTqv4BnjZdOUC4W3p8k1wMXSd5/2aFP4b/A6N5sg2Bkzcr9vQ==}
+  '@oxc-project/runtime@0.136.0':
+    resolution: {integrity: sha512-u0EutjK5y6NHJkl5jNJCs8zbup1z6A/UEWgajrYzqcEU3UX05HjqybhMQOLhSM0eKGISyM6WfSMMuklYSmH2wA==}
     engines: {node: ^20.19.0 || >=22.12.0}
 
   '@oxc-project/types@0.127.0':
@@ -3475,8 +3489,11 @@ packages:
   '@oxc-project/types@0.132.0':
     resolution: {integrity: sha512-FESMOxil5Se014ui/Eq8fT5uHJo6nIRwH0PfJrZJXs6Gek3ZVFOrpUv3YIZT20m+extU98Hg1Ym72U58rlsxUQ==}
 
-  '@oxc-project/types@0.133.0':
-    resolution: {integrity: sha512-KzkdCd6Uxqnf6l3HOw1xfatAlUURA0g14cvBYFyJ5SaNOQbOUvBr9PKArcPcrNIeRsBdgcUzOGrhKveVpvOIGA==}
+  '@oxc-project/types@0.135.0':
+    resolution: {integrity: sha512-wR+xRdFkUBMvcAjBJ2q2kcZM6d+DKu2NgoOyxZgYwZdLhmiv6+rnO8PZ/P68kMiZtIKm+pW7zyEJ4kSOs0vo+Q==}
+
+  '@oxc-project/types@0.136.0':
+    resolution: {integrity: sha512-39Al/B3v9esnHCX7S8l9Se2+s2tb9b2jcMd+bZ2L659VG73kNyGPpPrL5Zi/p0ty7p4pTTU2/Dd+g27hv94XCg==}
 
   '@oxc-resolver/binding-android-arm-eabi@11.20.0':
     resolution: {integrity: sha512-IjfWOXRgJFNdORDl+Uf1aibNgZY2guOD3zmOhx1BGVb/MIiqlFTdmjpQNplSN58lhWehnX4UNqC3QwpUo8pjJg==}
@@ -3581,124 +3598,124 @@ packages:
     cpu: [x64]
     os: [win32]
 
-  '@oxfmt/binding-android-arm-eabi@0.52.0':
-    resolution: {integrity: sha512-17EMSJnQ9g+upVHrAUYDMfH5lvRKQ9Nvg8WtEoH72oDr1VpWz+7/o3tD97U1EToen2YAQ/68JmtDYkQUi20dfQ==}
+  '@oxfmt/binding-android-arm-eabi@0.55.0':
+    resolution: {integrity: sha512-+rFDOqQe5LOWgxrAJaZgLRudr6GQm0wGI6gtu7vVkrdLGjNMUSGbAlaCr8j7F2H2Er97vYQCU8WDb30onqMM1g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [android]
 
-  '@oxfmt/binding-android-arm64@0.52.0':
-    resolution: {integrity: sha512-A2G1IdwGEW2lLJkIxcvuirRH1CzSl/e0NX11zTlW1gvxJThfwbI/BEoaKrTNpm7M2FchvIf6guvIQU7d5iz+OQ==}
+  '@oxfmt/binding-android-arm64@0.55.0':
+    resolution: {integrity: sha512-ctulLq8s3x8Zmvw6+iccB09TIKERAklRSmbJ10gk8mlAn05qZxoyo52dj3Hi9IJcmDSwF54fQaTVh2CbL6PInw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [android]
 
-  '@oxfmt/binding-darwin-arm64@0.52.0':
-    resolution: {integrity: sha512-f9+bLvOYxy7NttCLFTvQ7afmqDOWY4wIP9xdvfj5trQ1qj6f2UFAGwZESlfsMjvJNTyRpXfIlOanCI9FOvoeQA==}
+  '@oxfmt/binding-darwin-arm64@0.55.0':
+    resolution: {integrity: sha512-xDQczLH9pw/RBk1h/GH0qcGMm8hQtmtVHBNLSH3lk1gEIR09hZ4L+mJQl4VqiVAvPK9VG9PYrWWuSQLt7xTbiA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [darwin]
 
-  '@oxfmt/binding-darwin-x64@0.52.0':
-    resolution: {integrity: sha512-YSTB9sJ5nnQd/Q0ddHkgof0ZCHPAnWZT1IW2SJ8omz7CP7KluJhO1fNHrpqdxCtpztJwSs4hY1uAee35wKxxaw==}
+  '@oxfmt/binding-darwin-x64@0.55.0':
+    resolution: {integrity: sha512-JaNoFCkF2CJdGgpPSMbuO9HVyXyoNGIhMHPvp6NYAjeVKw9XEYc0HcUWJLPQa3Q69WV5wMa9m5jPMJPtbLtcRg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [darwin]
 
-  '@oxfmt/binding-freebsd-x64@0.52.0':
-    resolution: {integrity: sha512-NIrRNTTPCs4UbmVs0bxLSCDlLCtIRMJIXklNKaXa5Oj2/K1UIMBvgE8+uPVo01Io3N9HF0+GAX+aAHjUgZS7vA==}
+  '@oxfmt/binding-freebsd-x64@0.55.0':
+    resolution: {integrity: sha512-DNbszhpg6S2MIzax5azdHFTTBIVkR5xr8yyRZuA4yoDAwOkzIp3tmldgKZM2+VlT+hJIG0xUksA+elISzMEAfA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [freebsd]
 
-  '@oxfmt/binding-linux-arm-gnueabihf@0.52.0':
-    resolution: {integrity: sha512-JXUCde8mn3GpgQouz2PXUokgy/uT1QrRJBL2s983VWcSQp62wTFYiNXgTKdeo1Jgbr0IgUnKKvzIk/YBlj/nVQ==}
+  '@oxfmt/binding-linux-arm-gnueabihf@0.55.0':
+    resolution: {integrity: sha512-2snoaoRfFFyGnbOcKUK36rREBYxe/Xgz3uHbiA5zbCB/s6R4DQj4mHqYAaWWhgizCUSDxV8cE9zAZ0XleNpKGw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxfmt/binding-linux-arm-musleabihf@0.52.0':
-    resolution: {integrity: sha512-psbUXaRZ+V8DaXz10Qf7LSHtdtdKAmC8fxXgeU608jjzrmWK4quamZMOpl6sf+dikoFHA85uE93Q0BqxrCdQrQ==}
+  '@oxfmt/binding-linux-arm-musleabihf@0.55.0':
+    resolution: {integrity: sha512-q1aktHF/WRpSK81BX1dE/9vWrS2jGw1Nax2kb4DBLGAewubCLcoNyp4Zl/NSMgbv3vUS46Z33wIQkBVYOP3PYg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxfmt/binding-linux-arm64-gnu@0.52.0':
-    resolution: {integrity: sha512-Jw7MgWUU9lcLCcy82updISP3EthTlfvAwR6gWNxPzqly7+fLvOi2gHQE9xXQjpqaVLm/8P+gOzlv9ODuoVlaaw==}
+  '@oxfmt/binding-linux-arm64-gnu@0.55.0':
+    resolution: {integrity: sha512-VD0y36aENezl/3tsclA/4G53Cc7iV+7Uoh7gz4yvcOTaEYBtJpQsE6PKDGTtUtOvGS4kv51ybfXY/nWZejO5IA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-arm64-musl@0.52.0':
-    resolution: {integrity: sha512-wZg6bLjDvh2KibyI3QFUYo8GTXneIFsd0JvehtvJiUmQ8WRPERgxd/VM4ctWb86U5FT1FkqgS8/wZKVB+AZScg==}
+  '@oxfmt/binding-linux-arm64-musl@0.55.0':
+    resolution: {integrity: sha512-r8xlKJFcsRmn0H5jZrdORae6RX9jDBrZVvOoxF+bCQtampQJClv80aZEHsv+NsLsp2KCE5ql79O7DpPVzYWpXA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@oxfmt/binding-linux-ppc64-gnu@0.52.0':
-    resolution: {integrity: sha512-IngE8uxhNvxcMrLjZNDo9xNLY7rEK33AKnaMd2B46he1e/mz2CfcW6If/U1wUjdRZddm1QzQaciqZkuMkdh1FA==}
+  '@oxfmt/binding-linux-ppc64-gnu@0.55.0':
+    resolution: {integrity: sha512-GRKv/HXHcwIVld/WU61rF0g0R16hl5EJ+ScKdpjevT57lnLnagj/U2YUbXf2mT+2Pg1uCzWC+mvGicPV3CDdLQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-riscv64-gnu@0.52.0':
-    resolution: {integrity: sha512-H3+DdFMv/efN3Efmhsv18jDrpiWWqKG7wsfAlQBqAt6z/E2Bx+TwEj2Nowe51CPOWB8/mFBC2dAMSgVFLvvowA==}
+  '@oxfmt/binding-linux-riscv64-gnu@0.55.0':
+    resolution: {integrity: sha512-rdv57enTiPtpSYRMKfAiEbQb0Puw5t9N7isVinDoo5qeLDScro2gznmZqSgSWbVZRzLisTeCTW8Qwgw0bOHv3A==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-riscv64-musl@0.52.0':
-    resolution: {integrity: sha512-zji+1kb7lJKohSDjzC1IsS+K/cKRs1hdVf0ZH0VbdbiakmtLvN9twBoXo/k8VdjFax7kfo+DyPxS7vv52br1aw==}
+  '@oxfmt/binding-linux-riscv64-musl@0.55.0':
+    resolution: {integrity: sha512-7v1nNrlD43VY6+sYQ6efYyb3lE6QY182304PD/768ZxTjOmFd/3dQa3u/nGBUAXYdGSWOQc5N3PnS0QzUXyEIA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [musl]
 
-  '@oxfmt/binding-linux-s390x-gnu@0.52.0':
-    resolution: {integrity: sha512-hcLBYedpCy7ToUvvBidWk7+11Yhg1oAZ4+6hKPic/mQI6NaqXJSXMps5nFlwUuX2ewhtLZZDPg63TI042qGKBg==}
+  '@oxfmt/binding-linux-s390x-gnu@0.55.0':
+    resolution: {integrity: sha512-f4lJLUSPOgScjFl9LiflKCTocyNRwE25JmTMbN4XQdDjoZzEHjqf3wA3VESF1/csg7i8m7+EQLbrZyYDqe10UQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-x64-gnu@0.52.0':
-    resolution: {integrity: sha512-IDO2loXK2OtTOhSPchU9MW25mWL2QCDGdJbjN8MXKZVS80qXe5gMTwQWu/gMJ3juoBHbkuUZNB2N1LHzNT7DoA==}
+  '@oxfmt/binding-linux-x64-gnu@0.55.0':
+    resolution: {integrity: sha512-MihqiPziJNoWy4MqNSV+jVA1g+07iQDjZiR0vaCaDoPgFEiJpCMsxamktzLV07cEeQsSJ04vQaU4CzCQwIvtDA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-x64-musl@0.52.0':
-    resolution: {integrity: sha512-mAV2Hjn0SatJ+KoAzKUC3eJhdJ8wv+3m1KyuS0dTsbF0c5weq+QrCt/DRZZM+uj/XiKzCDEUKYsBF30e2qkcyw==}
+  '@oxfmt/binding-linux-x64-musl@0.55.0':
+    resolution: {integrity: sha512-Yqghym7KYAVjP9MmSrNZiDeerMuoejNjo0r3ox5H3GDKk8eAfl8VyJm9i+pWCLDCTnAbcTUMMN2ZKjUYXH1v3g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@oxfmt/binding-openharmony-arm64@0.52.0':
-    resolution: {integrity: sha512-vd4npaUIwChxp7XzkqmepBWTT9YMcSe/NBApVGPC30/lLyOVaV3dvma1SKo03t8O73BPRAG7EyJzGlN5cJM5hQ==}
+  '@oxfmt/binding-openharmony-arm64@0.55.0':
+    resolution: {integrity: sha512-s5SDvVVSbyQl1V5UU3Yl12M+XLUQ3rl5SglNqgAA2K4PXUtQhyNSS00wivONPEnNo5W01rCou8WkDNyvI/RGHg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [openharmony]
 
-  '@oxfmt/binding-win32-arm64-msvc@0.52.0':
-    resolution: {integrity: sha512-k2sz6gWQdMfh5HPpIS+Bw/0UEV/kaK2xuqJRrWL233sEHx9WLlsmvlPFM4HUNThkYbSN0U0vPW7LVKZWDS8hPQ==}
+  '@oxfmt/binding-win32-arm64-msvc@0.55.0':
+    resolution: {integrity: sha512-7p9FB5R32tw2KyyNX3wpQrR2WHwEHvMEiBlGXxeTCaRMCVNx3UtFMAUbaQ/pRNWIrEUZmYhJ6tcUH52uPTRYjQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [win32]
 
-  '@oxfmt/binding-win32-ia32-msvc@0.52.0':
-    resolution: {integrity: sha512-rhke69GTcArodLHpjMTfNnvjTEBryDeZcUCKK/VjXDMtfTULl6QRh0ymX5/hbCUv2WjYm9h/QbW++q2vE15gWQ==}
+  '@oxfmt/binding-win32-ia32-msvc@0.55.0':
+    resolution: {integrity: sha512-ZYqj3fDnOT1IaVGMP5kpmkQl4F3tQIm2ZyAxvqkJYmI0xgWWak4ss4XYwv3VDfM+TWXeC9K4uQ/wW5jm/5XABA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ia32]
     os: [win32]
 
-  '@oxfmt/binding-win32-x64-msvc@0.52.0':
-    resolution: {integrity: sha512-q5xL7oeXkZdEtNZWBdvehJcmt+GRu9l2bK40yJs1jJXlqq+r0Hygb1rTjq+FM2o/2xyt4cufH6KRplHp3Jjsvw==}
+  '@oxfmt/binding-win32-x64-msvc@0.55.0':
+    resolution: {integrity: sha512-eEYT5tivGnGbPHuOHuQpi6CGLObhh0re/5jcNQHihD2GRYkTM85dyi5a19zjP8Q00t1uqAx+/QGLUGdHeqzWyg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [win32]
@@ -3733,139 +3750,140 @@ packages:
     cpu: [x64]
     os: [win32]
 
-  '@oxlint/binding-android-arm-eabi@1.67.0':
-    resolution: {integrity: sha512-VrSi571rDv1N8HaEDM+DEX8nmT0y9jJo8tzzW13vsOWTx59xQczCIJx68n2zWOXRT5YKZsOZXp4qkHN/10x4mw==}
+  '@oxlint/binding-android-arm-eabi@1.70.0':
+    resolution: {integrity: sha512-zFh0P4cswmRvw6nkyb89dr18rRanuaCPAsEXsFDoQY8WdaquI8Pt4NWFjaMJg6L23cy5NeN8J9cBnREbWzZhaw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [android]
 
-  '@oxlint/binding-android-arm64@1.67.0':
-    resolution: {integrity: sha512-l6+NdYxMoRohix5r5bbigW16LPicceCwGcQ6LKKuE1kUdjgFfQolJjrJsQYPFetIs78Gxj/G/f5TEGoTCwj9nQ==}
+  '@oxlint/binding-android-arm64@1.70.0':
+    resolution: {integrity: sha512-qI8o4HZjeGiBrWv+pJv4lH0Yi2Gl/JSp/EumBUApezJprIKa5PS4nU0lQsQngtky8k+SplQIOjv6hwu0SSxeyg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [android]
 
-  '@oxlint/binding-darwin-arm64@1.67.0':
-    resolution: {integrity: sha512-jOzXxS1AxFxhImLIRbtGIMrEwaXcgMw3gR57WB1cRk8ai+vpr6726kxXqVvlNsrXtJ/FrmOm8RxlC0m8SW24Qg==}
+  '@oxlint/binding-darwin-arm64@1.70.0':
+    resolution: {integrity: sha512-8KjgVVHI5F9nVwHCRwwA78Ty7zNKP4Wd9OeN5PSv3iu/F/u1RVXoOCgLhWqust6HmwQG6xc8c+RCyaWENy24+w==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [darwin]
 
-  '@oxlint/binding-darwin-x64@1.67.0':
-    resolution: {integrity: sha512-3DFAVY94OqjIZHXIPz37yGRSWwOFTAqChQ64/M69GYLawzP0KiwdhDNfqdKKYT0bTR/DNxmMnQsj3ns+8+X/Lg==}
+  '@oxlint/binding-darwin-x64@1.70.0':
+    resolution: {integrity: sha512-WVydssv5PSUBXFJTdNBWlmGkbNmvPGaFt/2SUT/EZRB6bq6bEOHmMlbnupZD5jmlEvi9+mZJHi8TCw15lyfSfQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [darwin]
 
-  '@oxlint/binding-freebsd-x64@1.67.0':
-    resolution: {integrity: sha512-e4dDKZuLu8TR9DEBssWSDahlPgZBwojTTHZUvnjBRJfJJbpxYCjfjKfi0Z1+CSLMiJBwI2yCDtRM1XJQaARjmg==}
+  '@oxlint/binding-freebsd-x64@1.70.0':
+    resolution: {integrity: sha512-hJucmUf8OlinHNb1R7fI4Fw6WsAstOz7i8nmkWQfiHoZXtbufNm+MxiDTIMk1ggh2Ro4vLzgQ+bKvRY54MZoRA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [freebsd]
 
-  '@oxlint/binding-linux-arm-gnueabihf@1.67.0':
-    resolution: {integrity: sha512-BKytFdcQzbITV3xlnzDUDTEDtbUMCCiC4EaNTDZ4FyT8gdNvBC4gfiLucXp/sQl0XU3p7syTlorUWVVVBZab2g==}
+  '@oxlint/binding-linux-arm-gnueabihf@1.70.0':
+    resolution: {integrity: sha512-1BnS7wbCYDSXwWzJJ+mc3NURoha6m6m6RT5c6vgAY3oz7C3OVXP+S0awo2mRq97arrJkVvO3qRQfyAHL+76xtQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxlint/binding-linux-arm-musleabihf@1.67.0':
-    resolution: {integrity: sha512-XYAv0esBDX7BpTzRDjVX2Vdj+zndd8ll2dFQiaeQ6zTZr7A8GRDTN7fH3FP3jU+O0vCDx85oH/EtG7BzPgAXuw==}
+  '@oxlint/binding-linux-arm-musleabihf@1.70.0':
+    resolution: {integrity: sha512-yKy/UdbR55+M2yEcuiV5DCNC/gdQAjr/GioUy50QwBzSrKm8ueWADqyRLS9Xk+qjNeCYGg6A8FvUBds56ttfqg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxlint/binding-linux-arm64-gnu@1.67.0':
-    resolution: {integrity: sha512-zizRMjA0i6u/2B0evgda04iycu+MoNuf1pBy6Eh+1CjC5wMEG7qN5zdDKTCvFc0KSYSDM9QTG3gjZHirgtQuKg==}
+  '@oxlint/binding-linux-arm64-gnu@1.70.0':
+    resolution: {integrity: sha512-0A5XJ4alvmqFUFP/4oYSyaO+qLto/HrKEWTSaegiVl+HOufFngK2BjYw9x4RbwBt/du5QG6l5q1zeWiJYYG5yg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-arm64-musl@1.67.0':
-    resolution: {integrity: sha512-zB/Tf6sUjmmvvbva9Gj3JTJ8rJ9t4I8/U0o6vSRtd0DRIsIuyegBwJAzhSUFQHdMijIRJkW0exs/yBhpw2S20w==}
+  '@oxlint/binding-linux-arm64-musl@1.70.0':
+    resolution: {integrity: sha512-JiylyurlB0CLSedNtx1gzv3FvfWPF1h/2Y3BJszPLNt5XQFlBsH5ke0Jle3iJb3uqu5m2e7A/DwzpuCAHdiU+A==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@oxlint/binding-linux-ppc64-gnu@1.67.0':
-    resolution: {integrity: sha512-kgU40Gt74CK0TCsF51KZymkIwN9U0BajKsMijB52zPqOeZU9NAHkA/NSQkZDHEaCakx42DxhXkODiAqf2b4Gug==}
+  '@oxlint/binding-linux-ppc64-gnu@1.70.0':
+    resolution: {integrity: sha512-J8VPG7I3/HmgaU4u8pNU2kFx2+0U+vPLS1dXFxXOaR/2TQ0f8AC7DRz0SRGRI1bfphnX2hVYTTtLuhL4nYKL+Q==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-riscv64-gnu@1.67.0':
-    resolution: {integrity: sha512-tOYhkk/iaG9aD3FvGpBFd1Lrw0x0RaVoJBxjUkfNzS50rC5NS5BteNCwgr8A2zCdADrIIoze6D7u6U5Ic++/iQ==}
+  '@oxlint/binding-linux-riscv64-gnu@1.70.0':
+    resolution: {integrity: sha512-N2+4lV2KLN+oXTIIIwmWDhwkrnvqf5oX7Hw0zPjk+RuIVgiBQSOlJWF7uQoFx2siEYX0ZQ5cfSbEAHm+J3t7Wg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-riscv64-musl@1.67.0':
-    resolution: {integrity: sha512-sEtywrPb+0b+tHYl1SDCrw903fiC4eyKoNqzP3v+f2JT3Xcv4NEYG+P8rj+eEnX7IWhqV/xj8/JmcmVj21CXaA==}
+  '@oxlint/binding-linux-riscv64-musl@1.70.0':
+    resolution: {integrity: sha512-1e2L7cFCvx9QDzq6NPP+0tABKb5z6nWHyddWTNKprEsjO9xNrAtPowuCGpjNXxkTdsMiZ4jc8YQ5SstZd4XK6g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [musl]
 
-  '@oxlint/binding-linux-s390x-gnu@1.67.0':
-    resolution: {integrity: sha512-BvR8Moa0zCLxroOx4vZaZN9nUfwAUpSTwjZdxZyKy4bv3PrzrXrxKR/ZQ0L9wNSvlPhnMJeZfa3q5w6ZCTuN6Q==}
+  '@oxlint/binding-linux-s390x-gnu@1.70.0':
+    resolution: {integrity: sha512-Kwu/l/8GcYibCWA9m9N5pRXMIKVSsL/YbgpLzYkqDhWTiqdRfnNJ/+nqIKRKQiFbHWsdlHEhzMwruJK+qcEruA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-x64-gnu@1.67.0':
-    resolution: {integrity: sha512-mm2cxM6fksOpq6l0uFws8BUGKAR4dNa/cZCn37Npq7PFbhD5HDJqWfnoIvTaeRKMy5XdS2tO0MA0qbHDrnXAAA==}
+  '@oxlint/binding-linux-x64-gnu@1.70.0':
+    resolution: {integrity: sha512-tap04CsHYOl0nSAQJfPNIuBxqEPB2HnhQqwaOXLg1jnp2XfRo8Fa814dA4QC4zpvTWXCjAAaCY1W5LOORkEQuQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-x64-musl@1.67.0':
-    resolution: {integrity: sha512-WmbMuLapKyDlobMkXAaAL0Y+Uczh4LETfIfQsUpbId4Ip8Ai82/jqeYTOoUCkuuhBFapgqP253+d83tLKOksJg==}
+  '@oxlint/binding-linux-x64-musl@1.70.0':
+    resolution: {integrity: sha512-hzJa/WgvtJpbBD9rgfy0qe+MjbxOXNUT0bfR1S6EQQzfTtBFA9xg5q8KSwRrQ2QfSS+TaP4j+4mVPQrfNc6UNg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@oxlint/binding-openharmony-arm64@1.67.0':
-    resolution: {integrity: sha512-9g/PqxYJelzzTAOR5Y+RiRqdeydhEuXv2KxNeFcAKQ7UsvnWSY1OP4MsuPMbTO2Pf70tz7mFhl1j13H3fyh+8g==}
+  '@oxlint/binding-openharmony-arm64@1.70.0':
+    resolution: {integrity: sha512-xbsaNSNzVSnaJACCUYr1HQMyY/Q/Q1LkePmHG3UvZPvGCYGNxrsZp9OmtA6ick8xH47ltRRbRrPCM1YXYcyC+A==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [openharmony]
 
-  '@oxlint/binding-win32-arm64-msvc@1.67.0':
-    resolution: {integrity: sha512-2VhwE6Gatb0vJGnN0TBuQMbKCOiZlSQ/zJvVWYLK4a9d4iDiJOen/yVQkGpmsJ90MuH66fzi0kEKI0jRQMDxGA==}
+  '@oxlint/binding-win32-arm64-msvc@1.70.0':
+    resolution: {integrity: sha512-icAEsUI7JbW1TMRdEXV83mVAInhRVQYuuAlPpxdGwJ95chNdnCzjloRW8GglT0WvzOEZSio6fnYSk2DJ2Hv7LQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [win32]
 
-  '@oxlint/binding-win32-ia32-msvc@1.67.0':
-    resolution: {integrity: sha512-EQ3VExXfeM1InbE5+JjufhZZTWy+kHUwgt3yZR7gQ47Je/mE0WspQPan0OJznh493L5anM210YNJtH1PXjTSFg==}
+  '@oxlint/binding-win32-ia32-msvc@1.70.0':
+    resolution: {integrity: sha512-FHMSWbVsPVs/f+Jcl04ws4JJ2wUnauyTzlpxWRG/lSO/8GpX08Fo2gQZqdA6CrRFI+zvkxl+N/KwJGWfUwYVZA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ia32]
     os: [win32]
 
-  '@oxlint/binding-win32-x64-msvc@1.67.0':
-    resolution: {integrity: sha512-bw24y+/1MHS4QDkons3YyHkPT9uCMoLHHgQhb+mb8NOjTYwub1CZ+K9Ngr8aO5DMrDrkqHwTzlTwFP2vS8Y/ZQ==}
+  '@oxlint/binding-win32-x64-msvc@1.70.0':
+    resolution: {integrity: sha512-ptOlKwCz7n4AKs5VweMqG6DAg677FmKOK+vBkkL9DMNgFATIQ+upqUYBTOEwRQyRAx1ncGlPlXleV2hIcm3z4g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [win32]
 
-  '@oxlint/plugins@1.61.0':
-    resolution: {integrity: sha512-nkOyZEF1vH527CkdQtOp1HMrVFEM4ResURvI2JFeGoup+h+43J/k/FgdOR9b9Isxg+Yae7qVDa7y3nssE8b3TQ==}
+  '@oxlint/plugins@1.68.0':
+    resolution: {integrity: sha512-titLmukUt/h8ho7Svlf0xSBjoy2ccZKrXjpXpZCj+v6V4CJccC2KyP45BLSCMx8YIpifMyiDyUptM4+5sruKbQ==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
 
   '@pkgr/core@0.2.9':
     resolution: {integrity: sha512-QNqXyfVS2wm9hweSYD2O7F0G06uurj9kZ96TRQE5Y9hU7+tgdZwIkbAKc5Ocy1HxEY2kuDQa6cQ1WRs/O5LFKA==}
     engines: {node: ^12.20.0 || ^14.18.0 || >=16.0.0}
 
-  '@playwright/test@1.60.0':
-    resolution: {integrity: sha512-O71yZIbAh/PxDMNGns37GHBIfrVkEVyn+AXyIa5dOTfb4/xNvRWV+Vv/NMbNCtODB/pO7vLlF2OTmMVLhmr7Ag==}
+  '@playwright/test@1.61.0':
+    resolution: {integrity: sha512-cKA5B6lpFEMyMGjxF54QihfYpB4FkEGH+qZhtArDEG+wezQAJY8Pq6C7T1SjWz+FFzt3TbyoXBQYk/0292TdJA==}
     engines: {node: '>=18'}
+    hasBin: true
 
   '@polka/url@1.0.0-next.29':
     resolution: {integrity: sha512-wwQAWhWSuHaag8c4q/KN/vCoeOJYshAIvMQwD4GpSb3OiZklFfvAgmj0VCBBImRpuF/aFgIRzllXlVX93Jevww==}
@@ -4122,7 +4140,7 @@ packages:
     resolution: {integrity: sha512-J4RZarRvQAm5IF0/LwUUg+obsm+xZhYnbMXmXROyoSE1ATJe3oXSb9L5MMppdxP2ylNSjv6zFBwKYjcKMucVfA==}
     engines: {node: '>=14.0.0'}
     peerDependencies:
-      rollup: 4.61.1
+      rollup: 4.62.2
     peerDependenciesMeta:
       rollup:
         optional: true
@@ -4131,41 +4149,41 @@ packages:
     resolution: {integrity: sha512-5EdhGZtnu3V88ces7s53hhfK5KSASnJZv8Lulpc04cWO3REESroJXg73DFsOmgbU2BhwV0E20bu2IDZb3VKW4Q==}
     engines: {node: '>=14.0.0'}
     peerDependencies:
-      rollup: 4.61.1
+      rollup: 4.62.2
     peerDependenciesMeta:
       rollup:
         optional: true
 
-  '@sentry-internal/browser-utils@10.57.0':
-    resolution: {integrity: sha512-tXObp954rMTSYKlbftjVXHtNl4t/6ssks3jkqyzmKb+PDPWzabGQO7sWwqVuTjT8Kx/8A3FmriS1bGmqxiJy3A==}
+  '@sentry/browser-utils@10.59.0':
+    resolution: {integrity: sha512-DpJIrNi0Hsj/YONTZ8km1wv7ue2NzrTmFKJ3lRW8Q2nS/mrMeP3LCvjreLtKheTouB4go58NxM68AEFbXk4rPg==}
     engines: {node: '>=18'}
 
-  '@sentry-internal/feedback@10.57.0':
-    resolution: {integrity: sha512-ZcF4QhkqGX3iiQSXB2N0N3Awp+j5iqnDRu6PA/qyLFrWqH5ZiiAAgu59OLD9E6XAdg6iFtLYw19MAMZVK8qNOQ==}
+  '@sentry/browser@10.59.0':
+    resolution: {integrity: sha512-d0o0oc78KNWCZ6yq9gREf9BPXWza/Wj9W+nCm0CvPD5k2IbouD/eJsm2Mb+d53YfEm12L+SePfgOx01KbbVx4A==}
     engines: {node: '>=18'}
 
-  '@sentry-internal/replay-canvas@10.57.0':
-    resolution: {integrity: sha512-zsfa4JcfV0AEc9YhNxNabd5lSZL2Av84saAyexGAqcHs+67m9Gd0cGStOzMb/nCl7UAtmdP0aI+G7a3rcxxN/A==}
+  '@sentry/core@10.59.0':
+    resolution: {integrity: sha512-QeG7XZL5j6CkToYCE7OwCerb/r742Tjj9p1BBohBKcypYTPRuqfD+A3FeUj7pk5CGO6Vj1/gOAmdbuuNbR51dQ==}
     engines: {node: '>=18'}
 
-  '@sentry-internal/replay@10.57.0':
-    resolution: {integrity: sha512-Wmnx/6ABynVH1iwuoNUqJNyjIUqsqoGML7qsyivBRKb5Wo2YQtPOQlQYfxfZSvWzGpcoSVdInkRjDssUQxQEQg==}
+  '@sentry/feedback@10.59.0':
+    resolution: {integrity: sha512-Sa/06LlG/mYR4z8/JlxOwvkcOHJnaMW6JyTMKNsgEoR1SHZULIpirjUuHIp4P+7R1mqX/KGTj8I7SQ3adA0TxQ==}
     engines: {node: '>=18'}
 
-  '@sentry/browser@10.57.0':
-    resolution: {integrity: sha512-s36AQy/CKXTfyY9Z+qUhzNomntZXgfs0rbaK7q9ffnFkqcPwzE8qQtVs58y3Suut56u+AhwSztgQtERcuZ5VIA==}
-    engines: {node: '>=18'}
-
-  '@sentry/core@10.57.0':
-    resolution: {integrity: sha512-kntItTA2kiT0YpL7encXaF6mkdZMB+y48lwj8w1wkfBpfJAC7sifdgrzLQZqmsqVNE3crg9VfufaAGA+78uFMg==}
-    engines: {node: '>=18'}
-
-  '@sentry/react@10.57.0':
-    resolution: {integrity: sha512-6QThwQ4XWQ2rwKZEVQ9P9WKl7JlowC7S5LpAvmMdrwlfJBpLDFOsM7tycnIvbXTXf0ZOOuLFPa4L4YYbdyNGmA==}
+  '@sentry/react@10.59.0':
+    resolution: {integrity: sha512-B3MmXooGLnTu0gyL8hxElCu1+WVEXjIGoDPvGqn5qMHZNSmB2oPTAt1/UutuxAc6EWu2UKIHnyPowNeY2MPH3g==}
     engines: {node: '>=18'}
     peerDependencies:
       react: ^16.14.0 || 17.x || 18.x || 19.x
 
+  '@sentry/replay-canvas@10.59.0':
+    resolution: {integrity: sha512-bJkqvxQiat27P7+hUYC/m545Ct/uVxZCjh+PeCFdRcuHnZZ92e6Z7XPLf0LqAR6tR1U7wDUa4V5ugrMIEz+vpQ==}
+    engines: {node: '>=18'}
+
+  '@sentry/replay@10.59.0':
+    resolution: {integrity: sha512-fpHL25JErsSfTyusuyZ3Q5JmRZeWYWynJO3PNiQH6A/58EqaCp8U5y8LCJ+CSPaeuBMka3S3Qn6U4eXcvkDMRA==}
+    engines: {node: '>=18'}
+
   '@shikijs/core@4.2.0':
     resolution: {integrity: sha512-Hc87Ab1Ld/vEbZRCbwx344I5v+4RU8CVToUTRkqXL1+TjbuOp9U5Xa0M23V4GEWHxVn+yO5otb+HkQVm3ptWQQ==}
     engines: {node: '>=20'}
@@ -4200,6 +4218,7 @@ packages:
   '@shuding/opentype.js@1.4.0-beta.0':
     resolution: {integrity: sha512-3NgmNyH3l/Hv6EvsWJbsvpcpUba6R8IREQ83nH83cyakCw7uM1arZKNfHwv1Wz6jgqrF/j4x5ELvR6PnK9nTcA==}
     engines: {node: '>= 8.0.0'}
+    hasBin: true
 
   '@sindresorhus/base62@1.0.0':
     resolution: {integrity: sha512-TeheYy0ILzBEI/CO55CP6zJCSdSWeRtGnHy8U8dWSUH4I68iqTsy7HkMktR4xakThc9jotkPQUXT4ITdbV7cHA==}
@@ -4214,50 +4233,50 @@ packages:
   '@standard-schema/spec@1.1.0':
     resolution: {integrity: sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==}
 
-  '@storybook/addon-a11y@10.4.4':
-    resolution: {integrity: sha512-/eUCx/6Ozq5grauwm/NqKtlW0oJ26b6GNesXrMuFID8WLg/qLEKf79Awfz9XrmyWxe7loD40K952r7AA5Oc23A==}
+  '@storybook/addon-a11y@10.4.6':
+    resolution: {integrity: sha512-XCJy+f0DFOiCgUU9knRDlLDxVFI+AAQ3/wE/NF85zB9iDPPS2DwkSN+mas3zDgHt66zhN8Cq3/UiyCDUweV9Zw==}
     peerDependencies:
-      storybook: ^10.4.4
+      storybook: ^10.4.6
 
-  '@storybook/addon-docs@10.4.4':
-    resolution: {integrity: sha512-yPshCvtmQTq52T2sXuXgjy7B/QbhA/WIZxLYggptNjBL8BJMvbOfp9bAfCKh7+KpRWGqDZ6Y6tWL1Q48Wj3vtw==}
+  '@storybook/addon-docs@10.4.6':
+    resolution: {integrity: sha512-aWAfP5JMiT5a3zBJizwroCRzOCqZwDTJmvsYvwMD3ilIEa/kT1vhf6Xrbk4XIPhDwbh8Hpb/Gfnka1xBYEISWg==}
     peerDependencies:
       '@types/react': ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
-      storybook: ^10.4.4
+      storybook: ^10.4.6
     peerDependenciesMeta:
       '@types/react':
         optional: true
 
-  '@storybook/addon-links@10.4.4':
-    resolution: {integrity: sha512-sWydPWLgduT24p/NJ/hXHcHsPlAyzQP+cOtCGliSI989K9yBP/TOL3A8sz7LIDfukI9DVAsylPhJ1jDSiAEI1w==}
+  '@storybook/addon-links@10.4.6':
+    resolution: {integrity: sha512-VGfERTsGRFmfvNP3SKprFWkC6Od5kXzSutT5PSZjQ/O9NnCdHhd/RILxFDN2TzZn9ywDc7t5b4AldKmSYCv3EQ==}
     peerDependencies:
       '@types/react': ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
       react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
-      storybook: ^10.4.4
+      storybook: ^10.4.6
     peerDependenciesMeta:
       '@types/react':
         optional: true
       react:
         optional: true
 
-  '@storybook/addon-onboarding@10.4.4':
-    resolution: {integrity: sha512-ZTWGm8VXQUTepV4aEmIgHxdY7JMtn57H3uYnM3HD+qR8fmAcpLPoJ9ffXaMWUwsjK6SeferQyDTRN3q3Jd5+mg==}
+  '@storybook/addon-onboarding@10.4.6':
+    resolution: {integrity: sha512-BzTu5LW5Ygwv0BbmQM0QohGS5Uoa8GjSxPcZFCQ1iQfizUukKnd72UIsPDZBKjVytO0DbZ3YoM1Ww5+KL6ZXEg==}
     peerDependencies:
-      storybook: ^10.4.4
+      storybook: ^10.4.6
 
-  '@storybook/addon-themes@10.4.4':
-    resolution: {integrity: sha512-VH443z7o/JO5K9QFVuB9IzwaMu0jEiq4ybpzTlAmt0ZUEqNBuM+ESBvkVMkZ5QeNghKrs/J9yvum2g2t94YR4Q==}
+  '@storybook/addon-themes@10.4.6':
+    resolution: {integrity: sha512-80d622oB9xWZs3VH4uywkLOA5L2DAx04lVouvCM4XH+pLnJElidoylOLm3i3ByvlGkRjCbB27OUVsW94IgyDrw==}
     peerDependencies:
-      storybook: ^10.4.4
+      storybook: ^10.4.6
 
-  '@storybook/addon-vitest@10.4.4':
-    resolution: {integrity: sha512-VPpBwf1Elr+0g33am8ZE6aHhLB+r1TPxUsnDuCVNhxGjRxMFyQkAE8+jPJFPvS/YIUGMbVXarzaV7PcI/sJuVQ==}
+  '@storybook/addon-vitest@10.4.6':
+    resolution: {integrity: sha512-VvskHge0GZy86LG6kcY5Ww34z8rDV8JBxqSdUpcJVsWfIvyX6MfAbqI76LlereSyBIJGZJZsqaLwRXsQoVY+0Q==}
     peerDependencies:
       '@vitest/browser': ^3.0.0 || ^4.0.0
       '@vitest/browser-playwright': ^4.0.0
       '@vitest/runner': ^3.0.0 || ^4.0.0
-      storybook: ^10.4.4
-      vitest: ^3.0.0 || ^4.0.0
+      storybook: ^10.4.6
+      vitest: 4.1.9
     peerDependenciesMeta:
       '@vitest/browser':
         optional: true
@@ -4268,18 +4287,18 @@ packages:
       vitest:
         optional: true
 
-  '@storybook/builder-vite@10.4.4':
-    resolution: {integrity: sha512-VyuZ4mEvhhVXjJa1qXMWKH8ohnas0rgEuJDf6u4aJ54XeENFebPUEAHde1Qo2PflJ4rUdVdXieOZzKbYwP5RAQ==}
+  '@storybook/builder-vite@10.4.6':
+    resolution: {integrity: sha512-BHBtD81HiXUiDQz/CaFynLtWmm7AFUQn8VnXuHipZ8KlnUANopa4yqdVuy/Gwz8ub254uFI5NMZsW/KlgWNgNg==}
     peerDependencies:
-      storybook: ^10.4.4
+      storybook: ^10.4.6
       vite: ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0
 
-  '@storybook/csf-plugin@10.4.4':
-    resolution: {integrity: sha512-1mzZyAwVUmAcw4WEUsJDVdSupkJf+Kf/f5uNAs4RzlBXA75P8YRkDKAb2EoMwsB5URiXFi9XoeAN/vWke0G6+w==}
+  '@storybook/csf-plugin@10.4.6':
+    resolution: {integrity: sha512-NILLxDqpA/JR/AazGWpsz+4fadJwRU4uhHephGtYpVOWnQA/DkJfKT6zpcJVq8+QA8A2zKMLX3GVKsXIrxjuDA==}
     peerDependencies:
       esbuild: ^0.28.1
-      rollup: 4.61.1
-      storybook: ^10.4.4
+      rollup: 4.62.2
+      storybook: ^10.4.6
       vite: '*'
       webpack: '*'
     peerDependenciesMeta:
@@ -4301,15 +4320,15 @@ packages:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
 
-  '@storybook/nextjs-vite@10.4.4':
-    resolution: {integrity: sha512-pmihRfZSNLG6w+jQuqwv+vlC8JWGWfBnlHIFrle9HpNxqJDeKxKfjjDAjjgB+LUgbFz348TXbjzkZjJc5hFTOQ==}
+  '@storybook/nextjs-vite@10.4.6':
+    resolution: {integrity: sha512-o8vkNqJPY0oq5qGAcwjiyZoZUsfhk7eIU1mjgtYbNoJhA1/NshU7pIaFSTfFjMRs1i43Df8hqS5JmyjP8r+bUg==}
     peerDependencies:
       '@types/react': ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
       '@types/react-dom': ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
       next: ^14.1.0 || ^15.0.0 || ^16.0.0
       react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
-      storybook: ^10.4.4
+      storybook: ^10.4.6
       typescript: '*'
       vite: ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0
     peerDependenciesMeta:
@@ -4320,36 +4339,36 @@ packages:
       typescript:
         optional: true
 
-  '@storybook/react-dom-shim@10.4.4':
-    resolution: {integrity: sha512-y6SObmoW78AydE6VfKQSUmCkuqiaMPy9LgMpMdMEyWfJ/pSxBDMIKycr9dlRMJP1cvNgByaJgrusWtA46ndSQw==}
+  '@storybook/react-dom-shim@10.4.6':
+    resolution: {integrity: sha512-iGNmKzrq9vgl2PDrYAnZKI+yvac3Ym+lJXXuQaqlFRS23zA5MNm4EBX+rAG7WulqchoK6NaZ0KQOs2mAgEpTMg==}
     peerDependencies:
       '@types/react': ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
       '@types/react-dom': ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
       react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
-      storybook: ^10.4.4
+      storybook: ^10.4.6
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@storybook/react-vite@10.4.4':
-    resolution: {integrity: sha512-hXw1c9Jq2eFzwmJ3u9phmszbHoPjwPLYjcR1Grd6Xbe2g3bReGH35urm/fTZ0HNdjXAgQlUaXp2bWw6vz0BHQw==}
+  '@storybook/react-vite@10.4.6':
+    resolution: {integrity: sha512-0arEQtybqGYXHbXpTot+Wv9YtG+V5Vp43QayXavPKQ20M8mpEzhyCPKd0EhqMGSC1Z1UEt0hm365WUBhI9LfKA==}
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
-      storybook: ^10.4.4
+      storybook: ^10.4.6
       vite: ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0
 
-  '@storybook/react@10.4.4':
-    resolution: {integrity: sha512-6K5/uHrvjswrueyVpUt6IWGuSgYCMtMOYyVs86XJZYqKBV3Pv7nGsGNH7YSMLAVQBZW4CQqm2etd5Op0GHY9Kg==}
+  '@storybook/react@10.4.6':
+    resolution: {integrity: sha512-9Y7YecrVFe1/01KYjfOLxVqTg2Aq+IO6TEv6sC2U0PfD0AWCSCmQ91QqgBpN/XW4aFFWoiZNinyXMUlU8zxy2w==}
     peerDependencies:
       '@types/react': ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
       '@types/react-dom': ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
       react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
-      storybook: ^10.4.4
+      storybook: ^10.4.6
       typescript: '>= 4.9.x'
     peerDependenciesMeta:
       '@types/react':
@@ -4566,8 +4585,8 @@ packages:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
 
-  '@tanstack/react-virtual@3.14.2':
-    resolution: {integrity: sha512-IpWnmCLvuymRfeeLNVXIzNEYBFLpd3drVIS91sqV78VTZFyldlChkOocZRCPp1B+Wnk09bcLNme8WaMU/9/9bQ==}
+  '@tanstack/react-virtual@3.14.3':
+    resolution: {integrity: sha512-k/cnHPVaOfn46hSbiY6n4Dzf4QjCGWSF40zR5QIIYUqPAjpA6TN7InfYmcMiDVQGP2iUn9xsRbAl8u1v3UmeVQ==}
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
@@ -4575,8 +4594,8 @@ packages:
   '@tanstack/store@0.11.0':
     resolution: {integrity: sha512-WlzzCt3xi0G6pCAJu1U+2jiECwabETDpQDi3hfkFZvJii9AuZqEKbOiVarX1/bWhTNjU486yQtJCCasi/0q+Cw==}
 
-  '@tanstack/virtual-core@3.17.0':
-    resolution: {integrity: sha512-gOxY/hFkPh/XQYhnThBHzkbkX3Ed+z/iushyz+R+JAr213aXxUDgQoTgTdrDpBSRsjFM73P/KfUyWmaF9WHMkQ==}
+  '@tanstack/virtual-core@3.17.1':
+    resolution: {integrity: sha512-VZyW2Uiml5tmBZwPGrSD3Sz73OxzljQMCmzYHsUTPEuTsERf5xwa+uWb01xEzkz3ZSYTjj8NEb/mKHvgKxyZdA==}
 
   '@teppeis/multimaps@3.0.0':
     resolution: {integrity: sha512-ID7fosbc50TbT0MK0EG12O+gAP3W3Aa/Pz4DaTtQtEvlc9Odaqi0de+xuZ7Li2GtK4HzEX7IuRWS/JmZLksR3Q==}
@@ -4611,20 +4630,20 @@ packages:
     peerDependencies:
       '@testing-library/dom': '>=7.21.4'
 
-  '@tsslint/cli@3.1.3':
-    resolution: {integrity: sha512-W+SZhIewVWG2aF51TkPv4EwY2PCYQzsUgRXmjtamYRs06QWJn7X67bf+ZroZMGTg2eeajy6+LKGWV39KGsDFOQ==}
+  '@tsslint/cli@3.1.4':
+    resolution: {integrity: sha512-svoLfFkoWmdsDrIRLllFnrxydfMjKKZ1UBjv7Sua1KjFkx6VaJ88+YGYqNiTbB/dDcU10qnSMXRavNTJ0fjBkQ==}
     engines: {node: '>=22.6.0'}
     hasBin: true
     peerDependencies:
       typescript: '*'
 
-  '@tsslint/compat-eslint@3.1.3':
-    resolution: {integrity: sha512-3dH4nocZS/WY+a8N0TGawISEmAMxWOqEqX0YD18eTbOo9YBHVAhrQmPFA2AoEeBxR5+N8xbVYxVJ1b6K8yE8CA==}
+  '@tsslint/compat-eslint@3.1.4':
+    resolution: {integrity: sha512-aMSOnAHC/sJFGM21I1/rFzwNLyfbW2BVRivsP1xDgRwrt3+WfLT/eVU2HMEtS8J6XVPNkQ4bKD4Uk1lRpYaNlA==}
     peerDependencies:
       typescript: '*'
 
-  '@tsslint/config@3.1.3':
-    resolution: {integrity: sha512-gquCvrctDv1n2T+gdja0jnoDm+U/mwwYU01iaNglt+MHO6VAZRyTJaxtu72IMTPwo73pOfiummFTHaLdifIXJQ==}
+  '@tsslint/config@3.1.4':
+    resolution: {integrity: sha512-6VcUimc170M1v3b0vmOhRW7NI/b7DqXB5Wpo+1wCNLprDTN1HwjsbfdFNm/nsd0jXWChNr/cJhmsnVp4xHDCKw==}
     engines: {node: '>=22.6.0'}
     hasBin: true
     peerDependencies:
@@ -4636,12 +4655,12 @@ packages:
       tsl:
         optional: true
 
-  '@tsslint/core@3.1.3':
-    resolution: {integrity: sha512-X/XiTj3w4tZhy4yh/zvTR/Z0Nb68Ul/uiQGsdKE/ClUCK0Iu7wDpuO7PKH+yj16eg02+l7kD6ojhJKL7aXibaA==}
+  '@tsslint/core@3.1.4':
+    resolution: {integrity: sha512-C4bUPiZ6ZWemh/GIuH6RH+frGHLH7wh3HI3d4cEQiOUoICmFidEkdfq5YDI/Bfdeqol5Ezyp5GzyHaXq+wU2fA==}
     engines: {node: '>=22.6.0'}
 
-  '@tsslint/types@3.1.3':
-    resolution: {integrity: sha512-KskQ8bFj3DY0Esg8Fe9K3qZxiW7HOV3c+HuqwVGXR5s1LMmIooB2uG4Bb0Tpj7p5GMedhmfQjz3JoAWDa27FWA==}
+  '@tsslint/types@3.1.4':
+    resolution: {integrity: sha512-YMLUQwG/cGlvoCEg1WVAq0EmmoHOzJ/WkenKWP7tFfQnTk4wIyZgOMIQkvYBcREPin7OVbLlaAEOH9eTr8SUUA==}
 
   '@tybys/wasm-util@0.10.1':
     resolution: {integrity: sha512-9tTaPJLSiejZKx+Bmog4uSubteqTvFrVrURwkmHixBo0G4seD0zUxp98E1DzUBJxLQ3NPwXrGKDiVjwx/DpPsg==}
@@ -4814,6 +4833,9 @@ packages:
   '@types/node@25.9.3':
     resolution: {integrity: sha512-603BddQMv3pUcr4U2dhujk83N2tTDVr/34wII2B6bJy6g+8WD6yUb11jszNs0gdi4PesVWl7ABt8nYMVpnLUcg==}
 
+  '@types/node@25.9.4':
+    resolution: {integrity: sha512-dszCsrKb5U7ZsVZBWiHFklTloVl0mSEnWH/iZXfZUlI4rzCUnsvGmgqfuVRHL54ugE7/wRuxEIXRa2iMZ+BG6g==}
+
   '@types/normalize-package-data@2.4.4':
     resolution: {integrity: sha512-37i+OaWTh9qeK4LSHPsyRC7NahnGotNuZvjLSgcPzblpHB3rrCJxAOgI5gCdKm7coonsaX1Of0ILiTcnZjbfxA==}
 
@@ -4866,6 +4888,14 @@ packages:
       eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
       typescript: '>=4.8.4 <6.1.0'
 
+  '@typescript-eslint/eslint-plugin@8.61.1':
+    resolution: {integrity: sha512-ZPlVl3PB3et/59Ne0fv/sci6ZXz4T4Hp4nTJ56i/Y0gR89ARb+KphojTq6j+56E5PIezmOIOOWyY+aWQFd+IkQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      '@typescript-eslint/parser': ^8.61.1
+      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
+      typescript: '>=4.8.4 <6.1.0'
+
   '@typescript-eslint/parser@8.61.0':
     resolution: {integrity: sha512-5B7PfA2e1NQGCnDHd/0lW7W3gvp3d59Ryw54FYO8Uswxo9f6ikw3AZV+Xj/TvpImmpsiYyUqAfhC6kJID1jF6w==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
@@ -4873,22 +4903,45 @@ packages:
       eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
       typescript: '>=4.8.4 <6.1.0'
 
+  '@typescript-eslint/parser@8.61.1':
+    resolution: {integrity: sha512-PJ5vePq5/ognBbrIcoC5+SHO5dfpeLPzP9FpLkzWrguoYQEeeSjlJpVwOpo1JRSTEi7dRcwNy4h4dzV70PqHcg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
+      typescript: '>=4.8.4 <6.1.0'
+
   '@typescript-eslint/project-service@8.61.0':
     resolution: {integrity: sha512-DV42F7MLJO6Rax7SK1yg43tcnEfGUrurSpSxKuVX+a3RCTzBlH3fuxprrOJXKCJGAaw82xXocikJ0uQaqwXgGA==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       typescript: '>=4.8.4 <6.1.0'
 
+  '@typescript-eslint/project-service@8.61.1':
+    resolution: {integrity: sha512-PrC4JYGmR241lYnfhmKGTXkFqv8+ymbTFgSAY0fVXpY82/QkMw5TZPl+vGzuDDU2QYJk9fIDOBTntF+yDv9LEA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      typescript: '>=4.8.4 <6.1.0'
+
   '@typescript-eslint/scope-manager@8.61.0':
     resolution: {integrity: sha512-IWdXFHFSb6mlC3HPc7QsLDm5zYEbUla6trDEHf32D3/dnuUyXd87plScSNXSbm0/RxMvObpI17sv/EDTGrGZkA==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
+  '@typescript-eslint/scope-manager@8.61.1':
+    resolution: {integrity: sha512-L2bdIeoQS8FlKAvONAr20w6OcLXeB+qiDKbAooS9A0Ben+iSIkBef0FxqwKWYqt5sa0i4KJtxVyVmhMylKzF5w==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
   '@typescript-eslint/tsconfig-utils@8.61.0':
     resolution: {integrity: sha512-O5Amvdv9ztMpxpf+vmFULGG78IE6Qwdr3bCGvqwG4nwc9H2qXkOYJJnRbRHyMkQTjv1d03olqwwwzHLMqpFePQ==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       typescript: '>=4.8.4 <6.1.0'
 
+  '@typescript-eslint/tsconfig-utils@8.61.1':
+    resolution: {integrity: sha512-UN/H4di+OO7EWx2ovME+8t31YO+KVnK0RRKEHR3kOt21/Ay8BOq3M1OMvWs5vNiqcFCYGYoxK3MXPZzmMUE+yg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      typescript: '>=4.8.4 <6.1.0'
+
   '@typescript-eslint/type-utils@8.61.0':
     resolution: {integrity: sha512-TuBiQYIkd97yBfInHCTKVYMbX4kvEmpOEuixIuzCU9p8BGT1SfyyO0d0IfDMbPIHcjn/hWnusUX5e8v5Xg+X8A==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
@@ -4896,16 +4949,33 @@ packages:
       eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
       typescript: '>=4.8.4 <6.1.0'
 
+  '@typescript-eslint/type-utils@8.61.1':
+    resolution: {integrity: sha512-GYRicKmVK0C4fsKgaACaknOUAq9Oa2kwsjnpFhFcS/5p4Ht5IP9OVLbgIgcK4SRk92nVHFluurg1lumD9dBcLw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
+      typescript: '>=4.8.4 <6.1.0'
+
   '@typescript-eslint/types@8.61.0':
     resolution: {integrity: sha512-9QTQpZ5Iin4CdIodfbDQFSeiSJKidgYJYug1P9CC2xWgUTvlmixViqDZNciMjwLBZyJnG4tGmPl97rVAFb1AJg==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
+  '@typescript-eslint/types@8.61.1':
+    resolution: {integrity: sha512-G+CRlPqLv7Bz1IZVs03x5K59F1veqL0EJUROAdGhKsEq8qOiRiZbI+HUojPq5l0fEGOKModD9br6lObhB8zkoA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
   '@typescript-eslint/typescript-estree@8.61.0':
     resolution: {integrity: sha512-42zatd5qSvvcV1JdDBCLxYRznvP4eIHpPoZXdkPFnAmanA4FuZ5dibSnCBggY8hQnqajPpoGjXFdZ7fIJKQnlA==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       typescript: '>=4.8.4 <6.1.0'
 
+  '@typescript-eslint/typescript-estree@8.61.1':
+    resolution: {integrity: sha512-u+oQD3BqYWPc8YV9Zab4vaJElJuwOLPRc10Jm1o/qS+6Qwen14HCWwx0Seo4LnSn2wxea2Ik8DxPt2/FHmuhrg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      typescript: '>=4.8.4 <6.1.0'
+
   '@typescript-eslint/utils@8.61.0':
     resolution: {integrity: sha512-3bzFt7ImFMW/jVYwJamDoe/dMOdFLSC6pom6rRjdh4SZJEYupyMzem8e7vKZLclLfpHjlwSAXOUxtKxGXUiLqA==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
@@ -4913,54 +4983,65 @@ packages:
       eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
       typescript: '>=4.8.4 <6.1.0'
 
+  '@typescript-eslint/utils@8.61.1':
+    resolution: {integrity: sha512-1+P/3Dj6jvtybE1q0HQ6yBt/gq+oKJyLdEv4HdnqasaEXRSYCAsD59mXEVQnM/ULNdQxbX77tdG4jPRjIS6knA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
+      typescript: '>=4.8.4 <6.1.0'
+
   '@typescript-eslint/visitor-keys@8.61.0':
     resolution: {integrity: sha512-QVLZu3ZPQEE+HICQyAMZ2yLQhxf0meY/wx6Hx14YcTNj13JB3qHlX3lJ02L3fLGHgERRH71kvYDwiXIguT3AjQ==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  '@typescript/native-preview-darwin-arm64@7.0.0-dev.20260613.1':
-    resolution: {integrity: sha512-znTFp/M0SpN91/FM3FrsTycdTZr+bLszmHObm2LaR5sgo1c2wiK4qYsMnrhLeP0vSMD2LuiNg5J21501h7Aj6g==}
+  '@typescript-eslint/visitor-keys@8.61.1':
+    resolution: {integrity: sha512-6fJ9MHWtK14C1DSkiMlHUSOmrVebL7150xZJBlJiL62jjhIA4JmOq6flwBgDxIdBKKdoiZRel+dfPD5MLfny3w==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@typescript/native-preview-darwin-arm64@7.0.0-dev.20260620.1':
+    resolution: {integrity: sha512-1qwEjLW1JCRkDYrS8OyWdfXoL9bNHV28kP3ouQxytZmNpghWSMKZutsxDjVVbnlsbydBdYqqZMttPuTUlm3y0A==}
     engines: {node: '>=16.20.0'}
     cpu: [arm64]
     os: [darwin]
 
-  '@typescript/native-preview-darwin-x64@7.0.0-dev.20260613.1':
-    resolution: {integrity: sha512-7zXTq3SVw6XCLdm06VRIhMzayG032Ky14xCZ3isnlcm1KD/p4Ev4XL9TN9fZmIV0bVPGMQr4qGS7a2+te8x7lg==}
+  '@typescript/native-preview-darwin-x64@7.0.0-dev.20260620.1':
+    resolution: {integrity: sha512-/Z5Jx8V22RTuHSVR/QCbCT2eFq6NoYc5oLah5/yDoymZaTlmvuwuc50N6y9YXF0zAh+z4QGoyAqd561cAGSNOA==}
     engines: {node: '>=16.20.0'}
     cpu: [x64]
     os: [darwin]
 
-  '@typescript/native-preview-linux-arm64@7.0.0-dev.20260613.1':
-    resolution: {integrity: sha512-yYiDEMT4ok7Wd1VtbyB+0YqBdTkU/yzE36edZCbfA/Ljt6L1xZMEn0a7XGlmRtRfwPGHfjtFRFsxrA2nc7jHnw==}
+  '@typescript/native-preview-linux-arm64@7.0.0-dev.20260620.1':
+    resolution: {integrity: sha512-rz7JoRJE5zaL2RoTOHLUliz6UkDqjUngJEF1/GiSR032v8k8tp8GTezxFoosaCssQSf80cjA5wYup5zrCp4zIg==}
     engines: {node: '>=16.20.0'}
     cpu: [arm64]
     os: [linux]
 
-  '@typescript/native-preview-linux-arm@7.0.0-dev.20260613.1':
-    resolution: {integrity: sha512-xpA7nXiRE3fwvTUK2ibhkPr7hn6D4i3pB9WjlcX7CSPB2pYGMdHAsL55EAFlR3eNKyNM/geoLfqq4L4PIeOWsQ==}
+  '@typescript/native-preview-linux-arm@7.0.0-dev.20260620.1':
+    resolution: {integrity: sha512-wuqpmYeMkOvHEx+log3bi913JRacYRo7DwkABMbD5wQMEy2GCdp3461aQ5sGrRD/lL4rylZJxE5B5aQqyhkQYA==}
     engines: {node: '>=16.20.0'}
     cpu: [arm]
     os: [linux]
 
-  '@typescript/native-preview-linux-x64@7.0.0-dev.20260613.1':
-    resolution: {integrity: sha512-mZO9hIwXek9VO+N+gs6IKDOf0fPnrQg/SvaOsCDcDwsk7a60yPbacyY7IiXFnxhNgZDLsYqs8j9ojDGl6+Tp5g==}
+  '@typescript/native-preview-linux-x64@7.0.0-dev.20260620.1':
+    resolution: {integrity: sha512-8zhjBFu0RuL16iFr0TlUU8RRMdmvUY+NuSSxaVeitxmvORFoy0EwIaz+ZK9+xRhfHCIcugi6mEcTqEPv48X3oQ==}
     engines: {node: '>=16.20.0'}
     cpu: [x64]
     os: [linux]
 
-  '@typescript/native-preview-win32-arm64@7.0.0-dev.20260613.1':
-    resolution: {integrity: sha512-JtMTHRt7auXTCvvOtcn7aX1gdCPByQl4c5vc8e1d+8PcqtMqeSpH1j0Vp06F9vugTA+YMIzFsJQA91sUK1oHeg==}
+  '@typescript/native-preview-win32-arm64@7.0.0-dev.20260620.1':
+    resolution: {integrity: sha512-Bax5HY/6NUcbk7h+SLJIbRL8TvGRLP1mbvI9T4ah6wfYKRp3rwBlXHP3N+BEYdzOFTUlzBJLknxcjtxWd5cFPw==}
     engines: {node: '>=16.20.0'}
     cpu: [arm64]
     os: [win32]
 
-  '@typescript/native-preview-win32-x64@7.0.0-dev.20260613.1':
-    resolution: {integrity: sha512-aCZaFWHDt5n8B++F2FrTK2pF7muAFfkvi8qkUnC0N0SNBGdVnqlO28IbdjScIfI2JFOvgZtUoYWeATGWdrLXBA==}
+  '@typescript/native-preview-win32-x64@7.0.0-dev.20260620.1':
+    resolution: {integrity: sha512-+revF2e9JCBx1rLQCX+ny8KuZ0Tl5de7+YpYd4PUNKgF5yPi9n2+TmXtci8/3yBl7QRyLWG1td28RMa/8eIynQ==}
     engines: {node: '>=16.20.0'}
     cpu: [x64]
     os: [win32]
 
-  '@typescript/native-preview@7.0.0-dev.20260613.1':
-    resolution: {integrity: sha512-RJ3YrYNoshFGVY862CwZ/WcICvMW0u9XtezI8AAU81I71Cr3/IJoHPUGsGKUr2gVcPfKRQiaI8YTndFzUGvSug==}
+  '@typescript/native-preview@7.0.0-dev.20260620.1':
+    resolution: {integrity: sha512-W5XiTTbIGZSAJUMJqynchbfcjPcoNn29U8dnd+FK+x+Mj9VT9NNTymZ0YAIf+hU2uYAxx3AGe6/U/2OF2TpQwg==}
     engines: {node: '>=16.20.0'}
     hasBin: true
 
@@ -5022,16 +5103,27 @@ packages:
       react-server-dom-webpack:
         optional: true
 
-  '@vitest/browser@4.1.8':
-    resolution: {integrity: sha512-u21VzX07HzlJYpFgkxmjEXar/tG2UqWGgyGG/46SrrPc7rSdCTPw5vuowopO9CIqF8UCUQzDFdbVnNpw6N0BfQ==}
+  '@vitest/browser-playwright@4.1.9':
+    resolution: {integrity: sha512-Bq1rOGf9waevzG3EOkO/dene6bvKTUsZMVg8S1i+WH3JcMjuXEjiahP9rAqZRELUqjBySOJsvvSWqK/B3wjKQw==}
     peerDependencies:
-      vitest: 4.1.8
+      playwright: '*'
+      vitest: 4.1.9
 
-  '@vitest/coverage-v8@4.1.8':
-    resolution: {integrity: sha512-lt3kovsyHwYe00wq4D1ti0Z974fWj4NLp6siqiyEufUpyFwK9Yhi7rBhac9JL5aA0zoMrJqc4vYPZRUnI7l7nw==}
+  '@vitest/browser-preview@4.1.9':
+    resolution: {integrity: sha512-a4/OrkMDb/WUnE4OOB/4FJbK3rYVO7YykqtUgcTKG4p2a0R3XcjPVu7SLRHFBs2+NIYhv5yxp1Lz3dbdGBjIow==}
     peerDependencies:
-      '@vitest/browser': 4.1.8
-      vitest: 4.1.8
+      vitest: 4.1.9
+
+  '@vitest/browser@4.1.9':
+    resolution: {integrity: sha512-j1BKtWmPcqpMhmx/L9EPLgAJpCb0zKfwoWLmqBbxaogCXHjOwHFSEoHCBfnGtx93xKQwilZ26m+UOsHqHMkRNg==}
+    peerDependencies:
+      vitest: 4.1.9
+
+  '@vitest/coverage-v8@4.1.9':
+    resolution: {integrity: sha512-G9/lgqibheLVBDRuya45EbsEXTYcWoSG+TLg7i2axuzx0Eq62eXn+aWXyaVdV5vKvFSWd6ywcX8hA7la9Pvu8g==}
+    peerDependencies:
+      '@vitest/browser': 4.1.9
+      vitest: 4.1.9
     peerDependenciesMeta:
       '@vitest/browser':
         optional: true
@@ -5043,17 +5135,23 @@ packages:
       '@typescript-eslint/eslint-plugin': '*'
       eslint: '>=8.57.0'
       typescript: '>=5.0.0'
+      vitest: 4.1.9
     peerDependenciesMeta:
       '@typescript-eslint/eslint-plugin':
         optional: true
       typescript:
         optional: true
+      vitest:
+        optional: true
 
   '@vitest/expect@3.2.4':
     resolution: {integrity: sha512-Io0yyORnB6sikFlt8QW5K7slY4OjqNX9jmJQ02QDda8lyM6B5oNgVWoSoKPac8/kgnCUzuHQKrSLtu/uOqqrig==}
 
-  '@vitest/mocker@4.1.8':
-    resolution: {integrity: sha512-LEiN/xe4OSIbKe9HQIp5OC24agGD9J5CnmMgsLohVVoOPWL9a2sBoR6VBx43jQZb7Kr1l4RCuyCJzcAa0+dojw==}
+  '@vitest/expect@4.1.9':
+    resolution: {integrity: sha512-vl/rYsUKcBr3SnQn166+XR5ZQcgMx3DQhFWdfli/cWpLnLUmbxZvyrJZotLFUryib+LtArYMSTJ5RbQ57ZqrlA==}
+
+  '@vitest/mocker@4.1.9':
+    resolution: {integrity: sha512-EVkXzBjrPGM+cK8/ANWgBrkUCfJfb38/EfTSO8h7pWvKkyPkpWxvR7BkD2MyItMF62C97zAEoqdpUixwR/e+Rw==}
     peerDependencies:
       msw: ^2.4.9
       vite: ^6.0.0 || ^7.0.0 || ^8.0.0
@@ -5066,28 +5164,34 @@ packages:
   '@vitest/pretty-format@3.2.4':
     resolution: {integrity: sha512-IVNZik8IVRJRTr9fxlitMKeJeXFFFN0JaB9PHPGQ8NKQbGpfjlTx9zO4RefN8gp7eqjNy8nyK3NZmBzOPeIxtA==}
 
-  '@vitest/pretty-format@4.1.8':
-    resolution: {integrity: sha512-9GasEBxpZ1VYIpqHf/0+YGg121uSNwCKOJqIrTwWP/TB7DmFCiaBpNl3aPZzoLWfWkuqhbH8vJIVobZkvdo2cA==}
+  '@vitest/pretty-format@4.1.9':
+    resolution: {integrity: sha512-s0iufns3iIFitdgm+YR7g1whCAaGtXz459VS9/PqyKDEEFgYIhsHOQmXgIgDuYCt7DeQmiZT0Qe2OA2p4ZPu5A==}
+
+  '@vitest/runner@4.1.9':
+    resolution: {integrity: sha512-KXLMDtc7oe70+3mJfGrPUWPesswH+3sTxAMAMl8DG7I8IUQT4XW718dY5ID3vPUcmlu27CcKfY4P3h3I29SLJg==}
+
+  '@vitest/snapshot@4.1.9':
+    resolution: {integrity: sha512-Jc7RKGNBo8Z28WYIm0Niej4xdSPByRf6mU58VpHQkd6Zh05rlnA+twjbK5HyeIGHxrzsc3mJgS43uM0CZKzaIA==}
 
   '@vitest/spy@3.2.4':
     resolution: {integrity: sha512-vAfasCOe6AIK70iP5UD11Ac4siNUNJ9i/9PZ3NKx07sG6sUxeag1LWdNrMWeKKYBLlzuK+Gn65Yd5nyL6ds+nw==}
 
-  '@vitest/spy@4.1.8':
-    resolution: {integrity: sha512-6EevtBp6OZOPF7bmz36HrGMeP3txgVSrgebWxHOafDXGkhIzfXK14f8KF6MuFfgXXUeHxmpD3BQxkV00/3s5mA==}
+  '@vitest/spy@4.1.9':
+    resolution: {integrity: sha512-fHpsS6mIi+PiEW+vcRVOMkX1oSaPKne3VOclSFICPcGOmfKgXPU5iAah+wcNcj2xPrCCmfq99IDGf+EojhhvhA==}
 
   '@vitest/utils@3.2.4':
     resolution: {integrity: sha512-fB2V0JFrQSMsCo9HiSq3Ezpdv4iYaXRG1Sx8edX3MwxfyNn83mKiGzOcH+Fkxt4MHxr3y42fQi1oeAInqgX2QA==}
 
-  '@vitest/utils@4.1.8':
-    resolution: {integrity: sha512-uOJamYALNhfJ6iolExyQM40yIQwDqYnkKtQ5VCiSe17E33H0aQ/u+1GlRuz4LZBk6Mm3sg90G9hEbmEt37C1Zg==}
+  '@vitest/utils@4.1.9':
+    resolution: {integrity: sha512-A51o8ymO5PpqlWNnBP9ZHPXDIpuMtTLlGSjN7la4US+LJzoUMyhwjA5QXlm39JexgwHKW4Xjs8Z2d3dLCXOeuA==}
 
-  '@voidzero-dev/vite-plus-core@0.1.24':
-    resolution: {integrity: sha512-iXPGBABnQnrDMx89H6MOCGcTZp+QW+3rY4YMVKdE6ydchSvPk2O3MI2vgaRVfOtWJ2IjnxSnf1n2yjP67ZBRFQ==}
-    engines: {node: ^20.19.0 || >=22.12.0}
+  '@voidzero-dev/vite-plus-core@0.2.1':
+    resolution: {integrity: sha512-iWdtOlLezgYcDqIzxZx1yOUhY93vUB+ob+mRYBNr7/3Hf80uRyTQbqVD1WtsYaANbzeUi81SQ1ZoUraXHO+u8A==}
+    engines: {node: ^20.19.0 || ^22.18.0 || >=24.11.0}
     peerDependencies:
       '@arethetypeswrong/core': ^0.18.1
-      '@tsdown/css': 0.22.1
-      '@tsdown/exe': 0.22.1
+      '@tsdown/css': 0.22.3
+      '@tsdown/exe': 0.22.3
       '@types/node': ^20.19.0 || >=22.12.0
       '@vitejs/devtools': ^0.1.18
       esbuild: ^0.28.1
@@ -5144,86 +5248,55 @@ packages:
       yaml:
         optional: true
 
-  '@voidzero-dev/vite-plus-darwin-arm64@0.1.24':
-    resolution: {integrity: sha512-Hpo9W9piSFlEsJzGkwzfDXhJGrnYByxHXF7NVQZ7g+SLOprddtlfTeM8t+gq9dxcuq0RzM8ddMAhDQP/K3fZQA==}
-    engines: {node: ^20.19.0 || >=22.12.0}
+  '@voidzero-dev/vite-plus-darwin-arm64@0.2.1':
+    resolution: {integrity: sha512-9AfN/5LKRks8gbTaHPiQHT0L4yboy2xB6x6vvCRWxQMWxPS6/ZJLf5kUIZeE7I1z33AEyLKKkDscsZZVMgMLgg==}
+    engines: {node: ^20.19.0 || ^22.18.0 || >=24.11.0}
     cpu: [arm64]
     os: [darwin]
 
-  '@voidzero-dev/vite-plus-darwin-x64@0.1.24':
-    resolution: {integrity: sha512-SwnnnZrEFBiU5iKlh/CZAVwn0RFt/Udrvt3kFLtdRxMtN5bKaqTFVA2H8Y/FPCWp1QX9bs4V9ZIAeXAk06zLkw==}
-    engines: {node: ^20.19.0 || >=22.12.0}
+  '@voidzero-dev/vite-plus-darwin-x64@0.2.1':
+    resolution: {integrity: sha512-Q1vyimRbf4M82qIQSWRyr7NJaH9ag5G7vVEfGVVJlQHNprI+Q8zj2Phcs/PGf6QcyjcL8UclLznQTHU9NgnKZw==}
+    engines: {node: ^20.19.0 || ^22.18.0 || >=24.11.0}
     cpu: [x64]
     os: [darwin]
 
-  '@voidzero-dev/vite-plus-linux-arm64-gnu@0.1.24':
-    resolution: {integrity: sha512-ImM3eqDki4DpRuHjW6dEh4St8zvbcfOMR7KQZJX42ArriCLQ/QdaYhDRRbcDi27XsOBqRxm2eqUUEymPrYIHpA==}
-    engines: {node: ^20.19.0 || >=22.12.0}
+  '@voidzero-dev/vite-plus-linux-arm64-gnu@0.2.1':
+    resolution: {integrity: sha512-WHW3DziqedRfhJ2upq6kC4y/pmdQWYt322DVB7+4Xb4oOa/CT9GtnSrWIiXVJ4PSO42v54+YsSTKPH2HC5RbtA==}
+    engines: {node: ^20.19.0 || ^22.18.0 || >=24.11.0}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@voidzero-dev/vite-plus-linux-arm64-musl@0.1.24':
-    resolution: {integrity: sha512-gj4mzbob/ls8Zs7iTuF9Gr0EFFF7tdpDiPxDPBkH8tJP5OkHABlzWUwJhU+9xxcUbTaXqpHDw68Mil7jm5dpMg==}
-    engines: {node: ^20.19.0 || >=22.12.0}
+  '@voidzero-dev/vite-plus-linux-arm64-musl@0.2.1':
+    resolution: {integrity: sha512-vUY7hYycZW0qEevpl7ImzZJFnOEKRYCaCOX4TBW0vk6MJZ+zj/xW7e0LOggzJcz2wbYAgLDqp5h+b8wV9dguDA==}
+    engines: {node: ^20.19.0 || ^22.18.0 || >=24.11.0}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@voidzero-dev/vite-plus-linux-x64-gnu@0.1.24':
-    resolution: {integrity: sha512-x7IYK7lI+WuF1n3jSzEYU6FgJxPX/R0rDmTTsOutooGGCU7uShZvfZqIoiTXK0eFnJU5ij5BfBgenenUfsaT/A==}
-    engines: {node: ^20.19.0 || >=22.12.0}
+  '@voidzero-dev/vite-plus-linux-x64-gnu@0.2.1':
+    resolution: {integrity: sha512-tFxpToEaykBGxMQHp8M/qmr1yruRRED+c9gA1h9kmplqot04OxuqzRCWu/IiIvMJ0v3JFdOP3gqkyjXLLJhxIA==}
+    engines: {node: ^20.19.0 || ^22.18.0 || >=24.11.0}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@voidzero-dev/vite-plus-linux-x64-musl@0.1.24':
-    resolution: {integrity: sha512-JCy2w0eSVUlWQlggK5T47MnL+j0o4EY7hLskINVI8gi+aixQF4xnYBDobz0lbxkqz3/IfiLyXUx6TcU3thcsGQ==}
-    engines: {node: ^20.19.0 || >=22.12.0}
+  '@voidzero-dev/vite-plus-linux-x64-musl@0.2.1':
+    resolution: {integrity: sha512-2scSS7wEbLO2758fqr1/bAULg7nLCFa5V8LO2b5w3g1CrTYdMTDt2WX1ghPesIi+70pYGydRbXo6iaaN43zfMg==}
+    engines: {node: ^20.19.0 || ^22.18.0 || >=24.11.0}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@voidzero-dev/vite-plus-test@0.1.24':
-    resolution: {integrity: sha512-9NiG6UadG0iOaPL1AMsO5sDKkx6MADHw4/mMOmHWZUhhUwqzfVtnnptMK37vD71e6KyR7yAscx19FrtOWWtjvA==}
-    engines: {node: ^20.0.0 || ^22.0.0 || >=24.0.0}
-    peerDependencies:
-      '@edge-runtime/vm': '*'
-      '@opentelemetry/api': ^1.9.0
-      '@types/node': ^20.0.0 || ^22.0.0 || >=24.0.0
-      '@vitest/coverage-istanbul': 4.1.8
-      '@vitest/coverage-v8': 4.1.8
-      '@vitest/ui': 4.1.8
-      happy-dom: '*'
-      jsdom: '*'
-      vite: ^6.0.0 || ^7.0.0 || ^8.0.0
-    peerDependenciesMeta:
-      '@edge-runtime/vm':
-        optional: true
-      '@opentelemetry/api':
-        optional: true
-      '@types/node':
-        optional: true
-      '@vitest/coverage-istanbul':
-        optional: true
-      '@vitest/coverage-v8':
-        optional: true
-      '@vitest/ui':
-        optional: true
-      happy-dom:
-        optional: true
-      jsdom:
-        optional: true
-
-  '@voidzero-dev/vite-plus-win32-arm64-msvc@0.1.24':
-    resolution: {integrity: sha512-G+/lhLKVjyn3FmgXX8jeWgq7RcE5O1kdR7QyFayQOdlMX/ZRkvUwQD7bFaqhKzgJM6Oj3a1FH3HQPYk5QOYuCQ==}
-    engines: {node: ^20.19.0 || >=22.12.0}
+  '@voidzero-dev/vite-plus-win32-arm64-msvc@0.2.1':
+    resolution: {integrity: sha512-3+5FJYhi9SqBszjngI2LBmvoiqEwxJWyQ5UsOUtNz6/d+yDrDw+tOgHLl4OKIh5aVNZeIGXzxvP6h24kcEqIyg==}
+    engines: {node: ^20.19.0 || ^22.18.0 || >=24.11.0}
     cpu: [arm64]
     os: [win32]
 
-  '@voidzero-dev/vite-plus-win32-x64-msvc@0.1.24':
-    resolution: {integrity: sha512-b0e5XohEV1w/RdzAtv8/Hm6tvHPXouPtBNsljjW/lDJZq3NCLND5s6lqe8H4IenrgmKSoqakHWtlqJqM36cFbw==}
-    engines: {node: ^20.19.0 || >=22.12.0}
+  '@voidzero-dev/vite-plus-win32-x64-msvc@0.2.1':
+    resolution: {integrity: sha512-5sOEwEoU5PW7ObmJ5VCakU09Oh14rYCoLQJkFqvOph6PK30lN5iqWGk0KigEyfcd7Zv+fZg9EmcERDol/3Xl9w==}
+    engines: {node: ^20.19.0 || ^22.18.0 || >=24.11.0}
     cpu: [x64]
     os: [win32]
 
@@ -5537,6 +5610,10 @@ packages:
     resolution: {integrity: sha512-4zNhdJD/iOjSH0A05ea+Ke6MU5mmpQcbQsSOkgdaUMJ9zTlDTD/GYlwohmIE2u0gaxHYiVHEn1Fw9mZ/ktJWgw==}
     engines: {node: '>=18'}
 
+  chai@6.2.2:
+    resolution: {integrity: sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==}
+    engines: {node: '>=18'}
+
   chalk@4.1.1:
     resolution: {integrity: sha512-diHzdDKxcU+bAsUboHLPEDQiw0qEe0qd7SYUn3HgcFlWgbDcfLGswOHYeGrHKzG9z6UYf01d9VFMfZxPM1xZSg==}
     engines: {node: '>=10'}
@@ -5650,8 +5727,8 @@ packages:
       react: ^18 || ^19 || ^19.0.0-rc
       react-dom: ^18 || ^19 || ^19.0.0-rc
 
-  code-inspector-plugin@1.6.0:
-    resolution: {integrity: sha512-pH5sQoL5VGKXo92yimfzdF8yHWGU3hC8uA8kovLR3EB0WSJ7TfC+AZaPryLI2n5F2dSWUgaCv5zuoNvDvKHQBQ==}
+  code-inspector-plugin@1.6.1:
+    resolution: {integrity: sha512-XsGzQ2Kkrn2xdZtwviORKOVY4H8ixe95VSxkjUfzdWGhl9z3UVA2tci8o/1juJm+vaIxcVjlyefJOoTKjqhQcw==}
 
   collapse-white-space@2.1.0:
     resolution: {integrity: sha512-loKTxY1zCOuG4j9f6EPnuyyYkf58RnhhWTvRoZEokgB+WbdXehfjFviyOVYkqzEWz1Q5kRiZdBYS5SwxbQYwzw==}
@@ -5729,8 +5806,8 @@ packages:
   cose-base@2.2.0:
     resolution: {integrity: sha512-AzlgcsCbUMymkADOJtQm3wO9S3ltPfYOFD5033keQn9NJzIbtnZj+UdBJe7DYml/8TdbtHJW3j58SOnKhWY/5g==}
 
-  cron-parser@5.5.0:
-    resolution: {integrity: sha512-oML4lKUXxizYswqmxuOCpgFS8BNUJpIu6k/2HVHyaL8Ynnf3wdf9tkns0yRdJLSIjkJ+b0DXHMZEHGpMwjnPww==}
+  cron-parser@5.6.0:
+    resolution: {integrity: sha512-6159NDv4eDOjXYDmMTkvUtaVcIrNZI779ydTMOfDdi9fSjhPqmySx0icCHX2+nOyXgNSw6sFCsgLKxYs/2KPuQ==}
     engines: {node: '>=18'}
 
   cross-spawn@7.0.6:
@@ -6069,8 +6146,8 @@ packages:
     resolution: {integrity: sha512-cgwlv/1iFQiFnU96XXgROh8xTeetsnJiDsTc7TYCLFd9+/WNkIqPTxiM/8pSd8VIrhXGTf1Ny1q1hquVqDJB5w==}
     engines: {node: '>= 4'}
 
-  dompurify@3.4.10:
-    resolution: {integrity: sha512-0xzNv0e7oYC6yyuOGZIABPM4qtg3QxLFniDNPP4ZP90wR8Yq3zgwpRbrNiT4N3IKqDbbYFEJLV+JWEs19aZ//w==}
+  dompurify@3.4.11:
+    resolution: {integrity: sha512-zhlUV12GsaRzMsf9q5M254YhA4+VuF0fG+QFqu6aYpoGlKtz+w8//jBcGVYBgQkR5GHjUomejY84AV+/uPbWdw==}
 
   domutils@3.2.2:
     resolution: {integrity: sha512-6kZKyUajlDuqlHKVX1w7gyslj9MPIXzIFiz/rGu35uC1wMi+kMhQwGhl4lt9unC9Vb9INnY9Z3/ZA3+FhASLaw==}
@@ -6224,6 +6301,7 @@ packages:
   esbuild@0.28.1:
     resolution: {integrity: sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw==}
     engines: {node: '>=18'}
+    hasBin: true
 
   escalade@3.2.0:
     resolution: {integrity: sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==}
@@ -6437,16 +6515,16 @@ packages:
     peerDependencies:
       eslint: '>=9.38.0'
 
-  eslint-plugin-sonarjs@4.0.3:
-    resolution: {integrity: sha512-5drkJKLC9qQddIiaATV0e8+ygbUc7b0Ti6VB7M2d3jmKNh3X0RaiIJYTs3dr9xnlhlrxo+/s1FoO3Jgv6O/c7g==}
+  eslint-plugin-sonarjs@4.1.0:
+    resolution: {integrity: sha512-rh+FlVz0yfd2RNIb6WqSkuGh0addX/Qi5scwQ5FphXDFrM6fZKcxP1+attJ78yUKcyYfiu6MTaISPpAFPzqRJw==}
     peerDependencies:
       eslint: ^8.0.0 || ^9.0.0 || ^10.0.0
 
-  eslint-plugin-storybook@10.4.4:
-    resolution: {integrity: sha512-RqEDQJRaeTdfSDRO9W2sKui4oLax6cSuKU/6vFXbiyEmyaACktkQce9DYEf2i5+MZ07y/X/1G0UZeY+WrPQlIg==}
+  eslint-plugin-storybook@10.4.6:
+    resolution: {integrity: sha512-CfGSXn6zFspeYTU8R7v797MOmJFj8xc6MWf/oGuRwbKeMoSwnliR+OlXSjMZYM1D6gfmwiuH1VX58LSHdn+ZPg==}
     peerDependencies:
       eslint: '>=8'
-      storybook: ^10.4.4
+      storybook: ^10.4.6
 
   eslint-plugin-toml@1.3.1:
     resolution: {integrity: sha512-1l00fBP03HIt9IPV7ZxBi7x0y0NMdEZmakL1jBD6N/FoKBvfKxPw5S8XkmzBecOnFBTn5Z8sNJtL5vdf9cpRMQ==}
@@ -6585,6 +6663,10 @@ packages:
     resolution: {integrity: sha512-XYfuKMvj4O35f/pOXLObndIRvyQ+/+6AhODh+OKWj9S9498pHHn/IMszH+gt0fBCRWMNfk1ZSp5x3AifmnI2vg==}
     engines: {node: '>=6'}
 
+  expect-type@1.3.0:
+    resolution: {integrity: sha512-knvyeauYhqjOYvQ66MznSMs83wmHrCycNEN6Ao+2AeYEfxUIkuiVxdEa1qlGEPK+We3n0THiDciYSsCcgW/DoA==}
+    engines: {node: '>=12.0.0'}
+
   exsolve@1.0.8:
     resolution: {integrity: sha512-LmDxfWXwcTArk8fUEnOfSZpHOJ6zOMUJKOtFLFqJLoKJetuQG874Uc7/Kki7zFLzYybmZhp1M7+98pfMqeX8yA==}
 
@@ -6685,8 +6767,8 @@ packages:
     engines: {node: '>=18.3.0'}
     hasBin: true
 
-  foxact@0.3.5:
-    resolution: {integrity: sha512-pcn1Ro445aOooB9Vk6NfbUMpiMHOgZ/Nki9MmVslVfRYjvmySLtssgALYyzspt7j2dNbpxxCyClaYSL2I4iJTg==}
+  foxact@0.3.7:
+    resolution: {integrity: sha512-U9+boW5SGK8TMuJ/21s7yfszXJCqVoUj8K9Gqmpe/uqiOG4wtPILxsONqrh0IizteGzGwiDa7oiPX2hn5AJtog==}
     peerDependencies:
       react: '*'
       react-dom: '*'
@@ -6839,8 +6921,8 @@ packages:
   hachure-fill@0.5.2:
     resolution: {integrity: sha512-3GKBOn+m2LX9iq+JC1064cSFprJY4jL1jCXTcpnfER5HYE2l/4EfWSGzkPa/ZDBmYI0ZOEj5VHV/eKnPGkHuOg==}
 
-  happy-dom@20.10.3:
-    resolution: {integrity: sha512-Hjdiy8RziuCcn5z04QI/rlsNuQoG8P0xxjgvsSMpi89cvIXIOcucQtiHS1yHSShxoBcSCeYqAskINmTiy/mlfw==}
+  happy-dom@20.10.6:
+    resolution: {integrity: sha512-6QD0ilzDDt93tX44y8tbmZdAcdTRYDhUP+Asgi6pC8Pp5IA3cvaZGyoVN/EGtlq9ziT65iPuBBn3ASLr6hCgVw==}
     engines: {node: '>=20.0.0'}
 
   has-ansi@6.0.2:
@@ -6923,8 +7005,8 @@ packages:
     resolution: {integrity: sha512-Ox1pJVrDCyGHMG9CFg1tmrRUMRPRsAWYc/PinY0XzJU4K7y7vjNoLKIQ7BR5UJMCxNN8EM1MNDmHWA/B3aZUuw==}
     engines: {node: '>=6'}
 
-  hono@4.12.25:
-    resolution: {integrity: sha512-2NFaIyNVgJmBs/ecmtGzlmluTFs5cHEWGTdu0t1HBwYzoGXOL5nUQBRMXsXWla5i4KkG//QMzVP88m1+I3fdAQ==}
+  hono@4.12.26:
+    resolution: {integrity: sha512-uyZtpnYxM9CmQ7QsQknM4zN8EftNqhON1qYeIKM0Se67CCEe2c44xyGURwB0axX2fBDu1dqHrHAc1hmNT8ITkw==}
     engines: {node: '>=16.9.0'}
 
   hosted-git-info@9.0.2:
@@ -6990,6 +7072,7 @@ packages:
   image-size@2.0.2:
     resolution: {integrity: sha512-IRqXKlaXwgSMAMtpNzZa1ZAe8m+Sa1770Dhk8VkSsP9LS+iHD62Zd8FQKs8fbPiagBE7BzoFX23cxFnwshpV6w==}
     engines: {node: '>=16.x'}
+    hasBin: true
 
   immer@11.1.8:
     resolution: {integrity: sha512-/tbkHMW7y10Lx6i1crLjD4/OhNkRG+Fo7byZHtah0547nIeXYcpIXaUh0IAQY6gO5459qpGGYapcEOHtFXkIuA==}
@@ -7331,8 +7414,8 @@ packages:
   khroma@2.1.0:
     resolution: {integrity: sha512-Ls993zuzfayK269Svk9hzpeGUKob/sIgZzyHYdjQoAdQetRKpOLj+k/QQQ/6Qi0Yz65mlROrfd+Ev+1+7dz9Kw==}
 
-  knip@6.16.1:
-    resolution: {integrity: sha512-TKMn1rxgH6h9vXR9Y0B+Cq7AdPTr9EI02IwoT65NzqYUkvoDQAaJ/aPybiFpAhZ1px6cNYYwXf86iHkBgzCo9w==}
+  knip@6.17.1:
+    resolution: {integrity: sha512-HcQsZSQ4Ymhuay4BVzJtM5pFZNDSomYYqcNCZOSITPQh9g18a09DqziWAxSt2G+BH9wGlG+0ZjWpEnaFlnKseQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
 
@@ -7493,8 +7576,8 @@ packages:
   loose-envify@1.4.0:
     resolution: {integrity: sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==}
 
-  loro-crdt@1.13.2:
-    resolution: {integrity: sha512-Br9tZZk9x/HP83By9RvOCqzWh8v8tnOhVlR6/ibYNtLSmysO7ZgwzjNpqsCABqaSOcGC7TBkx5sG8tfosdJMQA==}
+  loro-crdt@1.13.5:
+    resolution: {integrity: sha512-U6L88EbSdv8TeFcXyKew0BySRJnOCPsgU8p38PhzGjQlfD8TC1pLRk1J7X5OYecr8Z9ijD1J13JEf+qIvw3ztg==}
 
   loupe@3.2.1:
     resolution: {integrity: sha512-CdzqowRJCeLU72bHvWqwRBBlLcMEtIvGrlvef74kMnV2AolS9Y8xUv1I0U/MNAWMhBlKIoyuEgoJ0t/bbwHbLQ==}
@@ -8133,15 +8216,15 @@ packages:
     resolution: {integrity: sha512-+0LAPHaqtfQlvWdpaAa09SmOaZZgP8C552xosEkGJ4+ruEwP1Vgx+sqBgcBCNfR6KDCmagGOZTde8wmAvcI/Hg==}
     engines: {node: ^20.19.0 || >=22.12.0}
 
-  oxc-parser@0.133.0:
-    resolution: {integrity: sha512-661RSx+ZcjBmjBYid+Fpp/2F5EbtildpeoZh5HdgnGs+jZ03nqQEQW8yGkt4BGyOC3OMPDQQRl8M5kqD2/g6jw==}
+  oxc-parser@0.135.0:
+    resolution: {integrity: sha512-/DaPStu0s2zzNSRRniKyTPM6Z/o+DapOp2JYNKDL8AsgaBGPK2IdZyB87SQjVH+xeQPz+Qr9mrjglfkYgtbVRA==}
     engines: {node: ^20.19.0 || >=22.12.0}
 
   oxc-resolver@11.20.0:
     resolution: {integrity: sha512-CblytBiV/a/ZXY34dsVU2NxhIOxMXst8CvDCtyBelVITgd7PLrKzbEbA6oKLdPjvDKDzCiW48qzmzZ+mYaqn+g==}
 
-  oxfmt@0.52.0:
-    resolution: {integrity: sha512-nJlYM35F64zTDMecCNhoHNkf+D/eHv7xcjj9XDSj+bFAVtN93m7v8DQMdHd6nDG6Akf/kEYYHmDUBs2Dz27Sug==}
+  oxfmt@0.55.0:
+    resolution: {integrity: sha512-jSj2wCTakwgPMxkfiVZX0jf+nX+Nz6xlyAZjqNE0qXTFdCBPYlP6JAN+ODjmealw7DXBjOzYbdsqwBMAZnPZ6A==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
     peerDependencies:
@@ -8155,9 +8238,10 @@ packages:
 
   oxlint-tsgolint@0.23.0:
     resolution: {integrity: sha512-3mBv3CoPbh8dFbzfDGIWa2ytZjn2v+3EX4aKRXjIhsoGFzG8GCjfRirz3rwZf1wYbZzsNLTSgpw8VjQuWdp/jA==}
+    hasBin: true
 
-  oxlint@1.67.0:
-    resolution: {integrity: sha512-blwwaHPdoH8piQ5/z0KHeoHFR7FZgl12WluKJfu4qFLPkZl6mK04PkLE45Fw1NxfBRSlh40Gu7MkxHUw++ociQ==}
+  oxlint@1.70.0:
+    resolution: {integrity: sha512-D6JgHtzkhRwvEC+A0Nw5AEc5bk8x5i1pHzvZIEf/a0C4hOzmAACNGtkDGPyFaxxX3ZVGxCPeig3P3rMM8XU3/g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
     peerDependencies:
@@ -8278,23 +8362,21 @@ packages:
   pinyin-pro@3.28.1:
     resolution: {integrity: sha512-oqz8ulwRgtUXRi0vbqEfGNly19zpyCxYrjhkk5TibGcgSW6eNwS5woajCXRwqURi8Ehc2yOFTiB4uNoZ+NJOnA==}
 
-  pixelmatch@7.1.0:
-    resolution: {integrity: sha512-1wrVzJ2STrpmONHKBy228LM1b84msXDUoAzVEl0R8Mz4Ce6EPr+IVtxm8+yvrqLYMHswREkjYFaMxnyGnaY3Ng==}
-    hasBin: true
-
   pkg-types@1.3.1:
     resolution: {integrity: sha512-/Jm5M4RvtBFVkKWRu2BLUTNP8/M2a+UwuAX+ae4770q1qVGtfjG+WTCupoZixokjmHiry8uI+dlY8KXYV5HVVQ==}
 
   pkg-types@2.3.1:
     resolution: {integrity: sha512-y+ichcgc2LrADuhLNAx8DFjVfgz91pRxfZdI3UDhxHvcVEZsenLO+7XaU5vOp0u/7V/wZ+plyuQxtrDlZJ+yeg==}
 
-  playwright-core@1.60.0:
-    resolution: {integrity: sha512-9bW6zvX/m0lEbgTKJ6YppOKx8H3VOPBMOCFh2irXFOT4BbHgrx5hPjwJYLT40Lu+4qtD36qKc/Hn56StUW57IA==}
+  playwright-core@1.61.0:
+    resolution: {integrity: sha512-caX7TrY3Ml6egyDX0WUcTHDxodl/b51y5wJOdCEA36QviK/s2g081hvmGs8eaE3DWb6NYZQ6BjO/QkNRPenoPA==}
     engines: {node: '>=18'}
+    hasBin: true
 
-  playwright@1.60.0:
-    resolution: {integrity: sha512-hheHdokM8cdqCb0lcE3s+zT4t4W+vvjpGxsZlDnikarzx8tSzMebh3UiFtgqwFwnTnjYQcsyMF8ei2mCO/tpeA==}
+  playwright@1.61.0:
+    resolution: {integrity: sha512-Z+7BeeqQPRRzklHsVFP4KTGIyMxKUmfeRA4WisM6G3/XW6nwGeX6fX9qYaDa+CiUqpOkb2f6X3nar05R3kSuJQ==}
     engines: {node: '>=18'}
+    hasBin: true
 
   pluralize@8.0.0:
     resolution: {integrity: sha512-Nc3IT5yHzflTfbjgqWcCPpo7DaKy4FnpB0l/zCAW0Tc7jxAiuqSxHasntB3D7887LSrA93kDJ9IXovxJYxyLCA==}
@@ -8787,8 +8869,8 @@ packages:
     resolution: {integrity: sha512-Ou9I5Ft9WNcCbXrU9cMgPBcCK8LiwLqcbywW3t4oDV37n1pzpuNLsYiAV8eODnjbtQlSDwZ2cUEeQz4E54Hltg==}
     engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
 
-  sharp@0.35.1:
-    resolution: {integrity: sha512-lW979AMi+ESidzMv/Lnv+F9bknzLyxLqFI05Sm433vOeRcltgxQmXpnfOOFIAlKtwXU/ksupm2srQoFCkR214g==}
+  sharp@0.35.2:
+    resolution: {integrity: sha512-FVtFjtBCMiJS6yb5CX7Sop45WFMpeGw6oRKuJnXYgf/f1ms/D7LE/ZUSNxnW7rZ/dbslQWYkoqFHGPaDBtaK4w==}
     engines: {node: '>=20.9.0'}
 
   shebang-command@2.0.0:
@@ -8807,6 +8889,9 @@ packages:
     resolution: {integrity: sha512-hjNax6o/ylDy9lefQEaSDtzaT3iVNtZ3WmpQnbuQNoG4xvnSKf2kSKbihZVO4JRG1TTMejs7CmNRYlWgAL66pQ==}
     engines: {node: '>=20'}
 
+  siginfo@2.0.0:
+    resolution: {integrity: sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==}
+
   signal-exit@3.0.7:
     resolution: {integrity: sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==}
 
@@ -8882,6 +8967,9 @@ packages:
     resolution: {integrity: sha512-iXsux0UcOjdvs0LCMa2Ws3WwcDUozA3JN3BquNXkaFPP7TpRqgunKdEgoZ/uwb1J6xaYHfxtz9Twlh6yzwM6Tg==}
     engines: {node: '>=20.16.0'}
 
+  stackback@0.0.2:
+    resolution: {integrity: sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==}
+
   stackframe@1.3.4:
     resolution: {integrity: sha512-oeVtt7eWQS+Na6F//S4kJ2K2VbRlS9D43mAlMyVpVWovy9o+jfgH8O9agzANzaiLjclA0oYzUXEM4PurhSUChw==}
 
@@ -8903,8 +8991,8 @@ packages:
     resolution: {integrity: sha512-eLoXW/DHyl62zxY4SCaIgnRhuMr6ri4juEYARS8E6sCEqzKpOiE521Ucofdx+KnDZl5xmvGYaaKCk5FEOxJCoQ==}
     engines: {node: '>= 0.4'}
 
-  storybook@10.4.4:
-    resolution: {integrity: sha512-Nn0qFRxU5fyABa6dGRftfL3lz0Y+HkKOaAkfytF8S4Q2K6Szwwq7TwPAEs3Wsj8hBQbYhsobrKADcPsyXQpJaA==}
+  storybook@10.4.6:
+    resolution: {integrity: sha512-6wkA6LxfDSSilloITsrFOJfsnw0mDUP2h8Ls+lRt8oRsudtz2RWFhLv+Toiwg6NW7hUpdTDc2hzR7DztJid6+A==}
     hasBin: true
     peerDependencies:
       '@types/react': ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
@@ -9089,6 +9177,10 @@ packages:
     resolution: {integrity: sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg==}
     engines: {node: '>=12.0.0'}
 
+  tinyglobby@0.2.17:
+    resolution: {integrity: sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==}
+    engines: {node: '>=12.0.0'}
+
   tinypool@2.1.0:
     resolution: {integrity: sha512-Pugqs6M0m7Lv1I7FtxN4aoyToKg1C4tu+/381vH35y8oENM/Ai7f7C4StcoK4/+BSw9ebcS8jRiVrORFKCALLw==}
     engines: {node: ^20.0.0 || >=22.0.0}
@@ -9105,11 +9197,12 @@ packages:
     resolution: {integrity: sha512-azl+t0z7pw/z958Gy9svOTuzqIk6xq+NSheJzn5MMWtWTFywIacg2wUlzKFGtt3cthx0r2SxMK0yzJOR0IES7Q==}
     engines: {node: '>=14.0.0'}
 
-  tldts-core@7.4.2:
-    resolution: {integrity: sha512-nwEyF4vl4RSJjwSjBUmOSxc3BFPoIFdlRthJ6e+5v9P3bHNsoD06UjuqMUspqp7vsEZ1beaHi1km+optiE17yA==}
+  tldts-core@7.4.3:
+    resolution: {integrity: sha512-27ep5H9PzdBrNd5OFM/j3WCU8F3kPwM9D0BOaOf7uYfxMJfyr0K5Tjj69Gri+sZlh2WXd5buIm47NuPF29CDiw==}
 
-  tldts@7.4.2:
-    resolution: {integrity: sha512-kCwffuaH8ntKtygnWe1b4BJKWiCUH30n5KfoTr6IchcXOwR7chAOFJxFrH3vjANafUYrIA4a7SDL+nn7SiR4Sw==}
+  tldts@7.4.3:
+    resolution: {integrity: sha512-A3BDQBeeukYPzB4QdQ1DtdlUmp4x2OCH8n5UVhEWbyANxNep8GavottKzd1xYKFJKjUgMyPT7EzOfnBO55s8Sg==}
+    hasBin: true
 
   to-regex-range@5.0.1:
     resolution: {integrity: sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==}
@@ -9158,6 +9251,7 @@ packages:
   tsconfck@3.1.6:
     resolution: {integrity: sha512-ks6Vjr/jEw0P1gmOVwutM3B7fWxoWBL2KRDb1JfqGVawBmO5UsvmWOQFGHBPl5yxYz4eERr19E6L7NMv+Fej4w==}
     engines: {node: ^18 || >=20}
+    deprecated: unmaintained
     hasBin: true
     peerDependencies:
       typescript: ^5.0.0
@@ -9235,8 +9329,8 @@ packages:
     resolution: {integrity: sha512-v3Xu+yuwBXisp6QYTcH4UbH+xYJXqnq2m/LtQVWKWzYc1iehYnLixoQDN9FH6/j9/oybfd6W9Ghwkl8+UMKTKQ==}
     engines: {node: '>=0.8.0'}
 
-  unbash@3.0.0:
-    resolution: {integrity: sha512-FeFPZ/WFT0mbRCuydiZzpPFlrYN8ZUpphQKoq4EeElVIYjYyGzPMxQR/simUwCOJIyVhpFk4RbtyO7RuMpMnHA==}
+  unbash@4.0.1:
+    resolution: {integrity: sha512-1ajSo3813sDoVIHx4inJdUS4l5L2ic5cFiddemPiyjb/PZEoBAhFwHtbaEdRDFxbAKy7FCG7s5ww3/uCFawuIA==}
     engines: {node: '>=14'}
 
   unbox-primitive@1.1.0:
@@ -9246,14 +9340,14 @@ packages:
   undici-types@7.24.6:
     resolution: {integrity: sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==}
 
-  undici@7.26.0:
-    resolution: {integrity: sha512-3O9Tf67pGhgOv9jM35AbhkXAKi13f3oy3aE4CSgr+TckGeY+/iu97ZXN+J7DpHPzLbVApFd1IFhcnBjREYXYcg==}
-    engines: {node: '>=20.18.1'}
-
   undici@7.27.2:
     resolution: {integrity: sha512-uZsKNuzQxDMUY6M3pIMvy5tvlGmtq8XJ2oLAkfRKGNu+1VQAIvLy2xIVG5ATZl5wDXl/tddByAWCizRbOme+TA==}
     engines: {node: '>=20.18.1'}
 
+  undici@7.28.0:
+    resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==}
+    engines: {node: '>=20.18.1'}
+
   unicode-trie@2.0.0:
     resolution: {integrity: sha512-x7bc76x0bm4prf1VLg79uhAzKw8DVboClSN5VxJuQ+LKDOVEW9CdH+VY7SP+vX7xCYQqzzgQpFqz15zeLvAtZQ==}
 
@@ -9383,8 +9477,9 @@ packages:
   util-deprecate@1.0.2:
     resolution: {integrity: sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==}
 
-  uuid@14.0.0:
-    resolution: {integrity: sha512-Qo+uWgilfSmAhXCMav1uYFynlQO7fMFiMVZsQqZRMIXp0O7rR7qjkj+cPvBHLgBqi960QCoo/PH2/6ZtVqKvrg==}
+  uuid@14.0.1:
+    resolution: {integrity: sha512-6ZxzVpzDXDa3bJWaHilVayA+BH/1zmxCJoVgvmqJnid/gPoKHxUrS/aC/T6LGQtNHT+XHG9fXPJB4d+IrU30Ew==}
+    hasBin: true
 
   valibot@1.4.1:
     resolution: {integrity: sha512-klCmFTz2jeDluy9RwX+F884TCiogtdBJ/YaxSx1EOBYXa3NXNWj8kR1jjN8rzluwojJVWWaHJ4r1U5LfICnM3g==}
@@ -9406,8 +9501,8 @@ packages:
   vfile@6.0.3:
     resolution: {integrity: sha512-KzIbH/9tXat2u30jf+smMwFCsno4wHVdNmzFyL+T/L3UGqqk6JKfVqOFOZEpZSHADH1k40ab6NUIXZq422ov3Q==}
 
-  vinext@0.1.2:
-    resolution: {integrity: sha512-ITrJGE7UwOanhz2Vfhkn44BSOskOrPxISjhJ3PbuFd8vEXzMNy6O2mOsFqWAatnFC4fMEanLVth5LAcxwkdH2A==}
+  vinext@0.1.6:
+    resolution: {integrity: sha512-uNqbo86PdaKcHCWpGcYOimQ2g1sS86um0InilA8bGjz51oktCssX6jWnQdOKYfOzYYOYYTW9y4N8vfC4vyIx6w==}
     engines: {node: '>=22'}
     hasBin: true
     peerDependencies:
@@ -9449,9 +9544,18 @@ packages:
       storybook: ^0.0.0-0 || ^9.0.0 || ^10.0.0 || ^10.0.0-0 || ^10.1.0-0 || ^10.2.0-0 || ^10.3.0-0 || ^10.4.0-0
       vite: ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0
 
-  vite-plus@0.1.24:
-    resolution: {integrity: sha512-b3fr6WtCiEhetjuzW/4KcEMOAMuZxoxZATWaXKmPzOLf1upG+pzKJOFZTb94D6wiPBlwcjxoaUtF7C3uAN+VjQ==}
-    engines: {node: ^20.19.0 || >=22.12.0}
+  vite-plus@0.2.1:
+    resolution: {integrity: sha512-q5q/Y38UkWFsNg1JO+RyRdPUqoewaSqIlMyK2p83GKNUvf4D38Ntb3PToRTDZbTRh7mWt+B+d0DQBv4nCDpMcQ==}
+    engines: {node: ^20.19.0 || ^22.18.0 || >=24.11.0}
+    hasBin: true
+    peerDependencies:
+      '@vitest/browser-playwright': 4.1.9
+      '@vitest/browser-webdriverio': 4.1.9
+    peerDependenciesMeta:
+      '@vitest/browser-playwright':
+        optional: true
+      '@vitest/browser-webdriverio':
+        optional: true
 
   vite-tsconfig-paths@5.1.4:
     resolution: {integrity: sha512-cYj0LRuLV2c2sMqhqhGpaO3LretdtMn/BVX4cPLanIZuwwrkVl+lK84E/miEXkCHWXuq65rhNN4rXsBcOB3S4w==}
@@ -9481,7 +9585,7 @@ packages:
       '@types/react-dom': ^18.0.0 || ^19.0.0
       react: ^18.0.0 || ^19.0.0
       react-dom: ^18.0.0 || ^19.0.0
-      vitest: ^4.0.0
+      vitest: 4.1.9
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -9491,7 +9595,48 @@ packages:
   vitest-canvas-mock@1.1.4:
     resolution: {integrity: sha512-4boWHY+STwAxGl1+uwakNNoQky5EjPLC8HuponXNoAscYyT1h/F7RUvTkl4IyF/MiWr3V8Q626je3Iel3eArqA==}
     peerDependencies:
-      vitest: ^3.0.0 || ^4.0.0
+      vitest: 4.1.9
+
+  vitest@4.1.9:
+    resolution: {integrity: sha512-nE3/LEyc0z87uHYLZebqCUOaJr2hdtuPp7BQ4BosVFnfltxgAvMG08NyrSGlPpOUWvR27c5flSmYFTNr78L9GQ==}
+    engines: {node: ^20.0.0 || ^22.0.0 || >=24.0.0}
+    hasBin: true
+    peerDependencies:
+      '@edge-runtime/vm': '*'
+      '@opentelemetry/api': ^1.9.0
+      '@types/node': ^20.0.0 || ^22.0.0 || >=24.0.0
+      '@vitest/browser-playwright': 4.1.9
+      '@vitest/browser-preview': 4.1.9
+      '@vitest/browser-webdriverio': 4.1.9
+      '@vitest/coverage-istanbul': 4.1.9
+      '@vitest/coverage-v8': 4.1.9
+      '@vitest/ui': 4.1.9
+      happy-dom: '*'
+      jsdom: '*'
+      vite: ^6.0.0 || ^7.0.0 || ^8.0.0
+    peerDependenciesMeta:
+      '@edge-runtime/vm':
+        optional: true
+      '@opentelemetry/api':
+        optional: true
+      '@types/node':
+        optional: true
+      '@vitest/browser-playwright':
+        optional: true
+      '@vitest/browser-preview':
+        optional: true
+      '@vitest/browser-webdriverio':
+        optional: true
+      '@vitest/coverage-istanbul':
+        optional: true
+      '@vitest/coverage-v8':
+        optional: true
+      '@vitest/ui':
+        optional: true
+      happy-dom:
+        optional: true
+      jsdom:
+        optional: true
 
   void-elements@3.1.0:
     resolution: {integrity: sha512-Dhxzh5HZuiHQhbvTW9AMetFfBHDMYpo23Uo9btPXgdYP+3T5S+p+jgNy7spra+veYhBP2dCSgxR/i2Y02h5/6w==}
@@ -9559,6 +9704,11 @@ packages:
     resolution: {integrity: sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==}
     engines: {node: '>= 8'}
 
+  why-is-node-running@2.3.0:
+    resolution: {integrity: sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w==}
+    engines: {node: '>=8'}
+    hasBin: true
+
   word-wrap@1.2.5:
     resolution: {integrity: sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==}
     engines: {node: '>=0.10.0'}
@@ -9854,17 +10004,73 @@ snapshots:
       idb: 8.0.0
       tslib: 2.8.1
 
-  '@antfu/eslint-config@9.0.0(@eslint-react/eslint-plugin@5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3))(@next/eslint-plugin-next@16.2.9)(@types/node@25.9.3)(@typescript-eslint/typescript-estree@8.61.0(typescript@6.0.3))(@typescript-eslint/utils@8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3))(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(eslint-plugin-jsx-a11y@6.10.2(eslint@10.5.0(jiti@2.7.0)))(eslint-plugin-react-refresh@0.5.3(eslint@10.5.0(jiti@2.7.0)))(eslint@10.5.0(jiti@2.7.0))(happy-dom@20.10.3)(jiti@2.7.0)(oxlint@1.67.0(oxlint-tsgolint@0.23.0)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)':
+  '@antfu/eslint-config@9.0.0(@eslint-react/eslint-plugin@5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3))(@next/eslint-plugin-next@16.2.9)(@typescript-eslint/typescript-estree@8.61.1(typescript@6.0.3))(@typescript-eslint/utils@8.61.1(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3))(eslint-plugin-jsx-a11y@6.10.2(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2)))(eslint-plugin-react-refresh@0.5.3(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2)))(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(oxlint@1.70.0(oxlint-tsgolint@0.23.0)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(supports-color@10.2.2)(typescript@6.0.3)(vitest@4.1.9)':
     dependencies:
       '@antfu/install-pkg': 1.1.0
       '@clack/prompts': 1.4.0
-      '@e18e/eslint-plugin': 0.4.1(eslint@10.5.0(jiti@2.7.0))(oxlint@1.67.0(oxlint-tsgolint@0.23.0)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
+      '@e18e/eslint-plugin': 0.4.1(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(oxlint@1.70.0(oxlint-tsgolint@0.23.0)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
+      '@eslint-community/eslint-plugin-eslint-comments': 4.7.1(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
+      '@eslint/markdown': 8.0.1
+      '@stylistic/eslint-plugin': 5.10.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
+      '@typescript-eslint/eslint-plugin': 8.61.0(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3)
+      '@typescript-eslint/parser': 8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3)
+      '@vitest/eslint-plugin': 1.6.17(@typescript-eslint/eslint-plugin@8.61.0(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)(vitest@4.1.9)
+      ansis: 4.3.0
+      cac: 7.0.0
+      eslint: 10.5.0(jiti@2.7.0)(supports-color@10.2.2)
+      eslint-config-flat-gitignore: 2.3.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
+      eslint-flat-config-utils: 3.2.0
+      eslint-merge-processors: 2.0.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
+      eslint-plugin-antfu: 3.2.3(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
+      eslint-plugin-command: 3.5.2(@typescript-eslint/typescript-estree@8.61.1(typescript@6.0.3))(@typescript-eslint/utils@8.61.1(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
+      eslint-plugin-import-lite: 0.6.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
+      eslint-plugin-jsdoc: 62.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)
+      eslint-plugin-jsonc: 3.1.2(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
+      eslint-plugin-n: 18.0.1(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
+      eslint-plugin-no-only-tests: 3.4.0
+      eslint-plugin-perfectionist: 5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
+      eslint-plugin-pnpm: 1.6.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
+      eslint-plugin-regexp: 3.1.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
+      eslint-plugin-toml: 1.3.1(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)
+      eslint-plugin-unicorn: 64.0.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
+      eslint-plugin-unused-imports: 4.4.1(@typescript-eslint/eslint-plugin@8.61.0(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
+      eslint-plugin-vue: 10.9.1(@stylistic/eslint-plugin@5.10.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2)))(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(vue-eslint-parser@10.4.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2))
+      eslint-plugin-yml: 3.3.2(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
+      eslint-processor-vue-blocks: 2.0.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
+      globals: 17.6.0
+      local-pkg: 1.1.2
+      parse-gitignore: 2.0.0
+      toml-eslint-parser: 1.0.3
+      vue-eslint-parser: 10.4.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)
+      yaml-eslint-parser: 2.0.0
+    optionalDependencies:
+      '@eslint-react/eslint-plugin': 5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
+      '@next/eslint-plugin-next': 16.2.9
+      eslint-plugin-jsx-a11y: 6.10.2(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
+      eslint-plugin-react-refresh: 0.5.3(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
+    transitivePeerDependencies:
+      - '@eslint/json'
+      - '@typescript-eslint/rule-tester'
+      - '@typescript-eslint/typescript-estree'
+      - '@typescript-eslint/utils'
+      - '@vue/compiler-sfc'
+      - oxlint
+      - supports-color
+      - ts-declaration-location
+      - typescript
+      - vitest
+
+  '@antfu/eslint-config@9.0.0(@eslint-react/eslint-plugin@5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3))(@next/eslint-plugin-next@16.2.9)(@typescript-eslint/typescript-estree@8.61.1(typescript@6.0.3))(@typescript-eslint/utils@8.61.1(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3))(eslint-plugin-jsx-a11y@6.10.2(eslint@10.5.0(jiti@2.7.0)))(eslint-plugin-react-refresh@0.5.3(eslint@10.5.0(jiti@2.7.0)))(eslint@10.5.0(jiti@2.7.0))(oxlint@1.70.0(oxlint-tsgolint@0.23.0)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(typescript@6.0.3)(vitest@4.1.9)':
+    dependencies:
+      '@antfu/install-pkg': 1.1.0
+      '@clack/prompts': 1.4.0
+      '@e18e/eslint-plugin': 0.4.1(eslint@10.5.0(jiti@2.7.0))(oxlint@1.70.0(oxlint-tsgolint@0.23.0)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
       '@eslint-community/eslint-plugin-eslint-comments': 4.7.1(eslint@10.5.0(jiti@2.7.0))
       '@eslint/markdown': 8.0.1
       '@stylistic/eslint-plugin': 5.10.0(eslint@10.5.0(jiti@2.7.0))
-      '@typescript-eslint/eslint-plugin': 8.61.0(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0))(supports-color@10.2.2)(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0))(supports-color@10.2.2)(typescript@6.0.3)
-      '@typescript-eslint/parser': 8.61.0(eslint@10.5.0(jiti@2.7.0))(supports-color@10.2.2)(typescript@6.0.3)
-      '@vitest/eslint-plugin': 1.6.17(@types/node@25.9.3)(@typescript-eslint/eslint-plugin@8.61.0(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3))(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(eslint@10.5.0(jiti@2.7.0))(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
+      '@typescript-eslint/eslint-plugin': 8.61.0(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/parser': 8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
+      '@vitest/eslint-plugin': 1.6.17(@typescript-eslint/eslint-plugin@8.61.0(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)(vitest@4.1.9)
       ansis: 4.3.0
       cac: 7.0.0
       eslint: 10.5.0(jiti@2.7.0)
@@ -9872,7 +10078,7 @@ snapshots:
       eslint-flat-config-utils: 3.2.0
       eslint-merge-processors: 2.0.0(eslint@10.5.0(jiti@2.7.0))
       eslint-plugin-antfu: 3.2.3(eslint@10.5.0(jiti@2.7.0))
-      eslint-plugin-command: 3.5.2(@typescript-eslint/typescript-estree@8.61.0(typescript@6.0.3))(@typescript-eslint/utils@8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0))
+      eslint-plugin-command: 3.5.2(@typescript-eslint/typescript-estree@8.61.1(typescript@6.0.3))(@typescript-eslint/utils@8.61.1(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0))
       eslint-plugin-import-lite: 0.6.0(eslint@10.5.0(jiti@2.7.0))
       eslint-plugin-jsdoc: 62.9.0(eslint@10.5.0(jiti@2.7.0))
       eslint-plugin-jsonc: 3.1.2(eslint@10.5.0(jiti@2.7.0))
@@ -9899,126 +10105,16 @@ snapshots:
       eslint-plugin-jsx-a11y: 6.10.2(eslint@10.5.0(jiti@2.7.0))
       eslint-plugin-react-refresh: 0.5.3(eslint@10.5.0(jiti@2.7.0))
     transitivePeerDependencies:
-      - '@arethetypeswrong/core'
-      - '@edge-runtime/vm'
       - '@eslint/json'
-      - '@opentelemetry/api'
-      - '@tsdown/css'
-      - '@tsdown/exe'
-      - '@types/node'
       - '@typescript-eslint/rule-tester'
       - '@typescript-eslint/typescript-estree'
       - '@typescript-eslint/utils'
-      - '@vitejs/devtools'
-      - '@vitest/coverage-istanbul'
-      - '@vitest/coverage-v8'
-      - '@vitest/ui'
       - '@vue/compiler-sfc'
-      - bufferutil
-      - esbuild
-      - happy-dom
-      - jiti
-      - jsdom
-      - less
       - oxlint
-      - publint
-      - sass
-      - sass-embedded
-      - stylus
-      - sugarss
       - supports-color
-      - terser
       - ts-declaration-location
-      - tsx
       - typescript
-      - unplugin-unused
-      - unrun
-      - utf-8-validate
-      - vite
-      - yaml
-
-  '@antfu/eslint-config@9.0.0(b376e15be293d4e014f0f69f32d1fb4a)':
-    dependencies:
-      '@antfu/install-pkg': 1.1.0
-      '@clack/prompts': 1.4.0
-      '@e18e/eslint-plugin': 0.4.1(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(oxlint@1.67.0(oxlint-tsgolint@0.23.0)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8(@vitest/browser@4.1.8(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))))(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
-      '@eslint-community/eslint-plugin-eslint-comments': 4.7.1(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
-      '@eslint/markdown': 8.0.1
-      '@stylistic/eslint-plugin': 5.10.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
-      '@typescript-eslint/eslint-plugin': 8.61.0(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
-      '@typescript-eslint/parser': 8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
-      '@vitest/eslint-plugin': 1.6.17(@types/node@25.9.3)(@typescript-eslint/eslint-plugin@8.61.0(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3))(@vitest/coverage-v8@4.1.8(@vitest/browser@4.1.8(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))))(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
-      ansis: 4.3.0
-      cac: 7.0.0
-      eslint: 10.5.0(jiti@2.7.0)(supports-color@10.2.2)
-      eslint-config-flat-gitignore: 2.3.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
-      eslint-flat-config-utils: 3.2.0
-      eslint-merge-processors: 2.0.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
-      eslint-plugin-antfu: 3.2.3(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
-      eslint-plugin-command: 3.5.2(@typescript-eslint/typescript-estree@8.61.0(typescript@6.0.3))(@typescript-eslint/utils@8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
-      eslint-plugin-import-lite: 0.6.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
-      eslint-plugin-jsdoc: 62.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)
-      eslint-plugin-jsonc: 3.1.2(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
-      eslint-plugin-n: 18.0.1(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
-      eslint-plugin-no-only-tests: 3.4.0
-      eslint-plugin-perfectionist: 5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
-      eslint-plugin-pnpm: 1.6.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
-      eslint-plugin-regexp: 3.1.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
-      eslint-plugin-toml: 1.3.1(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)
-      eslint-plugin-unicorn: 64.0.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
-      eslint-plugin-unused-imports: 4.4.1(@typescript-eslint/eslint-plugin@8.61.0(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
-      eslint-plugin-vue: 10.9.1(@stylistic/eslint-plugin@5.10.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2)))(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(vue-eslint-parser@10.4.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2))
-      eslint-plugin-yml: 3.3.2(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
-      eslint-processor-vue-blocks: 2.0.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
-      globals: 17.6.0
-      local-pkg: 1.1.2
-      parse-gitignore: 2.0.0
-      toml-eslint-parser: 1.0.3
-      vue-eslint-parser: 10.4.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)
-      yaml-eslint-parser: 2.0.0
-    optionalDependencies:
-      '@eslint-react/eslint-plugin': 5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
-      '@next/eslint-plugin-next': 16.2.9
-      eslint-plugin-jsx-a11y: 6.10.2(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
-      eslint-plugin-react-refresh: 0.5.3(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
-    transitivePeerDependencies:
-      - '@arethetypeswrong/core'
-      - '@edge-runtime/vm'
-      - '@eslint/json'
-      - '@opentelemetry/api'
-      - '@tsdown/css'
-      - '@tsdown/exe'
-      - '@types/node'
-      - '@typescript-eslint/rule-tester'
-      - '@typescript-eslint/typescript-estree'
-      - '@typescript-eslint/utils'
-      - '@vitejs/devtools'
-      - '@vitest/coverage-istanbul'
-      - '@vitest/coverage-v8'
-      - '@vitest/ui'
-      - '@vue/compiler-sfc'
-      - bufferutil
-      - esbuild
-      - happy-dom
-      - jiti
-      - jsdom
-      - less
-      - oxlint
-      - publint
-      - sass
-      - sass-embedded
-      - stylus
-      - sugarss
-      - supports-color
-      - terser
-      - ts-declaration-location
-      - tsx
-      - typescript
-      - unplugin-unused
-      - unrun
-      - utf-8-validate
-      - vite
-      - yaml
+      - vitest
 
   '@antfu/install-pkg@1.1.0':
     dependencies:
@@ -10061,14 +10157,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/generator@7.29.1':
-    dependencies:
-      '@babel/parser': 7.29.2
-      '@babel/types': 7.29.0
-      '@jridgewell/gen-mapping': 0.3.13
-      '@jridgewell/trace-mapping': 0.3.31
-      jsesc: 3.1.0
-
   '@babel/generator@7.29.7':
     dependencies:
       '@babel/parser': 7.29.7
@@ -10085,8 +10173,6 @@ snapshots:
       lru-cache: 5.1.1
       semver: 6.3.1
 
-  '@babel/helper-globals@7.28.0': {}
-
   '@babel/helper-globals@7.29.7': {}
 
   '@babel/helper-module-imports@7.29.7':
@@ -10105,8 +10191,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/helper-string-parser@7.27.1': {}
-
   '@babel/helper-string-parser@7.29.7': {}
 
   '@babel/helper-validator-identifier@7.28.5': {}
@@ -10120,40 +10204,18 @@ snapshots:
       '@babel/template': 7.29.7
       '@babel/types': 7.29.7
 
-  '@babel/parser@7.29.2':
-    dependencies:
-      '@babel/types': 7.29.0
-
   '@babel/parser@7.29.7':
     dependencies:
       '@babel/types': 7.29.7
 
   '@babel/runtime@7.29.2': {}
 
-  '@babel/template@7.28.6':
-    dependencies:
-      '@babel/code-frame': 7.29.0
-      '@babel/parser': 7.29.2
-      '@babel/types': 7.29.0
-
   '@babel/template@7.29.7':
     dependencies:
       '@babel/code-frame': 7.29.7
       '@babel/parser': 7.29.7
       '@babel/types': 7.29.7
 
-  '@babel/traverse@7.29.0':
-    dependencies:
-      '@babel/code-frame': 7.29.0
-      '@babel/generator': 7.29.1
-      '@babel/helper-globals': 7.28.0
-      '@babel/parser': 7.29.2
-      '@babel/template': 7.28.6
-      '@babel/types': 7.29.0
-      debug: 4.4.3(supports-color@10.2.2)
-    transitivePeerDependencies:
-      - supports-color
-
   '@babel/traverse@7.29.7':
     dependencies:
       '@babel/code-frame': 7.29.7
@@ -10166,20 +10228,15 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/types@7.29.0':
-    dependencies:
-      '@babel/helper-string-parser': 7.27.1
-      '@babel/helper-validator-identifier': 7.28.5
-
   '@babel/types@7.29.7':
     dependencies:
       '@babel/helper-string-parser': 7.29.7
       '@babel/helper-validator-identifier': 7.29.7
 
-  '@base-ui/react@1.5.0(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@base-ui/react@1.6.0(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@babel/runtime': 7.29.2
-      '@base-ui/utils': 0.2.9(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@base-ui/utils': 0.3.1(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@floating-ui/react-dom': 2.1.8(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@floating-ui/utils': 0.2.11
       react: 19.2.7
@@ -10188,7 +10245,7 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.2.17
 
-  '@base-ui/utils@0.2.9(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@base-ui/utils@0.3.1(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@babel/runtime': 7.29.2
       '@floating-ui/utils': 0.2.11
@@ -10207,12 +10264,12 @@ snapshots:
 
   '@chevrotain/types@11.1.2': {}
 
-  '@chromatic-com/storybook@5.2.1(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))':
+  '@chromatic-com/storybook@5.2.1(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))':
     dependencies:
       '@neoconfetti/react': 1.0.0
       chromatic: 16.10.0
       jsonfile: 6.2.0
-      storybook: 10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
+      storybook: 10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
       strip-ansi: 7.2.0
     transitivePeerDependencies:
       - '@chromatic-com/cypress'
@@ -10231,7 +10288,7 @@ snapshots:
       fast-wrap-ansi: 0.2.0
       sisteransi: 1.0.5
 
-  '@code-inspector/core@1.6.0(supports-color@10.2.2)':
+  '@code-inspector/core@1.6.1(supports-color@10.2.2)':
     dependencies:
       '@vue/compiler-dom': 3.5.31
       chalk: 4.1.2
@@ -10241,35 +10298,35 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@code-inspector/esbuild@1.6.0':
+  '@code-inspector/esbuild@1.6.1':
     dependencies:
-      '@code-inspector/core': 1.6.0(supports-color@10.2.2)
+      '@code-inspector/core': 1.6.1(supports-color@10.2.2)
     transitivePeerDependencies:
       - supports-color
 
-  '@code-inspector/mako@1.6.0':
+  '@code-inspector/mako@1.6.1':
     dependencies:
-      '@code-inspector/core': 1.6.0(supports-color@10.2.2)
+      '@code-inspector/core': 1.6.1(supports-color@10.2.2)
     transitivePeerDependencies:
       - supports-color
 
-  '@code-inspector/turbopack@1.6.0':
+  '@code-inspector/turbopack@1.6.1':
     dependencies:
-      '@code-inspector/core': 1.6.0(supports-color@10.2.2)
-      '@code-inspector/webpack': 1.6.0
+      '@code-inspector/core': 1.6.1(supports-color@10.2.2)
+      '@code-inspector/webpack': 1.6.1
     transitivePeerDependencies:
       - supports-color
 
-  '@code-inspector/vite@1.6.0':
+  '@code-inspector/vite@1.6.1':
     dependencies:
-      '@code-inspector/core': 1.6.0(supports-color@10.2.2)
+      '@code-inspector/core': 1.6.1(supports-color@10.2.2)
       chalk: 4.1.1
     transitivePeerDependencies:
       - supports-color
 
-  '@code-inspector/webpack@1.6.0':
+  '@code-inspector/webpack@1.6.1':
     dependencies:
-      '@code-inspector/core': 1.6.0(supports-color@10.2.2)
+      '@code-inspector/core': 1.6.1(supports-color@10.2.2)
     transitivePeerDependencies:
       - supports-color
 
@@ -10388,23 +10445,23 @@ snapshots:
       perfect-debounce: 2.1.0
       tinyexec: 1.2.3
 
-  '@e18e/eslint-plugin@0.4.1(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(oxlint@1.67.0(oxlint-tsgolint@0.23.0)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8(@vitest/browser@4.1.8(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))))(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))':
+  '@e18e/eslint-plugin@0.4.1(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(oxlint@1.70.0(oxlint-tsgolint@0.23.0)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))':
     dependencies:
       empathic: 2.0.0
       module-replacements: 3.0.0-beta.7
       semver: 7.8.4
     optionalDependencies:
       eslint: 10.5.0(jiti@2.7.0)(supports-color@10.2.2)
-      oxlint: 1.67.0(oxlint-tsgolint@0.23.0)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8(@vitest/browser@4.1.8(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))))(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
+      oxlint: 1.70.0(oxlint-tsgolint@0.23.0)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
 
-  '@e18e/eslint-plugin@0.4.1(eslint@10.5.0(jiti@2.7.0))(oxlint@1.67.0(oxlint-tsgolint@0.23.0)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))':
+  '@e18e/eslint-plugin@0.4.1(eslint@10.5.0(jiti@2.7.0))(oxlint@1.70.0(oxlint-tsgolint@0.23.0)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))':
     dependencies:
       empathic: 2.0.0
       module-replacements: 3.0.0-beta.7
       semver: 7.8.4
     optionalDependencies:
       eslint: 10.5.0(jiti@2.7.0)
-      oxlint: 1.67.0(oxlint-tsgolint@0.23.0)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
+      oxlint: 1.70.0(oxlint-tsgolint@0.23.0)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
 
   '@egoist/tailwindcss-icons@1.9.2(tailwindcss@4.3.1)':
     dependencies:
@@ -10567,9 +10624,9 @@ snapshots:
 
   '@eslint-react/ast@5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)':
     dependencies:
-      '@typescript-eslint/types': 8.61.0
-      '@typescript-eslint/typescript-estree': 8.61.0(typescript@6.0.3)
-      '@typescript-eslint/utils': 8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/typescript-estree': 8.61.1(typescript@6.0.3)
+      '@typescript-eslint/utils': 8.61.1(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
       eslint: 10.5.0(jiti@2.7.0)(supports-color@10.2.2)
       string-ts: 2.3.1
       typescript: 6.0.3
@@ -10579,9 +10636,9 @@ snapshots:
 
   '@eslint-react/ast@5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)':
     dependencies:
-      '@typescript-eslint/types': 8.61.0
-      '@typescript-eslint/typescript-estree': 8.61.0(typescript@6.0.3)
-      '@typescript-eslint/utils': 8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/typescript-estree': 8.61.1(typescript@6.0.3)
+      '@typescript-eslint/utils': 8.61.1(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       eslint: 10.5.0(jiti@2.7.0)
       string-ts: 2.3.1
       typescript: 6.0.3
@@ -10595,9 +10652,9 @@ snapshots:
       '@eslint-react/jsx': 5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
       '@eslint-react/shared': 5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
       '@eslint-react/var': 5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
-      '@typescript-eslint/scope-manager': 8.61.0
-      '@typescript-eslint/types': 8.61.0
-      '@typescript-eslint/utils': 8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
+      '@typescript-eslint/scope-manager': 8.61.1
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/utils': 8.61.1(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
       eslint: 10.5.0(jiti@2.7.0)(supports-color@10.2.2)
       ts-pattern: 5.9.0
       typescript: 6.0.3
@@ -10612,9 +10669,9 @@ snapshots:
       '@eslint-react/jsx': 5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       '@eslint-react/shared': 5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       '@eslint-react/var': 5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
-      '@typescript-eslint/scope-manager': 8.61.0
-      '@typescript-eslint/types': 8.61.0
-      '@typescript-eslint/utils': 8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/scope-manager': 8.61.1
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/utils': 8.61.1(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       eslint: 10.5.0(jiti@2.7.0)
       ts-pattern: 5.9.0
       typescript: 6.0.3
@@ -10652,7 +10709,7 @@ snapshots:
 
   '@eslint-react/eslint@5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)':
     dependencies:
-      '@typescript-eslint/utils': 8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
+      '@typescript-eslint/utils': 8.61.1(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
       eslint: 10.5.0(jiti@2.7.0)(supports-color@10.2.2)
       typescript: 6.0.3
     transitivePeerDependencies:
@@ -10661,7 +10718,7 @@ snapshots:
 
   '@eslint-react/eslint@5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)':
     dependencies:
-      '@typescript-eslint/utils': 8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/utils': 8.61.1(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       eslint: 10.5.0(jiti@2.7.0)
       typescript: 6.0.3
     transitivePeerDependencies:
@@ -10673,8 +10730,8 @@ snapshots:
       '@eslint-react/eslint': 5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
       '@eslint-react/shared': 5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
       '@eslint-react/var': 5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
-      '@typescript-eslint/types': 8.61.0
-      '@typescript-eslint/utils': 8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/utils': 8.61.1(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
       eslint: 10.5.0(jiti@2.7.0)(supports-color@10.2.2)
       ts-pattern: 5.9.0
       typescript: 6.0.3
@@ -10688,8 +10745,8 @@ snapshots:
       '@eslint-react/eslint': 5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       '@eslint-react/shared': 5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       '@eslint-react/var': 5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
-      '@typescript-eslint/types': 8.61.0
-      '@typescript-eslint/utils': 8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/utils': 8.61.1(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       eslint: 10.5.0(jiti@2.7.0)
       ts-pattern: 5.9.0
       typescript: 6.0.3
@@ -10699,7 +10756,7 @@ snapshots:
   '@eslint-react/shared@5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)':
     dependencies:
       '@eslint-react/eslint': 5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
-      '@typescript-eslint/utils': 8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
+      '@typescript-eslint/utils': 8.61.1(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
       eslint: 10.5.0(jiti@2.7.0)(supports-color@10.2.2)
       ts-pattern: 5.9.0
       typescript: 6.0.3
@@ -10711,7 +10768,7 @@ snapshots:
   '@eslint-react/shared@5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)':
     dependencies:
       '@eslint-react/eslint': 5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
-      '@typescript-eslint/utils': 8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/utils': 8.61.1(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       eslint: 10.5.0(jiti@2.7.0)
       ts-pattern: 5.9.0
       typescript: 6.0.3
@@ -10723,9 +10780,9 @@ snapshots:
     dependencies:
       '@eslint-react/ast': 5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
       '@eslint-react/eslint': 5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
-      '@typescript-eslint/scope-manager': 8.61.0
-      '@typescript-eslint/types': 8.61.0
-      '@typescript-eslint/utils': 8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
+      '@typescript-eslint/scope-manager': 8.61.1
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/utils': 8.61.1(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
       eslint: 10.5.0(jiti@2.7.0)(supports-color@10.2.2)
       ts-pattern: 5.9.0
       typescript: 6.0.3
@@ -10737,9 +10794,9 @@ snapshots:
     dependencies:
       '@eslint-react/ast': 5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       '@eslint-react/eslint': 5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
-      '@typescript-eslint/scope-manager': 8.61.0
-      '@typescript-eslint/types': 8.61.0
-      '@typescript-eslint/utils': 8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/scope-manager': 8.61.1
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/utils': 8.61.1(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       eslint: 10.5.0(jiti@2.7.0)
       ts-pattern: 5.9.0
       typescript: 6.0.3
@@ -10923,9 +10980,9 @@ snapshots:
 
   '@hey-api/types@0.1.4': {}
 
-  '@hono/node-server@2.0.4(hono@4.12.25)':
+  '@hono/node-server@2.0.5(hono@4.12.26)':
     dependencies:
-      hono: 4.12.25
+      hono: 4.12.26
 
   '@humanfs/core@0.19.1': {}
 
@@ -10988,9 +11045,9 @@ snapshots:
       '@img/sharp-libvips-darwin-arm64': 1.2.4
     optional: true
 
-  '@img/sharp-darwin-arm64@0.35.1':
+  '@img/sharp-darwin-arm64@0.35.2':
     optionalDependencies:
-      '@img/sharp-libvips-darwin-arm64': 1.3.0
+      '@img/sharp-libvips-darwin-arm64': 1.3.1
     optional: true
 
   '@img/sharp-darwin-x64@0.34.5':
@@ -10998,74 +11055,74 @@ snapshots:
       '@img/sharp-libvips-darwin-x64': 1.2.4
     optional: true
 
-  '@img/sharp-darwin-x64@0.35.1':
+  '@img/sharp-darwin-x64@0.35.2':
     optionalDependencies:
-      '@img/sharp-libvips-darwin-x64': 1.3.0
+      '@img/sharp-libvips-darwin-x64': 1.3.1
     optional: true
 
-  '@img/sharp-freebsd-wasm32@0.35.1':
+  '@img/sharp-freebsd-wasm32@0.35.2':
     dependencies:
-      '@img/sharp-wasm32': 0.35.1
+      '@img/sharp-wasm32': 0.35.2
     optional: true
 
   '@img/sharp-libvips-darwin-arm64@1.2.4':
     optional: true
 
-  '@img/sharp-libvips-darwin-arm64@1.3.0':
+  '@img/sharp-libvips-darwin-arm64@1.3.1':
     optional: true
 
   '@img/sharp-libvips-darwin-x64@1.2.4':
     optional: true
 
-  '@img/sharp-libvips-darwin-x64@1.3.0':
+  '@img/sharp-libvips-darwin-x64@1.3.1':
     optional: true
 
   '@img/sharp-libvips-linux-arm64@1.2.4':
     optional: true
 
-  '@img/sharp-libvips-linux-arm64@1.3.0':
+  '@img/sharp-libvips-linux-arm64@1.3.1':
     optional: true
 
   '@img/sharp-libvips-linux-arm@1.2.4':
     optional: true
 
-  '@img/sharp-libvips-linux-arm@1.3.0':
+  '@img/sharp-libvips-linux-arm@1.3.1':
     optional: true
 
   '@img/sharp-libvips-linux-ppc64@1.2.4':
     optional: true
 
-  '@img/sharp-libvips-linux-ppc64@1.3.0':
+  '@img/sharp-libvips-linux-ppc64@1.3.1':
     optional: true
 
   '@img/sharp-libvips-linux-riscv64@1.2.4':
     optional: true
 
-  '@img/sharp-libvips-linux-riscv64@1.3.0':
+  '@img/sharp-libvips-linux-riscv64@1.3.1':
     optional: true
 
   '@img/sharp-libvips-linux-s390x@1.2.4':
     optional: true
 
-  '@img/sharp-libvips-linux-s390x@1.3.0':
+  '@img/sharp-libvips-linux-s390x@1.3.1':
     optional: true
 
   '@img/sharp-libvips-linux-x64@1.2.4':
     optional: true
 
-  '@img/sharp-libvips-linux-x64@1.3.0':
+  '@img/sharp-libvips-linux-x64@1.3.1':
     optional: true
 
   '@img/sharp-libvips-linuxmusl-arm64@1.2.4':
     optional: true
 
-  '@img/sharp-libvips-linuxmusl-arm64@1.3.0':
+  '@img/sharp-libvips-linuxmusl-arm64@1.3.1':
     optional: true
 
   '@img/sharp-libvips-linuxmusl-x64@1.2.4':
     optional: true
 
-  '@img/sharp-libvips-linuxmusl-x64@1.3.0':
+  '@img/sharp-libvips-linuxmusl-x64@1.3.1':
     optional: true
 
   '@img/sharp-linux-arm64@0.34.5':
@@ -11073,9 +11130,9 @@ snapshots:
       '@img/sharp-libvips-linux-arm64': 1.2.4
     optional: true
 
-  '@img/sharp-linux-arm64@0.35.1':
+  '@img/sharp-linux-arm64@0.35.2':
     optionalDependencies:
-      '@img/sharp-libvips-linux-arm64': 1.3.0
+      '@img/sharp-libvips-linux-arm64': 1.3.1
     optional: true
 
   '@img/sharp-linux-arm@0.34.5':
@@ -11083,9 +11140,9 @@ snapshots:
       '@img/sharp-libvips-linux-arm': 1.2.4
     optional: true
 
-  '@img/sharp-linux-arm@0.35.1':
+  '@img/sharp-linux-arm@0.35.2':
     optionalDependencies:
-      '@img/sharp-libvips-linux-arm': 1.3.0
+      '@img/sharp-libvips-linux-arm': 1.3.1
     optional: true
 
   '@img/sharp-linux-ppc64@0.34.5':
@@ -11093,9 +11150,9 @@ snapshots:
       '@img/sharp-libvips-linux-ppc64': 1.2.4
     optional: true
 
-  '@img/sharp-linux-ppc64@0.35.1':
+  '@img/sharp-linux-ppc64@0.35.2':
     optionalDependencies:
-      '@img/sharp-libvips-linux-ppc64': 1.3.0
+      '@img/sharp-libvips-linux-ppc64': 1.3.1
     optional: true
 
   '@img/sharp-linux-riscv64@0.34.5':
@@ -11103,9 +11160,9 @@ snapshots:
       '@img/sharp-libvips-linux-riscv64': 1.2.4
     optional: true
 
-  '@img/sharp-linux-riscv64@0.35.1':
+  '@img/sharp-linux-riscv64@0.35.2':
     optionalDependencies:
-      '@img/sharp-libvips-linux-riscv64': 1.3.0
+      '@img/sharp-libvips-linux-riscv64': 1.3.1
     optional: true
 
   '@img/sharp-linux-s390x@0.34.5':
@@ -11113,9 +11170,9 @@ snapshots:
       '@img/sharp-libvips-linux-s390x': 1.2.4
     optional: true
 
-  '@img/sharp-linux-s390x@0.35.1':
+  '@img/sharp-linux-s390x@0.35.2':
     optionalDependencies:
-      '@img/sharp-libvips-linux-s390x': 1.3.0
+      '@img/sharp-libvips-linux-s390x': 1.3.1
     optional: true
 
   '@img/sharp-linux-x64@0.34.5':
@@ -11123,9 +11180,9 @@ snapshots:
       '@img/sharp-libvips-linux-x64': 1.2.4
     optional: true
 
-  '@img/sharp-linux-x64@0.35.1':
+  '@img/sharp-linux-x64@0.35.2':
     optionalDependencies:
-      '@img/sharp-libvips-linux-x64': 1.3.0
+      '@img/sharp-libvips-linux-x64': 1.3.1
     optional: true
 
   '@img/sharp-linuxmusl-arm64@0.34.5':
@@ -11133,9 +11190,9 @@ snapshots:
       '@img/sharp-libvips-linuxmusl-arm64': 1.2.4
     optional: true
 
-  '@img/sharp-linuxmusl-arm64@0.35.1':
+  '@img/sharp-linuxmusl-arm64@0.35.2':
     optionalDependencies:
-      '@img/sharp-libvips-linuxmusl-arm64': 1.3.0
+      '@img/sharp-libvips-linuxmusl-arm64': 1.3.1
     optional: true
 
   '@img/sharp-linuxmusl-x64@0.34.5':
@@ -11143,9 +11200,9 @@ snapshots:
       '@img/sharp-libvips-linuxmusl-x64': 1.2.4
     optional: true
 
-  '@img/sharp-linuxmusl-x64@0.35.1':
+  '@img/sharp-linuxmusl-x64@0.35.2':
     optionalDependencies:
-      '@img/sharp-libvips-linuxmusl-x64': 1.3.0
+      '@img/sharp-libvips-linuxmusl-x64': 1.3.1
     optional: true
 
   '@img/sharp-wasm32@0.34.5':
@@ -11153,43 +11210,43 @@ snapshots:
       '@emnapi/runtime': 1.11.1
     optional: true
 
-  '@img/sharp-wasm32@0.35.1':
+  '@img/sharp-wasm32@0.35.2':
     dependencies:
       '@emnapi/runtime': 1.11.1
     optional: true
 
-  '@img/sharp-webcontainers-wasm32@0.35.1':
+  '@img/sharp-webcontainers-wasm32@0.35.2':
     dependencies:
-      '@img/sharp-wasm32': 0.35.1
+      '@img/sharp-wasm32': 0.35.2
     optional: true
 
   '@img/sharp-win32-arm64@0.34.5':
     optional: true
 
-  '@img/sharp-win32-arm64@0.35.1':
+  '@img/sharp-win32-arm64@0.35.2':
     optional: true
 
   '@img/sharp-win32-ia32@0.34.5':
     optional: true
 
-  '@img/sharp-win32-ia32@0.35.1':
+  '@img/sharp-win32-ia32@0.35.2':
     optional: true
 
   '@img/sharp-win32-x64@0.34.5':
     optional: true
 
-  '@img/sharp-win32-x64@0.35.1':
+  '@img/sharp-win32-x64@0.35.2':
     optional: true
 
   '@isaacs/fs-minipass@4.0.1':
     dependencies:
       minipass: 7.1.3
 
-  '@joshwooding/vite-plugin-react-docgen-typescript@0.7.0(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(typescript@6.0.3)':
+  '@joshwooding/vite-plugin-react-docgen-typescript@0.7.0(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(typescript@6.0.3)':
     dependencies:
       glob: 13.0.6
       react-docgen-typescript: 2.4.0(typescript@6.0.3)
-      vite: '@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+      vite: '@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
     optionalDependencies:
       typescript: 6.0.3
 
@@ -11649,7 +11706,7 @@ snapshots:
   '@oxc-parser/binding-android-arm-eabi@0.132.0':
     optional: true
 
-  '@oxc-parser/binding-android-arm-eabi@0.133.0':
+  '@oxc-parser/binding-android-arm-eabi@0.135.0':
     optional: true
 
   '@oxc-parser/binding-android-arm64@0.127.0':
@@ -11658,7 +11715,7 @@ snapshots:
   '@oxc-parser/binding-android-arm64@0.132.0':
     optional: true
 
-  '@oxc-parser/binding-android-arm64@0.133.0':
+  '@oxc-parser/binding-android-arm64@0.135.0':
     optional: true
 
   '@oxc-parser/binding-darwin-arm64@0.127.0':
@@ -11667,7 +11724,7 @@ snapshots:
   '@oxc-parser/binding-darwin-arm64@0.132.0':
     optional: true
 
-  '@oxc-parser/binding-darwin-arm64@0.133.0':
+  '@oxc-parser/binding-darwin-arm64@0.135.0':
     optional: true
 
   '@oxc-parser/binding-darwin-x64@0.127.0':
@@ -11676,7 +11733,7 @@ snapshots:
   '@oxc-parser/binding-darwin-x64@0.132.0':
     optional: true
 
-  '@oxc-parser/binding-darwin-x64@0.133.0':
+  '@oxc-parser/binding-darwin-x64@0.135.0':
     optional: true
 
   '@oxc-parser/binding-freebsd-x64@0.127.0':
@@ -11685,7 +11742,7 @@ snapshots:
   '@oxc-parser/binding-freebsd-x64@0.132.0':
     optional: true
 
-  '@oxc-parser/binding-freebsd-x64@0.133.0':
+  '@oxc-parser/binding-freebsd-x64@0.135.0':
     optional: true
 
   '@oxc-parser/binding-linux-arm-gnueabihf@0.127.0':
@@ -11694,7 +11751,7 @@ snapshots:
   '@oxc-parser/binding-linux-arm-gnueabihf@0.132.0':
     optional: true
 
-  '@oxc-parser/binding-linux-arm-gnueabihf@0.133.0':
+  '@oxc-parser/binding-linux-arm-gnueabihf@0.135.0':
     optional: true
 
   '@oxc-parser/binding-linux-arm-musleabihf@0.127.0':
@@ -11703,7 +11760,7 @@ snapshots:
   '@oxc-parser/binding-linux-arm-musleabihf@0.132.0':
     optional: true
 
-  '@oxc-parser/binding-linux-arm-musleabihf@0.133.0':
+  '@oxc-parser/binding-linux-arm-musleabihf@0.135.0':
     optional: true
 
   '@oxc-parser/binding-linux-arm64-gnu@0.127.0':
@@ -11712,7 +11769,7 @@ snapshots:
   '@oxc-parser/binding-linux-arm64-gnu@0.132.0':
     optional: true
 
-  '@oxc-parser/binding-linux-arm64-gnu@0.133.0':
+  '@oxc-parser/binding-linux-arm64-gnu@0.135.0':
     optional: true
 
   '@oxc-parser/binding-linux-arm64-musl@0.127.0':
@@ -11721,7 +11778,7 @@ snapshots:
   '@oxc-parser/binding-linux-arm64-musl@0.132.0':
     optional: true
 
-  '@oxc-parser/binding-linux-arm64-musl@0.133.0':
+  '@oxc-parser/binding-linux-arm64-musl@0.135.0':
     optional: true
 
   '@oxc-parser/binding-linux-ppc64-gnu@0.127.0':
@@ -11730,7 +11787,7 @@ snapshots:
   '@oxc-parser/binding-linux-ppc64-gnu@0.132.0':
     optional: true
 
-  '@oxc-parser/binding-linux-ppc64-gnu@0.133.0':
+  '@oxc-parser/binding-linux-ppc64-gnu@0.135.0':
     optional: true
 
   '@oxc-parser/binding-linux-riscv64-gnu@0.127.0':
@@ -11739,7 +11796,7 @@ snapshots:
   '@oxc-parser/binding-linux-riscv64-gnu@0.132.0':
     optional: true
 
-  '@oxc-parser/binding-linux-riscv64-gnu@0.133.0':
+  '@oxc-parser/binding-linux-riscv64-gnu@0.135.0':
     optional: true
 
   '@oxc-parser/binding-linux-riscv64-musl@0.127.0':
@@ -11748,7 +11805,7 @@ snapshots:
   '@oxc-parser/binding-linux-riscv64-musl@0.132.0':
     optional: true
 
-  '@oxc-parser/binding-linux-riscv64-musl@0.133.0':
+  '@oxc-parser/binding-linux-riscv64-musl@0.135.0':
     optional: true
 
   '@oxc-parser/binding-linux-s390x-gnu@0.127.0':
@@ -11757,7 +11814,7 @@ snapshots:
   '@oxc-parser/binding-linux-s390x-gnu@0.132.0':
     optional: true
 
-  '@oxc-parser/binding-linux-s390x-gnu@0.133.0':
+  '@oxc-parser/binding-linux-s390x-gnu@0.135.0':
     optional: true
 
   '@oxc-parser/binding-linux-x64-gnu@0.127.0':
@@ -11766,7 +11823,7 @@ snapshots:
   '@oxc-parser/binding-linux-x64-gnu@0.132.0':
     optional: true
 
-  '@oxc-parser/binding-linux-x64-gnu@0.133.0':
+  '@oxc-parser/binding-linux-x64-gnu@0.135.0':
     optional: true
 
   '@oxc-parser/binding-linux-x64-musl@0.127.0':
@@ -11775,7 +11832,7 @@ snapshots:
   '@oxc-parser/binding-linux-x64-musl@0.132.0':
     optional: true
 
-  '@oxc-parser/binding-linux-x64-musl@0.133.0':
+  '@oxc-parser/binding-linux-x64-musl@0.135.0':
     optional: true
 
   '@oxc-parser/binding-openharmony-arm64@0.127.0':
@@ -11784,7 +11841,7 @@ snapshots:
   '@oxc-parser/binding-openharmony-arm64@0.132.0':
     optional: true
 
-  '@oxc-parser/binding-openharmony-arm64@0.133.0':
+  '@oxc-parser/binding-openharmony-arm64@0.135.0':
     optional: true
 
   '@oxc-parser/binding-wasm32-wasi@0.127.0':
@@ -11801,7 +11858,7 @@ snapshots:
       '@napi-rs/wasm-runtime': 1.1.4(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)
     optional: true
 
-  '@oxc-parser/binding-wasm32-wasi@0.133.0':
+  '@oxc-parser/binding-wasm32-wasi@0.135.0':
     dependencies:
       '@emnapi/core': 1.10.0
       '@emnapi/runtime': 1.10.0
@@ -11814,7 +11871,7 @@ snapshots:
   '@oxc-parser/binding-win32-arm64-msvc@0.132.0':
     optional: true
 
-  '@oxc-parser/binding-win32-arm64-msvc@0.133.0':
+  '@oxc-parser/binding-win32-arm64-msvc@0.135.0':
     optional: true
 
   '@oxc-parser/binding-win32-ia32-msvc@0.127.0':
@@ -11823,7 +11880,7 @@ snapshots:
   '@oxc-parser/binding-win32-ia32-msvc@0.132.0':
     optional: true
 
-  '@oxc-parser/binding-win32-ia32-msvc@0.133.0':
+  '@oxc-parser/binding-win32-ia32-msvc@0.135.0':
     optional: true
 
   '@oxc-parser/binding-win32-x64-msvc@0.127.0':
@@ -11832,16 +11889,18 @@ snapshots:
   '@oxc-parser/binding-win32-x64-msvc@0.132.0':
     optional: true
 
-  '@oxc-parser/binding-win32-x64-msvc@0.133.0':
+  '@oxc-parser/binding-win32-x64-msvc@0.135.0':
     optional: true
 
-  '@oxc-project/runtime@0.133.0': {}
+  '@oxc-project/runtime@0.136.0': {}
 
   '@oxc-project/types@0.127.0': {}
 
   '@oxc-project/types@0.132.0': {}
 
-  '@oxc-project/types@0.133.0': {}
+  '@oxc-project/types@0.135.0': {}
+
+  '@oxc-project/types@0.136.0': {}
 
   '@oxc-resolver/binding-android-arm-eabi@11.20.0':
     optional: true
@@ -11904,61 +11963,61 @@ snapshots:
   '@oxc-resolver/binding-win32-x64-msvc@11.20.0':
     optional: true
 
-  '@oxfmt/binding-android-arm-eabi@0.52.0':
+  '@oxfmt/binding-android-arm-eabi@0.55.0':
     optional: true
 
-  '@oxfmt/binding-android-arm64@0.52.0':
+  '@oxfmt/binding-android-arm64@0.55.0':
     optional: true
 
-  '@oxfmt/binding-darwin-arm64@0.52.0':
+  '@oxfmt/binding-darwin-arm64@0.55.0':
     optional: true
 
-  '@oxfmt/binding-darwin-x64@0.52.0':
+  '@oxfmt/binding-darwin-x64@0.55.0':
     optional: true
 
-  '@oxfmt/binding-freebsd-x64@0.52.0':
+  '@oxfmt/binding-freebsd-x64@0.55.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm-gnueabihf@0.52.0':
+  '@oxfmt/binding-linux-arm-gnueabihf@0.55.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm-musleabihf@0.52.0':
+  '@oxfmt/binding-linux-arm-musleabihf@0.55.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm64-gnu@0.52.0':
+  '@oxfmt/binding-linux-arm64-gnu@0.55.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm64-musl@0.52.0':
+  '@oxfmt/binding-linux-arm64-musl@0.55.0':
     optional: true
 
-  '@oxfmt/binding-linux-ppc64-gnu@0.52.0':
+  '@oxfmt/binding-linux-ppc64-gnu@0.55.0':
     optional: true
 
-  '@oxfmt/binding-linux-riscv64-gnu@0.52.0':
+  '@oxfmt/binding-linux-riscv64-gnu@0.55.0':
     optional: true
 
-  '@oxfmt/binding-linux-riscv64-musl@0.52.0':
+  '@oxfmt/binding-linux-riscv64-musl@0.55.0':
     optional: true
 
-  '@oxfmt/binding-linux-s390x-gnu@0.52.0':
+  '@oxfmt/binding-linux-s390x-gnu@0.55.0':
     optional: true
 
-  '@oxfmt/binding-linux-x64-gnu@0.52.0':
+  '@oxfmt/binding-linux-x64-gnu@0.55.0':
     optional: true
 
-  '@oxfmt/binding-linux-x64-musl@0.52.0':
+  '@oxfmt/binding-linux-x64-musl@0.55.0':
     optional: true
 
-  '@oxfmt/binding-openharmony-arm64@0.52.0':
+  '@oxfmt/binding-openharmony-arm64@0.55.0':
     optional: true
 
-  '@oxfmt/binding-win32-arm64-msvc@0.52.0':
+  '@oxfmt/binding-win32-arm64-msvc@0.55.0':
     optional: true
 
-  '@oxfmt/binding-win32-ia32-msvc@0.52.0':
+  '@oxfmt/binding-win32-ia32-msvc@0.55.0':
     optional: true
 
-  '@oxfmt/binding-win32-x64-msvc@0.52.0':
+  '@oxfmt/binding-win32-x64-msvc@0.55.0':
     optional: true
 
   '@oxlint-tsgolint/darwin-arm64@0.23.0':
@@ -11979,70 +12038,70 @@ snapshots:
   '@oxlint-tsgolint/win32-x64@0.23.0':
     optional: true
 
-  '@oxlint/binding-android-arm-eabi@1.67.0':
+  '@oxlint/binding-android-arm-eabi@1.70.0':
     optional: true
 
-  '@oxlint/binding-android-arm64@1.67.0':
+  '@oxlint/binding-android-arm64@1.70.0':
     optional: true
 
-  '@oxlint/binding-darwin-arm64@1.67.0':
+  '@oxlint/binding-darwin-arm64@1.70.0':
     optional: true
 
-  '@oxlint/binding-darwin-x64@1.67.0':
+  '@oxlint/binding-darwin-x64@1.70.0':
     optional: true
 
-  '@oxlint/binding-freebsd-x64@1.67.0':
+  '@oxlint/binding-freebsd-x64@1.70.0':
     optional: true
 
-  '@oxlint/binding-linux-arm-gnueabihf@1.67.0':
+  '@oxlint/binding-linux-arm-gnueabihf@1.70.0':
     optional: true
 
-  '@oxlint/binding-linux-arm-musleabihf@1.67.0':
+  '@oxlint/binding-linux-arm-musleabihf@1.70.0':
     optional: true
 
-  '@oxlint/binding-linux-arm64-gnu@1.67.0':
+  '@oxlint/binding-linux-arm64-gnu@1.70.0':
     optional: true
 
-  '@oxlint/binding-linux-arm64-musl@1.67.0':
+  '@oxlint/binding-linux-arm64-musl@1.70.0':
     optional: true
 
-  '@oxlint/binding-linux-ppc64-gnu@1.67.0':
+  '@oxlint/binding-linux-ppc64-gnu@1.70.0':
     optional: true
 
-  '@oxlint/binding-linux-riscv64-gnu@1.67.0':
+  '@oxlint/binding-linux-riscv64-gnu@1.70.0':
     optional: true
 
-  '@oxlint/binding-linux-riscv64-musl@1.67.0':
+  '@oxlint/binding-linux-riscv64-musl@1.70.0':
     optional: true
 
-  '@oxlint/binding-linux-s390x-gnu@1.67.0':
+  '@oxlint/binding-linux-s390x-gnu@1.70.0':
     optional: true
 
-  '@oxlint/binding-linux-x64-gnu@1.67.0':
+  '@oxlint/binding-linux-x64-gnu@1.70.0':
     optional: true
 
-  '@oxlint/binding-linux-x64-musl@1.67.0':
+  '@oxlint/binding-linux-x64-musl@1.70.0':
     optional: true
 
-  '@oxlint/binding-openharmony-arm64@1.67.0':
+  '@oxlint/binding-openharmony-arm64@1.70.0':
     optional: true
 
-  '@oxlint/binding-win32-arm64-msvc@1.67.0':
+  '@oxlint/binding-win32-arm64-msvc@1.70.0':
     optional: true
 
-  '@oxlint/binding-win32-ia32-msvc@1.67.0':
+  '@oxlint/binding-win32-ia32-msvc@1.70.0':
     optional: true
 
-  '@oxlint/binding-win32-x64-msvc@1.67.0':
+  '@oxlint/binding-win32-x64-msvc@1.70.0':
     optional: true
 
-  '@oxlint/plugins@1.61.0': {}
+  '@oxlint/plugins@1.68.0': {}
 
   '@pkgr/core@0.2.9': {}
 
-  '@playwright/test@1.60.0':
+  '@playwright/test@1.61.0':
     dependencies:
-      playwright: 1.60.0
+      playwright: 1.61.0
 
   '@polka/url@1.0.0-next.29': {}
 
@@ -12306,40 +12365,40 @@ snapshots:
       estree-walker: 2.0.2
       picomatch: 4.0.4
 
-  '@sentry-internal/browser-utils@10.57.0':
+  '@sentry/browser-utils@10.59.0':
     dependencies:
-      '@sentry/core': 10.57.0
+      '@sentry/core': 10.59.0
 
-  '@sentry-internal/feedback@10.57.0':
+  '@sentry/browser@10.59.0':
     dependencies:
-      '@sentry/core': 10.57.0
+      '@sentry/browser-utils': 10.59.0
+      '@sentry/core': 10.59.0
+      '@sentry/feedback': 10.59.0
+      '@sentry/replay': 10.59.0
+      '@sentry/replay-canvas': 10.59.0
 
-  '@sentry-internal/replay-canvas@10.57.0':
+  '@sentry/core@10.59.0': {}
+
+  '@sentry/feedback@10.59.0':
     dependencies:
-      '@sentry-internal/replay': 10.57.0
-      '@sentry/core': 10.57.0
+      '@sentry/core': 10.59.0
 
-  '@sentry-internal/replay@10.57.0':
+  '@sentry/react@10.59.0(react@19.2.7)':
     dependencies:
-      '@sentry-internal/browser-utils': 10.57.0
-      '@sentry/core': 10.57.0
-
-  '@sentry/browser@10.57.0':
-    dependencies:
-      '@sentry-internal/browser-utils': 10.57.0
-      '@sentry-internal/feedback': 10.57.0
-      '@sentry-internal/replay': 10.57.0
-      '@sentry-internal/replay-canvas': 10.57.0
-      '@sentry/core': 10.57.0
-
-  '@sentry/core@10.57.0': {}
-
-  '@sentry/react@10.57.0(react@19.2.7)':
-    dependencies:
-      '@sentry/browser': 10.57.0
-      '@sentry/core': 10.57.0
+      '@sentry/browser': 10.59.0
+      '@sentry/core': 10.59.0
       react: 19.2.7
 
+  '@sentry/replay-canvas@10.59.0':
+    dependencies:
+      '@sentry/core': 10.59.0
+      '@sentry/replay': 10.59.0
+
+  '@sentry/replay@10.59.0':
+    dependencies:
+      '@sentry/browser-utils': 10.59.0
+      '@sentry/core': 10.59.0
+
   '@shikijs/core@4.2.0':
     dependencies:
       '@shikijs/primitive': 4.2.0
@@ -12393,21 +12452,21 @@ snapshots:
 
   '@standard-schema/spec@1.1.0': {}
 
-  '@storybook/addon-a11y@10.4.4(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))':
+  '@storybook/addon-a11y@10.4.6(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))':
     dependencies:
       '@storybook/global': 5.0.0
       axe-core: 4.12.0
-      storybook: 10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
+      storybook: 10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
 
-  '@storybook/addon-docs@10.4.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))':
+  '@storybook/addon-docs@10.4.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))':
     dependencies:
       '@mdx-js/react': 3.1.1(@types/react@19.2.17)(react@19.2.7)
-      '@storybook/csf-plugin': 10.4.4(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
+      '@storybook/csf-plugin': 10.4.6(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
       '@storybook/icons': 2.0.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@storybook/react-dom-shim': 10.4.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
+      '@storybook/react-dom-shim': 10.4.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
       react: 19.2.7
       react-dom: 19.2.7(react@19.2.7)
-      storybook: 10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
+      storybook: 10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
       ts-dedent: 2.2.0
     optionalDependencies:
       '@types/react': 19.2.17
@@ -12418,53 +12477,55 @@ snapshots:
       - vite
       - webpack
 
-  '@storybook/addon-links@10.4.4(@types/react@19.2.17)(react@19.2.7)(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))':
+  '@storybook/addon-links@10.4.6(@types/react@19.2.17)(react@19.2.7)(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))':
     dependencies:
       '@storybook/global': 5.0.0
-      storybook: 10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
+      storybook: 10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
     optionalDependencies:
       '@types/react': 19.2.17
       react: 19.2.7
 
-  '@storybook/addon-onboarding@10.4.4(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))':
+  '@storybook/addon-onboarding@10.4.6(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))':
     dependencies:
-      storybook: 10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
+      storybook: 10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
 
-  '@storybook/addon-themes@10.4.4(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))':
+  '@storybook/addon-themes@10.4.6(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))':
     dependencies:
-      storybook: 10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
+      storybook: 10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
       ts-dedent: 2.2.0
 
-  '@storybook/addon-vitest@10.4.4(@vitest/browser@4.1.8)(@voidzero-dev/vite-plus-test@0.1.24)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))':
+  '@storybook/addon-vitest@10.4.6(@vitest/browser-playwright@4.1.9)(@vitest/browser@4.1.9)(@vitest/runner@4.1.9)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(vitest@4.1.9)':
     dependencies:
       '@storybook/global': 5.0.0
       '@storybook/icons': 2.0.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      storybook: 10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
+      storybook: 10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
     optionalDependencies:
-      '@vitest/browser': 4.1.8(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(@voidzero-dev/vite-plus-test@0.1.24)
-      vitest: '@voidzero-dev/vite-plus-test@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+      '@vitest/browser': 4.1.9(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(vitest@4.1.9)
+      '@vitest/browser-playwright': 4.1.9(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(playwright@1.61.0)(vitest@4.1.9)
+      '@vitest/runner': 4.1.9
+      vitest: 4.1.9(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/browser-preview@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(happy-dom@20.10.6)
     transitivePeerDependencies:
       - react
       - react-dom
 
-  '@storybook/builder-vite@10.4.4(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))':
+  '@storybook/builder-vite@10.4.6(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))':
     dependencies:
-      '@storybook/csf-plugin': 10.4.4(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
-      storybook: 10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
+      '@storybook/csf-plugin': 10.4.6(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
+      storybook: 10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
       ts-dedent: 2.2.0
-      vite: '@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+      vite: '@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
     transitivePeerDependencies:
       - esbuild
       - rollup
       - webpack
 
-  '@storybook/csf-plugin@10.4.4(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))':
+  '@storybook/csf-plugin@10.4.6(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))':
     dependencies:
-      storybook: 10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
+      storybook: 10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
       unplugin: 2.3.11
     optionalDependencies:
       esbuild: 0.28.1
-      vite: '@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+      vite: '@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
 
   '@storybook/global@5.0.0': {}
 
@@ -12473,18 +12534,18 @@ snapshots:
       react: 19.2.7
       react-dom: 19.2.7(react@19.2.7)
 
-  '@storybook/nextjs-vite@10.4.4(@babel/core@7.29.7)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(next@16.2.9(@babel/core@7.29.7)(@playwright/test@1.60.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(supports-color@10.2.2)(typescript@6.0.3)':
+  '@storybook/nextjs-vite@10.4.6(@babel/core@7.29.7)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(next@16.2.9(@babel/core@7.29.7)(@playwright/test@1.61.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(supports-color@10.2.2)(typescript@6.0.3)':
     dependencies:
-      '@storybook/builder-vite': 10.4.4(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
-      '@storybook/react': 10.4.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(typescript@6.0.3)
-      '@storybook/react-vite': 10.4.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(typescript@6.0.3)
-      next: 16.2.9(@babel/core@7.29.7)(@playwright/test@1.60.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@storybook/builder-vite': 10.4.6(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
+      '@storybook/react': 10.4.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(typescript@6.0.3)
+      '@storybook/react-vite': 10.4.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(typescript@6.0.3)
+      next: 16.2.9(@babel/core@7.29.7)(@playwright/test@1.61.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       react: 19.2.7
       react-dom: 19.2.7(react@19.2.7)
-      storybook: 10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
+      storybook: 10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
       styled-jsx: 5.1.6(@babel/core@7.29.7)(react@19.2.7)
-      vite: '@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
-      vite-plugin-storybook-nextjs: 3.2.4(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(next@16.2.9(@babel/core@7.29.7)(@playwright/test@1.60.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(supports-color@10.2.2)(typescript@6.0.3)
+      vite: '@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+      vite-plugin-storybook-nextjs: 3.2.4(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(next@16.2.9(@babel/core@7.29.7)(@playwright/test@1.61.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(supports-color@10.2.2)(typescript@6.0.3)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
@@ -12497,30 +12558,30 @@ snapshots:
       - supports-color
       - webpack
 
-  '@storybook/react-dom-shim@10.4.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))':
+  '@storybook/react-dom-shim@10.4.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))':
     dependencies:
       react: 19.2.7
       react-dom: 19.2.7(react@19.2.7)
-      storybook: 10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
+      storybook: 10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@storybook/react-vite@10.4.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(typescript@6.0.3)':
+  '@storybook/react-vite@10.4.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(typescript@6.0.3)':
     dependencies:
-      '@joshwooding/vite-plugin-react-docgen-typescript': 0.7.0(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(typescript@6.0.3)
+      '@joshwooding/vite-plugin-react-docgen-typescript': 0.7.0(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(typescript@6.0.3)
       '@rollup/pluginutils': 5.3.0
-      '@storybook/builder-vite': 10.4.4(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
-      '@storybook/react': 10.4.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(typescript@6.0.3)
+      '@storybook/builder-vite': 10.4.6(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
+      '@storybook/react': 10.4.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(typescript@6.0.3)
       empathic: 2.0.0
       magic-string: 0.30.21
       react: 19.2.7
       react-docgen: 8.0.3
       react-dom: 19.2.7(react@19.2.7)
       resolve: 1.22.11
-      storybook: 10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
+      storybook: 10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
       tsconfig-paths: 4.2.0
-      vite: '@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+      vite: '@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
     transitivePeerDependencies:
       - '@types/react'
       - '@types/react-dom'
@@ -12530,15 +12591,15 @@ snapshots:
       - typescript
       - webpack
 
-  '@storybook/react@10.4.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(typescript@6.0.3)':
+  '@storybook/react@10.4.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(typescript@6.0.3)':
     dependencies:
       '@storybook/global': 5.0.0
-      '@storybook/react-dom-shim': 10.4.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
+      '@storybook/react-dom-shim': 10.4.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))
       react: 19.2.7
       react-docgen: 8.0.3
       react-docgen-typescript: 2.4.0(typescript@6.0.3)
       react-dom: 19.2.7(react@19.2.7)
-      storybook: 10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
+      storybook: 10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
@@ -12669,12 +12730,12 @@ snapshots:
       postcss-selector-parser: 6.1.4
       tailwindcss: 4.3.1
 
-  '@tailwindcss/vite@4.3.1(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))':
+  '@tailwindcss/vite@4.3.1(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))':
     dependencies:
       '@tailwindcss/node': 4.3.1
       '@tailwindcss/oxide': 4.3.1
       tailwindcss: 4.3.1
-      vite: '@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+      vite: '@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
 
   '@tanstack/devtools-event-client@0.4.3': {}
 
@@ -12728,21 +12789,21 @@ snapshots:
       react-dom: 19.2.7(react@19.2.7)
       use-sync-external-store: 1.6.0(react@19.2.7)
 
-  '@tanstack/react-virtual@3.14.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@tanstack/react-virtual@3.14.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@tanstack/virtual-core': 3.17.0
+      '@tanstack/virtual-core': 3.17.1
       react: 19.2.7
       react-dom: 19.2.7(react@19.2.7)
 
   '@tanstack/store@0.11.0': {}
 
-  '@tanstack/virtual-core@3.17.0': {}
+  '@tanstack/virtual-core@3.17.1': {}
 
   '@teppeis/multimaps@3.0.0': {}
 
   '@testing-library/dom@10.4.1':
     dependencies:
-      '@babel/code-frame': 7.29.0
+      '@babel/code-frame': 7.29.7
       '@babel/runtime': 7.29.2
       '@types/aria-query': 5.0.4
       aria-query: 5.3.0
@@ -12774,11 +12835,11 @@ snapshots:
     dependencies:
       '@testing-library/dom': 10.4.1
 
-  '@tsslint/cli@3.1.3(@tsslint/compat-eslint@3.1.3(typescript@6.0.3))(typescript@6.0.3)':
+  '@tsslint/cli@3.1.4(@tsslint/compat-eslint@3.1.4(typescript@6.0.3))(typescript@6.0.3)':
     dependencies:
-      '@tsslint/config': 3.1.3(@tsslint/compat-eslint@3.1.3(typescript@6.0.3))
-      '@tsslint/core': 3.1.3
-      '@tsslint/types': 3.1.3
+      '@tsslint/config': 3.1.4(@tsslint/compat-eslint@3.1.4(typescript@6.0.3))
+      '@tsslint/core': 3.1.4
+      '@tsslint/types': 3.1.4
       '@volar/language-core': 2.4.28
       '@volar/language-hub': 0.0.1
       '@volar/typescript': 2.4.28
@@ -12788,25 +12849,25 @@ snapshots:
       - '@tsslint/compat-eslint'
       - tsl
 
-  '@tsslint/compat-eslint@3.1.3(typescript@6.0.3)':
+  '@tsslint/compat-eslint@3.1.4(typescript@6.0.3)':
     dependencies:
-      '@tsslint/types': 3.1.3
+      '@tsslint/types': 3.1.4
       esquery: 1.7.0
       typescript: 6.0.3
 
-  '@tsslint/config@3.1.3(@tsslint/compat-eslint@3.1.3(typescript@6.0.3))':
+  '@tsslint/config@3.1.4(@tsslint/compat-eslint@3.1.4(typescript@6.0.3))':
     dependencies:
-      '@tsslint/types': 3.1.3
+      '@tsslint/types': 3.1.4
       minimatch: 10.2.5
     optionalDependencies:
-      '@tsslint/compat-eslint': 3.1.3(typescript@6.0.3)
+      '@tsslint/compat-eslint': 3.1.4(typescript@6.0.3)
 
-  '@tsslint/core@3.1.3':
+  '@tsslint/core@3.1.4':
     dependencies:
-      '@tsslint/types': 3.1.3
+      '@tsslint/types': 3.1.4
       minimatch: 10.2.5
 
-  '@tsslint/types@3.1.3': {}
+  '@tsslint/types@3.1.4': {}
 
   '@tybys/wasm-util@0.10.1':
     dependencies:
@@ -12817,24 +12878,24 @@ snapshots:
 
   '@types/babel__core@7.20.5':
     dependencies:
-      '@babel/parser': 7.29.2
-      '@babel/types': 7.29.0
+      '@babel/parser': 7.29.7
+      '@babel/types': 7.29.7
       '@types/babel__generator': 7.27.0
       '@types/babel__template': 7.4.4
       '@types/babel__traverse': 7.28.0
 
   '@types/babel__generator@7.27.0':
     dependencies:
-      '@babel/types': 7.29.0
+      '@babel/types': 7.29.7
 
   '@types/babel__template@7.4.4':
     dependencies:
-      '@babel/parser': 7.29.2
-      '@babel/types': 7.29.0
+      '@babel/parser': 7.29.7
+      '@babel/types': 7.29.7
 
   '@types/babel__traverse@7.28.0':
     dependencies:
-      '@babel/types': 7.29.0
+      '@babel/types': 7.29.7
 
   '@types/chai@5.2.3':
     dependencies:
@@ -13005,12 +13066,17 @@ snapshots:
   '@types/node@25.9.3':
     dependencies:
       undici-types: 7.24.6
+    optional: true
+
+  '@types/node@25.9.4':
+    dependencies:
+      undici-types: 7.24.6
 
   '@types/normalize-package-data@2.4.4': {}
 
   '@types/papaparse@5.5.2':
     dependencies:
-      '@types/node': 25.9.3
+      '@types/node': 25.9.4
 
   '@types/qs@6.15.1': {}
 
@@ -13036,7 +13102,7 @@ snapshots:
 
   '@types/ws@8.18.1':
     dependencies:
-      '@types/node': 25.9.3
+      '@types/node': 25.9.4
 
   '@types/yauzl@2.10.3':
     dependencies:
@@ -13045,12 +13111,12 @@ snapshots:
 
   '@types/zen-observable@0.8.3': {}
 
-  '@typescript-eslint/eslint-plugin@8.61.0(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)':
+  '@typescript-eslint/eslint-plugin@8.61.0(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3)':
     dependencies:
       '@eslint-community/regexpp': 4.12.2
-      '@typescript-eslint/parser': 8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
+      '@typescript-eslint/parser': 8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3)
       '@typescript-eslint/scope-manager': 8.61.0
-      '@typescript-eslint/type-utils': 8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
+      '@typescript-eslint/type-utils': 8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3)
       '@typescript-eslint/utils': 8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
       '@typescript-eslint/visitor-keys': 8.61.0
       eslint: 10.5.0(jiti@2.7.0)(supports-color@10.2.2)
@@ -13061,12 +13127,12 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/eslint-plugin@8.61.0(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0))(supports-color@10.2.2)(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0))(supports-color@10.2.2)(typescript@6.0.3)':
+  '@typescript-eslint/eslint-plugin@8.61.0(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)':
     dependencies:
       '@eslint-community/regexpp': 4.12.2
-      '@typescript-eslint/parser': 8.61.0(eslint@10.5.0(jiti@2.7.0))(supports-color@10.2.2)(typescript@6.0.3)
+      '@typescript-eslint/parser': 8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       '@typescript-eslint/scope-manager': 8.61.0
-      '@typescript-eslint/type-utils': 8.61.0(eslint@10.5.0(jiti@2.7.0))(supports-color@10.2.2)(typescript@6.0.3)
+      '@typescript-eslint/type-utils': 8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       '@typescript-eslint/utils': 8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       '@typescript-eslint/visitor-keys': 8.61.0
       eslint: 10.5.0(jiti@2.7.0)
@@ -13077,7 +13143,23 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)':
+  '@typescript-eslint/eslint-plugin@8.61.1(@typescript-eslint/parser@8.61.1(eslint@10.5.0(jiti@2.7.0))(supports-color@10.2.2)(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0))(supports-color@10.2.2)(typescript@6.0.3)':
+    dependencies:
+      '@eslint-community/regexpp': 4.12.2
+      '@typescript-eslint/parser': 8.61.1(eslint@10.5.0(jiti@2.7.0))(supports-color@10.2.2)(typescript@6.0.3)
+      '@typescript-eslint/scope-manager': 8.61.1
+      '@typescript-eslint/type-utils': 8.61.1(eslint@10.5.0(jiti@2.7.0))(supports-color@10.2.2)(typescript@6.0.3)
+      '@typescript-eslint/utils': 8.61.1(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/visitor-keys': 8.61.1
+      eslint: 10.5.0(jiti@2.7.0)
+      ignore: 7.0.5
+      natural-compare: 1.4.0
+      ts-api-utils: 2.5.0(typescript@6.0.3)
+      typescript: 6.0.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3)':
     dependencies:
       '@typescript-eslint/scope-manager': 8.61.0
       '@typescript-eslint/types': 8.61.0
@@ -13089,7 +13171,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0))(supports-color@10.2.2)(typescript@6.0.3)':
+  '@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)':
     dependencies:
       '@typescript-eslint/scope-manager': 8.61.0
       '@typescript-eslint/types': 8.61.0
@@ -13101,6 +13183,18 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  '@typescript-eslint/parser@8.61.1(eslint@10.5.0(jiti@2.7.0))(supports-color@10.2.2)(typescript@6.0.3)':
+    dependencies:
+      '@typescript-eslint/scope-manager': 8.61.1
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/typescript-estree': 8.61.1(typescript@6.0.3)
+      '@typescript-eslint/visitor-keys': 8.61.1
+      debug: 4.4.3(supports-color@10.2.2)
+      eslint: 10.5.0(jiti@2.7.0)
+      typescript: 6.0.3
+    transitivePeerDependencies:
+      - supports-color
+
   '@typescript-eslint/project-service@8.61.0(typescript@6.0.3)':
     dependencies:
       '@typescript-eslint/tsconfig-utils': 8.61.0(typescript@6.0.3)
@@ -13110,16 +13204,34 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  '@typescript-eslint/project-service@8.61.1(typescript@6.0.3)':
+    dependencies:
+      '@typescript-eslint/tsconfig-utils': 8.61.1(typescript@6.0.3)
+      '@typescript-eslint/types': 8.61.1
+      debug: 4.4.3(supports-color@10.2.2)
+      typescript: 6.0.3
+    transitivePeerDependencies:
+      - supports-color
+
   '@typescript-eslint/scope-manager@8.61.0':
     dependencies:
       '@typescript-eslint/types': 8.61.0
       '@typescript-eslint/visitor-keys': 8.61.0
 
+  '@typescript-eslint/scope-manager@8.61.1':
+    dependencies:
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/visitor-keys': 8.61.1
+
   '@typescript-eslint/tsconfig-utils@8.61.0(typescript@6.0.3)':
     dependencies:
       typescript: 6.0.3
 
-  '@typescript-eslint/type-utils@8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)':
+  '@typescript-eslint/tsconfig-utils@8.61.1(typescript@6.0.3)':
+    dependencies:
+      typescript: 6.0.3
+
+  '@typescript-eslint/type-utils@8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3)':
     dependencies:
       '@typescript-eslint/types': 8.61.0
       '@typescript-eslint/typescript-estree': 8.61.0(typescript@6.0.3)
@@ -13131,7 +13243,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/type-utils@8.61.0(eslint@10.5.0(jiti@2.7.0))(supports-color@10.2.2)(typescript@6.0.3)':
+  '@typescript-eslint/type-utils@8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)':
     dependencies:
       '@typescript-eslint/types': 8.61.0
       '@typescript-eslint/typescript-estree': 8.61.0(typescript@6.0.3)
@@ -13143,8 +13255,35 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  '@typescript-eslint/type-utils@8.61.1(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)':
+    dependencies:
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/typescript-estree': 8.61.1(typescript@6.0.3)
+      '@typescript-eslint/utils': 8.61.1(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
+      debug: 4.4.3(supports-color@10.2.2)
+      eslint: 10.5.0(jiti@2.7.0)(supports-color@10.2.2)
+      ts-api-utils: 2.5.0(typescript@6.0.3)
+      typescript: 6.0.3
+    transitivePeerDependencies:
+      - supports-color
+    optional: true
+
+  '@typescript-eslint/type-utils@8.61.1(eslint@10.5.0(jiti@2.7.0))(supports-color@10.2.2)(typescript@6.0.3)':
+    dependencies:
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/typescript-estree': 8.61.1(typescript@6.0.3)
+      '@typescript-eslint/utils': 8.61.1(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
+      debug: 4.4.3(supports-color@10.2.2)
+      eslint: 10.5.0(jiti@2.7.0)
+      ts-api-utils: 2.5.0(typescript@6.0.3)
+      typescript: 6.0.3
+    transitivePeerDependencies:
+      - supports-color
+
   '@typescript-eslint/types@8.61.0': {}
 
+  '@typescript-eslint/types@8.61.1': {}
+
   '@typescript-eslint/typescript-estree@8.61.0(typescript@6.0.3)':
     dependencies:
       '@typescript-eslint/project-service': 8.61.0(typescript@6.0.3)
@@ -13154,7 +13293,22 @@ snapshots:
       debug: 4.4.3(supports-color@10.2.2)
       minimatch: 10.2.5
       semver: 7.8.4
-      tinyglobby: 0.2.16
+      tinyglobby: 0.2.17
+      ts-api-utils: 2.5.0(typescript@6.0.3)
+      typescript: 6.0.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/typescript-estree@8.61.1(typescript@6.0.3)':
+    dependencies:
+      '@typescript-eslint/project-service': 8.61.1(typescript@6.0.3)
+      '@typescript-eslint/tsconfig-utils': 8.61.1(typescript@6.0.3)
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/visitor-keys': 8.61.1
+      debug: 4.4.3(supports-color@10.2.2)
+      minimatch: 10.2.5
+      semver: 7.8.4
+      tinyglobby: 0.2.17
       ts-api-utils: 2.5.0(typescript@6.0.3)
       typescript: 6.0.3
     transitivePeerDependencies:
@@ -13182,41 +13336,68 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  '@typescript-eslint/utils@8.61.1(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)':
+    dependencies:
+      '@eslint-community/eslint-utils': 4.9.1(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
+      '@typescript-eslint/scope-manager': 8.61.1
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/typescript-estree': 8.61.1(typescript@6.0.3)
+      eslint: 10.5.0(jiti@2.7.0)(supports-color@10.2.2)
+      typescript: 6.0.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/utils@8.61.1(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)':
+    dependencies:
+      '@eslint-community/eslint-utils': 4.9.1(eslint@10.5.0(jiti@2.7.0))
+      '@typescript-eslint/scope-manager': 8.61.1
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/typescript-estree': 8.61.1(typescript@6.0.3)
+      eslint: 10.5.0(jiti@2.7.0)
+      typescript: 6.0.3
+    transitivePeerDependencies:
+      - supports-color
+
   '@typescript-eslint/visitor-keys@8.61.0':
     dependencies:
       '@typescript-eslint/types': 8.61.0
       eslint-visitor-keys: 5.0.1
 
-  '@typescript/native-preview-darwin-arm64@7.0.0-dev.20260613.1':
+  '@typescript-eslint/visitor-keys@8.61.1':
+    dependencies:
+      '@typescript-eslint/types': 8.61.1
+      eslint-visitor-keys: 5.0.1
+
+  '@typescript/native-preview-darwin-arm64@7.0.0-dev.20260620.1':
     optional: true
 
-  '@typescript/native-preview-darwin-x64@7.0.0-dev.20260613.1':
+  '@typescript/native-preview-darwin-x64@7.0.0-dev.20260620.1':
     optional: true
 
-  '@typescript/native-preview-linux-arm64@7.0.0-dev.20260613.1':
+  '@typescript/native-preview-linux-arm64@7.0.0-dev.20260620.1':
     optional: true
 
-  '@typescript/native-preview-linux-arm@7.0.0-dev.20260613.1':
+  '@typescript/native-preview-linux-arm@7.0.0-dev.20260620.1':
     optional: true
 
-  '@typescript/native-preview-linux-x64@7.0.0-dev.20260613.1':
+  '@typescript/native-preview-linux-x64@7.0.0-dev.20260620.1':
     optional: true
 
-  '@typescript/native-preview-win32-arm64@7.0.0-dev.20260613.1':
+  '@typescript/native-preview-win32-arm64@7.0.0-dev.20260620.1':
     optional: true
 
-  '@typescript/native-preview-win32-x64@7.0.0-dev.20260613.1':
+  '@typescript/native-preview-win32-x64@7.0.0-dev.20260620.1':
     optional: true
 
-  '@typescript/native-preview@7.0.0-dev.20260613.1':
+  '@typescript/native-preview@7.0.0-dev.20260620.1':
     optionalDependencies:
-      '@typescript/native-preview-darwin-arm64': 7.0.0-dev.20260613.1
-      '@typescript/native-preview-darwin-x64': 7.0.0-dev.20260613.1
-      '@typescript/native-preview-linux-arm': 7.0.0-dev.20260613.1
-      '@typescript/native-preview-linux-arm64': 7.0.0-dev.20260613.1
-      '@typescript/native-preview-linux-x64': 7.0.0-dev.20260613.1
-      '@typescript/native-preview-win32-arm64': 7.0.0-dev.20260613.1
-      '@typescript/native-preview-win32-x64': 7.0.0-dev.20260613.1
+      '@typescript/native-preview-darwin-arm64': 7.0.0-dev.20260620.1
+      '@typescript/native-preview-darwin-x64': 7.0.0-dev.20260620.1
+      '@typescript/native-preview-linux-arm': 7.0.0-dev.20260620.1
+      '@typescript/native-preview-linux-arm64': 7.0.0-dev.20260620.1
+      '@typescript/native-preview-linux-x64': 7.0.0-dev.20260620.1
+      '@typescript/native-preview-win32-arm64': 7.0.0-dev.20260620.1
+      '@typescript/native-preview-win32-x64': 7.0.0-dev.20260620.1
 
   '@ungap/structured-clone@1.3.0': {}
 
@@ -13224,13 +13405,13 @@ snapshots:
     dependencies:
       unpic: 4.2.2
 
-  '@unpic/react@1.0.2(next@16.2.9(@babel/core@7.29.7)(@playwright/test@1.60.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@unpic/react@1.0.2(next@16.2.9(@babel/core@7.29.7)(@playwright/test@1.61.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@unpic/core': 1.0.3
       react: 19.2.7
       react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      next: 16.2.9(@babel/core@7.29.7)(@playwright/test@1.60.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      next: 16.2.9(@babel/core@7.29.7)(@playwright/test@1.61.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
 
   '@upsetjs/venn.js@2.0.0':
     optionalDependencies:
@@ -13246,7 +13427,7 @@ snapshots:
       '@resvg/resvg-wasm': 2.4.0
       satori: 0.16.0
 
-  '@vitejs/devtools-kit@0.3.1(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(typescript@6.0.3)':
+  '@vitejs/devtools-kit@0.3.1(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(typescript@6.0.3)':
     dependencies:
       '@devframes/hub': 0.5.2(devframe@0.5.2(typescript@6.0.3))
       birpc: 4.0.0
@@ -13256,7 +13437,7 @@ snapshots:
       pathe: 2.0.3
       perfect-debounce: 2.1.0
       tinyexec: 1.2.3
-      vite: '@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+      vite: '@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
     transitivePeerDependencies:
       - '@modelcontextprotocol/sdk'
       - bufferutil
@@ -13264,12 +13445,12 @@ snapshots:
       - typescript
       - utf-8-validate
 
-  '@vitejs/plugin-react@6.0.2(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))':
+  '@vitejs/plugin-react@6.0.2(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))':
     dependencies:
       '@rolldown/pluginutils': 1.0.1
-      vite: '@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+      vite: '@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
 
-  '@vitejs/plugin-rsc@0.5.27(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(react-dom@19.2.7(react@19.2.7))(react-server-dom-webpack@19.2.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)':
+  '@vitejs/plugin-rsc@0.5.27(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(react-dom@19.2.7(react@19.2.7))(react-server-dom-webpack@19.2.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@rolldown/pluginutils': 1.0.1
       es-module-lexer: 2.1.0
@@ -13280,21 +13461,46 @@ snapshots:
       srvx: 0.11.15
       strip-literal: 3.1.0
       turbo-stream: 3.2.0
-      vite: '@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
-      vitefu: 1.1.3(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
+      vite: '@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+      vitefu: 1.1.3(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
     optionalDependencies:
       react-server-dom-webpack: 19.2.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
 
-  '@vitest/browser@4.1.8(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(@voidzero-dev/vite-plus-test@0.1.24)':
+  '@vitest/browser-playwright@4.1.9(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(playwright@1.61.0)(vitest@4.1.9)':
+    dependencies:
+      '@vitest/browser': 4.1.9(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(vitest@4.1.9)
+      '@vitest/mocker': 4.1.9(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
+      playwright: 1.61.0
+      tinyrainbow: 3.1.0
+      vitest: 4.1.9(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/browser-preview@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(happy-dom@20.10.6)
+    transitivePeerDependencies:
+      - bufferutil
+      - msw
+      - utf-8-validate
+      - vite
+
+  '@vitest/browser-preview@4.1.9(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(vitest@4.1.9)':
+    dependencies:
+      '@testing-library/dom': 10.4.1
+      '@testing-library/user-event': 14.6.1(@testing-library/dom@10.4.1)
+      '@vitest/browser': 4.1.9(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(vitest@4.1.9)
+      vitest: 4.1.9(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/browser-preview@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(happy-dom@20.10.6)
+    transitivePeerDependencies:
+      - bufferutil
+      - msw
+      - utf-8-validate
+      - vite
+
+  '@vitest/browser@4.1.9(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(vitest@4.1.9)':
     dependencies:
       '@blazediff/core': 1.9.1
-      '@vitest/mocker': 4.1.8(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
-      '@vitest/utils': 4.1.8
+      '@vitest/mocker': 4.1.9(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
+      '@vitest/utils': 4.1.9
       magic-string: 0.30.21
       pngjs: 7.0.0
       sirv: 3.0.2
       tinyrainbow: 3.1.0
-      vitest: '@voidzero-dev/vite-plus-test@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+      vitest: 4.1.9(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/browser-preview@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(happy-dom@20.10.6)
       ws: 8.21.0
     transitivePeerDependencies:
       - bufferutil
@@ -13302,10 +13508,10 @@ snapshots:
       - utf-8-validate
       - vite
 
-  '@vitest/coverage-v8@4.1.8(@vitest/browser@4.1.8)(@voidzero-dev/vite-plus-test@0.1.24)':
+  '@vitest/coverage-v8@4.1.9(@vitest/browser@4.1.9)(vitest@4.1.9)':
     dependencies:
       '@bcoe/v8-coverage': 1.0.2
-      '@vitest/utils': 4.1.8
+      '@vitest/utils': 4.1.9
       ast-v8-to-istanbul: 1.0.0
       istanbul-lib-coverage: 3.2.2
       istanbul-lib-report: 3.0.1
@@ -13314,89 +13520,33 @@ snapshots:
       obug: 2.1.1
       std-env: 4.0.0
       tinyrainbow: 3.1.0
-      vitest: '@voidzero-dev/vite-plus-test@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+      vitest: 4.1.9(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/browser-preview@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(happy-dom@20.10.6)
     optionalDependencies:
-      '@vitest/browser': 4.1.8(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(@voidzero-dev/vite-plus-test@0.1.24)
+      '@vitest/browser': 4.1.9(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(vitest@4.1.9)
 
-  '@vitest/eslint-plugin@1.6.17(@types/node@25.9.3)(@typescript-eslint/eslint-plugin@8.61.0(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3))(@vitest/coverage-v8@4.1.8(@vitest/browser@4.1.8(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))))(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)':
+  '@vitest/eslint-plugin@1.6.17(@typescript-eslint/eslint-plugin@8.61.0(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)(vitest@4.1.9)':
     dependencies:
       '@typescript-eslint/scope-manager': 8.61.0
       '@typescript-eslint/utils': 8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
       eslint: 10.5.0(jiti@2.7.0)(supports-color@10.2.2)
-      vitest: '@voidzero-dev/vite-plus-test@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
     optionalDependencies:
-      '@typescript-eslint/eslint-plugin': 8.61.0(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
+      '@typescript-eslint/eslint-plugin': 8.61.0(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3)
       typescript: 6.0.3
+      vitest: 4.1.9(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/browser-preview@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(happy-dom@20.10.6)
     transitivePeerDependencies:
-      - '@arethetypeswrong/core'
-      - '@edge-runtime/vm'
-      - '@opentelemetry/api'
-      - '@tsdown/css'
-      - '@tsdown/exe'
-      - '@types/node'
-      - '@vitejs/devtools'
-      - '@vitest/coverage-istanbul'
-      - '@vitest/coverage-v8'
-      - '@vitest/ui'
-      - bufferutil
-      - esbuild
-      - happy-dom
-      - jiti
-      - jsdom
-      - less
-      - publint
-      - sass
-      - sass-embedded
-      - stylus
-      - sugarss
       - supports-color
-      - terser
-      - tsx
-      - unplugin-unused
-      - unrun
-      - utf-8-validate
-      - vite
-      - yaml
 
-  '@vitest/eslint-plugin@1.6.17(@types/node@25.9.3)(@typescript-eslint/eslint-plugin@8.61.0(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3))(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(eslint@10.5.0(jiti@2.7.0))(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)':
+  '@vitest/eslint-plugin@1.6.17(@typescript-eslint/eslint-plugin@8.61.0(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)(vitest@4.1.9)':
     dependencies:
       '@typescript-eslint/scope-manager': 8.61.0
       '@typescript-eslint/utils': 8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       eslint: 10.5.0(jiti@2.7.0)
-      vitest: '@voidzero-dev/vite-plus-test@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
     optionalDependencies:
-      '@typescript-eslint/eslint-plugin': 8.61.0(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0))(supports-color@10.2.2)(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0))(supports-color@10.2.2)(typescript@6.0.3)
+      '@typescript-eslint/eslint-plugin': 8.61.0(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       typescript: 6.0.3
+      vitest: 4.1.9(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/browser-preview@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(happy-dom@20.10.6)
     transitivePeerDependencies:
-      - '@arethetypeswrong/core'
-      - '@edge-runtime/vm'
-      - '@opentelemetry/api'
-      - '@tsdown/css'
-      - '@tsdown/exe'
-      - '@types/node'
-      - '@vitejs/devtools'
-      - '@vitest/coverage-istanbul'
-      - '@vitest/coverage-v8'
-      - '@vitest/ui'
-      - bufferutil
-      - esbuild
-      - happy-dom
-      - jiti
-      - jsdom
-      - less
-      - publint
-      - sass
-      - sass-embedded
-      - stylus
-      - sugarss
       - supports-color
-      - terser
-      - tsx
-      - unplugin-unused
-      - unrun
-      - utf-8-validate
-      - vite
-      - yaml
 
   '@vitest/expect@3.2.4':
     dependencies:
@@ -13406,27 +13556,48 @@ snapshots:
       chai: 5.3.3
       tinyrainbow: 2.0.0
 
-  '@vitest/mocker@4.1.8(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))':
+  '@vitest/expect@4.1.9':
     dependencies:
-      '@vitest/spy': 4.1.8
+      '@standard-schema/spec': 1.1.0
+      '@types/chai': 5.2.3
+      '@vitest/spy': 4.1.9
+      '@vitest/utils': 4.1.9
+      chai: 6.2.2
+      tinyrainbow: 3.1.0
+
+  '@vitest/mocker@4.1.9(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))':
+    dependencies:
+      '@vitest/spy': 4.1.9
       estree-walker: 3.0.3
       magic-string: 0.30.21
     optionalDependencies:
-      vite: '@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+      vite: '@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
 
   '@vitest/pretty-format@3.2.4':
     dependencies:
       tinyrainbow: 2.0.0
 
-  '@vitest/pretty-format@4.1.8':
+  '@vitest/pretty-format@4.1.9':
     dependencies:
       tinyrainbow: 3.1.0
 
+  '@vitest/runner@4.1.9':
+    dependencies:
+      '@vitest/utils': 4.1.9
+      pathe: 2.0.3
+
+  '@vitest/snapshot@4.1.9':
+    dependencies:
+      '@vitest/pretty-format': 4.1.9
+      '@vitest/utils': 4.1.9
+      magic-string: 0.30.21
+      pathe: 2.0.3
+
   '@vitest/spy@3.2.4':
     dependencies:
       tinyspy: 4.0.4
 
-  '@vitest/spy@4.1.8': {}
+  '@vitest/spy@4.1.9': {}
 
   '@vitest/utils@3.2.4':
     dependencies:
@@ -13434,20 +13605,20 @@ snapshots:
       loupe: 3.2.1
       tinyrainbow: 2.0.0
 
-  '@vitest/utils@4.1.8':
+  '@vitest/utils@4.1.9':
     dependencies:
-      '@vitest/pretty-format': 4.1.8
+      '@vitest/pretty-format': 4.1.9
       convert-source-map: 2.0.0
       tinyrainbow: 3.1.0
 
-  '@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)':
+  '@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)':
     dependencies:
-      '@oxc-project/runtime': 0.133.0
-      '@oxc-project/types': 0.133.0
+      '@oxc-project/runtime': 0.136.0
+      '@oxc-project/types': 0.136.0
       lightningcss: 1.32.0
       postcss: 8.5.15
     optionalDependencies:
-      '@types/node': 25.9.3
+      '@types/node': 25.9.4
       esbuild: 0.28.1
       fsevents: 2.3.3
       jiti: 2.7.0
@@ -13455,70 +13626,28 @@ snapshots:
       typescript: 6.0.3
       yaml: 2.9.0
 
-  '@voidzero-dev/vite-plus-darwin-arm64@0.1.24':
+  '@voidzero-dev/vite-plus-darwin-arm64@0.2.1':
     optional: true
 
-  '@voidzero-dev/vite-plus-darwin-x64@0.1.24':
+  '@voidzero-dev/vite-plus-darwin-x64@0.2.1':
     optional: true
 
-  '@voidzero-dev/vite-plus-linux-arm64-gnu@0.1.24':
+  '@voidzero-dev/vite-plus-linux-arm64-gnu@0.2.1':
     optional: true
 
-  '@voidzero-dev/vite-plus-linux-arm64-musl@0.1.24':
+  '@voidzero-dev/vite-plus-linux-arm64-musl@0.2.1':
     optional: true
 
-  '@voidzero-dev/vite-plus-linux-x64-gnu@0.1.24':
+  '@voidzero-dev/vite-plus-linux-x64-gnu@0.2.1':
     optional: true
 
-  '@voidzero-dev/vite-plus-linux-x64-musl@0.1.24':
+  '@voidzero-dev/vite-plus-linux-x64-musl@0.2.1':
     optional: true
 
-  '@voidzero-dev/vite-plus-test@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)':
-    dependencies:
-      '@standard-schema/spec': 1.1.0
-      '@types/chai': 5.2.3
-      '@voidzero-dev/vite-plus-core': 0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
-      es-module-lexer: 1.7.0
-      obug: 2.1.1
-      pixelmatch: 7.1.0
-      pngjs: 7.0.0
-      sirv: 3.0.2
-      std-env: 4.0.0
-      tinybench: 2.9.0
-      tinyexec: 1.2.3
-      tinyglobby: 0.2.16
-      vite: '@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
-      ws: 8.21.0
-    optionalDependencies:
-      '@types/node': 25.9.3
-      '@vitest/coverage-v8': 4.1.8(@vitest/browser@4.1.8)(@voidzero-dev/vite-plus-test@0.1.24)
-      happy-dom: 20.10.3
-    transitivePeerDependencies:
-      - '@arethetypeswrong/core'
-      - '@tsdown/css'
-      - '@tsdown/exe'
-      - '@vitejs/devtools'
-      - bufferutil
-      - esbuild
-      - jiti
-      - less
-      - publint
-      - sass
-      - sass-embedded
-      - stylus
-      - sugarss
-      - terser
-      - tsx
-      - typescript
-      - unplugin-unused
-      - unrun
-      - utf-8-validate
-      - yaml
-
-  '@voidzero-dev/vite-plus-win32-arm64-msvc@0.1.24':
+  '@voidzero-dev/vite-plus-win32-arm64-msvc@0.2.1':
     optional: true
 
-  '@voidzero-dev/vite-plus-win32-x64-msvc@0.1.24':
+  '@voidzero-dev/vite-plus-win32-x64-msvc@0.2.1':
     optional: true
 
   '@volar/language-core@2.4.28':
@@ -13537,7 +13666,7 @@ snapshots:
 
   '@vue/compiler-core@3.5.31':
     dependencies:
-      '@babel/parser': 7.29.2
+      '@babel/parser': 7.29.7
       '@vue/shared': 3.5.31
       entities: 7.0.1
       estree-walker: 2.0.2
@@ -13752,7 +13881,7 @@ snapshots:
 
   buffer-image-size@0.6.4:
     dependencies:
-      '@types/node': 25.9.3
+      '@types/node': 25.9.4
 
   buffer@5.7.1:
     dependencies:
@@ -13841,6 +13970,8 @@ snapshots:
       loupe: 3.2.1
       pathval: 2.0.1
 
+  chai@6.2.2: {}
+
   chalk@4.1.1:
     dependencies:
       ansi-styles: 4.3.0
@@ -13885,7 +14016,7 @@ snapshots:
       parse5: 7.3.0
       parse5-htmlparser2-tree-adapter: 7.1.0
       parse5-parser-stream: 7.1.2
-      undici: 7.26.0
+      undici: 7.27.2
       whatwg-mimetype: 4.0.0
 
   chokidar@5.0.0:
@@ -13951,14 +14082,14 @@ snapshots:
       - '@types/react'
       - '@types/react-dom'
 
-  code-inspector-plugin@1.6.0(supports-color@10.2.2):
+  code-inspector-plugin@1.6.1(supports-color@10.2.2):
     dependencies:
-      '@code-inspector/core': 1.6.0(supports-color@10.2.2)
-      '@code-inspector/esbuild': 1.6.0
-      '@code-inspector/mako': 1.6.0
-      '@code-inspector/turbopack': 1.6.0
-      '@code-inspector/vite': 1.6.0
-      '@code-inspector/webpack': 1.6.0
+      '@code-inspector/core': 1.6.1(supports-color@10.2.2)
+      '@code-inspector/esbuild': 1.6.1
+      '@code-inspector/mako': 1.6.1
+      '@code-inspector/turbopack': 1.6.1
+      '@code-inspector/vite': 1.6.1
+      '@code-inspector/webpack': 1.6.1
       chalk: 4.1.1
     transitivePeerDependencies:
       - supports-color
@@ -14022,7 +14153,7 @@ snapshots:
     dependencies:
       layout-base: 2.0.1
 
-  cron-parser@5.5.0:
+  cron-parser@5.6.0:
     dependencies:
       luxon: 3.7.2
 
@@ -14388,7 +14519,7 @@ snapshots:
     dependencies:
       domelementtype: 2.3.0
 
-  dompurify@3.4.10:
+  dompurify@3.4.11:
     optionalDependencies:
       '@types/trusted-types': 2.0.7
 
@@ -14708,7 +14839,7 @@ snapshots:
     dependencies:
       eslint: 10.5.0(jiti@2.7.0)
 
-  eslint-plugin-better-tailwindcss@4.6.0(eslint@10.5.0(jiti@2.7.0))(oxlint@1.67.0(oxlint-tsgolint@0.23.0)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(tailwindcss@4.3.1)(typescript@6.0.3):
+  eslint-plugin-better-tailwindcss@4.6.0(eslint@10.5.0(jiti@2.7.0))(oxlint@1.70.0(oxlint-tsgolint@0.23.0)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(tailwindcss@4.3.1)(typescript@6.0.3):
     dependencies:
       '@eslint/css-tree': 4.0.1
       '@valibot/to-json-schema': 1.7.0(valibot@1.4.1(typescript@6.0.3))
@@ -14721,23 +14852,23 @@ snapshots:
       valibot: 1.4.1(typescript@6.0.3)
     optionalDependencies:
       eslint: 10.5.0(jiti@2.7.0)
-      oxlint: 1.67.0(oxlint-tsgolint@0.23.0)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
+      oxlint: 1.70.0(oxlint-tsgolint@0.23.0)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
     transitivePeerDependencies:
       - '@eslint/css'
       - typescript
 
-  eslint-plugin-command@3.5.2(@typescript-eslint/typescript-estree@8.61.0(typescript@6.0.3))(@typescript-eslint/utils@8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2)):
+  eslint-plugin-command@3.5.2(@typescript-eslint/typescript-estree@8.61.1(typescript@6.0.3))(@typescript-eslint/utils@8.61.1(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2)):
     dependencies:
       '@es-joy/jsdoccomment': 0.84.0
-      '@typescript-eslint/typescript-estree': 8.61.0(typescript@6.0.3)
-      '@typescript-eslint/utils': 8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
+      '@typescript-eslint/typescript-estree': 8.61.1(typescript@6.0.3)
+      '@typescript-eslint/utils': 8.61.1(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
       eslint: 10.5.0(jiti@2.7.0)(supports-color@10.2.2)
 
-  eslint-plugin-command@3.5.2(@typescript-eslint/typescript-estree@8.61.0(typescript@6.0.3))(@typescript-eslint/utils@8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0)):
+  eslint-plugin-command@3.5.2(@typescript-eslint/typescript-estree@8.61.1(typescript@6.0.3))(@typescript-eslint/utils@8.61.1(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0)):
     dependencies:
       '@es-joy/jsdoccomment': 0.84.0
-      '@typescript-eslint/typescript-estree': 8.61.0(typescript@6.0.3)
-      '@typescript-eslint/utils': 8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/typescript-estree': 8.61.1(typescript@6.0.3)
+      '@typescript-eslint/utils': 8.61.1(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       eslint: 10.5.0(jiti@2.7.0)
 
   eslint-plugin-es-x@7.8.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2)):
@@ -15007,8 +15138,8 @@ snapshots:
       '@eslint-react/eslint': 5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
       '@eslint-react/jsx': 5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
       '@eslint-react/shared': 5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
-      '@typescript-eslint/types': 8.61.0
-      '@typescript-eslint/utils': 8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/utils': 8.61.1(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
       compare-versions: 6.1.1
       eslint: 10.5.0(jiti@2.7.0)(supports-color@10.2.2)
       typescript: 6.0.3
@@ -15022,8 +15153,8 @@ snapshots:
       '@eslint-react/eslint': 5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       '@eslint-react/jsx': 5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       '@eslint-react/shared': 5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
-      '@typescript-eslint/types': 8.61.0
-      '@typescript-eslint/utils': 8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/utils': 8.61.1(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       compare-versions: 6.1.1
       eslint: 10.5.0(jiti@2.7.0)
       typescript: 6.0.3
@@ -15037,8 +15168,8 @@ snapshots:
       '@eslint-react/eslint': 5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
       '@eslint-react/jsx': 5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
       '@eslint-react/shared': 5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
-      '@typescript-eslint/types': 8.61.0
-      '@typescript-eslint/utils': 8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/utils': 8.61.1(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
       eslint: 10.5.0(jiti@2.7.0)(supports-color@10.2.2)
       typescript: 6.0.3
     transitivePeerDependencies:
@@ -15052,8 +15183,8 @@ snapshots:
       '@eslint-react/eslint': 5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       '@eslint-react/jsx': 5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       '@eslint-react/shared': 5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
-      '@typescript-eslint/types': 8.61.0
-      '@typescript-eslint/utils': 8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/utils': 8.61.1(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       eslint: 10.5.0(jiti@2.7.0)
       typescript: 6.0.3
     transitivePeerDependencies:
@@ -15065,8 +15196,8 @@ snapshots:
       '@eslint-react/core': 5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
       '@eslint-react/eslint': 5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
       '@eslint-react/var': 5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
-      '@typescript-eslint/types': 8.61.0
-      '@typescript-eslint/utils': 8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/utils': 8.61.1(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
       eslint: 10.5.0(jiti@2.7.0)(supports-color@10.2.2)
       ts-pattern: 5.9.0
       typescript: 6.0.3
@@ -15080,8 +15211,8 @@ snapshots:
       '@eslint-react/core': 5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       '@eslint-react/eslint': 5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       '@eslint-react/var': 5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
-      '@typescript-eslint/types': 8.61.0
-      '@typescript-eslint/utils': 8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/utils': 8.61.1(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       eslint: 10.5.0(jiti@2.7.0)
       ts-pattern: 5.9.0
       typescript: 6.0.3
@@ -15104,8 +15235,8 @@ snapshots:
       '@eslint-react/eslint': 5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
       '@eslint-react/shared': 5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
       '@eslint-react/var': 5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
-      '@typescript-eslint/types': 8.61.0
-      '@typescript-eslint/utils': 8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/utils': 8.61.1(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
       eslint: 10.5.0(jiti@2.7.0)(supports-color@10.2.2)
       typescript: 6.0.3
     transitivePeerDependencies:
@@ -15119,8 +15250,8 @@ snapshots:
       '@eslint-react/eslint': 5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       '@eslint-react/shared': 5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       '@eslint-react/var': 5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
-      '@typescript-eslint/types': 8.61.0
-      '@typescript-eslint/utils': 8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/utils': 8.61.1(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       eslint: 10.5.0(jiti@2.7.0)
       typescript: 6.0.3
     transitivePeerDependencies:
@@ -15133,8 +15264,8 @@ snapshots:
       '@eslint-react/eslint': 5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
       '@eslint-react/shared': 5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
       '@eslint-react/var': 5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
-      '@typescript-eslint/types': 8.61.0
-      '@typescript-eslint/utils': 8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/utils': 8.61.1(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
       birecord: 0.1.1
       eslint: 10.5.0(jiti@2.7.0)(supports-color@10.2.2)
       ts-pattern: 5.9.0
@@ -15150,8 +15281,8 @@ snapshots:
       '@eslint-react/eslint': 5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       '@eslint-react/shared': 5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       '@eslint-react/var': 5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
-      '@typescript-eslint/types': 8.61.0
-      '@typescript-eslint/utils': 8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/utils': 8.61.1(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       birecord: 0.1.1
       eslint: 10.5.0(jiti@2.7.0)
       ts-pattern: 5.9.0
@@ -15167,11 +15298,11 @@ snapshots:
       '@eslint-react/jsx': 5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
       '@eslint-react/shared': 5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
       '@eslint-react/var': 5.9.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
-      '@typescript-eslint/scope-manager': 8.61.0
-      '@typescript-eslint/type-utils': 8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
-      '@typescript-eslint/types': 8.61.0
-      '@typescript-eslint/typescript-estree': 8.61.0(typescript@6.0.3)
-      '@typescript-eslint/utils': 8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
+      '@typescript-eslint/scope-manager': 8.61.1
+      '@typescript-eslint/type-utils': 8.61.1(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/typescript-estree': 8.61.1(typescript@6.0.3)
+      '@typescript-eslint/utils': 8.61.1(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
       compare-versions: 6.1.1
       eslint: 10.5.0(jiti@2.7.0)(supports-color@10.2.2)
       string-ts: 2.3.1
@@ -15190,11 +15321,11 @@ snapshots:
       '@eslint-react/jsx': 5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       '@eslint-react/shared': 5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       '@eslint-react/var': 5.9.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
-      '@typescript-eslint/scope-manager': 8.61.0
-      '@typescript-eslint/type-utils': 8.61.0(eslint@10.5.0(jiti@2.7.0))(supports-color@10.2.2)(typescript@6.0.3)
-      '@typescript-eslint/types': 8.61.0
-      '@typescript-eslint/typescript-estree': 8.61.0(typescript@6.0.3)
-      '@typescript-eslint/utils': 8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/scope-manager': 8.61.1
+      '@typescript-eslint/type-utils': 8.61.1(eslint@10.5.0(jiti@2.7.0))(supports-color@10.2.2)(typescript@6.0.3)
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/typescript-estree': 8.61.1(typescript@6.0.3)
+      '@typescript-eslint/utils': 8.61.1(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       compare-versions: 6.1.1
       eslint: 10.5.0(jiti@2.7.0)
       string-ts: 2.3.1
@@ -15226,7 +15357,7 @@ snapshots:
       regexp-ast-analysis: 0.7.1
       scslre: 0.3.0
 
-  eslint-plugin-sonarjs@4.0.3(eslint@10.5.0(jiti@2.7.0)):
+  eslint-plugin-sonarjs@4.1.0(eslint@10.5.0(jiti@2.7.0)):
     dependencies:
       '@eslint-community/regexpp': 4.12.2
       builtin-modules: 3.3.0
@@ -15241,12 +15372,13 @@ snapshots:
       semver: 7.8.4
       ts-api-utils: 2.5.0(typescript@6.0.3)
       typescript: 6.0.3
+      yaml: 2.9.0
 
-  eslint-plugin-storybook@10.4.4(eslint@10.5.0(jiti@2.7.0))(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(typescript@6.0.3):
+  eslint-plugin-storybook@10.4.6(eslint@10.5.0(jiti@2.7.0))(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(typescript@6.0.3):
     dependencies:
       '@typescript-eslint/utils': 8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
       eslint: 10.5.0(jiti@2.7.0)
-      storybook: 10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
+      storybook: 10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
     transitivePeerDependencies:
       - supports-color
       - typescript
@@ -15313,19 +15445,19 @@ snapshots:
       semver: 7.8.4
       strip-indent: 4.1.1
 
-  eslint-plugin-unused-imports@4.4.1(@typescript-eslint/eslint-plugin@8.61.0(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2)):
+  eslint-plugin-unused-imports@4.4.1(@typescript-eslint/eslint-plugin@8.61.0(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2)):
     dependencies:
       eslint: 10.5.0(jiti@2.7.0)(supports-color@10.2.2)
     optionalDependencies:
-      '@typescript-eslint/eslint-plugin': 8.61.0(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
+      '@typescript-eslint/eslint-plugin': 8.61.0(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3)
 
   eslint-plugin-unused-imports@4.4.1(@typescript-eslint/eslint-plugin@8.61.0(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0)):
     dependencies:
       eslint: 10.5.0(jiti@2.7.0)
     optionalDependencies:
-      '@typescript-eslint/eslint-plugin': 8.61.0(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0))(supports-color@10.2.2)(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0))(supports-color@10.2.2)(typescript@6.0.3)
+      '@typescript-eslint/eslint-plugin': 8.61.0(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
 
-  eslint-plugin-vue@10.9.1(@stylistic/eslint-plugin@5.10.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2)))(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(vue-eslint-parser@10.4.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)):
+  eslint-plugin-vue@10.9.1(@stylistic/eslint-plugin@5.10.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2)))(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(vue-eslint-parser@10.4.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)):
     dependencies:
       '@eslint-community/eslint-utils': 4.9.1(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
       eslint: 10.5.0(jiti@2.7.0)(supports-color@10.2.2)
@@ -15337,7 +15469,7 @@ snapshots:
       xml-name-validator: 4.0.0
     optionalDependencies:
       '@stylistic/eslint-plugin': 5.10.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))
-      '@typescript-eslint/parser': 8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(typescript@6.0.3)
+      '@typescript-eslint/parser': 8.61.0(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3)
 
   eslint-plugin-vue@10.9.1(@stylistic/eslint-plugin@5.10.0(eslint@10.5.0(jiti@2.7.0)))(@typescript-eslint/parser@8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.5.0(jiti@2.7.0))(vue-eslint-parser@10.4.0(eslint@10.5.0(jiti@2.7.0))):
     dependencies:
@@ -15351,7 +15483,7 @@ snapshots:
       xml-name-validator: 4.0.0
     optionalDependencies:
       '@stylistic/eslint-plugin': 5.10.0(eslint@10.5.0(jiti@2.7.0))
-      '@typescript-eslint/parser': 8.61.0(eslint@10.5.0(jiti@2.7.0))(supports-color@10.2.2)(typescript@6.0.3)
+      '@typescript-eslint/parser': 8.61.0(eslint@10.5.0(jiti@2.7.0))(typescript@6.0.3)
 
   eslint-plugin-yml@3.3.2(eslint@10.5.0(jiti@2.7.0)(supports-color@10.2.2)):
     dependencies:
@@ -15538,6 +15670,8 @@ snapshots:
   expand-template@2.0.3:
     optional: true
 
+  expect-type@1.3.0: {}
+
   exsolve@1.0.8: {}
 
   extend@3.0.2: {}
@@ -15640,7 +15774,7 @@ snapshots:
     dependencies:
       fd-package-json: 2.0.0
 
-  foxact@0.3.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
+  foxact@0.3.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
     dependencies:
       client-only: 0.0.1
       event-target-bus: 1.0.0
@@ -15773,9 +15907,9 @@ snapshots:
 
   hachure-fill@0.5.2: {}
 
-  happy-dom@20.10.3:
+  happy-dom@20.10.6:
     dependencies:
-      '@types/node': 25.9.3
+      '@types/node': 25.9.4
       '@types/whatwg-mimetype': 3.0.2
       '@types/ws': 8.18.1
       buffer-image-size: 0.6.4
@@ -15961,7 +16095,7 @@ snapshots:
 
   hex-rgb@4.3.0: {}
 
-  hono@4.12.25: {}
+  hono@4.12.26: {}
 
   hosted-git-info@9.0.2:
     dependencies:
@@ -16307,19 +16441,19 @@ snapshots:
 
   khroma@2.1.0: {}
 
-  knip@6.16.1:
+  knip@6.17.1:
     dependencies:
       fdir: 6.5.0(picomatch@4.0.4)
       formatly: 0.3.0
       get-tsconfig: 4.14.0
       jiti: 2.7.0
-      oxc-parser: 0.133.0
+      oxc-parser: 0.135.0
       oxc-resolver: 11.20.0
       picomatch: 4.0.4
       smol-toml: 1.6.1
       strip-json-comments: 5.0.3
-      tinyglobby: 0.2.16
-      unbash: 3.0.0
+      tinyglobby: 0.2.17
+      unbash: 4.0.1
       yaml: 2.9.0
       zod: 4.4.3
 
@@ -16453,7 +16587,7 @@ snapshots:
     dependencies:
       js-tokens: 4.0.0
 
-  loro-crdt@1.13.2: {}
+  loro-crdt@1.13.5: {}
 
   loupe@3.2.1: {}
 
@@ -16473,8 +16607,8 @@ snapshots:
 
   magicast@0.5.2:
     dependencies:
-      '@babel/parser': 7.29.2
-      '@babel/types': 7.29.0
+      '@babel/parser': 7.29.7
+      '@babel/types': 7.29.7
       source-map-js: 1.2.1
 
   make-dir@4.0.0:
@@ -16718,7 +16852,7 @@ snapshots:
       d3-sankey: 0.12.3
       dagre-d3-es: 7.0.14
       dayjs: 1.11.21
-      dompurify: 3.4.10
+      dompurify: 3.4.11
       es-toolkit: 1.47.1
       katex: 0.16.47
       khroma: 2.1.0
@@ -16726,7 +16860,7 @@ snapshots:
       roughjs: 4.6.6
       stylis: 4.3.6
       ts-dedent: 2.2.0
-      uuid: 14.0.0
+      uuid: 14.0.1
 
   micromark-core-commonmark@2.0.3:
     dependencies:
@@ -17109,7 +17243,7 @@ snapshots:
       react: 19.2.7
       react-dom: 19.2.7(react@19.2.7)
 
-  next@16.2.9(@babel/core@7.29.7)(@playwright/test@1.60.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
+  next@16.2.9(@babel/core@7.29.7)(@playwright/test@1.61.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
     dependencies:
       '@next/env': 16.2.9
       '@swc/helpers': 0.5.15
@@ -17128,7 +17262,7 @@ snapshots:
       '@next/swc-linux-x64-musl': 16.2.9
       '@next/swc-win32-arm64-msvc': 16.2.9
       '@next/swc-win32-x64-msvc': 16.2.9
-      '@playwright/test': 1.60.0
+      '@playwright/test': 1.61.0
       sharp: 0.34.5
     transitivePeerDependencies:
       - '@babel/core'
@@ -17164,12 +17298,12 @@ snapshots:
     dependencies:
       boolbase: 1.0.0
 
-  nuqs@2.8.9(next@16.2.9(@babel/core@7.29.7)(@playwright/test@1.60.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7):
+  nuqs@2.8.9(next@16.2.9(@babel/core@7.29.7)(@playwright/test@1.61.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7):
     dependencies:
       '@standard-schema/spec': 1.0.0
       react: 19.2.7
     optionalDependencies:
-      next: 16.2.9(@babel/core@7.29.7)(@playwright/test@1.60.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      next: 16.2.9(@babel/core@7.29.7)(@playwright/test@1.61.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
 
   object-assign@4.1.1: {}
 
@@ -17316,30 +17450,30 @@ snapshots:
       '@oxc-parser/binding-win32-ia32-msvc': 0.132.0
       '@oxc-parser/binding-win32-x64-msvc': 0.132.0
 
-  oxc-parser@0.133.0:
+  oxc-parser@0.135.0:
     dependencies:
-      '@oxc-project/types': 0.133.0
+      '@oxc-project/types': 0.135.0
     optionalDependencies:
-      '@oxc-parser/binding-android-arm-eabi': 0.133.0
-      '@oxc-parser/binding-android-arm64': 0.133.0
-      '@oxc-parser/binding-darwin-arm64': 0.133.0
-      '@oxc-parser/binding-darwin-x64': 0.133.0
-      '@oxc-parser/binding-freebsd-x64': 0.133.0
-      '@oxc-parser/binding-linux-arm-gnueabihf': 0.133.0
-      '@oxc-parser/binding-linux-arm-musleabihf': 0.133.0
-      '@oxc-parser/binding-linux-arm64-gnu': 0.133.0
-      '@oxc-parser/binding-linux-arm64-musl': 0.133.0
-      '@oxc-parser/binding-linux-ppc64-gnu': 0.133.0
-      '@oxc-parser/binding-linux-riscv64-gnu': 0.133.0
-      '@oxc-parser/binding-linux-riscv64-musl': 0.133.0
-      '@oxc-parser/binding-linux-s390x-gnu': 0.133.0
-      '@oxc-parser/binding-linux-x64-gnu': 0.133.0
-      '@oxc-parser/binding-linux-x64-musl': 0.133.0
-      '@oxc-parser/binding-openharmony-arm64': 0.133.0
-      '@oxc-parser/binding-wasm32-wasi': 0.133.0
-      '@oxc-parser/binding-win32-arm64-msvc': 0.133.0
-      '@oxc-parser/binding-win32-ia32-msvc': 0.133.0
-      '@oxc-parser/binding-win32-x64-msvc': 0.133.0
+      '@oxc-parser/binding-android-arm-eabi': 0.135.0
+      '@oxc-parser/binding-android-arm64': 0.135.0
+      '@oxc-parser/binding-darwin-arm64': 0.135.0
+      '@oxc-parser/binding-darwin-x64': 0.135.0
+      '@oxc-parser/binding-freebsd-x64': 0.135.0
+      '@oxc-parser/binding-linux-arm-gnueabihf': 0.135.0
+      '@oxc-parser/binding-linux-arm-musleabihf': 0.135.0
+      '@oxc-parser/binding-linux-arm64-gnu': 0.135.0
+      '@oxc-parser/binding-linux-arm64-musl': 0.135.0
+      '@oxc-parser/binding-linux-ppc64-gnu': 0.135.0
+      '@oxc-parser/binding-linux-riscv64-gnu': 0.135.0
+      '@oxc-parser/binding-linux-riscv64-musl': 0.135.0
+      '@oxc-parser/binding-linux-s390x-gnu': 0.135.0
+      '@oxc-parser/binding-linux-x64-gnu': 0.135.0
+      '@oxc-parser/binding-linux-x64-musl': 0.135.0
+      '@oxc-parser/binding-openharmony-arm64': 0.135.0
+      '@oxc-parser/binding-wasm32-wasi': 0.135.0
+      '@oxc-parser/binding-win32-arm64-msvc': 0.135.0
+      '@oxc-parser/binding-win32-ia32-msvc': 0.135.0
+      '@oxc-parser/binding-win32-x64-msvc': 0.135.0
 
   oxc-resolver@11.20.0:
     optionalDependencies:
@@ -17363,55 +17497,30 @@ snapshots:
       '@oxc-resolver/binding-win32-arm64-msvc': 11.20.0
       '@oxc-resolver/binding-win32-x64-msvc': 11.20.0
 
-  oxfmt@0.52.0(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8(@vitest/browser@4.1.8(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))))(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)):
+  oxfmt@0.55.0(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)):
     dependencies:
       tinypool: 2.1.0
     optionalDependencies:
-      '@oxfmt/binding-android-arm-eabi': 0.52.0
-      '@oxfmt/binding-android-arm64': 0.52.0
-      '@oxfmt/binding-darwin-arm64': 0.52.0
-      '@oxfmt/binding-darwin-x64': 0.52.0
-      '@oxfmt/binding-freebsd-x64': 0.52.0
-      '@oxfmt/binding-linux-arm-gnueabihf': 0.52.0
-      '@oxfmt/binding-linux-arm-musleabihf': 0.52.0
-      '@oxfmt/binding-linux-arm64-gnu': 0.52.0
-      '@oxfmt/binding-linux-arm64-musl': 0.52.0
-      '@oxfmt/binding-linux-ppc64-gnu': 0.52.0
-      '@oxfmt/binding-linux-riscv64-gnu': 0.52.0
-      '@oxfmt/binding-linux-riscv64-musl': 0.52.0
-      '@oxfmt/binding-linux-s390x-gnu': 0.52.0
-      '@oxfmt/binding-linux-x64-gnu': 0.52.0
-      '@oxfmt/binding-linux-x64-musl': 0.52.0
-      '@oxfmt/binding-openharmony-arm64': 0.52.0
-      '@oxfmt/binding-win32-arm64-msvc': 0.52.0
-      '@oxfmt/binding-win32-ia32-msvc': 0.52.0
-      '@oxfmt/binding-win32-x64-msvc': 0.52.0
-      vite-plus: 0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8(@vitest/browser@4.1.8(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))))(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
-
-  oxfmt@0.52.0(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)):
-    dependencies:
-      tinypool: 2.1.0
-    optionalDependencies:
-      '@oxfmt/binding-android-arm-eabi': 0.52.0
-      '@oxfmt/binding-android-arm64': 0.52.0
-      '@oxfmt/binding-darwin-arm64': 0.52.0
-      '@oxfmt/binding-darwin-x64': 0.52.0
-      '@oxfmt/binding-freebsd-x64': 0.52.0
-      '@oxfmt/binding-linux-arm-gnueabihf': 0.52.0
-      '@oxfmt/binding-linux-arm-musleabihf': 0.52.0
-      '@oxfmt/binding-linux-arm64-gnu': 0.52.0
-      '@oxfmt/binding-linux-arm64-musl': 0.52.0
-      '@oxfmt/binding-linux-ppc64-gnu': 0.52.0
-      '@oxfmt/binding-linux-riscv64-gnu': 0.52.0
-      '@oxfmt/binding-linux-riscv64-musl': 0.52.0
-      '@oxfmt/binding-linux-s390x-gnu': 0.52.0
-      '@oxfmt/binding-linux-x64-gnu': 0.52.0
-      '@oxfmt/binding-linux-x64-musl': 0.52.0
-      '@oxfmt/binding-openharmony-arm64': 0.52.0
-      '@oxfmt/binding-win32-arm64-msvc': 0.52.0
-      '@oxfmt/binding-win32-ia32-msvc': 0.52.0
-      '@oxfmt/binding-win32-x64-msvc': 0.52.0
-      vite-plus: 0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
+      '@oxfmt/binding-android-arm-eabi': 0.55.0
+      '@oxfmt/binding-android-arm64': 0.55.0
+      '@oxfmt/binding-darwin-arm64': 0.55.0
+      '@oxfmt/binding-darwin-x64': 0.55.0
+      '@oxfmt/binding-freebsd-x64': 0.55.0
+      '@oxfmt/binding-linux-arm-gnueabihf': 0.55.0
+      '@oxfmt/binding-linux-arm-musleabihf': 0.55.0
+      '@oxfmt/binding-linux-arm64-gnu': 0.55.0
+      '@oxfmt/binding-linux-arm64-musl': 0.55.0
+      '@oxfmt/binding-linux-ppc64-gnu': 0.55.0
+      '@oxfmt/binding-linux-riscv64-gnu': 0.55.0
+      '@oxfmt/binding-linux-riscv64-musl': 0.55.0
+      '@oxfmt/binding-linux-s390x-gnu': 0.55.0
+      '@oxfmt/binding-linux-x64-gnu': 0.55.0
+      '@oxfmt/binding-linux-x64-musl': 0.55.0
+      '@oxfmt/binding-openharmony-arm64': 0.55.0
+      '@oxfmt/binding-win32-arm64-msvc': 0.55.0
+      '@oxfmt/binding-win32-ia32-msvc': 0.55.0
+      '@oxfmt/binding-win32-x64-msvc': 0.55.0
+      vite-plus: 0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
 
   oxlint-tsgolint@0.23.0:
     optionalDependencies:
@@ -17422,53 +17531,29 @@ snapshots:
       '@oxlint-tsgolint/win32-arm64': 0.23.0
       '@oxlint-tsgolint/win32-x64': 0.23.0
 
-  oxlint@1.67.0(oxlint-tsgolint@0.23.0)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8(@vitest/browser@4.1.8(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))))(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)):
+  oxlint@1.70.0(oxlint-tsgolint@0.23.0)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)):
     optionalDependencies:
-      '@oxlint/binding-android-arm-eabi': 1.67.0
-      '@oxlint/binding-android-arm64': 1.67.0
-      '@oxlint/binding-darwin-arm64': 1.67.0
-      '@oxlint/binding-darwin-x64': 1.67.0
-      '@oxlint/binding-freebsd-x64': 1.67.0
-      '@oxlint/binding-linux-arm-gnueabihf': 1.67.0
-      '@oxlint/binding-linux-arm-musleabihf': 1.67.0
-      '@oxlint/binding-linux-arm64-gnu': 1.67.0
-      '@oxlint/binding-linux-arm64-musl': 1.67.0
-      '@oxlint/binding-linux-ppc64-gnu': 1.67.0
-      '@oxlint/binding-linux-riscv64-gnu': 1.67.0
-      '@oxlint/binding-linux-riscv64-musl': 1.67.0
-      '@oxlint/binding-linux-s390x-gnu': 1.67.0
-      '@oxlint/binding-linux-x64-gnu': 1.67.0
-      '@oxlint/binding-linux-x64-musl': 1.67.0
-      '@oxlint/binding-openharmony-arm64': 1.67.0
-      '@oxlint/binding-win32-arm64-msvc': 1.67.0
-      '@oxlint/binding-win32-ia32-msvc': 1.67.0
-      '@oxlint/binding-win32-x64-msvc': 1.67.0
+      '@oxlint/binding-android-arm-eabi': 1.70.0
+      '@oxlint/binding-android-arm64': 1.70.0
+      '@oxlint/binding-darwin-arm64': 1.70.0
+      '@oxlint/binding-darwin-x64': 1.70.0
+      '@oxlint/binding-freebsd-x64': 1.70.0
+      '@oxlint/binding-linux-arm-gnueabihf': 1.70.0
+      '@oxlint/binding-linux-arm-musleabihf': 1.70.0
+      '@oxlint/binding-linux-arm64-gnu': 1.70.0
+      '@oxlint/binding-linux-arm64-musl': 1.70.0
+      '@oxlint/binding-linux-ppc64-gnu': 1.70.0
+      '@oxlint/binding-linux-riscv64-gnu': 1.70.0
+      '@oxlint/binding-linux-riscv64-musl': 1.70.0
+      '@oxlint/binding-linux-s390x-gnu': 1.70.0
+      '@oxlint/binding-linux-x64-gnu': 1.70.0
+      '@oxlint/binding-linux-x64-musl': 1.70.0
+      '@oxlint/binding-openharmony-arm64': 1.70.0
+      '@oxlint/binding-win32-arm64-msvc': 1.70.0
+      '@oxlint/binding-win32-ia32-msvc': 1.70.0
+      '@oxlint/binding-win32-x64-msvc': 1.70.0
       oxlint-tsgolint: 0.23.0
-      vite-plus: 0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8(@vitest/browser@4.1.8(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))))(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
-
-  oxlint@1.67.0(oxlint-tsgolint@0.23.0)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)):
-    optionalDependencies:
-      '@oxlint/binding-android-arm-eabi': 1.67.0
-      '@oxlint/binding-android-arm64': 1.67.0
-      '@oxlint/binding-darwin-arm64': 1.67.0
-      '@oxlint/binding-darwin-x64': 1.67.0
-      '@oxlint/binding-freebsd-x64': 1.67.0
-      '@oxlint/binding-linux-arm-gnueabihf': 1.67.0
-      '@oxlint/binding-linux-arm-musleabihf': 1.67.0
-      '@oxlint/binding-linux-arm64-gnu': 1.67.0
-      '@oxlint/binding-linux-arm64-musl': 1.67.0
-      '@oxlint/binding-linux-ppc64-gnu': 1.67.0
-      '@oxlint/binding-linux-riscv64-gnu': 1.67.0
-      '@oxlint/binding-linux-riscv64-musl': 1.67.0
-      '@oxlint/binding-linux-s390x-gnu': 1.67.0
-      '@oxlint/binding-linux-x64-gnu': 1.67.0
-      '@oxlint/binding-linux-x64-musl': 1.67.0
-      '@oxlint/binding-openharmony-arm64': 1.67.0
-      '@oxlint/binding-win32-arm64-msvc': 1.67.0
-      '@oxlint/binding-win32-ia32-msvc': 1.67.0
-      '@oxlint/binding-win32-x64-msvc': 1.67.0
-      oxlint-tsgolint: 0.23.0
-      vite-plus: 0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
+      vite-plus: 0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
 
   p-limit@3.1.0:
     dependencies:
@@ -17573,10 +17658,6 @@ snapshots:
 
   pinyin-pro@3.28.1: {}
 
-  pixelmatch@7.1.0:
-    dependencies:
-      pngjs: 7.0.0
-
   pkg-types@1.3.1:
     dependencies:
       confbox: 0.1.8
@@ -17589,11 +17670,11 @@ snapshots:
       exsolve: 1.0.8
       pathe: 2.0.3
 
-  playwright-core@1.60.0: {}
+  playwright-core@1.61.0: {}
 
-  playwright@1.60.0:
+  playwright@1.61.0:
     dependencies:
-      playwright-core: 1.60.0
+      playwright-core: 1.61.0
     optionalDependencies:
       fsevents: 2.3.2
 
@@ -17721,8 +17802,8 @@ snapshots:
   react-docgen@8.0.3:
     dependencies:
       '@babel/core': 7.29.7
-      '@babel/traverse': 7.29.0
-      '@babel/types': 7.29.0
+      '@babel/traverse': 7.29.7
+      '@babel/types': 7.29.7
       '@types/babel__core': 7.20.5
       '@types/babel__traverse': 7.28.0
       '@types/doctrine': 0.0.9
@@ -18245,37 +18326,37 @@ snapshots:
       '@img/sharp-win32-x64': 0.34.5
     optional: true
 
-  sharp@0.35.1:
+  sharp@0.35.2:
     dependencies:
       '@img/colour': 1.1.0
       detect-libc: 2.1.2
       semver: 7.8.4
     optionalDependencies:
-      '@img/sharp-darwin-arm64': 0.35.1
-      '@img/sharp-darwin-x64': 0.35.1
-      '@img/sharp-freebsd-wasm32': 0.35.1
-      '@img/sharp-libvips-darwin-arm64': 1.3.0
-      '@img/sharp-libvips-darwin-x64': 1.3.0
-      '@img/sharp-libvips-linux-arm': 1.3.0
-      '@img/sharp-libvips-linux-arm64': 1.3.0
-      '@img/sharp-libvips-linux-ppc64': 1.3.0
-      '@img/sharp-libvips-linux-riscv64': 1.3.0
-      '@img/sharp-libvips-linux-s390x': 1.3.0
-      '@img/sharp-libvips-linux-x64': 1.3.0
-      '@img/sharp-libvips-linuxmusl-arm64': 1.3.0
-      '@img/sharp-libvips-linuxmusl-x64': 1.3.0
-      '@img/sharp-linux-arm': 0.35.1
-      '@img/sharp-linux-arm64': 0.35.1
-      '@img/sharp-linux-ppc64': 0.35.1
-      '@img/sharp-linux-riscv64': 0.35.1
-      '@img/sharp-linux-s390x': 0.35.1
-      '@img/sharp-linux-x64': 0.35.1
-      '@img/sharp-linuxmusl-arm64': 0.35.1
-      '@img/sharp-linuxmusl-x64': 0.35.1
-      '@img/sharp-webcontainers-wasm32': 0.35.1
-      '@img/sharp-win32-arm64': 0.35.1
-      '@img/sharp-win32-ia32': 0.35.1
-      '@img/sharp-win32-x64': 0.35.1
+      '@img/sharp-darwin-arm64': 0.35.2
+      '@img/sharp-darwin-x64': 0.35.2
+      '@img/sharp-freebsd-wasm32': 0.35.2
+      '@img/sharp-libvips-darwin-arm64': 1.3.1
+      '@img/sharp-libvips-darwin-x64': 1.3.1
+      '@img/sharp-libvips-linux-arm': 1.3.1
+      '@img/sharp-libvips-linux-arm64': 1.3.1
+      '@img/sharp-libvips-linux-ppc64': 1.3.1
+      '@img/sharp-libvips-linux-riscv64': 1.3.1
+      '@img/sharp-libvips-linux-s390x': 1.3.1
+      '@img/sharp-libvips-linux-x64': 1.3.1
+      '@img/sharp-libvips-linuxmusl-arm64': 1.3.1
+      '@img/sharp-libvips-linuxmusl-x64': 1.3.1
+      '@img/sharp-linux-arm': 0.35.2
+      '@img/sharp-linux-arm64': 0.35.2
+      '@img/sharp-linux-ppc64': 0.35.2
+      '@img/sharp-linux-riscv64': 0.35.2
+      '@img/sharp-linux-s390x': 0.35.2
+      '@img/sharp-linux-x64': 0.35.2
+      '@img/sharp-linuxmusl-arm64': 0.35.2
+      '@img/sharp-linuxmusl-x64': 0.35.2
+      '@img/sharp-webcontainers-wasm32': 0.35.2
+      '@img/sharp-win32-arm64': 0.35.2
+      '@img/sharp-win32-ia32': 0.35.2
+      '@img/sharp-win32-x64': 0.35.2
 
   shebang-command@2.0.0:
     dependencies:
@@ -18296,6 +18377,8 @@ snapshots:
       '@shikijs/vscode-textmate': 10.0.2
       '@types/hast': 3.0.4
 
+  siginfo@2.0.0: {}
+
   signal-exit@3.0.7: {}
 
   signal-exit@4.1.0: {}
@@ -18376,6 +18459,8 @@ snapshots:
 
   srvx@0.11.15: {}
 
+  stackback@0.0.2: {}
+
   stackframe@1.3.4: {}
 
   state-local@1.0.7: {}
@@ -18391,7 +18476,7 @@ snapshots:
       es-errors: 1.3.0
       internal-slot: 1.1.0
 
-  storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)):
+  storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)):
     dependencies:
       '@storybook/global': 5.0.0
       '@storybook/icons': 2.0.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
@@ -18410,7 +18495,7 @@ snapshots:
       ws: 8.21.0
     optionalDependencies:
       '@types/react': 19.2.17
-      vite-plus: 0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
+      vite-plus: 0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
     transitivePeerDependencies:
       - '@testing-library/dom'
       - bufferutil
@@ -18606,6 +18691,11 @@ snapshots:
       fdir: 6.5.0(picomatch@4.0.4)
       picomatch: 4.0.4
 
+  tinyglobby@0.2.17:
+    dependencies:
+      fdir: 6.5.0(picomatch@4.0.4)
+      picomatch: 4.0.4
+
   tinypool@2.1.0: {}
 
   tinyrainbow@2.0.0: {}
@@ -18614,11 +18704,11 @@ snapshots:
 
   tinyspy@4.0.4: {}
 
-  tldts-core@7.4.2: {}
+  tldts-core@7.4.3: {}
 
-  tldts@7.4.2:
+  tldts@7.4.3:
     dependencies:
-      tldts-core: 7.4.2
+      tldts-core: 7.4.3
 
   to-regex-range@5.0.1:
     dependencies:
@@ -18740,7 +18830,7 @@ snapshots:
 
   uglify-js@3.19.3: {}
 
-  unbash@3.0.0: {}
+  unbash@4.0.1: {}
 
   unbox-primitive@1.1.0:
     dependencies:
@@ -18751,10 +18841,10 @@ snapshots:
 
   undici-types@7.24.6: {}
 
-  undici@7.26.0: {}
-
   undici@7.27.2: {}
 
+  undici@7.28.0: {}
+
   unicode-trie@2.0.0:
     dependencies:
       pako: 0.2.9
@@ -18890,7 +18980,7 @@ snapshots:
 
   util-deprecate@1.0.2: {}
 
-  uuid@14.0.0: {}
+  uuid@14.0.1: {}
 
   valibot@1.4.1(typescript@6.0.3):
     optionalDependencies:
@@ -18916,23 +19006,23 @@ snapshots:
       '@types/unist': 3.0.3
       vfile-message: 4.0.3
 
-  vinext@0.1.2(@mdx-js/rollup@3.1.1)(@vitejs/plugin-react@6.0.2(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(@vitejs/plugin-rsc@0.5.27(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(react-dom@19.2.7(react@19.2.7))(react-server-dom-webpack@19.2.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7))(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(next@16.2.9(@babel/core@7.29.7)(@playwright/test@1.60.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react-server-dom-webpack@19.2.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)(supports-color@10.2.2)(typescript@6.0.3):
+  vinext@0.1.6(@mdx-js/rollup@3.1.1)(@vitejs/plugin-react@6.0.2(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(@vitejs/plugin-rsc@0.5.27(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(react-dom@19.2.7(react@19.2.7))(react-server-dom-webpack@19.2.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7))(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(next@16.2.9(@babel/core@7.29.7)(@playwright/test@1.61.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react-server-dom-webpack@19.2.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)(supports-color@10.2.2)(typescript@6.0.3):
     dependencies:
-      '@unpic/react': 1.0.2(next@16.2.9(@babel/core@7.29.7)(@playwright/test@1.60.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@unpic/react': 1.0.2(next@16.2.9(@babel/core@7.29.7)(@playwright/test@1.61.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@vercel/og': 0.8.6
-      '@vitejs/plugin-react': 6.0.2(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
+      '@vitejs/plugin-react': 6.0.2(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
       image-size: 2.0.2
       ipaddr.js: 2.4.0
       magic-string: 0.30.21
       react: 19.2.7
       react-dom: 19.2.7(react@19.2.7)
-      vite: '@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+      vite: '@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
       vite-plugin-commonjs: 0.10.4
-      vite-tsconfig-paths: 6.1.1(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(supports-color@10.2.2)(typescript@6.0.3)
+      vite-tsconfig-paths: 6.1.1(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(supports-color@10.2.2)(typescript@6.0.3)
       web-vitals: 4.2.4
     optionalDependencies:
       '@mdx-js/rollup': 3.1.1
-      '@vitejs/plugin-rsc': 0.5.27(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(react-dom@19.2.7(react@19.2.7))(react-server-dom-webpack@19.2.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)
+      '@vitejs/plugin-rsc': 0.5.27(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(react-dom@19.2.7(react@19.2.7))(react-server-dom-webpack@19.2.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)
       react-server-dom-webpack: 19.2.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
     transitivePeerDependencies:
       - next
@@ -18952,9 +19042,9 @@ snapshots:
       fast-glob: 3.3.3
       magic-string: 0.30.21
 
-  vite-plugin-inspect@12.0.0-beta.3(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(typescript@6.0.3):
+  vite-plugin-inspect@12.0.0-beta.3(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(typescript@6.0.3):
     dependencies:
-      '@vitejs/devtools-kit': 0.3.1(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(typescript@6.0.3)
+      '@vitejs/devtools-kit': 0.3.1(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(typescript@6.0.3)
       ansis: 4.3.0
       error-stack-parser-es: 1.0.5
       obug: 2.1.1
@@ -18963,7 +19053,7 @@ snapshots:
       perfect-debounce: 2.1.0
       sirv: 3.0.2
       unplugin-utils: 0.3.1
-      vite: '@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+      vite: '@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
     transitivePeerDependencies:
       - '@modelcontextprotocol/sdk'
       - bufferutil
@@ -18971,39 +19061,49 @@ snapshots:
       - typescript
       - utf-8-validate
 
-  vite-plugin-storybook-nextjs@3.2.4(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(next@16.2.9(@babel/core@7.29.7)(@playwright/test@1.60.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(storybook@10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(supports-color@10.2.2)(typescript@6.0.3):
+  vite-plugin-storybook-nextjs@3.2.4(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(next@16.2.9(@babel/core@7.29.7)(@playwright/test@1.61.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(storybook@10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)))(supports-color@10.2.2)(typescript@6.0.3):
     dependencies:
       '@next/env': 16.0.0
       image-size: 2.0.2
       magic-string: 0.30.21
       module-alias: 2.3.4
-      next: 16.2.9(@babel/core@7.29.7)(@playwright/test@1.60.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      storybook: 10.4.4(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
+      next: 16.2.9(@babel/core@7.29.7)(@playwright/test@1.61.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      storybook: 10.4.6(@testing-library/dom@10.4.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
       ts-dedent: 2.2.0
-      vite: '@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
-      vite-tsconfig-paths: 5.1.4(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(supports-color@10.2.2)(typescript@6.0.3)
+      vite: '@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+      vite-tsconfig-paths: 5.1.4(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(supports-color@10.2.2)(typescript@6.0.3)
     transitivePeerDependencies:
       - supports-color
       - typescript
 
-  vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8(@vitest/browser@4.1.8(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))))(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0):
+  vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0):
     dependencies:
-      '@oxc-project/types': 0.133.0
-      '@oxlint/plugins': 1.61.0
-      '@voidzero-dev/vite-plus-core': 0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
-      '@voidzero-dev/vite-plus-test': 0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
-      oxfmt: 0.52.0(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8(@vitest/browser@4.1.8(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))))(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
-      oxlint: 1.67.0(oxlint-tsgolint@0.23.0)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8(@vitest/browser@4.1.8(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))))(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
+      '@oxc-project/types': 0.136.0
+      '@oxlint/plugins': 1.68.0
+      '@vitest/browser': 4.1.9(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(vitest@4.1.9)
+      '@vitest/browser-preview': 4.1.9(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(vitest@4.1.9)
+      '@vitest/expect': 4.1.9
+      '@vitest/mocker': 4.1.9(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
+      '@vitest/pretty-format': 4.1.9
+      '@vitest/runner': 4.1.9
+      '@vitest/snapshot': 4.1.9
+      '@vitest/spy': 4.1.9
+      '@vitest/utils': 4.1.9
+      '@voidzero-dev/vite-plus-core': 0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
+      oxfmt: 0.55.0(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
+      oxlint: 1.70.0(oxlint-tsgolint@0.23.0)(vite-plus@0.2.1(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.6)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
       oxlint-tsgolint: 0.23.0
+      vitest: 4.1.9(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/browser-preview@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(happy-dom@20.10.6)
     optionalDependencies:
-      '@voidzero-dev/vite-plus-darwin-arm64': 0.1.24
-      '@voidzero-dev/vite-plus-darwin-x64': 0.1.24
-      '@voidzero-dev/vite-plus-linux-arm64-gnu': 0.1.24
-      '@voidzero-dev/vite-plus-linux-arm64-musl': 0.1.24
-      '@voidzero-dev/vite-plus-linux-x64-gnu': 0.1.24
-      '@voidzero-dev/vite-plus-linux-x64-musl': 0.1.24
-      '@voidzero-dev/vite-plus-win32-arm64-msvc': 0.1.24
-      '@voidzero-dev/vite-plus-win32-x64-msvc': 0.1.24
+      '@vitest/browser-playwright': 4.1.9(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(playwright@1.61.0)(vitest@4.1.9)
+      '@voidzero-dev/vite-plus-darwin-arm64': 0.2.1
+      '@voidzero-dev/vite-plus-darwin-x64': 0.2.1
+      '@voidzero-dev/vite-plus-linux-arm64-gnu': 0.2.1
+      '@voidzero-dev/vite-plus-linux-arm64-musl': 0.2.1
+      '@voidzero-dev/vite-plus-linux-x64-gnu': 0.2.1
+      '@voidzero-dev/vite-plus-linux-x64-musl': 0.2.1
+      '@voidzero-dev/vite-plus-win32-arm64-msvc': 0.2.1
+      '@voidzero-dev/vite-plus-win32-x64-msvc': 0.2.1
     transitivePeerDependencies:
       - '@arethetypeswrong/core'
       - '@edge-runtime/vm'
@@ -19021,6 +19121,7 @@ snapshots:
       - jiti
       - jsdom
       - less
+      - msw
       - publint
       - sass
       - sass-embedded
@@ -19036,95 +19137,76 @@ snapshots:
       - vite
       - yaml
 
-  vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0):
-    dependencies:
-      '@oxc-project/types': 0.133.0
-      '@oxlint/plugins': 1.61.0
-      '@voidzero-dev/vite-plus-core': 0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
-      '@voidzero-dev/vite-plus-test': 0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)
-      oxfmt: 0.52.0(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
-      oxlint: 1.67.0(oxlint-tsgolint@0.23.0)(vite-plus@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
-      oxlint-tsgolint: 0.23.0
-    optionalDependencies:
-      '@voidzero-dev/vite-plus-darwin-arm64': 0.1.24
-      '@voidzero-dev/vite-plus-darwin-x64': 0.1.24
-      '@voidzero-dev/vite-plus-linux-arm64-gnu': 0.1.24
-      '@voidzero-dev/vite-plus-linux-arm64-musl': 0.1.24
-      '@voidzero-dev/vite-plus-linux-x64-gnu': 0.1.24
-      '@voidzero-dev/vite-plus-linux-x64-musl': 0.1.24
-      '@voidzero-dev/vite-plus-win32-arm64-msvc': 0.1.24
-      '@voidzero-dev/vite-plus-win32-x64-msvc': 0.1.24
-    transitivePeerDependencies:
-      - '@arethetypeswrong/core'
-      - '@edge-runtime/vm'
-      - '@opentelemetry/api'
-      - '@tsdown/css'
-      - '@tsdown/exe'
-      - '@types/node'
-      - '@vitejs/devtools'
-      - '@vitest/coverage-istanbul'
-      - '@vitest/coverage-v8'
-      - '@vitest/ui'
-      - bufferutil
-      - esbuild
-      - happy-dom
-      - jiti
-      - jsdom
-      - less
-      - publint
-      - sass
-      - sass-embedded
-      - stylus
-      - sugarss
-      - svelte
-      - terser
-      - tsx
-      - typescript
-      - unplugin-unused
-      - unrun
-      - utf-8-validate
-      - vite
-      - yaml
-
-  vite-tsconfig-paths@5.1.4(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(supports-color@10.2.2)(typescript@6.0.3):
+  vite-tsconfig-paths@5.1.4(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(supports-color@10.2.2)(typescript@6.0.3):
     dependencies:
       debug: 4.4.3(supports-color@10.2.2)
       globrex: 0.1.2
       tsconfck: 3.1.6(typescript@6.0.3)
     optionalDependencies:
-      vite: '@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+      vite: '@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
     transitivePeerDependencies:
       - supports-color
       - typescript
 
-  vite-tsconfig-paths@6.1.1(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(supports-color@10.2.2)(typescript@6.0.3):
+  vite-tsconfig-paths@6.1.1(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(supports-color@10.2.2)(typescript@6.0.3):
     dependencies:
       debug: 4.4.3(supports-color@10.2.2)
       globrex: 0.1.2
       tsconfck: 3.1.6(typescript@6.0.3)
-      vite: '@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+      vite: '@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
     transitivePeerDependencies:
       - supports-color
       - typescript
 
-  vitefu@1.1.3(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)):
+  vitefu@1.1.3(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)):
     optionalDependencies:
-      vite: '@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+      vite: '@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
 
-  vitest-browser-react@2.2.0(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(@voidzero-dev/vite-plus-test@0.1.24)(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
+  vitest-browser-react@2.2.0(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vitest@4.1.9):
     dependencies:
       react: 19.2.7
       react-dom: 19.2.7(react@19.2.7)
-      vitest: '@voidzero-dev/vite-plus-test@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+      vitest: 4.1.9(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/browser-preview@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(happy-dom@20.10.6)
     optionalDependencies:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  vitest-canvas-mock@1.1.4(@voidzero-dev/vite-plus-test@0.1.24):
+  vitest-canvas-mock@1.1.4(vitest@4.1.9):
     dependencies:
       cssfontparser: 1.2.1
       moo-color: 1.0.3
-      vitest: '@voidzero-dev/vite-plus-test@0.1.24(@types/node@25.9.3)(@vitest/coverage-v8@4.1.8)(@voidzero-dev/vite-plus-core@0.1.24(@types/node@25.9.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(esbuild@0.28.1)(happy-dom@20.10.3)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+      vitest: 4.1.9(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/browser-preview@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(happy-dom@20.10.6)
+
+  vitest@4.1.9(@types/node@25.9.4)(@vitest/browser-playwright@4.1.9)(@vitest/browser-preview@4.1.9)(@vitest/coverage-v8@4.1.9)(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(happy-dom@20.10.6):
+    dependencies:
+      '@vitest/expect': 4.1.9
+      '@vitest/mocker': 4.1.9(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))
+      '@vitest/pretty-format': 4.1.9
+      '@vitest/runner': 4.1.9
+      '@vitest/snapshot': 4.1.9
+      '@vitest/spy': 4.1.9
+      '@vitest/utils': 4.1.9
+      es-module-lexer: 2.1.0
+      expect-type: 1.3.0
+      magic-string: 0.30.21
+      obug: 2.1.1
+      pathe: 2.0.3
+      picomatch: 4.0.4
+      std-env: 4.0.0
+      tinybench: 2.9.0
+      tinyexec: 1.2.3
+      tinyglobby: 0.2.17
+      tinyrainbow: 3.1.0
+      vite: '@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0)'
+      why-is-node-running: 2.3.0
+    optionalDependencies:
+      '@types/node': 25.9.4
+      '@vitest/browser-playwright': 4.1.9(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(playwright@1.61.0)(vitest@4.1.9)
+      '@vitest/browser-preview': 4.1.9(@voidzero-dev/vite-plus-core@0.2.1(@types/node@25.9.4)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(typescript@6.0.3)(yaml@2.9.0))(vitest@4.1.9)
+      '@vitest/coverage-v8': 4.1.9(@vitest/browser@4.1.9)(vitest@4.1.9)
+      happy-dom: 20.10.6
+    transitivePeerDependencies:
+      - msw
 
   void-elements@3.1.0: {}
 
@@ -19219,6 +19301,11 @@ snapshots:
     dependencies:
       isexe: 2.0.0
 
+  why-is-node-running@2.3.0:
+    dependencies:
+      siginfo: 2.0.0
+      stackback: 0.0.2
+
   word-wrap@1.2.5: {}
 
   wrap-ansi@9.0.2:
@@ -19321,7 +19408,7 @@ time:
   '@amplitude/analytics-browser@2.44.1': '2026-06-11T23:28:53.586Z'
   '@amplitude/plugin-session-replay-browser@1.32.1': '2026-06-13T00:09:40.086Z'
   '@antfu/eslint-config@9.0.0': '2026-05-11T06:18:58.474Z'
-  '@base-ui/react@1.5.0': '2026-05-19T13:22:48.843Z'
+  '@base-ui/react@1.6.0': '2026-06-18T12:04:15.326Z'
   '@chromatic-com/storybook@5.2.1': '2026-05-14T07:49:29.364Z'
   '@cucumber/cucumber@13.0.0': '2026-06-02T07:10:03.122Z'
   '@egoist/tailwindcss-icons@1.9.2': '2026-01-31T10:48:44.594Z'
@@ -19332,7 +19419,7 @@ time:
   '@formatjs/intl-localematcher@0.8.10': '2026-06-04T15:24:22.451Z'
   '@heroicons/react@2.2.0': '2024-11-18T15:33:27.317Z'
   '@hey-api/openapi-ts@0.98.2': '2026-06-08T05:37:17.524Z'
-  '@hono/node-server@2.0.4': '2026-05-24T08:20:41.156Z'
+  '@hono/node-server@2.0.5': '2026-06-15T12:55:56.300Z'
   '@iconify-json/heroicons@1.2.3': '2025-09-20T05:33:02.364Z'
   '@iconify-json/ri@1.2.10': '2026-02-10T08:41:46.666Z'
   '@lexical/link@0.45.0': '2026-05-28T20:34:31.715Z'
@@ -19352,19 +19439,19 @@ time:
   '@orpc/contract@1.14.6': '2026-06-12T04:16:50.143Z'
   '@orpc/openapi-client@1.14.6': '2026-06-12T04:17:49.271Z'
   '@orpc/tanstack-query@1.14.6': '2026-06-12T04:17:13.682Z'
-  '@playwright/test@1.60.0': '2026-05-11T19:09:45.394Z'
+  '@playwright/test@1.61.0': '2026-06-15T10:06:35.237Z'
   '@remixicon/react@4.9.0': '2026-01-29T10:53:18.993Z'
   '@rgrove/parse-xml@4.2.0': '2024-10-25T03:58:22.145Z'
-  '@sentry/react@10.57.0': '2026-06-09T09:44:56.173Z'
-  '@storybook/addon-a11y@10.4.4': '2026-06-11T11:47:24.917Z'
-  '@storybook/addon-docs@10.4.4': '2026-06-11T11:47:25.111Z'
-  '@storybook/addon-links@10.4.4': '2026-06-11T11:47:29.814Z'
-  '@storybook/addon-onboarding@10.4.4': '2026-06-11T11:47:29.674Z'
-  '@storybook/addon-themes@10.4.4': '2026-06-11T11:47:34.054Z'
-  '@storybook/addon-vitest@10.4.4': '2026-06-11T11:47:37.457Z'
-  '@storybook/nextjs-vite@10.4.4': '2026-06-11T11:47:57.869Z'
-  '@storybook/react-vite@10.4.4': '2026-06-11T11:48:05.555Z'
-  '@storybook/react@10.4.4': '2026-06-11T11:48:50.264Z'
+  '@sentry/react@10.59.0': '2026-06-19T12:52:07.460Z'
+  '@storybook/addon-a11y@10.4.6': '2026-06-16T11:41:54.974Z'
+  '@storybook/addon-docs@10.4.6': '2026-06-16T11:41:55.049Z'
+  '@storybook/addon-links@10.4.6': '2026-06-16T11:42:01.532Z'
+  '@storybook/addon-onboarding@10.4.6': '2026-06-16T11:42:01.175Z'
+  '@storybook/addon-themes@10.4.6': '2026-06-16T11:42:06.465Z'
+  '@storybook/addon-vitest@10.4.6': '2026-06-16T11:42:09.951Z'
+  '@storybook/nextjs-vite@10.4.6': '2026-06-16T11:42:31.117Z'
+  '@storybook/react-vite@10.4.6': '2026-06-16T11:42:40.527Z'
+  '@storybook/react@10.4.6': '2026-06-16T11:43:30.413Z'
   '@streamdown/math@1.0.2': '2026-02-09T17:31:31.085Z'
   '@svgdotjs/svg.js@3.2.5': '2025-09-15T16:22:12.771Z'
   '@t3-oss/env-nextjs@0.13.11': '2026-03-22T19:16:09.026Z'
@@ -19372,36 +19459,37 @@ time:
   '@tailwindcss/typography@0.5.20': '2026-06-08T10:34:41.124Z'
   '@tailwindcss/vite@4.3.1': '2026-06-12T17:59:45.667Z'
   '@tanstack/eslint-plugin-query@5.101.0': '2026-06-02T19:24:31.866Z'
+  '@tanstack/form-core@1.33.0': '2026-05-28T17:05:43.320Z'
   '@tanstack/query-core@5.101.0': '2026-06-02T19:24:32.202Z'
   '@tanstack/react-form@1.33.0': '2026-05-28T17:05:42.660Z'
   '@tanstack/react-hotkeys@0.10.0': '2026-04-25T12:28:06.989Z'
   '@tanstack/react-query@5.101.0': '2026-06-02T19:24:39.383Z'
-  '@tanstack/react-virtual@3.14.2': '2026-06-02T07:27:48.537Z'
+  '@tanstack/react-virtual@3.14.3': '2026-06-15T19:53:08.471Z'
   '@testing-library/dom@10.4.1': '2025-07-27T13:23:37.151Z'
   '@testing-library/jest-dom@6.9.1': '2025-10-01T20:04:22.720Z'
   '@testing-library/react@16.3.2': '2026-01-19T10:59:08.185Z'
   '@testing-library/user-event@14.6.1': '2025-01-21T17:35:55.574Z'
-  '@tsslint/cli@3.1.3': '2026-05-16T14:17:58.782Z'
-  '@tsslint/compat-eslint@3.1.3': '2026-05-16T14:17:54.194Z'
-  '@tsslint/config@3.1.3': '2026-05-16T14:17:56.687Z'
+  '@tsslint/cli@3.1.4': '2026-06-16T18:21:29.075Z'
+  '@tsslint/compat-eslint@3.1.4': '2026-06-16T18:21:23.786Z'
+  '@tsslint/config@3.1.4': '2026-06-16T18:21:26.545Z'
   '@types/js-cookie@3.0.6': '2023-11-07T08:41:16.889Z'
   '@types/js-yaml@4.0.9': '2023-11-07T20:20:13.264Z'
   '@types/lockfile@1.0.4': '2023-11-07T20:23:21.070Z'
   '@types/negotiator@0.6.4': '2025-06-07T02:18:17.532Z'
-  '@types/node@25.9.3': '2026-06-10T22:15:10.607Z'
+  '@types/node@25.9.4': '2026-06-19T07:15:05.196Z'
   '@types/qs@6.15.1': '2026-05-06T23:46:01.024Z'
   '@types/react-dom@19.2.3': '2025-11-12T04:37:39.524Z'
   '@types/react@19.2.17': '2026-06-05T20:10:24.692Z'
   '@types/sortablejs@1.15.9': '2025-10-24T04:31:45.132Z'
-  '@typescript-eslint/eslint-plugin@8.61.0': '2026-06-08T18:01:21.196Z'
-  '@typescript-eslint/parser@8.61.0': '2026-06-08T18:00:59.869Z'
-  '@typescript/native-preview@7.0.0-dev.20260613.1': '2026-06-13T08:01:38.753Z'
+  '@typescript-eslint/eslint-plugin@8.61.1': '2026-06-15T18:31:50.659Z'
+  '@typescript-eslint/parser@8.61.1': '2026-06-15T18:31:27.695Z'
+  '@typescript/native-preview@7.0.0-dev.20260620.1': '2026-06-20T08:01:54.980Z'
   '@vitejs/plugin-react@6.0.2': '2026-05-14T20:03:24.044Z'
   '@vitejs/plugin-rsc@0.5.27': '2026-06-01T09:07:55.389Z'
-  '@vitest/browser@4.1.8': '2026-06-01T08:14:46.126Z'
-  '@vitest/coverage-v8@4.1.8': '2026-06-01T08:15:09.012Z'
-  '@voidzero-dev/vite-plus-core@0.1.24': '2026-06-01T13:04:55.392Z'
-  '@voidzero-dev/vite-plus-test@0.1.24': '2026-06-01T13:05:02.584Z'
+  '@vitest/browser-playwright@4.1.9': '2026-06-15T07:21:50.860Z'
+  '@vitest/browser@4.1.9': '2026-06-15T07:21:58.373Z'
+  '@vitest/coverage-v8@4.1.9': '2026-06-15T07:21:14.145Z'
+  '@voidzero-dev/vite-plus-core@0.2.1': '2026-06-18T05:33:26.237Z'
   abcjs@6.6.3: '2026-04-24T17:38:01.079Z'
   agentation@3.0.2: '2026-03-25T16:24:19.682Z'
   ahooks@3.9.7: '2026-03-23T15:49:13.605Z'
@@ -19411,13 +19499,13 @@ time:
   cli-table3@0.6.5: '2024-05-12T16:36:50.079Z'
   clsx@2.1.1: '2024-04-23T05:26:04.645Z'
   cmdk@1.1.1: '2025-03-14T19:21:16.194Z'
-  code-inspector-plugin@1.6.0: '2026-06-12T11:45:35.134Z'
+  code-inspector-plugin@1.6.1: '2026-06-15T01:14:26.288Z'
   concurrently@10.0.3: '2026-06-02T04:31:54.180Z'
   copy-to-clipboard@4.0.2: '2026-04-24T22:15:18.933Z'
-  cron-parser@5.5.0: '2026-01-16T13:14:50.225Z'
+  cron-parser@5.6.0: '2026-06-20T18:24:08.824Z'
   dayjs@1.11.21: '2026-05-26T05:46:12.427Z'
   decimal.js@10.6.0: '2025-07-06T22:50:38.844Z'
-  dompurify@3.4.10: '2026-06-12T12:49:46.101Z'
+  dompurify@3.4.11: '2026-06-17T10:33:28.065Z'
   echarts-for-react@3.0.6: '2026-01-21T04:38:21.243Z'
   echarts@6.1.0: '2026-05-19T17:52:11.076Z'
   elkjs@0.11.1: '2026-03-03T12:21:48.463Z'
@@ -19433,16 +19521,16 @@ time:
   eslint-plugin-markdown-preferences@0.41.1: '2026-04-09T23:28:41.552Z'
   eslint-plugin-no-barrel-files@1.3.1: '2026-04-12T18:28:18.653Z'
   eslint-plugin-react-refresh@0.5.3: '2026-06-14T12:46:34.395Z'
-  eslint-plugin-sonarjs@4.0.3: '2026-04-16T08:09:42.856Z'
-  eslint-plugin-storybook@10.4.4: '2026-06-11T11:48:35.390Z'
+  eslint-plugin-sonarjs@4.1.0: '2026-06-18T17:14:11.087Z'
+  eslint-plugin-storybook@10.4.6: '2026-06-16T11:43:14.113Z'
   eslint@10.5.0: '2026-06-12T17:54:40.577Z'
   eventsource-parser@3.1.0: '2026-05-27T20:55:51.466Z'
   fast-deep-equal@3.1.3: '2020-06-08T07:27:28.474Z'
-  foxact@0.3.5: '2026-06-11T15:55:09.889Z'
+  foxact@0.3.7: '2026-06-17T18:34:56.297Z'
   fuse.js@7.4.2: '2026-06-05T22:22:52.388Z'
-  happy-dom@20.10.3: '2026-06-12T22:45:20.950Z'
+  happy-dom@20.10.6: '2026-06-17T23:41:40.697Z'
   hast-util-to-jsx-runtime@2.3.6: '2025-03-05T11:30:29.166Z'
-  hono@4.12.25: '2026-06-09T03:28:50.819Z'
+  hono@4.12.26: '2026-06-18T02:18:42.144Z'
   html-entities@2.6.0: '2025-03-30T15:40:10.885Z'
   html-to-image@1.11.13: '2025-02-14T01:43:48.709Z'
   i18next-resources-to-backend@1.2.1: '2024-04-10T19:22:23.117Z'
@@ -19457,13 +19545,13 @@ time:
   js-yaml@4.2.0: '2026-05-31T22:17:13.783Z'
   jsonschema@1.5.0: '2025-01-07T15:09:11.287Z'
   katex@0.17.0: '2026-05-22T08:06:26.967Z'
-  knip@6.16.1: '2026-06-06T17:52:39.499Z'
+  knip@6.17.1: '2026-06-16T06:18:07.787Z'
   ky@2.0.2: '2026-04-21T08:58:46.923Z'
   lamejs@1.2.1: '2021-12-02T15:44:40.036Z'
   lexical-code-no-prism@0.41.0: '2026-03-08T16:50:40.266Z'
   lexical@0.45.0: '2026-05-28T20:33:56.686Z'
   lockfile@1.0.4: '2018-04-17T00:36:12.565Z'
-  loro-crdt@1.13.2: '2026-06-12T05:06:09.528Z'
+  loro-crdt@1.13.5: '2026-06-21T00:28:46.635Z'
   mermaid@11.15.0: '2026-05-11T11:15:09.824Z'
   mime@4.1.0: '2025-09-12T17:53:01.376Z'
   mitt@3.0.1: '2023-07-04T17:31:47.638Z'
@@ -19476,7 +19564,7 @@ time:
   ora@9.4.0: '2026-04-22T06:11:17.972Z'
   picocolors@1.1.1: '2024-10-16T18:20:03.921Z'
   pinyin-pro@3.28.1: '2026-04-10T09:18:57.903Z'
-  playwright@1.60.0: '2026-05-11T19:09:33.114Z'
+  playwright@1.61.0: '2026-06-15T10:06:22.269Z'
   postcss@8.5.15: '2026-05-19T09:51:29.843Z'
   qrcode.react@4.2.0: '2024-12-11T17:22:40.569Z'
   qs@6.15.2: '2026-05-16T23:19:19.539Z'
@@ -19495,29 +19583,30 @@ time:
   remark-directive@4.0.0: '2025-02-27T15:15:20.630Z'
   scheduler@0.27.0: '2025-10-01T21:39:15.208Z'
   server-only@0.0.1: '2022-09-03T01:07:26.139Z'
-  sharp@0.35.1: '2026-06-11T17:10:33.369Z'
+  sharp@0.35.2: '2026-06-19T13:47:27.073Z'
   shiki@4.2.0: '2026-06-03T01:35:47.302Z'
   socket.io-client@4.8.3: '2025-12-23T16:39:16.428Z'
   sortablejs@1.15.7: '2026-02-11T22:42:31.720Z'
   std-semver@1.0.8: '2026-03-09T17:23:55.795Z'
-  storybook@10.4.4: '2026-06-11T11:47:45.294Z'
+  storybook@10.4.6: '2026-06-16T11:42:18.729Z'
   streamdown@2.5.0: '2026-03-17T17:35:05.216Z'
   string-ts@2.3.1: '2025-11-28T17:33:10.099Z'
   tailwind-merge@3.6.0: '2026-05-10T12:56:43.142Z'
   tailwindcss@4.3.1: '2026-06-12T17:59:19.225Z'
-  tldts@7.4.2: '2026-05-30T09:56:28.759Z'
+  tldts@7.4.3: '2026-06-15T14:51:15.009Z'
   tsx@4.22.4: '2026-05-31T12:22:19.330Z'
   typescript@6.0.3: '2026-04-16T23:38:27.905Z'
   uglify-js@3.19.3: '2024-08-29T13:49:01.316Z'
-  undici@7.27.2: '2026-06-06T08:21:50.946Z'
+  undici@7.28.0: '2026-06-15T15:51:12.886Z'
   unist-util-visit@5.1.0: '2026-01-22T19:02:58.977Z'
   use-context-selector@2.0.0: '2024-05-06T11:23:59.259Z'
-  uuid@14.0.0: '2026-04-19T15:15:42.302Z'
-  vinext@0.1.2: '2026-06-12T10:31:09.245Z'
+  uuid@14.0.1: '2026-06-20T11:56:02.499Z'
+  vinext@0.1.6: '2026-06-19T15:54:13.598Z'
   vite-plugin-inspect@12.0.0-beta.3: '2026-05-29T06:16:55.694Z'
-  vite-plus@0.1.24: '2026-06-01T13:05:08.610Z'
+  vite-plus@0.2.1: '2026-06-18T05:33:32.399Z'
   vitest-browser-react@2.2.0: '2026-04-05T06:56:34.635Z'
   vitest-canvas-mock@1.1.4: '2026-03-24T14:42:39.285Z'
+  vitest@4.1.9: '2026-06-15T07:23:00.326Z'
   zod@4.4.3: '2026-05-04T07:06:40.819Z'
   zundo@2.3.0: '2024-11-17T16:35:11.372Z'
   zustand@5.0.14: '2026-05-28T10:17:58.249Z'
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 8aaafed7267..39c72faa330 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -39,14 +39,14 @@ overrides:
   postcss-selector-parser@>=6.0.0 <6.1.3: 6.1.4
   postcss-selector-parser@>=7.0.0 <7.1.3: 7.1.4
   postcss@<8.5.10: ^8.5.10
-  rollup@>=4.0.0 <4.59.0: 4.61.1
+  rollup@>=4.0.0 <4.59.0: 4.62.2
   safer-buffer: npm:@nolyfill/safer-buffer@^1.0.44
   side-channel: npm:@nolyfill/side-channel@^1.0.44
   solid-js: 1.9.13
   string-width: ~8.2.1
   tar@<=7.5.15: ^7.5.16
-  vite: npm:@voidzero-dev/vite-plus-core@0.1.24
-  vitest: npm:@voidzero-dev/vite-plus-test@0.1.24
+  vite: npm:@voidzero-dev/vite-plus-core@0.2.1
+  vitest: 4.1.9
   ws@>=8.0.0 <8.20.1: ^8.21.0
   yaml@>=2.0.0 <2.8.3: 2.9.0
   yauzl@<3.2.1: 3.2.1
@@ -54,7 +54,7 @@ catalog:
   '@amplitude/analytics-browser': 2.44.1
   '@amplitude/plugin-session-replay-browser': 1.32.1
   '@antfu/eslint-config': 9.0.0
-  '@base-ui/react': 1.5.0
+  '@base-ui/react': 1.6.0
   '@chromatic-com/storybook': 5.2.1
   '@cucumber/cucumber': 13.0.0
   '@egoist/tailwindcss-icons': 1.9.2
@@ -65,7 +65,7 @@ catalog:
   '@formatjs/intl-localematcher': 0.8.10
   '@heroicons/react': 2.2.0
   '@hey-api/openapi-ts': 0.98.2
-  '@hono/node-server': 2.0.4
+  '@hono/node-server': 2.0.5
   '@iconify-json/heroicons': 1.2.3
   '@iconify-json/ri': 1.2.10
   '@lexical/code': 0.45.0
@@ -86,19 +86,19 @@ catalog:
   '@orpc/contract': 1.14.6
   '@orpc/openapi-client': 1.14.6
   '@orpc/tanstack-query': 1.14.6
-  '@playwright/test': 1.60.0
+  '@playwright/test': 1.61.0
   '@remixicon/react': 4.9.0
   '@rgrove/parse-xml': 4.2.0
-  '@sentry/react': 10.57.0
-  '@storybook/addon-a11y': 10.4.4
-  '@storybook/addon-docs': 10.4.4
-  '@storybook/addon-links': 10.4.4
-  '@storybook/addon-onboarding': 10.4.4
-  '@storybook/addon-themes': 10.4.4
-  '@storybook/addon-vitest': 10.4.4
-  '@storybook/nextjs-vite': 10.4.4
-  '@storybook/react': 10.4.4
-  '@storybook/react-vite': 10.4.4
+  '@sentry/react': 10.59.0
+  '@storybook/addon-a11y': 10.4.6
+  '@storybook/addon-docs': 10.4.6
+  '@storybook/addon-links': 10.4.6
+  '@storybook/addon-onboarding': 10.4.6
+  '@storybook/addon-themes': 10.4.6
+  '@storybook/addon-vitest': 10.4.6
+  '@storybook/nextjs-vite': 10.4.6
+  '@storybook/react': 10.4.6
+  '@storybook/react-vite': 10.4.6
   '@streamdown/math': 1.0.2
   '@svgdotjs/svg.js': 3.2.5
   '@t3-oss/env-nextjs': 0.13.11
@@ -106,34 +106,36 @@ catalog:
   '@tailwindcss/typography': 0.5.20
   '@tailwindcss/vite': 4.3.1
   '@tanstack/eslint-plugin-query': 5.101.0
+  '@tanstack/form-core': 1.33.0
   '@tanstack/query-core': 5.101.0
   '@tanstack/react-form': 1.33.0
   '@tanstack/react-hotkeys': 0.10.0
   '@tanstack/react-query': 5.101.0
-  '@tanstack/react-virtual': 3.14.2
+  '@tanstack/react-virtual': 3.14.3
   '@testing-library/dom': 10.4.1
   '@testing-library/jest-dom': 6.9.1
   '@testing-library/react': 16.3.2
   '@testing-library/user-event': 14.6.1
-  '@tsslint/cli': 3.1.3
-  '@tsslint/compat-eslint': 3.1.3
-  '@tsslint/config': 3.1.3
+  '@tsslint/cli': 3.1.4
+  '@tsslint/compat-eslint': 3.1.4
+  '@tsslint/config': 3.1.4
   '@types/js-cookie': 3.0.6
   '@types/js-yaml': 4.0.9
   '@types/lockfile': 1.0.4
   '@types/negotiator': 0.6.4
-  '@types/node': 25.9.3
+  '@types/node': 25.9.4
   '@types/qs': 6.15.1
   '@types/react': 19.2.17
   '@types/react-dom': 19.2.3
   '@types/sortablejs': 1.15.9
-  '@typescript-eslint/eslint-plugin': 8.61.0
-  '@typescript-eslint/parser': 8.61.0
-  '@typescript/native-preview': 7.0.0-dev.20260613.1
+  '@typescript-eslint/eslint-plugin': 8.61.1
+  '@typescript-eslint/parser': 8.61.1
+  '@typescript/native-preview': 7.0.0-dev.20260620.1
   '@vitejs/plugin-react': 6.0.2
   '@vitejs/plugin-rsc': 0.5.27
-  '@vitest/browser': 4.1.8
-  '@vitest/coverage-v8': 4.1.8
+  '@vitest/browser': 4.1.9
+  '@vitest/browser-playwright': 4.1.9
+  '@vitest/coverage-v8': 4.1.9
   abcjs: 6.6.3
   agentation: 3.0.2
   ahooks: 3.9.7
@@ -143,13 +145,13 @@ catalog:
   cli-table3: 0.6.5
   clsx: 2.1.1
   cmdk: 1.1.1
-  code-inspector-plugin: 1.6.0
+  code-inspector-plugin: 1.6.1
   concurrently: ^10.0.3
   copy-to-clipboard: 4.0.2
-  cron-parser: 5.5.0
+  cron-parser: 5.6.0
   dayjs: 1.11.21
   decimal.js: 10.6.0
-  dompurify: 3.4.10
+  dompurify: 3.4.11
   echarts: 6.1.0
   echarts-for-react: 3.0.6
   elkjs: 0.11.1
@@ -166,15 +168,15 @@ catalog:
   eslint-plugin-markdown-preferences: 0.41.1
   eslint-plugin-no-barrel-files: 1.3.1
   eslint-plugin-react-refresh: 0.5.3
-  eslint-plugin-sonarjs: 4.0.3
-  eslint-plugin-storybook: 10.4.4
+  eslint-plugin-sonarjs: 4.1.0
+  eslint-plugin-storybook: 10.4.6
   eventsource-parser: 3.1.0
   fast-deep-equal: 3.1.3
-  foxact: 0.3.5
+  foxact: 0.3.7
   fuse.js: 7.4.2
-  happy-dom: 20.10.3
+  happy-dom: 20.10.6
   hast-util-to-jsx-runtime: 2.3.6
-  hono: 4.12.25
+  hono: 4.12.26
   html-entities: 2.6.0
   html-to-image: 1.11.13
   i18next: 26.3.1
@@ -189,12 +191,12 @@ catalog:
   js-yaml: 4.2.0
   jsonschema: 1.5.0
   katex: 0.17.0
-  knip: 6.16.1
+  knip: 6.17.1
   ky: 2.0.2
   lamejs: 1.2.1
   lexical: 0.45.0
   lockfile: 1.0.4
-  loro-crdt: 1.13.2
+  loro-crdt: 1.13.5
   mermaid: 11.15.0
   mime: 4.1.0
   mitt: 3.0.1
@@ -207,7 +209,7 @@ catalog:
   ora: 9.4.0
   picocolors: 1.1.1
   pinyin-pro: 3.28.1
-  playwright: 1.60.0
+  playwright: 1.61.0
   postcss: 8.5.15
   qrcode.react: 4.2.0
   qs: 6.15.2
@@ -226,29 +228,29 @@ catalog:
   remark-directive: 4.0.0
   scheduler: 0.27.0
   server-only: 0.0.1
-  sharp: 0.35.1
+  sharp: 0.35.2
   shiki: 4.2.0
   socket.io-client: 4.8.3
   sortablejs: 1.15.7
   std-semver: 1.0.8
-  storybook: 10.4.4
+  storybook: 10.4.6
   streamdown: 2.5.0
   string-ts: 2.3.1
   tailwind-merge: 3.6.0
   tailwindcss: 4.3.1
-  tldts: 7.4.2
+  tldts: 7.4.3
   tsx: 4.22.4
   typescript: 6.0.3
   uglify-js: 3.19.3
-  undici: 7.27.2
+  undici: 7.28.0
   unist-util-visit: 5.1.0
   use-context-selector: 2.0.0
-  uuid: 14.0.0
-  vinext: 0.1.2
-  vite: npm:@voidzero-dev/vite-plus-core@0.1.24
+  uuid: 14.0.1
+  vinext: 0.1.6
+  vite: npm:@voidzero-dev/vite-plus-core@0.2.1
   vite-plugin-inspect: 12.0.0-beta.3
-  vite-plus: 0.1.24
-  vitest: npm:@voidzero-dev/vite-plus-test@0.1.24
+  vite-plus: 0.2.1
+  vitest: 4.1.9
   vitest-browser-react: 2.2.0
   vitest-canvas-mock: 1.1.4
   zod: 4.4.3
diff --git a/web/__tests__/app-sidebar/dataset-info-flow.test.tsx b/web/__tests__/app-sidebar/dataset-info-flow.test.tsx
index bff6f5a29c5..62761743a10 100644
--- a/web/__tests__/app-sidebar/dataset-info-flow.test.tsx
+++ b/web/__tests__/app-sidebar/dataset-info-flow.test.tsx
@@ -1,6 +1,7 @@
 import type { DataSet } from '@/models/datasets'
-import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { fireEvent, screen, waitFor } from '@testing-library/react'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { renderWithSystemFeatures as render } from '@/__tests__/utils/mock-system-features'
 import DatasetInfo from '@/app/components/app-sidebar/dataset-info'
 import { ChunkingMode, DatasetPermission, DataSourceType } from '@/models/datasets'
 import { RETRIEVE_METHOD } from '@/types/app'
diff --git a/web/__tests__/tools/tool-provider-detail-flow.test.tsx b/web/__tests__/tools/tool-provider-detail-flow.test.tsx
index e99e7ac24c2..8cbfae8d693 100644
--- a/web/__tests__/tools/tool-provider-detail-flow.test.tsx
+++ b/web/__tests__/tools/tool-provider-detail-flow.test.tsx
@@ -49,7 +49,7 @@ vi.mock('@/context/app-context', () => ({
     isCurrentWorkspaceManager: true,
   }),
   useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) => selector({
-    workspacePermissionKeys: ['tool.manage', 'credential.manage', 'credential.use'],
+    workspacePermissionKeys: ['tool.manage', 'credential.create', 'credential.manage', 'credential.use'],
   }),
 }))
 
diff --git a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/__tests__/layout-main.spec.tsx b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/__tests__/layout-main.spec.tsx
index f9742f35e13..ec7aad05b74 100644
--- a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/__tests__/layout-main.spec.tsx
+++ b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/__tests__/layout-main.spec.tsx
@@ -1,5 +1,6 @@
 import type { App } from '@/types/app'
-import { render, screen, waitFor } from '@testing-library/react'
+import { screen, waitFor } from '@testing-library/react'
+import { renderWithSystemFeatures } from '@/__tests__/utils/mock-system-features'
 import { useStore } from '@/app/components/app/store'
 import { usePathname, useRouter } from '@/next/navigation'
 import { fetchAppDetailDirect } from '@/service/apps'
@@ -10,6 +11,13 @@ import AppDetailLayout from '../layout-main'
 const mockReplace = vi.fn()
 let mockPathname = '/app/app-1/workflow'
 let mockIsLoadingWorkspacePermissionKeys = false
+let mockIsRbacEnabled = true
+
+const render = (ui: Parameters<typeof renderWithSystemFeatures>[0]) => renderWithSystemFeatures(ui, {
+  systemFeatures: {
+    rbac_enabled: mockIsRbacEnabled,
+  },
+})
 
 vi.mock('@/next/navigation', () => ({
   usePathname: vi.fn(),
@@ -57,6 +65,7 @@ describe('AppDetailLayout', () => {
     vi.clearAllMocks()
     mockPathname = '/app/app-1/workflow'
     mockIsLoadingWorkspacePermissionKeys = false
+    mockIsRbacEnabled = true
     mockUsePathname.mockImplementation(() => mockPathname)
     mockUseRouter.mockReturnValue({
       back: vi.fn(),
@@ -262,6 +271,24 @@ describe('AppDetailLayout', () => {
     expect(useStore.getState().appDetail?.id).toBe('app-1')
   })
 
+  it('should redirect access config pages when RBAC is disabled', async () => {
+    mockIsRbacEnabled = false
+    mockPathname = '/app/app-1/access-config'
+    mockFetchAppDetailDirect.mockResolvedValue(createAppDetail({ permission_keys: [AppACLPermission.AccessConfig] }))
+
+    render(
+      <AppDetailLayout appId="app-1">
+        <div>App page content</div>
+      </AppDetailLayout>,
+    )
+
+    await waitFor(() => {
+      expect(mockReplace).toHaveBeenCalledWith('/app/app-1/develop')
+    })
+    expect(screen.queryByText('App page content')).not.toBeInTheDocument()
+    expect(useStore.getState().appDetail).toBeUndefined()
+  })
+
   it('should redirect annotation pages when edit access is missing', async () => {
     mockPathname = '/app/app-1/annotations'
     mockFetchAppDetailDirect.mockResolvedValue(createAppDetail({
diff --git a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/layout-main.tsx b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/layout-main.tsx
index dcbcba4116d..517c8819e91 100644
--- a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/layout-main.tsx
+++ b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/layout-main.tsx
@@ -2,6 +2,7 @@
 import type { FC } from 'react'
 import type { App } from '@/types/app'
 import { cn } from '@langgenius/dify-ui/cn'
+import { useSuspenseQuery } from '@tanstack/react-query'
 import * as React from 'react'
 import { useEffect, useState } from 'react'
 import { useTranslation } from 'react-i18next'
@@ -9,6 +10,7 @@ import { useShallow } from 'zustand/react/shallow'
 import { useStore } from '@/app/components/app/store'
 import Loading from '@/app/components/base/loading'
 import { useAppContext } from '@/context/app-context'
+import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import useDocumentTitle from '@/hooks/use-document-title'
 import { usePathname, useRouter } from '@/next/navigation'
 import { fetchAppDetailDirect } from '@/service/apps'
@@ -36,7 +38,9 @@ const AppDetailLayout: FC<IAppDetailLayoutProps> = (props) => {
   const { t } = useTranslation()
   const router = useRouter()
   const pathname = usePathname()
+  const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
   const { isLoadingCurrentWorkspace, isLoadingWorkspacePermissionKeys, currentWorkspace, userProfile, workspacePermissionKeys } = useAppContext()
+  const isRbacEnabled = systemFeatures.rbac_enabled
   const { appDetail, setAppDetail } = useStore(useShallow(state => ({
     appDetail: state.appDetail,
     setAppDetail: state.setAppDetail,
@@ -95,6 +99,7 @@ const AppDetailLayout: FC<IAppDetailLayoutProps> = (props) => {
       currentUserId: userProfile?.id,
       resourceMaintainer: routeAppDetail.maintainer,
       workspacePermissionKeys,
+      isRbacEnabled,
     })
     const isLayoutPath = pathname.endsWith('configuration') || pathname.endsWith('workflow')
     const isLogsPath = pathname.endsWith('logs')
@@ -112,6 +117,7 @@ const AppDetailLayout: FC<IAppDetailLayoutProps> = (props) => {
         currentUserId: userProfile?.id,
         resourceMaintainer: routeAppDetail.maintainer,
         workspacePermissionKeys,
+        isRbacEnabled,
       }))
       return
     }
@@ -125,7 +131,7 @@ const AppDetailLayout: FC<IAppDetailLayoutProps> = (props) => {
 
     if (appDetailRes && appDetail?.id !== appDetailRes.id)
       setAppDetail({ ...appDetailRes, enable_sso: false })
-  }, [appDetail?.id, appDetailRes, appId, currentWorkspace.id, isLoadingAppDetail, isLoadingCurrentWorkspace, isLoadingWorkspacePermissionKeys, pathname, routeAppDetail, router, setAppDetail, userProfile?.id, workspacePermissionKeys])
+  }, [appDetail?.id, appDetailRes, appId, currentWorkspace.id, isLoadingAppDetail, isLoadingCurrentWorkspace, isLoadingWorkspacePermissionKeys, isRbacEnabled, pathname, routeAppDetail, router, setAppDetail, userProfile?.id, workspacePermissionKeys])
 
   if (!appDetail) {
     return (
diff --git a/web/app/(commonLayout)/datasets/(datasetDetailLayout)/[datasetId]/__tests__/layout-main.spec.tsx b/web/app/(commonLayout)/datasets/(datasetDetailLayout)/[datasetId]/__tests__/layout-main.spec.tsx
index 23a9672a220..d669a675dac 100644
--- a/web/app/(commonLayout)/datasets/(datasetDetailLayout)/[datasetId]/__tests__/layout-main.spec.tsx
+++ b/web/app/(commonLayout)/datasets/(datasetDetailLayout)/[datasetId]/__tests__/layout-main.spec.tsx
@@ -1,10 +1,18 @@
-import { render, screen, waitFor } from '@testing-library/react'
+import { screen, waitFor } from '@testing-library/react'
+import { renderWithSystemFeatures } from '@/__tests__/utils/mock-system-features'
 import { usePathname, useRouter } from '@/next/navigation'
 import { useDatasetDetail } from '@/service/knowledge/use-dataset'
 import { DatasetACLPermission } from '@/utils/permission'
 import DatasetDetailLayout from '../layout-main'
 
 const mockReplace = vi.fn()
+let mockIsRbacEnabled = true
+
+const render = (ui: Parameters<typeof renderWithSystemFeatures>[0]) => renderWithSystemFeatures(ui, {
+  systemFeatures: {
+    rbac_enabled: mockIsRbacEnabled,
+  },
+})
 
 vi.mock('@/next/navigation', () => ({
   usePathname: vi.fn(),
@@ -42,6 +50,7 @@ const mockUseDatasetDetail = vi.mocked(useDatasetDetail)
 describe('DatasetDetailLayout', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockIsRbacEnabled = true
     mockUsePathname.mockReturnValue('/datasets/dataset-1/documents')
     mockUseRouter.mockReturnValue({
       back: vi.fn(),
@@ -292,5 +301,36 @@ describe('DatasetDetailLayout', () => {
       expect(screen.getByText('Access config content')).toBeInTheDocument()
       expect(mockReplace).not.toHaveBeenCalled()
     })
+
+    it('should redirect from access config when RBAC is disabled', async () => {
+      // Arrange
+      mockIsRbacEnabled = false
+      mockUsePathname.mockReturnValue('/datasets/dataset-1/access-config')
+      mockUseDatasetDetail.mockReturnValue({
+        data: {
+          id: 'dataset-1',
+          name: 'Dataset 1',
+          provider: 'vendor',
+          runtime_mode: 'general',
+          is_published: true,
+          permission_keys: [DatasetACLPermission.AccessConfig],
+        },
+        error: null,
+        refetch: vi.fn(),
+      } as unknown as ReturnType<typeof useDatasetDetail>)
+
+      // Act
+      render(
+        <DatasetDetailLayout datasetId="dataset-1">
+          <div>Access config content</div>
+        </DatasetDetailLayout>,
+      )
+
+      // Assert
+      await waitFor(() => {
+        expect(mockReplace).toHaveBeenCalledWith('/datasets/dataset-1/documents')
+      })
+      expect(screen.queryByText('Access config content')).not.toBeInTheDocument()
+    })
   })
 })
diff --git a/web/app/(commonLayout)/datasets/(datasetDetailLayout)/[datasetId]/layout-main.tsx b/web/app/(commonLayout)/datasets/(datasetDetailLayout)/[datasetId]/layout-main.tsx
index 3791009061d..a7df61c6c57 100644
--- a/web/app/(commonLayout)/datasets/(datasetDetailLayout)/[datasetId]/layout-main.tsx
+++ b/web/app/(commonLayout)/datasets/(datasetDetailLayout)/[datasetId]/layout-main.tsx
@@ -2,12 +2,14 @@
 import type { FC } from 'react'
 import type { DataSet } from '@/models/datasets'
 import { cn } from '@langgenius/dify-ui/cn'
+import { useSuspenseQuery } from '@tanstack/react-query'
 import * as React from 'react'
 import { useEffect } from 'react'
 import { useTranslation } from 'react-i18next'
 import Loading from '@/app/components/base/loading'
 import { useAppContext } from '@/context/app-context'
 import DatasetDetailContext from '@/context/dataset-detail'
+import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import useDocumentTitle from '@/hooks/use-document-title'
 import { usePathname, useRouter } from '@/next/navigation'
 import { useDatasetDetail } from '@/service/knowledge/use-dataset'
@@ -56,12 +58,14 @@ const DatasetDetailLayout: FC<IAppDetailLayoutProps> = (props) => {
   const { t } = useTranslation()
   const router = useRouter()
   const pathname = usePathname()
+  const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
   const {
     isLoadingCurrentWorkspace,
     isLoadingWorkspacePermissionKeys,
     userProfile,
     workspacePermissionKeys,
   } = useAppContext()
+  const isRbacEnabled = systemFeatures.rbac_enabled
 
   const { data: datasetRes, error, refetch: mutateDatasetRes } = useDatasetDetail(datasetId)
   const shouldRedirect = shouldRedirectToDatasetList(error)
@@ -69,7 +73,8 @@ const DatasetDetailLayout: FC<IAppDetailLayoutProps> = (props) => {
     currentUserId: userProfile?.id,
     resourceMaintainer: datasetRes?.maintainer,
     workspacePermissionKeys,
-  }), [datasetRes?.maintainer, datasetRes?.permission_keys, userProfile?.id, workspacePermissionKeys])
+    isRbacEnabled,
+  }), [datasetRes?.maintainer, datasetRes?.permission_keys, isRbacEnabled, userProfile?.id, workspacePermissionKeys])
   const isAccessConfigPath = pathname.endsWith('/access-config')
   const isHitTestingPath = pathname.endsWith('/hitTesting')
   const isPermissionControlledPath = isAccessConfigPath || isHitTestingPath
diff --git a/web/app/(commonLayout)/deployments/layout.tsx b/web/app/(commonLayout)/deployments/layout.tsx
index eb522444778..b8088169fd5 100644
--- a/web/app/(commonLayout)/deployments/layout.tsx
+++ b/web/app/(commonLayout)/deployments/layout.tsx
@@ -1,11 +1,13 @@
 import type { ReactNode } from 'react'
 import { DeployDrawer } from '@/features/deployments/deploy-drawer'
+import { DeploymentsRouteStateHydrator } from '@/features/deployments/route-state-hydrator'
 
 export default function DeploymentsLayout({ children }: {
   children: ReactNode
 }) {
   return (
     <>
+      <DeploymentsRouteStateHydrator />
       {children}
       <DeployDrawer />
     </>
diff --git a/web/app/components/app-sidebar/__tests__/app-detail-section.spec.tsx b/web/app/components/app-sidebar/__tests__/app-detail-section.spec.tsx
index 6dc9f5dfb19..8d83f6c7711 100644
--- a/web/app/components/app-sidebar/__tests__/app-detail-section.spec.tsx
+++ b/web/app/components/app-sidebar/__tests__/app-detail-section.spec.tsx
@@ -1,4 +1,5 @@
-import { render, screen } from '@testing-library/react'
+import { screen } from '@testing-library/react'
+import { renderWithSystemFeatures } from '@/__tests__/utils/mock-system-features'
 import { AppACLPermission } from '@/utils/permission'
 import AppDetailSection from '../app-detail-section'
 import { useAppInfoActions } from '../app-info/use-app-info-actions'
@@ -6,6 +7,13 @@ import { useAppInfoActions } from '../app-info/use-app-info-actions'
 let mockAppMode = 'chat'
 let mockPathname = '/app/app-1/logs'
 let mockAppPermissionKeys: string[] = []
+let mockIsRbacEnabled = true
+
+const render = (ui: Parameters<typeof renderWithSystemFeatures>[0]) => renderWithSystemFeatures(ui, {
+  systemFeatures: {
+    rbac_enabled: mockIsRbacEnabled,
+  },
+})
 
 vi.mock('@/app/components/app/store', () => ({
   useStore: (selector: (state: Record<string, unknown>) => unknown) => selector({
@@ -56,6 +64,7 @@ describe('AppDetailSection', () => {
     mockAppMode = 'chat'
     mockPathname = '/app/app-1/logs'
     mockAppPermissionKeys = [AppACLPermission.Monitor]
+    mockIsRbacEnabled = true
   })
 
   // Rendering behavior for app detail navigation entries.
@@ -203,6 +212,18 @@ describe('AppDetailSection', () => {
       expect(screen.queryByRole('link', { name: 'common.settings.resourceAccess' })).not.toBeInTheDocument()
     })
 
+    it('should hide resource access navigation when RBAC is disabled', () => {
+      // Arrange
+      mockIsRbacEnabled = false
+      mockAppPermissionKeys = [AppACLPermission.AccessConfig]
+
+      // Act
+      render(<AppDetailSection />)
+
+      // Assert
+      expect(screen.queryByRole('link', { name: 'common.settings.resourceAccess' })).not.toBeInTheDocument()
+    })
+
     it('should pass collapsed mode to app info and navigation links when collapsed', () => {
       // Act
       render(<AppDetailSection expand={false} />)
diff --git a/web/app/components/app-sidebar/__tests__/dataset-detail-section.spec.tsx b/web/app/components/app-sidebar/__tests__/dataset-detail-section.spec.tsx
index 25763fb11ae..2b19ee5043e 100644
--- a/web/app/components/app-sidebar/__tests__/dataset-detail-section.spec.tsx
+++ b/web/app/components/app-sidebar/__tests__/dataset-detail-section.spec.tsx
@@ -1,11 +1,19 @@
 import type { DataSet, RelatedAppResponse } from '@/models/datasets'
-import { render, screen } from '@testing-library/react'
+import { screen } from '@testing-library/react'
+import { renderWithSystemFeatures } from '@/__tests__/utils/mock-system-features'
 import { DatasetACLPermission } from '@/utils/permission'
 import DatasetDetailSection from '../dataset-detail-section'
 
 let mockPathname = '/datasets/dataset-1/documents'
 let mockDataset: DataSet | undefined
 let mockRelatedApps: RelatedAppResponse | undefined
+let mockIsRbacEnabled = true
+
+const render = (ui: Parameters<typeof renderWithSystemFeatures>[0]) => renderWithSystemFeatures(ui, {
+  systemFeatures: {
+    rbac_enabled: mockIsRbacEnabled,
+  },
+})
 
 vi.mock('@/next/navigation', () => ({
   usePathname: () => mockPathname,
@@ -77,6 +85,7 @@ describe('DatasetDetailSection', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mockPathname = '/datasets/dataset-1/documents'
+    mockIsRbacEnabled = true
     mockDataset = createDataset()
     mockRelatedApps = {
       data: [],
@@ -120,6 +129,17 @@ describe('DatasetDetailSection', () => {
     expect(screen.queryByRole('link', { name: 'common.settings.resourceAccess' })).not.toBeInTheDocument()
   })
 
+  it('should hide resource access navigation when RBAC is disabled', () => {
+    mockIsRbacEnabled = false
+    mockDataset = createDataset({
+      permission_keys: [DatasetACLPermission.AccessConfig],
+    })
+
+    render(<DatasetDetailSection expand />)
+
+    expect(screen.queryByRole('link', { name: 'common.settings.resourceAccess' })).not.toBeInTheDocument()
+  })
+
   it('should render hit testing navigation as a link when retrieval recall permission is granted', () => {
     mockDataset = createDataset({
       permission_keys: [DatasetACLPermission.RetrievalRecall],
diff --git a/web/app/components/app-sidebar/app-detail-section.tsx b/web/app/components/app-sidebar/app-detail-section.tsx
index 5df0a4ef573..15d963244cb 100644
--- a/web/app/components/app-sidebar/app-detail-section.tsx
+++ b/web/app/components/app-sidebar/app-detail-section.tsx
@@ -15,12 +15,14 @@ import {
   RiTerminalWindowFill,
   RiTerminalWindowLine,
 } from '@remixicon/react'
+import { useSuspenseQuery } from '@tanstack/react-query'
 import { Fragment, useMemo } from 'react'
 import { useTranslation } from 'react-i18next'
 import { useStore } from '@/app/components/app/store'
 import Divider from '@/app/components/base/divider'
 import Annotations from '@/app/components/base/icons/src/vender/Annotations'
 import { useAppContext } from '@/context/app-context'
+import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import { usePathname } from '@/next/navigation'
 import { AppModeEnum } from '@/types/app'
 import { getAppACLCapabilities } from '@/utils/permission'
@@ -71,7 +73,9 @@ const AppDetailSection = ({
 }: AppDetailSectionProps) => {
   const { t } = useTranslation()
   const pathname = usePathname()
+  const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
   const { userProfile, workspacePermissionKeys } = useAppContext()
+  const isRbacEnabled = systemFeatures.rbac_enabled
   const appDetail = useStore(state => state.appDetail)
   const appInfoActions = useAppInfoActions({
     resetKey: appDetail?.id,
@@ -88,6 +92,7 @@ const AppDetailSection = ({
       currentUserId: userProfile?.id,
       resourceMaintainer: appDetail.maintainer,
       workspacePermissionKeys,
+      isRbacEnabled,
     })
 
     return [
@@ -143,7 +148,7 @@ const AppDetailSection = ({
         : []
       ),
     ]
-  }, [appDetail, t, userProfile?.id, workspacePermissionKeys])
+  }, [appDetail, t, userProfile?.id, workspacePermissionKeys, isRbacEnabled])
 
   if (!appDetail)
     return null
diff --git a/web/app/components/app-sidebar/app-info/__tests__/use-app-info-actions.spec.ts b/web/app/components/app-sidebar/app-info/__tests__/use-app-info-actions.spec.ts
index 898b8c55a74..8f417ee7ce4 100644
--- a/web/app/components/app-sidebar/app-info/__tests__/use-app-info-actions.spec.ts
+++ b/web/app/components/app-sidebar/app-info/__tests__/use-app-info-actions.spec.ts
@@ -69,6 +69,10 @@ vi.mock('@/service/use-apps', () => ({
 }))
 
 vi.mock('@tanstack/react-query', () => ({
+  queryOptions: <TOptions>(options: TOptions) => options,
+  useSuspenseQuery: () => ({
+    data: { rbac_enabled: true },
+  }),
   useQueryClient: () => ({
     setQueryData: mockSetQueryData,
   }),
diff --git a/web/app/components/app-sidebar/app-info/use-app-info-actions.ts b/web/app/components/app-sidebar/app-info/use-app-info-actions.ts
index 89688a4882f..24931418733 100644
--- a/web/app/components/app-sidebar/app-info/use-app-info-actions.ts
+++ b/web/app/components/app-sidebar/app-info/use-app-info-actions.ts
@@ -3,12 +3,13 @@ import type { DuplicateAppModalProps } from '@/app/components/app/duplicate-moda
 import type { CreateAppModalProps } from '@/app/components/explore/create-app-modal'
 import type { EnvironmentVariable } from '@/app/components/workflow/types'
 import { toast } from '@langgenius/dify-ui/toast'
-import { useQueryClient } from '@tanstack/react-query'
+import { useQueryClient, useSuspenseQuery } from '@tanstack/react-query'
 import { useCallback, useEffect, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import { useStore as useAppStore } from '@/app/components/app/store'
 import { useSetNeedRefreshAppList } from '@/app/components/apps/storage'
 import { useProviderContext } from '@/context/provider-context'
+import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import { useRouter } from '@/next/navigation'
 import { copyApp, deleteApp, exportAppConfig, fetchAppDetail, updateAppInfo } from '@/service/apps'
 import { appDetailQueryKeyPrefix, useInvalidateAppList } from '@/service/use-apps'
@@ -58,6 +59,8 @@ export function useAppInfoActions({ onDetailExpand, resetKey }: UseAppInfoAction
   const appDetail = useAppStore(state => state.appDetail)
   const setAppDetail = useAppStore(state => state.setAppDetail)
   const invalidateAppList = useInvalidateAppList()
+  const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
+  const isRbacEnabled = systemFeatures.rbac_enabled
 
   const [uiState, setUiState] = useState(() => createInitialUiState(resetKey))
   const uiStateMatchesResetKey = uiState.resetKey === resetKey
@@ -216,12 +219,12 @@ export function useAppInfoActions({ onDetailExpand, resetKey }: UseAppInfoAction
       toast(t('newApp.appCreated', { ns: 'app' }), { type: 'success' })
       setNeedRefresh('1')
       onPlanInfoChanged()
-      getRedirection(newApp, replace)
+      getRedirection(newApp, replace, { isRbacEnabled })
     }
     catch {
       toast(t('newApp.appCreateFailed', { ns: 'app' }), { type: 'error' })
     }
-  }, [appDetail, closeModal, onPlanInfoChanged, replace, setNeedRefresh, t])
+  }, [appDetail, closeModal, isRbacEnabled, onPlanInfoChanged, replace, setNeedRefresh, t])
 
   const onExport = useCallback(async (include = false) => {
     if (!appDetail)
diff --git a/web/app/components/app-sidebar/dataset-detail-section.tsx b/web/app/components/app-sidebar/dataset-detail-section.tsx
index f337c6b15aa..4c57f9eb51a 100644
--- a/web/app/components/app-sidebar/dataset-detail-section.tsx
+++ b/web/app/components/app-sidebar/dataset-detail-section.tsx
@@ -12,6 +12,7 @@ import {
   RiLock2Fill,
   RiLock2Line,
 } from '@remixicon/react'
+import { useSuspenseQuery } from '@tanstack/react-query'
 import { useMemo } from 'react'
 import { useTranslation } from 'react-i18next'
 import Divider from '@/app/components/base/divider'
@@ -19,6 +20,7 @@ import { PipelineFill, PipelineLine } from '@/app/components/base/icons/src/vend
 import ExtraInfo from '@/app/components/datasets/extra-info'
 import { useAppContext } from '@/context/app-context'
 import DatasetDetailContext from '@/context/dataset-detail'
+import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import { usePathname } from '@/next/navigation'
 import { useDatasetDetail, useDatasetRelatedApps } from '@/service/knowledge/use-dataset'
 import { getDatasetACLCapabilities } from '@/utils/permission'
@@ -40,14 +42,17 @@ const DatasetDetailSection = ({
   const { t } = useTranslation()
   const pathname = usePathname()
   const datasetId = getDatasetIdFromPathname(pathname)
+  const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
   const { userProfile, workspacePermissionKeys } = useAppContext()
+  const isRbacEnabled = systemFeatures.rbac_enabled
   const { data: datasetRes, refetch: mutateDatasetRes } = useDatasetDetail(datasetId ?? '')
   const { data: relatedApps } = useDatasetRelatedApps(datasetId ?? '', { enabled: !!datasetId && !!datasetRes })
   const datasetACLCapabilities = useMemo(() => getDatasetACLCapabilities(datasetRes?.permission_keys, {
     currentUserId: userProfile?.id,
     resourceMaintainer: datasetRes?.maintainer,
     workspacePermissionKeys,
-  }), [datasetRes?.maintainer, datasetRes?.permission_keys, userProfile?.id, workspacePermissionKeys])
+    isRbacEnabled,
+  }), [datasetRes?.maintainer, datasetRes?.permission_keys, isRbacEnabled, userProfile?.id, workspacePermissionKeys])
 
   const isButtonDisabledWithPipeline = useMemo(() => {
     if (!datasetRes)
diff --git a/web/app/components/app-sidebar/dataset-info/__tests__/dropdown-callbacks.spec.tsx b/web/app/components/app-sidebar/dataset-info/__tests__/dropdown-callbacks.spec.tsx
index e1bfb008a71..6155445befb 100644
--- a/web/app/components/app-sidebar/dataset-info/__tests__/dropdown-callbacks.spec.tsx
+++ b/web/app/components/app-sidebar/dataset-info/__tests__/dropdown-callbacks.spec.tsx
@@ -1,7 +1,8 @@
 import type { DataSet } from '@/models/datasets'
-import { render, screen, waitFor } from '@testing-library/react'
+import { screen, waitFor } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import * as React from 'react'
+import { renderWithSystemFeatures } from '@/__tests__/utils/mock-system-features'
 import {
   ChunkingMode,
   DatasetPermission,
@@ -19,6 +20,13 @@ const mockExportPipeline = vi.fn()
 const mockCheckIsUsedInApp = vi.fn()
 const mockDeleteDataset = vi.fn()
 const mockToast = vi.fn()
+let mockIsRbacEnabled = true
+
+const render = (ui: Parameters<typeof renderWithSystemFeatures>[0]) => renderWithSystemFeatures(ui, {
+  systemFeatures: {
+    rbac_enabled: mockIsRbacEnabled,
+  },
+})
 
 const createDataset = (overrides: Partial<DataSet> = {}): DataSet => ({
   id: 'dataset-1',
@@ -94,6 +102,13 @@ vi.mock('@/context/dataset-detail', () => ({
   useDatasetDetailContextWithSelector: (selector: (state: { dataset?: DataSet }) => unknown) => selector({ dataset: mockDataset }),
 }))
 
+vi.mock('@/context/app-context', () => ({
+  useSelector: (selector: (state: { userProfile: { id: string }, workspacePermissionKeys: string[] }) => unknown) => selector({
+    userProfile: { id: 'user-1' },
+    workspacePermissionKeys: [],
+  }),
+}))
+
 vi.mock('@/service/knowledge/use-dataset', () => ({
   datasetDetailQueryKeyPrefix: ['dataset', 'detail'],
   useInvalidDatasetList: () => mockInvalidDatasetList,
@@ -142,6 +157,7 @@ vi.mock('@/app/components/datasets/rename-modal', () => ({
 describe('Dropdown callback coverage', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockIsRbacEnabled = true
     mockDataset = createDataset({ pipeline_id: 'pipeline-1', runtime_mode: 'rag_pipeline' })
     mockExportPipeline.mockResolvedValue({ data: 'pipeline-content' })
     mockCheckIsUsedInApp.mockResolvedValue({ is_using: false })
diff --git a/web/app/components/app-sidebar/dataset-info/__tests__/index.spec.tsx b/web/app/components/app-sidebar/dataset-info/__tests__/index.spec.tsx
index 63e05435c99..a12e7348675 100644
--- a/web/app/components/app-sidebar/dataset-info/__tests__/index.spec.tsx
+++ b/web/app/components/app-sidebar/dataset-info/__tests__/index.spec.tsx
@@ -1,7 +1,8 @@
 import type { DataSet } from '@/models/datasets'
-import { createEvent, fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { createEvent, fireEvent, screen, waitFor } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import * as React from 'react'
+import { renderWithSystemFeatures } from '@/__tests__/utils/mock-system-features'
 import {
   ChunkingMode,
   DatasetPermission,
@@ -23,6 +24,13 @@ const mockExportPipeline = vi.fn()
 const mockCheckIsUsedInApp = vi.fn()
 const mockDeleteDataset = vi.fn()
 const TestEditIcon = () => <span aria-hidden className="i-ri-edit-line" />
+let mockIsRbacEnabled = true
+
+const render = (ui: Parameters<typeof renderWithSystemFeatures>[0]) => renderWithSystemFeatures(ui, {
+  systemFeatures: {
+    rbac_enabled: mockIsRbacEnabled,
+  },
+})
 
 const createDataset = (overrides: Partial<DataSet> = {}): DataSet => ({
   id: 'dataset-1',
@@ -107,6 +115,13 @@ vi.mock('@/context/dataset-detail', () => ({
   useDatasetDetailContextWithSelector: (selector: (state: { dataset?: DataSet }) => unknown) => selector({ dataset: mockDataset }),
 }))
 
+vi.mock('@/context/app-context', () => ({
+  useSelector: (selector: (state: { userProfile: { id: string }, workspacePermissionKeys: string[] }) => unknown) => selector({
+    userProfile: { id: 'user-1' },
+    workspacePermissionKeys: [],
+  }),
+}))
+
 vi.mock('@/service/knowledge/use-dataset', () => ({
   datasetDetailQueryKeyPrefix: ['dataset', 'detail'],
   useInvalidDatasetList: () => mockInvalidDatasetList,
@@ -162,6 +177,7 @@ const openMenu = async (user: ReturnType<typeof userEvent.setup>) => {
 describe('DatasetInfo', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockIsRbacEnabled = true
     mockDataset = createDataset()
   })
 
@@ -374,6 +390,7 @@ describe('Dropdown', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mockDataset = createDataset({ pipeline_id: 'pipeline-1', runtime_mode: 'rag_pipeline' })
+    mockIsRbacEnabled = true
     mockExportPipeline.mockResolvedValue({ data: 'pipeline-content' })
     mockCheckIsUsedInApp.mockResolvedValue({ is_using: false })
     mockDeleteDataset.mockResolvedValue({})
@@ -430,6 +447,24 @@ describe('Dropdown', () => {
       expect(screen.queryByText('common.operation.edit')).not.toBeInTheDocument()
       expect(screen.queryByText('common.operation.delete')).not.toBeInTheDocument()
     })
+
+    it('should hide resource access option when RBAC is disabled', async () => {
+      const user = userEvent.setup()
+      // Arrange
+      mockIsRbacEnabled = false
+      mockDataset = createDataset({
+        runtime_mode: 'general',
+        permission_keys: [DatasetACLPermission.AccessConfig, DatasetACLPermission.Delete],
+      })
+      render(<Dropdown expand />)
+
+      // Act
+      await openMenu(user)
+
+      // Assert
+      expect(screen.getByText('common.operation.delete')).toBeInTheDocument()
+      expect(screen.queryByText('common.settings.resourceAccess')).not.toBeInTheDocument()
+    })
   })
 
   // User interactions that trigger modals and exports.
diff --git a/web/app/components/app-sidebar/dataset-info/dropdown.tsx b/web/app/components/app-sidebar/dataset-info/dropdown.tsx
index 6539e6e1715..51c433d5f0a 100644
--- a/web/app/components/app-sidebar/dataset-info/dropdown.tsx
+++ b/web/app/components/app-sidebar/dataset-info/dropdown.tsx
@@ -15,11 +15,13 @@ import {
   DropdownMenuTrigger,
 } from '@langgenius/dify-ui/dropdown-menu'
 import { toast } from '@langgenius/dify-ui/toast'
+import { useSuspenseQuery } from '@tanstack/react-query'
 import * as React from 'react'
 import { useCallback, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { useDatasetDetailContextWithSelector } from '@/context/dataset-detail'
+import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import { useRouter } from '@/next/navigation'
 import { checkIsUsedInApp, deleteDataset } from '@/service/datasets'
 import { datasetDetailQueryKeyPrefix, useInvalidDatasetList } from '@/service/knowledge/use-dataset'
@@ -69,11 +71,14 @@ const DropDown = ({
   const dataset = useDatasetDetailContextWithSelector(state => state.dataset) as DataSet
   const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
   const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
+  const isRbacEnabled = systemFeatures.rbac_enabled
   const datasetACLCapabilities = React.useMemo(() => getDatasetACLCapabilities(dataset?.permission_keys, {
     currentUserId,
     resourceMaintainer: dataset?.maintainer,
     workspacePermissionKeys,
-  }), [dataset?.maintainer, dataset?.permission_keys, currentUserId, workspacePermissionKeys])
+    isRbacEnabled,
+  }), [dataset?.maintainer, dataset?.permission_keys, currentUserId, isRbacEnabled, workspacePermissionKeys])
   const canShowOperations = datasetACLCapabilities.canEdit
     || datasetACLCapabilities.canImportExportDSL
     || datasetACLCapabilities.canAccessConfig
diff --git a/web/app/components/app/access-config/__tests__/index.spec.tsx b/web/app/components/app/access-config/__tests__/index.spec.tsx
index 49e8c86825d..63909979344 100644
--- a/web/app/components/app/access-config/__tests__/index.spec.tsx
+++ b/web/app/components/app/access-config/__tests__/index.spec.tsx
@@ -1,5 +1,6 @@
 import type { AccessRulesEditorProps } from '@/app/components/access-rules-editor'
-import { render, screen } from '@testing-library/react'
+import { screen } from '@testing-library/react'
+import { renderWithSystemFeatures } from '@/__tests__/utils/mock-system-features'
 import { useStore } from '@/app/components/app/store'
 import {
   useAppAccessRules,
@@ -13,6 +14,14 @@ const mockAppContext = vi.hoisted(() => ({
   workspacePermissionKeys: [] as string[],
 }))
 
+let mockIsRbacEnabled = true
+
+const render = (ui: Parameters<typeof renderWithSystemFeatures>[0]) => renderWithSystemFeatures(ui, {
+  systemFeatures: {
+    rbac_enabled: mockIsRbacEnabled,
+  },
+})
+
 const mockAppAccessRules = vi.hoisted(() => ({
   items: [] as AccessRulesEditorProps['rules'],
   isLoading: false,
@@ -75,6 +84,7 @@ describe('AppAccessConfigPage', () => {
     vi.clearAllMocks()
     mockAppContext.userProfile = { id: 'user-1' }
     mockAppContext.workspacePermissionKeys = []
+    mockIsRbacEnabled = true
     mockAppAccessRules.items = []
     mockAppAccessRules.isLoading = false
     mockAppUserAccessSettings.data = []
@@ -195,6 +205,16 @@ describe('AppAccessConfigPage', () => {
       expect(useAppUserAccessSettings).not.toHaveBeenCalled()
     })
 
+    it('should not mount access config data hooks when RBAC is disabled', () => {
+      mockIsRbacEnabled = false
+
+      render(<AppAccessConfigPage appId="app-1" />)
+
+      expect(screen.queryByTestId('access-rules-editor')).not.toBeInTheDocument()
+      expect(useAppAccessRules).not.toHaveBeenCalled()
+      expect(useAppUserAccessSettings).not.toHaveBeenCalled()
+    })
+
     it('should allow the app maintainer with app management workspace permission', () => {
       mockAppContext.userProfile = { id: 'account-1' }
       mockAppContext.workspacePermissionKeys = ['app.create_and_management']
diff --git a/web/app/components/app/access-config/index.tsx b/web/app/components/app/access-config/index.tsx
index 9704540bbd7..6efc718012c 100644
--- a/web/app/components/app/access-config/index.tsx
+++ b/web/app/components/app/access-config/index.tsx
@@ -2,12 +2,14 @@
 
 import type { ResourceOpenScope } from '@/models/access-control'
 import { ScrollArea } from '@langgenius/dify-ui/scroll-area'
+import { useSuspenseQuery } from '@tanstack/react-query'
 import { useCallback, useMemo, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import AccessRulesEditor from '@/app/components/access-rules-editor'
 import { useStore } from '@/app/components/app/store'
 import { useAppContext } from '@/context/app-context'
 import { useLocale } from '@/context/i18n'
+import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import { getAccessControlTemplateLanguage } from '@/i18n-config/language'
 import {
   useAppAccessRules,
@@ -103,13 +105,16 @@ const AppAccessConfigContent = ({ appId, maintainerId }: AppAccessConfigContentP
 }
 
 const AppAccessConfigPage = ({ appId }: AppAccessConfigPageProps) => {
+  const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
   const { userProfile, workspacePermissionKeys } = useAppContext()
+  const isRbacEnabled = systemFeatures.rbac_enabled
   const appDetail = useStore(state => state.appDetail)
   const appACLCapabilities = useMemo(() => getAppACLCapabilities(appDetail?.permission_keys, {
     currentUserId: userProfile?.id,
     resourceMaintainer: appDetail?.maintainer,
     workspacePermissionKeys,
-  }), [appDetail?.maintainer, appDetail?.permission_keys, userProfile?.id, workspacePermissionKeys])
+    isRbacEnabled,
+  }), [appDetail?.maintainer, appDetail?.permission_keys, isRbacEnabled, userProfile?.id, workspacePermissionKeys])
 
   if (!appDetail || appDetail.id !== appId || !appACLCapabilities.canAccessConfig)
     return null
diff --git a/web/app/components/app/app-publisher/__tests__/index.spec.tsx b/web/app/components/app/app-publisher/__tests__/index.spec.tsx
index f5b800ee40b..0fe3770645b 100644
--- a/web/app/components/app/app-publisher/__tests__/index.spec.tsx
+++ b/web/app/components/app/app-publisher/__tests__/index.spec.tsx
@@ -30,6 +30,7 @@ const sectionProps = vi.hoisted(() => ({
   actions: null as null | Record<string, any>,
 }))
 const hotkeyMocks = vi.hoisted(() => ({
+  hotkeys: [] as string[],
   handlers: [] as Array<(event: { preventDefault: () => void }) => void>,
 }))
 
@@ -44,7 +45,8 @@ vi.mock('react-i18next', () => ({
 }))
 
 vi.mock('@tanstack/react-hotkeys', () => ({
-  useHotkey: (_hotkey: string, handler: (event: { preventDefault: () => void }) => void) => {
+  useHotkey: (hotkey: string, handler: (event: { preventDefault: () => void }) => void) => {
+    hotkeyMocks.hotkeys.push(hotkey)
     hotkeyMocks.handlers.push(handler)
   },
 }))
@@ -190,6 +192,7 @@ vi.mock('../sections', () => ({
 describe('AppPublisher', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    hotkeyMocks.hotkeys.length = 0
     hotkeyMocks.handlers.length = 0
     sectionProps.summary = null
     sectionProps.access = null
@@ -240,6 +243,7 @@ describe('AppPublisher', () => {
         enabled: true,
       })
     })
+    expect(sectionProps.summary?.publishShortcut).toEqual(['Mod', 'Shift', 'P'])
     expect(mockRefetch).not.toHaveBeenCalled()
   })
 
@@ -477,6 +481,7 @@ describe('AppPublisher', () => {
       />,
     )
 
+    expect(hotkeyMocks.hotkeys).toContain('Mod+Shift+P')
     hotkeyMocks.handlers[0]!({ preventDefault })
 
     await waitFor(() => {
diff --git a/web/app/components/app/app-publisher/index.tsx b/web/app/components/app/app-publisher/index.tsx
index f3e65682a8f..e0713ecdd74 100644
--- a/web/app/components/app/app-publisher/index.tsx
+++ b/web/app/components/app/app-publisher/index.tsx
@@ -1,3 +1,4 @@
+import type { RegisterableHotkey } from '@tanstack/react-hotkeys'
 import type { FormEvent } from 'react'
 import type { ModelAndParameter } from '../configuration/debug/types'
 import type { WorkflowHiddenStartVariable, WorkflowLaunchInputValue } from '@/app/components/app/overview/app-card-utils'
@@ -82,7 +83,8 @@ export type AppPublisherProps = {
   hasHumanInputNode?: boolean
 }
 
-const PUBLISH_SHORTCUT = ['ctrl', '⇧', 'P']
+const PUBLISH_HOTKEY = 'Mod+Shift+P' satisfies RegisterableHotkey
+const PUBLISH_SHORTCUT = PUBLISH_HOTKEY.split('+')
 
 export type AppPublisherPublishParams = ModelAndParameter | PublishWorkflowParams
 
@@ -290,7 +292,7 @@ export function AppPublisher({
     }
   }
 
-  useHotkey('Mod+Shift+P', (e) => {
+  useHotkey(PUBLISH_HOTKEY, (e) => {
     e.preventDefault()
     if (publishDisabled || published)
       return
diff --git a/web/app/components/app/create-app-dialog/app-list/__tests__/index.spec.tsx b/web/app/components/app/create-app-dialog/app-list/__tests__/index.spec.tsx
index 72e3ff2c19a..ada0afe17fa 100644
--- a/web/app/components/app/create-app-dialog/app-list/__tests__/index.spec.tsx
+++ b/web/app/components/app/create-app-dialog/app-list/__tests__/index.spec.tsx
@@ -1,4 +1,5 @@
-import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { fireEvent, screen, waitFor } from '@testing-library/react'
+import { renderWithSystemFeatures as render } from '@/__tests__/utils/mock-system-features'
 import { NEED_REFRESH_APP_LIST_KEY } from '@/app/components/apps/storage'
 import { AppModeEnum } from '@/types/app'
 import Apps from '../index'
@@ -295,7 +296,7 @@ describe('Apps', () => {
       id: 'created-app-id',
       mode: AppModeEnum.CHAT,
       permission_keys: ['app.acl.view_layout'],
-    }, mockPush)
+    }, mockPush, { isRbacEnabled: false })
   })
 
   it('shows an error toast when importing the template fails', async () => {
diff --git a/web/app/components/app/create-app-dialog/app-list/index.tsx b/web/app/components/app/create-app-dialog/app-list/index.tsx
index 04e759575b9..c97b8b5fcb5 100644
--- a/web/app/components/app/create-app-dialog/app-list/index.tsx
+++ b/web/app/components/app/create-app-dialog/app-list/index.tsx
@@ -5,6 +5,7 @@ import type { App } from '@/models/explore'
 import { cn } from '@langgenius/dify-ui/cn'
 import { toast } from '@langgenius/dify-ui/toast'
 import { RiRobot2Line } from '@remixicon/react'
+import { useSuspenseQuery } from '@tanstack/react-query'
 import { useDebounceFn } from 'ahooks'
 import * as React from 'react'
 import { useMemo, useState } from 'react'
@@ -17,6 +18,7 @@ import Loading from '@/app/components/base/loading'
 import CreateAppModal from '@/app/components/explore/create-app-modal'
 import { usePluginDependencies } from '@/app/components/workflow/plugin-dependency/hooks'
 import { useAppContext } from '@/context/app-context'
+import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import { DSLImportMode } from '@/models/app'
 import { useRouter } from '@/next/navigation'
 import { importDSL } from '@/service/apps'
@@ -45,7 +47,9 @@ const Apps = ({
   onCreateFromBlank,
 }: AppsProps) => {
   const { t } = useTranslation()
+  const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
   const { workspacePermissionKeys } = useAppContext()
+  const isRbacEnabled = systemFeatures.rbac_enabled
   const canCreateAppFromTemplate = hasPermission(workspacePermissionKeys, 'app.create_and_management')
   const { push } = useRouter()
   const invalidateAppList = useInvalidateAppList()
@@ -144,7 +148,7 @@ const Apps = ({
       setNeedRefresh('1')
       invalidateAppList()
       if (app.app_id)
-        getRedirection({ id: app.app_id, mode: app.app_mode, permission_keys: app.permission_keys }, push)
+        getRedirection({ id: app.app_id, mode: app.app_mode, permission_keys: app.permission_keys }, push, { isRbacEnabled })
     }
     catch {
       toast.error(t('newApp.appCreateFailed', { ns: 'app' }))
diff --git a/web/app/components/app/create-app-modal/__tests__/index.spec.tsx b/web/app/components/app/create-app-modal/__tests__/index.spec.tsx
index 47c8fb5c46c..d583dadedda 100644
--- a/web/app/components/app/create-app-modal/__tests__/index.spec.tsx
+++ b/web/app/components/app/create-app-modal/__tests__/index.spec.tsx
@@ -1,7 +1,8 @@
 import type { App } from '@/types/app'
-import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { fireEvent, screen, waitFor } from '@testing-library/react'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
+import { renderWithSystemFeatures as render } from '@/__tests__/utils/mock-system-features'
 import { NEED_REFRESH_APP_LIST_KEY } from '@/app/components/apps/storage'
 import { useAppContext } from '@/context/app-context'
 import { useProviderContext } from '@/context/provider-context'
@@ -177,6 +178,7 @@ describe('CreateAppModal', () => {
         currentUserId: 'user-1',
         resourceMaintainer: 'user-1',
         workspacePermissionKeys: ['app.create_and_management'],
+        isRbacEnabled: false,
       }),
     )
   })
diff --git a/web/app/components/app/create-app-modal/index.tsx b/web/app/components/app/create-app-modal/index.tsx
index ce3f11f24c3..a53f07d5b12 100644
--- a/web/app/components/app/create-app-modal/index.tsx
+++ b/web/app/components/app/create-app-modal/index.tsx
@@ -9,6 +9,7 @@ import { Textarea } from '@langgenius/dify-ui/textarea'
 import { toast } from '@langgenius/dify-ui/toast'
 import { RiArrowRightLine, RiArrowRightSLine, RiExchange2Fill } from '@remixicon/react'
 import { formatForDisplay, useHotkey } from '@tanstack/react-hotkeys'
+import { useSuspenseQuery } from '@tanstack/react-query'
 import { useDebounceFn } from 'ahooks'
 import { useCallback, useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
@@ -20,6 +21,7 @@ import Input from '@/app/components/base/input'
 import AppsFull from '@/app/components/billing/apps-full-in-dialog'
 import { useAppContext } from '@/context/app-context'
 import { useProviderContext } from '@/context/provider-context'
+import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import useTheme from '@/hooks/use-theme'
 import { useRouter } from '@/next/navigation'
 import { createApp } from '@/service/apps'
@@ -56,7 +58,9 @@ function CreateApp({ onClose, onSuccess, onCreateFromTemplate, defaultAppMode }:
 
   const { plan, enableBilling } = useProviderContext()
   const isAppsFull = (enableBilling && plan.usage.buildApps >= plan.total.buildApps)
+  const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
   const { userProfile, workspacePermissionKeys } = useAppContext()
+  const isRbacEnabled = systemFeatures.rbac_enabled
   const canCreateApp = hasPermission(workspacePermissionKeys, 'app.create_and_management')
   const invalidateAppList = useInvalidateAppList()
 
@@ -100,13 +104,14 @@ function CreateApp({ onClose, onSuccess, onCreateFromTemplate, defaultAppMode }:
         currentUserId: userProfile?.id,
         resourceMaintainer: app.maintainer,
         workspacePermissionKeys,
+        isRbacEnabled,
       })
     }
     catch (error) {
       toast.error(error instanceof Error ? error.message : t('newApp.appCreateFailed', { ns: 'app' }))
     }
     isCreatingRef.current = false
-  }, [canCreateApp, name, t, appMode, appIcon, description, onSuccess, onClose, push, userProfile?.id, workspacePermissionKeys, setNeedRefresh, invalidateAppList])
+  }, [canCreateApp, name, t, appMode, appIcon, description, onSuccess, onClose, push, userProfile?.id, workspacePermissionKeys, isRbacEnabled, setNeedRefresh, invalidateAppList])
 
   const { run: handleCreateApp } = useDebounceFn(onCreate, { wait: 300 })
   useHotkey('Mod+Enter', () => {
diff --git a/web/app/components/app/create-from-dsl-modal/__tests__/index.spec.tsx b/web/app/components/app/create-from-dsl-modal/__tests__/index.spec.tsx
index 45bb635edcb..fb58e964b75 100644
--- a/web/app/components/app/create-from-dsl-modal/__tests__/index.spec.tsx
+++ b/web/app/components/app/create-from-dsl-modal/__tests__/index.spec.tsx
@@ -2,10 +2,10 @@
 import {
   act,
   fireEvent,
-  render,
   screen,
   waitFor,
 } from '@testing-library/react'
+import { renderWithSystemFeatures as render } from '@/__tests__/utils/mock-system-features'
 import { NEED_REFRESH_APP_LIST_KEY } from '@/app/components/apps/storage'
 import { DSLImportMode, DSLImportStatus } from '@/models/app'
 import { AppModeEnum } from '@/types/app'
@@ -247,6 +247,7 @@ describe('CreateFromDSLModal', () => {
     expect(mockGetRedirection).toHaveBeenCalledWith(
       { id: 'app-1', mode: 'chat', permission_keys: ['app.acl.view_layout'] },
       mockPush,
+      { isRbacEnabled: false },
     )
   })
 
diff --git a/web/app/components/app/create-from-dsl-modal/index.tsx b/web/app/components/app/create-from-dsl-modal/index.tsx
index c44e6f3769c..8414b7c6f4f 100644
--- a/web/app/components/app/create-from-dsl-modal/index.tsx
+++ b/web/app/components/app/create-from-dsl-modal/index.tsx
@@ -7,6 +7,7 @@ import { Dialog, DialogContent } from '@langgenius/dify-ui/dialog'
 import { Kbd, KbdGroup } from '@langgenius/dify-ui/kbd'
 import { toast } from '@langgenius/dify-ui/toast'
 import { formatForDisplay, useHotkey } from '@tanstack/react-hotkeys'
+import { useSuspenseQuery } from '@tanstack/react-query'
 import { useDebounceFn } from 'ahooks'
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
@@ -15,6 +16,7 @@ import Input from '@/app/components/base/input'
 import AppsFull from '@/app/components/billing/apps-full-in-dialog'
 import { usePluginDependencies } from '@/app/components/workflow/plugin-dependency/hooks'
 import { useProviderContext } from '@/context/provider-context'
+import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import {
   DSLImportMode,
   DSLImportStatus,
@@ -55,6 +57,8 @@ const CreateFromDSLModal = ({ show, onSuccess, onClose, activeTab = CreateFromDS
   const [importId, setImportId] = useState<string>()
   const { handleCheckPluginDependencies } = usePluginDependencies()
   const setNeedRefresh = useSetNeedRefreshAppList()
+  const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
+  const isRbacEnabled = systemFeatures.rbac_enabled
 
   const readFile = useCallback((file: File) => {
     const reader = new FileReader()
@@ -129,7 +133,7 @@ const CreateFromDSLModal = ({ show, onSuccess, onClose, activeTab = CreateFromDS
         invalidateAppList()
         if (app_id) {
           await handleCheckPluginDependencies(app_id)
-          getRedirection({ id: app_id, mode: app_mode, permission_keys }, push)
+          getRedirection({ id: app_id, mode: app_mode, permission_keys }, push, { isRbacEnabled })
         }
       }
       else if (status === DSLImportStatus.PENDING) {
@@ -184,7 +188,7 @@ const CreateFromDSLModal = ({ show, onSuccess, onClose, activeTab = CreateFromDS
         setNeedRefresh('1')
         invalidateAppList()
         if (app_id)
-          getRedirection({ id: app_id, mode: app_mode, permission_keys }, push)
+          getRedirection({ id: app_id, mode: app_mode, permission_keys }, push, { isRbacEnabled })
       }
       else if (status === DSLImportStatus.FAILED) {
         toast.error(response.error || t('newApp.appCreateFailed', { ns: 'app' }))
diff --git a/web/app/components/app/in-site-message/__tests__/index.spec.tsx b/web/app/components/app/in-site-message/__tests__/index.spec.tsx
index e4b54e82159..2c13ea9cbf5 100644
--- a/web/app/components/app/in-site-message/__tests__/index.spec.tsx
+++ b/web/app/components/app/in-site-message/__tests__/index.spec.tsx
@@ -42,12 +42,14 @@ describe('InSiteMessage', () => {
     it('should render title, subtitle, markdown content, and action buttons', () => {
       const actions: InSiteMessageActionItem[] = [
         { action: 'close', action_name: 'dismiss', text: 'Close', type: 'default' },
+        { action: 'close', action_name: 'outline', text: 'Outline', type: 'outline' },
         { action: 'link', action_name: 'learn_more', text: 'Learn more', type: 'primary', data: 'https://example.com' },
       ]
 
       renderComponent(actions, { className: 'custom-message' })
 
       const closeButton = screen.getByRole('button', { name: 'Close' })
+      const outlineButton = screen.getByRole('button', { name: 'Outline' })
       const learnMoreButton = screen.getByRole('button', { name: 'Learn more' })
       const panel = closeButton.closest('div.fixed')
       const titleElement = panel?.querySelector('.title-3xl-bold')
@@ -59,6 +61,7 @@ describe('InSiteMessage', () => {
       expect(subtitleElement?.textContent).not.toContain('\\n')
       expect(screen.getByText('Main content')).toBeInTheDocument()
       expect(closeButton).toBeInTheDocument()
+      expect(outlineButton).toHaveClass('bg-components-button-secondary-bg')
       expect(learnMoreButton).toBeInTheDocument()
     })
 
diff --git a/web/app/components/app/in-site-message/__tests__/notification.spec.tsx b/web/app/components/app/in-site-message/__tests__/notification.spec.tsx
index f5171a57c5b..0af00256789 100644
--- a/web/app/components/app/in-site-message/__tests__/notification.spec.tsx
+++ b/web/app/components/app/in-site-message/__tests__/notification.spec.tsx
@@ -116,6 +116,7 @@ describe('InSiteMessageNotification', () => {
               main: 'Parsed body main',
               actions: [
                 { action: 'link', data: 'https://example.com/docs', text: 'Visit docs', type: 'primary' },
+                { action: 'close', text: 'Outline close', type: 'outline' },
                 { action: 'close', text: 'Dismiss now', type: 'default' },
                 { action: 'link', data: 'https://example.com/invalid', text: 100, type: 'primary' },
               ],
@@ -132,6 +133,7 @@ describe('InSiteMessageNotification', () => {
         expect(screen.getByText('Parsed body main')).toBeInTheDocument()
       })
       expect(screen.getByRole('button', { name: 'Visit docs' })).toBeInTheDocument()
+      expect(screen.getByRole('button', { name: 'Outline close' })).toBeInTheDocument()
       expect(screen.getByRole('button', { name: 'Dismiss now' })).toBeInTheDocument()
       expect(screen.queryByRole('button', { name: 'Invalid' })).not.toBeInTheDocument()
 
diff --git a/web/app/components/app/in-site-message/index.tsx b/web/app/components/app/in-site-message/index.tsx
index 4038fb375d9..9452218cf78 100644
--- a/web/app/components/app/in-site-message/index.tsx
+++ b/web/app/components/app/in-site-message/index.tsx
@@ -7,7 +7,7 @@ import { trackEvent } from '@/app/components/base/amplitude'
 import { MarkdownWithDirective } from '@/app/components/base/markdown-with-directive'
 
 type InSiteMessageAction = 'link' | 'close'
-type InSiteMessageButtonType = 'primary' | 'default'
+type InSiteMessageButtonType = 'primary' | 'default' | 'outline'
 
 export type InSiteMessageActionItem = {
   action: InSiteMessageAction
@@ -54,6 +54,14 @@ function normalizeLinkData(data: unknown): { href: string, rel?: string, target?
 
 const DEFAULT_HEADER_BG_URL = '/in-site-message/header-bg.svg'
 
+function resolveButtonVariant(type: InSiteMessageButtonType) {
+  if (type === 'primary')
+    return 'primary'
+  if (type === 'outline')
+    return 'secondary'
+  return 'ghost'
+}
+
 function InSiteMessage({
   notificationId,
   actions,
@@ -132,7 +140,7 @@ function InSiteMessage({
         {actions.map(item => (
           <Button
             key={`${item.type}-${item.action}-${item.text}`}
-            variant={item.type === 'primary' ? 'primary' : 'ghost'}
+            variant={resolveButtonVariant(item.type)}
             size="medium"
             className={cn(item.type === 'default' && 'text-text-secondary')}
             onClick={() => handleAction(item)}
diff --git a/web/app/components/app/in-site-message/notification.tsx b/web/app/components/app/in-site-message/notification.tsx
index cebf6ffd912..97ac168cb5d 100644
--- a/web/app/components/app/in-site-message/notification.tsx
+++ b/web/app/components/app/in-site-message/notification.tsx
@@ -25,7 +25,7 @@ function isValidActionItem(value: unknown): value is InSiteMessageActionItem {
 
   return (
     typeof candidate.text === 'string'
-    && (candidate.type === 'primary' || candidate.type === 'default')
+    && (candidate.type === 'primary' || candidate.type === 'default' || candidate.type === 'outline')
     && (candidate.action === 'link' || candidate.action === 'close')
     && (candidate.data === undefined || typeof candidate.data !== 'function')
   )
diff --git a/web/app/components/app/log/__tests__/empty-element.spec.tsx b/web/app/components/app/log/__tests__/empty-element.spec.tsx
index 41f82375f9a..f53225c5554 100644
--- a/web/app/components/app/log/__tests__/empty-element.spec.tsx
+++ b/web/app/components/app/log/__tests__/empty-element.spec.tsx
@@ -1,5 +1,6 @@
 import type { App } from '@/types/app'
-import { render, screen } from '@testing-library/react'
+import { screen } from '@testing-library/react'
+import { renderWithSystemFeatures as render } from '@/__tests__/utils/mock-system-features'
 import { AppModeEnum } from '@/types/app'
 import EmptyElement from '../empty-element'
 
diff --git a/web/app/components/app/log/empty-element.tsx b/web/app/components/app/log/empty-element.tsx
index 232e913b942..70813290319 100644
--- a/web/app/components/app/log/empty-element.tsx
+++ b/web/app/components/app/log/empty-element.tsx
@@ -1,9 +1,11 @@
 'use client'
 import type { FC, SVGProps } from 'react'
 import type { App } from '@/types/app'
+import { useSuspenseQuery } from '@tanstack/react-query'
 import * as React from 'react'
 import { Trans, useTranslation } from 'react-i18next'
 import { useSelector as useAppContextWithSelector } from '@/context/app-context'
+import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import Link from '@/next/link'
 import { AppModeEnum } from '@/types/app'
 import { getRedirectionPath } from '@/utils/app-redirection'
@@ -21,6 +23,8 @@ const EmptyElement: FC<{ appDetail: App }> = ({ appDetail }) => {
   const { t } = useTranslation()
   const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
   const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
+  const isRbacEnabled = systemFeatures.rbac_enabled
 
   const getWebAppType = (appType: AppModeEnum) => {
     if (appType !== AppModeEnum.COMPLETION && appType !== AppModeEnum.WORKFLOW)
@@ -54,6 +58,7 @@ const EmptyElement: FC<{ appDetail: App }> = ({ appDetail }) => {
                     currentUserId,
                     resourceMaintainer: appDetail.maintainer,
                     workspacePermissionKeys,
+                    isRbacEnabled,
                   })}
                   className="text-util-colors-blue-blue-600"
                 />
diff --git a/web/app/components/app/switch-app-modal/__tests__/index.spec.tsx b/web/app/components/app/switch-app-modal/__tests__/index.spec.tsx
index 8d3684c0d03..eda5f2cc11a 100644
--- a/web/app/components/app/switch-app-modal/__tests__/index.spec.tsx
+++ b/web/app/components/app/switch-app-modal/__tests__/index.spec.tsx
@@ -1,7 +1,8 @@
 import type { App } from '@/types/app'
-import { render, screen, waitFor } from '@testing-library/react'
+import { screen, waitFor } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import * as React from 'react'
+import { renderWithSystemFeatures as render } from '@/__tests__/utils/mock-system-features'
 import { useStore as useAppStore } from '@/app/components/app/store'
 import { NEED_REFRESH_APP_LIST_KEY } from '@/app/components/apps/storage'
 import { Plan } from '@/app/components/billing/type'
diff --git a/web/app/components/app/switch-app-modal/index.tsx b/web/app/components/app/switch-app-modal/index.tsx
index 40eb7252746..694623d3e54 100644
--- a/web/app/components/app/switch-app-modal/index.tsx
+++ b/web/app/components/app/switch-app-modal/index.tsx
@@ -16,6 +16,7 @@ import { cn } from '@langgenius/dify-ui/cn'
 import { Dialog, DialogContent } from '@langgenius/dify-ui/dialog'
 import { toast } from '@langgenius/dify-ui/toast'
 import { RiCloseLine } from '@remixicon/react'
+import { useSuspenseQuery } from '@tanstack/react-query'
 import { useEffect, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import { useStore as useAppStore } from '@/app/components/app/store'
@@ -25,6 +26,7 @@ import { AlertTriangle } from '@/app/components/base/icons/src/vender/solid/aler
 import Input from '@/app/components/base/input'
 import AppsFull from '@/app/components/billing/apps-full-in-dialog'
 import { useProviderContext } from '@/context/provider-context'
+import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import { useRouter } from '@/next/navigation'
 import { deleteApp, switchApp } from '@/service/apps'
 import { AppModeEnum } from '@/types/app'
@@ -43,6 +45,8 @@ const SwitchAppModal = ({ show, appDetail, inAppDetail = false, onSuccess, onClo
   const { push, replace } = useRouter()
   const { t } = useTranslation()
   const setAppDetail = useAppStore(s => s.setAppDetail)
+  const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
+  const isRbacEnabled = systemFeatures.rbac_enabled
 
   const { plan, enableBilling } = useProviderContext()
   const isAppsFull = (enableBilling && plan.usage.buildApps >= plan.total.buildApps)
@@ -86,6 +90,7 @@ const SwitchAppModal = ({ show, appDetail, inAppDetail = false, onSuccess, onClo
           permission_keys,
         },
         removeOriginal ? replace : push,
+        { isRbacEnabled },
       )
     }
     catch {
diff --git a/web/app/components/app/workflow-log/__tests__/filter.spec.tsx b/web/app/components/app/workflow-log/__tests__/filter.spec.tsx
index 91fcdebe142..1b9a0e5935f 100644
--- a/web/app/components/app/workflow-log/__tests__/filter.spec.tsx
+++ b/web/app/components/app/workflow-log/__tests__/filter.spec.tsx
@@ -171,7 +171,7 @@ describe('Filter', () => {
 
       const statusTrigger = screen.getByRole('combobox', { name: 'Success' })
       const statusChip = statusTrigger.parentElement!
-      const clearButton = within(statusChip).getByRole('button', { name: 'common.operation.clear' })
+      const clearButton = within(statusChip).getByRole('button', { name: /common\.operation\.clear Success/ })
 
       await user.click(clearButton)
 
@@ -286,7 +286,7 @@ describe('Filter', () => {
 
       const periodTrigger = screen.getByRole('combobox', { name: 'appLog.filter.period.last7days' })
       const periodChip = periodTrigger.parentElement!
-      const clearButton = within(periodChip).getByRole('button', { name: 'common.operation.clear' })
+      const clearButton = within(periodChip).getByRole('button', { name: /common\.operation\.clear appLog\.filter\.period\.last7days/ })
 
       await user.click(clearButton)
       expect(setQueryParams).toHaveBeenCalledWith({
diff --git a/web/app/components/app/workflow-log/__tests__/index.spec.tsx b/web/app/components/app/workflow-log/__tests__/index.spec.tsx
index af5f7ed85a8..79afa706293 100644
--- a/web/app/components/app/workflow-log/__tests__/index.spec.tsx
+++ b/web/app/components/app/workflow-log/__tests__/index.spec.tsx
@@ -19,9 +19,9 @@ import type { MockedFunction } from 'vitest'
 import type { ILogsProps } from '../index'
 import type { WorkflowAppLogDetail, WorkflowLogsResponse, WorkflowRunDetail } from '@/models/log'
 import type { App, AppIconType, AppModeEnum } from '@/types/app'
-import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
-import { render, screen, waitFor } from '@testing-library/react'
+import { screen, waitFor } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
+import { renderWithSystemFeatures } from '@/__tests__/utils/mock-system-features'
 import { APP_PAGE_LIMIT } from '@/config'
 import { WorkflowRunTriggeredFrom } from '@/models/log'
 import * as useLogModule from '@/service/use-log'
@@ -101,21 +101,8 @@ const mockedUseWorkflowLogs = useLogModule.useWorkflowLogs as MockedFunction<typ
 // Test Utilities
 // ============================================================================
 
-const createQueryClient = () => new QueryClient({
-  defaultOptions: {
-    queries: {
-      retry: false,
-    },
-  },
-})
-
 const renderWithQueryClient = (ui: React.ReactElement) => {
-  const queryClient = createQueryClient()
-  return render(
-    <QueryClientProvider client={queryClient}>
-      {ui}
-    </QueryClientProvider>,
-  )
+  return renderWithSystemFeatures(ui)
 }
 
 // ============================================================================
diff --git a/web/app/components/apps/__tests__/app-card.spec.tsx b/web/app/components/apps/__tests__/app-card.spec.tsx
index 78c47fc865c..f1a2c4e67a9 100644
--- a/web/app/components/apps/__tests__/app-card.spec.tsx
+++ b/web/app/components/apps/__tests__/app-card.spec.tsx
@@ -13,11 +13,13 @@ import { AppCard } from '../app-card'
 import { StarredAppCard } from '../starred-app-card'
 
 let mockWebappAuthEnabled = false
+let mockRbacEnabled = true
 
 const render = (ui: React.ReactElement) => renderWithSystemFeatures(ui, {
   systemFeatures: {
     webapp_auth: { enabled: mockWebappAuthEnabled },
     branding: { enabled: false },
+    rbac_enabled: mockRbacEnabled,
   },
 })
 
@@ -377,6 +379,7 @@ describe('AppCard', () => {
     vi.clearAllMocks()
     mockOpenAsyncWindow.mockReset()
     mockWebappAuthEnabled = false
+    mockRbacEnabled = true
     mockDeleteMutationPending = false
     mockToggleStarMutationPending = false
     mockAppContext.isCurrentWorkspaceEditor = true
@@ -390,6 +393,70 @@ describe('AppCard', () => {
       expect(screen.getByRole('link', { name: 'Test App' })).toBeInTheDocument()
     })
 
+    it('should render preview-only app card as a dimmed information-only card', () => {
+      const previewOnlyApp = createMockApp({
+        name: 'Preview Only App',
+        description: 'Only visible metadata',
+        author_name: 'Readonly Author',
+        created_by: 'another-user',
+        maintainer: 'another-user',
+        tags: [{ id: 'tag-preview', name: 'Readonly Tag', type: 'app' as const, binding_count: 0 }],
+        permission_keys: [AppACLPermission.Preview],
+      })
+
+      render(<AppCard app={previewOnlyApp} />)
+
+      const card = screen.getByRole('button', { name: 'Preview Only App' })
+      expect(card).toHaveClass('opacity-60')
+      expect(card).toHaveAttribute('aria-disabled', 'true')
+      expect(screen.getByText('Only visible metadata')).toBeInTheDocument()
+      expect(screen.getByText('Readonly Author')).toBeInTheDocument()
+      const tagSelector = screen.getByLabelText('tag-selector')
+      expect(tagSelector).toBeInTheDocument()
+      expect(tagSelector).toHaveAttribute('data-can-bind-or-unbind-tags', 'false')
+      expect(screen.queryByRole('link', { name: 'Preview Only App' })).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: 'app.studio.starApp' })).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: 'common.operation.more' })).not.toBeInTheDocument()
+
+      fireEvent.click(tagSelector)
+
+      expect(toastMocks.record).not.toHaveBeenCalled()
+
+      fireEvent.click(card)
+
+      expect(toastMocks.record).toHaveBeenCalledWith({
+        type: 'warning',
+        message: 'app.noAccessResourcePermission',
+      })
+    })
+
+    it('should render preview-only starred app card as a dimmed information-only card', () => {
+      const previewOnlyApp = createMockApp({
+        name: 'Preview Only Starred App',
+        author_name: 'Readonly Author',
+        created_by: 'another-user',
+        maintainer: 'another-user',
+        permission_keys: [AppACLPermission.Preview],
+      })
+
+      render(<StarredAppCard app={previewOnlyApp} />)
+
+      const card = screen.getByRole('button', { name: 'Preview Only Starred App' })
+      expect(card).toHaveClass('opacity-60')
+      expect(card).toHaveAttribute('aria-disabled', 'true')
+      expect(screen.getByText('Readonly Author')).toBeInTheDocument()
+      expect(screen.queryByRole('link', { name: 'Preview Only Starred App' })).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: 'app.studio.starApp' })).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: 'common.operation.more' })).not.toBeInTheDocument()
+
+      fireEvent.click(card)
+
+      expect(toastMocks.record).toHaveBeenCalledWith({
+        type: 'warning',
+        message: 'app.noAccessResourcePermission',
+      })
+    })
+
     it('should display app name', () => {
       render(<AppCard app={mockApp} />)
       expect(screen.getByText('Test App')).toBeInTheDocument()
@@ -473,7 +540,22 @@ describe('AppCard', () => {
       expect(screen.getByLabelText('tag-selector')).toHaveAttribute('data-can-bind-or-unbind-tags', 'true')
     })
 
-    it('should not render tag selector without app edit or workspace tag management permission', () => {
+    it('should allow workspace app tag management permission to bind tags without app edit permission', () => {
+      mockAppContext.isCurrentWorkspaceEditor = false
+      mockAppContext.workspacePermissionKeys = ['app.tag.manage']
+      mockAppContext.userProfile = { id: 'user-2' }
+      const tagManageApp = createMockApp({
+        maintainer: 'user-1',
+        tags: [{ id: 'tag1', name: 'Tag 1', type: 'app' as const, binding_count: 0 }],
+        permission_keys: [AppACLPermission.ViewLayout],
+      })
+
+      render(<AppCard app={tagManageApp} />)
+
+      expect(screen.getByLabelText('tag-selector')).toHaveAttribute('data-can-bind-or-unbind-tags', 'true')
+    })
+
+    it('should render existing app tags as readonly without app edit or workspace tag management permission', () => {
       mockAppContext.isCurrentWorkspaceEditor = false
       mockAppContext.workspacePermissionKeys = []
       mockAppContext.userProfile = { id: 'user-2' }
@@ -485,7 +567,7 @@ describe('AppCard', () => {
 
       render(<AppCard app={readonlyApp} />)
 
-      expect(screen.queryByLabelText('tag-selector')).not.toBeInTheDocument()
+      expect(screen.getByLabelText('tag-selector')).toHaveAttribute('data-can-bind-or-unbind-tags', 'false')
     })
 
     it('should render with onRefresh callback', () => {
@@ -1767,6 +1849,23 @@ describe('AppCard', () => {
       expect(screen.getByText('common.settings.resourceAccess')).toBeInTheDocument()
     })
 
+    it('should hide resource access option when RBAC is disabled', async () => {
+      mockRbacEnabled = false
+      const appWithAccessConfigPermission = createMockApp({
+        created_by: 'another-user',
+        maintainer: 'another-user',
+        permission_keys: [AppACLPermission.AccessConfig, AppACLPermission.Delete],
+      })
+      render(<AppCard app={appWithAccessConfigPermission} />)
+
+      fireEvent.click(screen.getByTestId('dropdown-menu-trigger'))
+
+      await waitFor(() => {
+        expect(screen.getByText('common.operation.delete')).toBeInTheDocument()
+      })
+      expect(screen.queryByText('common.settings.resourceAccess')).not.toBeInTheDocument()
+    })
+
     it('should navigate to app access config when resource access is clicked', async () => {
       const appWithAccessConfigPermission = createMockApp({
         created_by: 'another-user',
diff --git a/web/app/components/apps/__tests__/list.spec.tsx b/web/app/components/apps/__tests__/list.spec.tsx
index f5ac48c3a46..47f328d50d6 100644
--- a/web/app/components/apps/__tests__/list.spec.tsx
+++ b/web/app/components/apps/__tests__/list.spec.tsx
@@ -421,18 +421,16 @@ describe('List', () => {
       expect(screen.getByRole('button', { name: 'common.operation.create' }))!.toBeInTheDocument()
     })
 
-    it('should render sort filter before search and the snippets link', () => {
+    it('should render sort filter before search and hide the snippets link', () => {
       renderList()
 
       const sortButton = screen.getByRole('button', { name: 'Sort by Last modified' })
       const searchInput = screen.getByRole('searchbox', { name: 'app.gotoAnything.actions.searchApplications' })
-      const snippetsLink = screen.getByRole('link', { name: 'app.studio.viewSnippets' })
       const createButton = screen.getByRole('button', { name: 'common.operation.create' })
 
-      expect(snippetsLink).toHaveAttribute('href', '/snippets')
       expect(sortButton.compareDocumentPosition(searchInput) & Node.DOCUMENT_POSITION_FOLLOWING).toBeTruthy()
-      expect(searchInput.compareDocumentPosition(snippetsLink) & Node.DOCUMENT_POSITION_FOLLOWING).toBeTruthy()
-      expect(snippetsLink.compareDocumentPosition(createButton) & Node.DOCUMENT_POSITION_FOLLOWING).toBeTruthy()
+      expect(searchInput.compareDocumentPosition(createButton) & Node.DOCUMENT_POSITION_FOLLOWING).toBeTruthy()
+      expect(screen.queryByRole('link', { name: 'app.studio.viewSnippets' })).not.toBeInTheDocument()
     })
 
     it('should render app cards when apps exist', () => {
diff --git a/web/app/components/apps/app-card.tsx b/web/app/components/apps/app-card.tsx
index 7e2f173ee3f..92868958505 100644
--- a/web/app/components/apps/app-card.tsx
+++ b/web/app/components/apps/app-card.tsx
@@ -1,6 +1,6 @@
 'use client'
 
-import type { FormEvent, FormEventHandler, MouseEvent } from 'react'
+import type { FormEvent, FormEventHandler, KeyboardEvent, MouseEvent } from 'react'
 import type { DuplicateAppModalProps } from '@/app/components/app/duplicate-modal'
 import type { CreateAppModalProps } from '@/app/components/explore/create-app-modal'
 import type { EnvironmentVariable } from '@/app/components/workflow/types'
@@ -56,7 +56,7 @@ import { fetchWorkflowDraft } from '@/service/workflow'
 import { AppModeEnum } from '@/types/app'
 import { getRedirection, getRedirectionPath } from '@/utils/app-redirection'
 import { downloadBlob } from '@/utils/download'
-import { getAppACLCapabilities, hasPermission } from '@/utils/permission'
+import { getAppACLCapabilities, hasOnlyAppPreviewPermission, hasPermission } from '@/utils/permission'
 import { formatTime } from '@/utils/time'
 import { basePath } from '@/utils/var'
 
@@ -297,6 +297,7 @@ export function AppCardActionBar({ app, onRefresh }: AppCardActionBarProps) {
   const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
   const currentUserId = useAppContextSelector(state => state.userProfile?.id)
   const workspacePermissionKeys = useAppContextSelector(state => state.workspacePermissionKeys)
+  const isRbacEnabled = systemFeatures.rbac_enabled
   const { onPlanInfoChanged } = useProviderContext()
   const { push } = useRouter()
 
@@ -316,8 +317,10 @@ export function AppCardActionBar({ app, onRefresh }: AppCardActionBarProps) {
     currentUserId,
     resourceMaintainer,
     workspacePermissionKeys,
-  }), [currentUserId, resourceMaintainer, workspacePermissionKeys])
+    isRbacEnabled,
+  }), [currentUserId, isRbacEnabled, resourceMaintainer, workspacePermissionKeys])
   const appACLCapabilities = useMemo(() => getAppACLCapabilities(app.permission_keys, maintainerPermissionOptions), [app.permission_keys, maintainerPermissionOptions])
+  const isPreviewOnly = hasOnlyAppPreviewPermission(app.permission_keys)
   const canCreateApp = hasPermission(workspacePermissionKeys, 'app.create_and_management')
 
   const onConfirmDelete = useCallback(async () => {
@@ -441,6 +444,7 @@ export function AppCardActionBar({ app, onRefresh }: AppCardActionBarProps) {
         currentUserId,
         resourceMaintainer: getAppResourceMaintainer(newApp),
         workspacePermissionKeys,
+        isRbacEnabled,
       })
     }
     catch {
@@ -526,101 +530,103 @@ export function AppCardActionBar({ app, onRefresh }: AppCardActionBarProps) {
 
   return (
     <>
-      <div
-        className={cn(
-          'absolute top-2 right-2 flex items-center overflow-hidden rounded-[10px] border-[0.5px] border-components-actionbar-border bg-components-actionbar-bg p-0.5 shadow-lg backdrop-blur-xs transition-opacity',
-          isOperationsMenuOpen
-            ? 'pointer-events-auto opacity-100'
-            : 'pointer-events-none opacity-0 group-focus-within:pointer-events-auto group-focus-within:opacity-100 group-hover:pointer-events-auto group-hover:opacity-100',
-        )}
-      >
-        <Tooltip>
-          <TooltipTrigger
-            render={(
-              <button
-                type="button"
-                aria-label={starActionLabel}
-                disabled={isTogglingStar}
-                className="flex h-8 w-8 cursor-pointer items-center justify-center rounded-lg hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden disabled:cursor-not-allowed disabled:opacity-70"
-                onClick={handleToggleStar}
-              >
-                <StarIcon
-                  aria-hidden
-                  className={cn(
-                    app.is_starred ? 'text-text-warning-secondary' : 'text-text-tertiary',
-                    'size-[18px]',
-                  )}
-                />
-              </button>
-            )}
-          />
-          <TooltipContent>{starActionLabel}</TooltipContent>
-        </Tooltip>
-        {shouldShowOperationsMenu && (
-          <DropdownMenu modal={false} open={isOperationsMenuOpen} onOpenChange={setIsOperationsMenuOpen}>
-            <DropdownMenuTrigger
-              aria-label={t('operation.more', { ns: 'common' })}
-              className={cn(
-                'flex h-8 w-8 cursor-pointer items-center justify-center rounded-lg focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden',
-                isOperationsMenuOpen ? 'bg-state-base-hover' : 'hover:bg-state-base-hover',
+      {!isPreviewOnly && (
+        <div
+          className={cn(
+            'absolute top-2 right-2 flex items-center overflow-hidden rounded-[10px] border-[0.5px] border-components-actionbar-border bg-components-actionbar-bg p-0.5 shadow-lg backdrop-blur-xs transition-opacity',
+            isOperationsMenuOpen
+              ? 'pointer-events-auto opacity-100'
+              : 'pointer-events-none opacity-0 group-focus-within:pointer-events-auto group-focus-within:opacity-100 group-hover:pointer-events-auto group-hover:opacity-100',
+          )}
+        >
+          <Tooltip>
+            <TooltipTrigger
+              render={(
+                <button
+                  type="button"
+                  aria-label={starActionLabel}
+                  disabled={isTogglingStar}
+                  className="flex h-8 w-8 cursor-pointer items-center justify-center rounded-lg hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden disabled:cursor-not-allowed disabled:opacity-70"
+                  onClick={handleToggleStar}
+                >
+                  <StarIcon
+                    aria-hidden
+                    className={cn(
+                      app.is_starred ? 'text-text-warning-secondary' : 'text-text-tertiary',
+                      'size-[18px]',
+                    )}
+                  />
+                </button>
               )}
-              onClick={(e) => {
-                e.stopPropagation()
-                e.preventDefault()
-              }}
-            >
-              <span className="sr-only">{t('operation.more', { ns: 'common' })}</span>
-              <span aria-hidden className="i-ri-more-fill h-[18px] w-[18px] text-text-tertiary" />
-            </DropdownMenuTrigger>
-            <DropdownMenuContent
-              placement="bottom-end"
-              sideOffset={4}
-              popupClassName={operationsMenuWidthClassName}
-            >
-              {systemFeatures.webapp_auth.enabled
-                ? (
-                    <AppCardOperationsMenuContent
-                      app={app}
-                      shouldShowEditOption={shouldShowEditOption}
-                      shouldShowDuplicateOption={shouldShowDuplicateOption}
-                      shouldShowExportOption={shouldShowExportOption}
-                      shouldShowSwitchOption={shouldShowSwitchOption}
-                      shouldShowAccessControlOption={shouldShowAccessControlOption}
-                      shouldShowAccessConfigOption={shouldShowAccessConfigOption}
-                      shouldShowDeleteOption={shouldShowDeleteOption}
-                      onEdit={handleShowEditModal}
-                      onDuplicate={handleShowDuplicateModal}
-                      onExport={exportCheck}
-                      onSwitch={handleShowSwitchModal}
-                      onDelete={handleShowDeleteConfirm}
-                      onAccessControl={handleShowAccessControl}
-                      onAccessConfig={handleOpenAccessConfig}
-                    />
-                  )
-                : (
-                    <AppCardOperationsMenu
-                      app={app}
-                      shouldShowEditOption={shouldShowEditOption}
-                      shouldShowDuplicateOption={shouldShowDuplicateOption}
-                      shouldShowExportOption={shouldShowExportOption}
-                      shouldShowSwitchOption={shouldShowSwitchOption}
-                      shouldShowOpenInExploreOption={!app.has_draft_trigger}
-                      shouldShowAccessControlOption={shouldShowAccessControlOption}
-                      shouldShowAccessConfigOption={shouldShowAccessConfigOption}
-                      shouldShowDeleteOption={shouldShowDeleteOption}
-                      onEdit={handleShowEditModal}
-                      onDuplicate={handleShowDuplicateModal}
-                      onExport={exportCheck}
-                      onSwitch={handleShowSwitchModal}
-                      onDelete={handleShowDeleteConfirm}
-                      onAccessControl={handleShowAccessControl}
-                      onAccessConfig={handleOpenAccessConfig}
-                    />
-                  )}
-            </DropdownMenuContent>
-          </DropdownMenu>
-        )}
-      </div>
+            />
+            <TooltipContent>{starActionLabel}</TooltipContent>
+          </Tooltip>
+          {shouldShowOperationsMenu && (
+            <DropdownMenu modal={false} open={isOperationsMenuOpen} onOpenChange={setIsOperationsMenuOpen}>
+              <DropdownMenuTrigger
+                aria-label={t('operation.more', { ns: 'common' })}
+                className={cn(
+                  'flex h-8 w-8 cursor-pointer items-center justify-center rounded-lg focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden',
+                  isOperationsMenuOpen ? 'bg-state-base-hover' : 'hover:bg-state-base-hover',
+                )}
+                onClick={(e) => {
+                  e.stopPropagation()
+                  e.preventDefault()
+                }}
+              >
+                <span className="sr-only">{t('operation.more', { ns: 'common' })}</span>
+                <span aria-hidden className="i-ri-more-fill h-[18px] w-[18px] text-text-tertiary" />
+              </DropdownMenuTrigger>
+              <DropdownMenuContent
+                placement="bottom-end"
+                sideOffset={4}
+                popupClassName={operationsMenuWidthClassName}
+              >
+                {systemFeatures.webapp_auth.enabled
+                  ? (
+                      <AppCardOperationsMenuContent
+                        app={app}
+                        shouldShowEditOption={shouldShowEditOption}
+                        shouldShowDuplicateOption={shouldShowDuplicateOption}
+                        shouldShowExportOption={shouldShowExportOption}
+                        shouldShowSwitchOption={shouldShowSwitchOption}
+                        shouldShowAccessControlOption={shouldShowAccessControlOption}
+                        shouldShowAccessConfigOption={shouldShowAccessConfigOption}
+                        shouldShowDeleteOption={shouldShowDeleteOption}
+                        onEdit={handleShowEditModal}
+                        onDuplicate={handleShowDuplicateModal}
+                        onExport={exportCheck}
+                        onSwitch={handleShowSwitchModal}
+                        onDelete={handleShowDeleteConfirm}
+                        onAccessControl={handleShowAccessControl}
+                        onAccessConfig={handleOpenAccessConfig}
+                      />
+                    )
+                  : (
+                      <AppCardOperationsMenu
+                        app={app}
+                        shouldShowEditOption={shouldShowEditOption}
+                        shouldShowDuplicateOption={shouldShowDuplicateOption}
+                        shouldShowExportOption={shouldShowExportOption}
+                        shouldShowSwitchOption={shouldShowSwitchOption}
+                        shouldShowOpenInExploreOption={!app.has_draft_trigger}
+                        shouldShowAccessControlOption={shouldShowAccessControlOption}
+                        shouldShowAccessConfigOption={shouldShowAccessConfigOption}
+                        shouldShowDeleteOption={shouldShowDeleteOption}
+                        onEdit={handleShowEditModal}
+                        onDuplicate={handleShowDuplicateModal}
+                        onExport={exportCheck}
+                        onSwitch={handleShowSwitchModal}
+                        onDelete={handleShowDeleteConfirm}
+                        onAccessControl={handleShowAccessControl}
+                        onAccessConfig={handleOpenAccessConfig}
+                      />
+                    )}
+              </DropdownMenuContent>
+            </DropdownMenu>
+          )}
+        </div>
+      )}
       {showEditModal && (
         <EditAppModal
           isEditModal
@@ -724,6 +730,7 @@ export function AppCard({ app, onlineUsers = [], onRefresh, onOpenTagManagement
   const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
   const currentUserId = useAppContextSelector(state => state.userProfile?.id)
   const workspacePermissionKeys = useAppContextSelector(state => state.workspacePermissionKeys)
+  const isRbacEnabled = systemFeatures.rbac_enabled
   const { onPlanInfoChanged } = useProviderContext()
   const { push } = useRouter()
 
@@ -743,8 +750,10 @@ export function AppCard({ app, onlineUsers = [], onRefresh, onOpenTagManagement
     currentUserId,
     resourceMaintainer,
     workspacePermissionKeys,
-  }), [currentUserId, resourceMaintainer, workspacePermissionKeys])
+    isRbacEnabled,
+  }), [currentUserId, isRbacEnabled, resourceMaintainer, workspacePermissionKeys])
   const appACLCapabilities = useMemo(() => getAppACLCapabilities(app.permission_keys, maintainerPermissionOptions), [app.permission_keys, maintainerPermissionOptions])
+  const isPreviewOnly = hasOnlyAppPreviewPermission(app.permission_keys)
   const canCreateApp = hasPermission(workspacePermissionKeys, 'app.create_and_management')
   const canManageAppTags = hasPermission(workspacePermissionKeys, 'app.tag.manage')
 
@@ -871,6 +880,7 @@ export function AppCard({ app, onlineUsers = [], onRefresh, onOpenTagManagement
         currentUserId,
         resourceMaintainer: getAppResourceMaintainer(newApp),
         workspacePermissionKeys,
+        isRbacEnabled,
       })
     }
     catch {
@@ -951,7 +961,7 @@ export function AppCard({ app, onlineUsers = [], onRefresh, onOpenTagManagement
   const shouldShowAccessConfigOption = appACLCapabilities.canAccessConfig
   const shouldShowDeleteOption = appACLCapabilities.canDelete
   const shouldShowOperationsMenu = shouldShowEditOption || shouldShowDuplicateOption || shouldShowExportOption || shouldShowSwitchOption || shouldShowAccessControlOption || shouldShowAccessConfigOption || shouldShowDeleteOption
-  const shouldShowAppTags = appACLCapabilities.canEdit || canManageAppTags
+  const canBindOrUnbindTags = !isPreviewOnly && (canManageAppTags || appACLCapabilities.canEdit)
   const operationsMenuWidthClassName = shouldShowSwitchOption ? 'w-[256px]' : 'w-[216px]'
 
   const editTimeText = useMemo(() => {
@@ -995,174 +1005,212 @@ export function AppCard({ app, onlineUsers = [], onRefresh, onOpenTagManagement
   const appNameId = useId()
   const appDescriptionId = useId()
   const appHref = getRedirectionPath(app, maintainerPermissionOptions)
+  const appCardClassName = cn(
+    'inline-flex h-full w-full touch-manipulation flex-col overflow-hidden rounded-xl border-[0.5px] border-solid border-components-card-border bg-components-card-bg shadow-xs outline-hidden transition-shadow duration-200 ease-in-out',
+    isPreviewOnly
+      ? 'cursor-not-allowed opacity-60 focus-visible:ring-2 focus-visible:ring-state-accent-solid'
+      : 'cursor-pointer hover:shadow-lg focus-visible:ring-2 focus-visible:ring-state-accent-solid',
+  )
   const starActionLabel = app.is_starred
     ? t('studio.unstarApp', { ns: 'app' })
     : t('studio.starApp', { ns: 'app' })
+  const showPreviewOnlyAccessWarning = useCallback(() => {
+    toast.warning(t('noAccessResourcePermission', { ns: 'app' }))
+  }, [t])
+  const handlePreviewOnlyCardKeyDown = useCallback((event: KeyboardEvent<HTMLElement>) => {
+    if (event.key !== 'Enter' && event.key !== ' ')
+      return
+
+    event.preventDefault()
+    showPreviewOnlyAccessWarning()
+  }, [showPreviewOnlyAccessWarning])
+  const appCardContent = (
+    <>
+      <div className="flex shrink-0 items-center gap-3 pt-4 pr-4 pb-2 pl-4">
+        <div className="relative shrink-0">
+          <AppIcon
+            size="large"
+            iconType={app.icon_type}
+            icon={app.icon}
+            background={app.icon_background}
+            imageUrl={app.icon_url}
+          />
+          <AppTypeIcon type={app.mode} wrapperClassName="absolute -bottom-0.5 -right-0.5 w-4 h-4 shadow-sm" className="size-3" />
+        </div>
+        <div className="flex w-0 grow flex-col gap-1 py-px">
+          <div className="flex items-center text-sm/5 font-semibold text-text-secondary">
+            <div id={appNameId} className="truncate">{app.name}</div>
+          </div>
+          <div className="truncate system-2xs-medium-uppercase text-text-tertiary">{appModeLabel}</div>
+        </div>
+        {onlinePresenceUsers.length > 0 && (
+          <div className="ml-3 flex shrink-0 items-start">
+            <UserAvatarList users={onlinePresenceUsers} size="xxs" maxVisible={3} className="justify-end" />
+          </div>
+        )}
+      </div>
+      <div className="shrink-0 px-4 py-1 system-xs-regular text-text-tertiary">
+        <div
+          id={appDescriptionId}
+          className="line-clamp-2 min-h-8"
+        >
+          {app.description}
+        </div>
+      </div>
+      <div className="flex h-[26px] shrink-0 items-start px-3" />
+      <div className="flex min-w-0 shrink-0 items-center pt-2 pr-4 pb-3 pl-4 system-xs-regular text-text-tertiary">
+        <div className="flex min-w-0 flex-1 items-center gap-1 whitespace-nowrap">
+          <div className="truncate">{app.author_name}</div>
+          <div className="shrink-0">·</div>
+          <div className="truncate">{editTimeText}</div>
+        </div>
+      </div>
+    </>
+  )
 
   return (
     <>
       <div
         className="group relative col-span-1 h-41.5"
       >
-        <Link
-          href={appHref}
-          aria-labelledby={appNameId}
-          aria-describedby={app.description ? appDescriptionId : undefined}
-          className="inline-flex h-full w-full cursor-pointer touch-manipulation flex-col overflow-hidden rounded-xl border-[0.5px] border-solid border-components-card-border bg-components-card-bg shadow-xs outline-hidden transition-shadow duration-200 ease-in-out hover:shadow-lg focus-visible:ring-2 focus-visible:ring-state-accent-solid"
+        {isPreviewOnly
+          ? (
+              <article
+                role="button"
+                tabIndex={0}
+                aria-disabled="true"
+                aria-labelledby={appNameId}
+                aria-describedby={app.description ? appDescriptionId : undefined}
+                className={appCardClassName}
+                onClick={showPreviewOnlyAccessWarning}
+                onKeyDown={handlePreviewOnlyCardKeyDown}
+              >
+                {appCardContent}
+              </article>
+            )
+          : (
+              <Link
+                href={appHref}
+                aria-labelledby={appNameId}
+                aria-describedby={app.description ? appDescriptionId : undefined}
+                className={appCardClassName}
+              >
+                {appCardContent}
+              </Link>
+            )}
+        <div
+          className="absolute top-[104px] right-3 left-3 flex h-[26px] min-w-0 items-start"
+          onClick={(e) => {
+            e.stopPropagation()
+            e.preventDefault()
+          }}
         >
-          <div className="flex shrink-0 items-center gap-3 pt-4 pr-4 pb-2 pl-4">
-            <div className="relative shrink-0">
-              <AppIcon
-                size="large"
-                iconType={app.icon_type}
-                icon={app.icon}
-                background={app.icon_background}
-                imageUrl={app.icon_url}
+          <AppCardTags
+            appId={app.id}
+            tags={app.tags}
+            canBindOrUnbindTags={canBindOrUnbindTags}
+            onOpenTagManagement={onOpenTagManagement}
+            onTagsChange={onRefresh}
+          />
+        </div>
+        <AppAccessModeIcon accessMode={app.access_mode} />
+        {!isPreviewOnly && (
+          <div
+            className={cn(
+              'absolute top-2 right-2 flex items-center overflow-hidden rounded-[10px] border-[0.5px] border-components-actionbar-border bg-components-actionbar-bg p-0.5 shadow-lg backdrop-blur-xs transition-opacity',
+              isOperationsMenuOpen
+                ? 'pointer-events-auto opacity-100'
+                : 'pointer-events-none opacity-0 group-focus-within:pointer-events-auto group-focus-within:opacity-100 group-hover:pointer-events-auto group-hover:opacity-100',
+            )}
+          >
+            <Tooltip>
+              <TooltipTrigger
+                render={(
+                  <button
+                    type="button"
+                    aria-label={starActionLabel}
+                    disabled={isTogglingStar}
+                    className="flex h-8 w-8 cursor-pointer items-center justify-center rounded-lg hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden disabled:cursor-not-allowed disabled:opacity-70"
+                    onClick={handleToggleStar}
+                  >
+                    <StarIcon
+                      aria-hidden
+                      className={cn(
+                        app.is_starred ? 'text-text-warning-secondary' : 'text-text-tertiary',
+                        'size-[18px]',
+                      )}
+                    />
+                  </button>
+                )}
               />
-              <AppTypeIcon type={app.mode} wrapperClassName="absolute -bottom-0.5 -right-0.5 w-4 h-4 shadow-sm" className="size-3" />
-            </div>
-            <div className="flex w-0 grow flex-col gap-1 py-px">
-              <div className="flex items-center text-sm/5 font-semibold text-text-secondary">
-                <div id={appNameId} className="truncate">{app.name}</div>
-              </div>
-              <div className="truncate system-2xs-medium-uppercase text-text-tertiary">{appModeLabel}</div>
-            </div>
-            {onlinePresenceUsers.length > 0 && (
-              <div className="ml-3 flex shrink-0 items-start">
-                <UserAvatarList users={onlinePresenceUsers} size="xxs" maxVisible={3} className="justify-end" />
-              </div>
+              <TooltipContent>{starActionLabel}</TooltipContent>
+            </Tooltip>
+            {shouldShowOperationsMenu && (
+              <DropdownMenu modal={false} open={isOperationsMenuOpen} onOpenChange={setIsOperationsMenuOpen}>
+                <DropdownMenuTrigger
+                  aria-label={t('operation.more', { ns: 'common' })}
+                  className={cn(
+                    'flex h-8 w-8 cursor-pointer items-center justify-center rounded-lg focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden',
+                    isOperationsMenuOpen ? 'bg-state-base-hover' : 'hover:bg-state-base-hover',
+                  )}
+                  onClick={(e) => {
+                    e.stopPropagation()
+                    e.preventDefault()
+                  }}
+                >
+                  <span className="sr-only">{t('operation.more', { ns: 'common' })}</span>
+                  <span aria-hidden className="i-ri-more-fill h-[18px] w-[18px] text-text-tertiary" />
+                </DropdownMenuTrigger>
+                <DropdownMenuContent
+                  placement="bottom-end"
+                  sideOffset={4}
+                  popupClassName={operationsMenuWidthClassName}
+                >
+                  {systemFeatures.webapp_auth.enabled
+                    ? (
+                        <AppCardOperationsMenuContent
+                          app={app}
+                          shouldShowEditOption={shouldShowEditOption}
+                          shouldShowDuplicateOption={shouldShowDuplicateOption}
+                          shouldShowExportOption={shouldShowExportOption}
+                          shouldShowSwitchOption={shouldShowSwitchOption}
+                          shouldShowAccessControlOption={shouldShowAccessControlOption}
+                          shouldShowAccessConfigOption={shouldShowAccessConfigOption}
+                          shouldShowDeleteOption={shouldShowDeleteOption}
+                          onEdit={handleShowEditModal}
+                          onDuplicate={handleShowDuplicateModal}
+                          onExport={exportCheck}
+                          onSwitch={handleShowSwitchModal}
+                          onDelete={handleShowDeleteConfirm}
+                          onAccessControl={handleShowAccessControl}
+                          onAccessConfig={handleOpenAccessConfig}
+                        />
+                      )
+                    : (
+                        <AppCardOperationsMenu
+                          app={app}
+                          shouldShowEditOption={shouldShowEditOption}
+                          shouldShowDuplicateOption={shouldShowDuplicateOption}
+                          shouldShowExportOption={shouldShowExportOption}
+                          shouldShowSwitchOption={shouldShowSwitchOption}
+                          shouldShowOpenInExploreOption={!app.has_draft_trigger}
+                          shouldShowAccessControlOption={shouldShowAccessControlOption}
+                          shouldShowAccessConfigOption={shouldShowAccessConfigOption}
+                          shouldShowDeleteOption={shouldShowDeleteOption}
+                          onEdit={handleShowEditModal}
+                          onDuplicate={handleShowDuplicateModal}
+                          onExport={exportCheck}
+                          onSwitch={handleShowSwitchModal}
+                          onDelete={handleShowDeleteConfirm}
+                          onAccessControl={handleShowAccessControl}
+                          onAccessConfig={handleOpenAccessConfig}
+                        />
+                      )}
+                </DropdownMenuContent>
+              </DropdownMenu>
             )}
           </div>
-          <div className="shrink-0 px-4 py-1 system-xs-regular text-text-tertiary">
-            <div
-              id={appDescriptionId}
-              className="line-clamp-2 min-h-8"
-            >
-              {app.description}
-            </div>
-          </div>
-          <div className="flex h-[26px] shrink-0 items-start px-3" />
-          <div className="flex min-w-0 shrink-0 items-center pt-2 pr-4 pb-3 pl-4 system-xs-regular text-text-tertiary">
-            <div className="flex min-w-0 flex-1 items-center gap-1 whitespace-nowrap">
-              <div className="truncate">{app.author_name}</div>
-              <div className="shrink-0">·</div>
-              <div className="truncate">{editTimeText}</div>
-            </div>
-          </div>
-        </Link>
-        {shouldShowAppTags && (
-          <div
-            className="absolute top-[104px] right-3 left-3 flex h-[26px] min-w-0 items-start"
-            onClick={(e) => {
-              e.stopPropagation()
-              e.preventDefault()
-            }}
-          >
-            <AppCardTags
-              appId={app.id}
-              tags={app.tags}
-              canBindOrUnbindTags={appACLCapabilities.canEdit}
-              onOpenTagManagement={onOpenTagManagement}
-              onTagsChange={onRefresh}
-            />
-          </div>
         )}
-        <AppAccessModeIcon accessMode={app.access_mode} />
-        <div
-          className={cn(
-            'absolute top-2 right-2 flex items-center overflow-hidden rounded-[10px] border-[0.5px] border-components-actionbar-border bg-components-actionbar-bg p-0.5 shadow-lg backdrop-blur-xs transition-opacity',
-            isOperationsMenuOpen
-              ? 'pointer-events-auto opacity-100'
-              : 'pointer-events-none opacity-0 group-focus-within:pointer-events-auto group-focus-within:opacity-100 group-hover:pointer-events-auto group-hover:opacity-100',
-          )}
-        >
-          <Tooltip>
-            <TooltipTrigger
-              render={(
-                <button
-                  type="button"
-                  aria-label={starActionLabel}
-                  disabled={isTogglingStar}
-                  className="flex h-8 w-8 cursor-pointer items-center justify-center rounded-lg hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden disabled:cursor-not-allowed disabled:opacity-70"
-                  onClick={handleToggleStar}
-                >
-                  <StarIcon
-                    aria-hidden
-                    className={cn(
-                      app.is_starred ? 'text-text-warning-secondary' : 'text-text-tertiary',
-                      'size-[18px]',
-                    )}
-                  />
-                </button>
-              )}
-            />
-            <TooltipContent>{starActionLabel}</TooltipContent>
-          </Tooltip>
-          {shouldShowOperationsMenu && (
-            <DropdownMenu modal={false} open={isOperationsMenuOpen} onOpenChange={setIsOperationsMenuOpen}>
-              <DropdownMenuTrigger
-                aria-label={t('operation.more', { ns: 'common' })}
-                className={cn(
-                  'flex h-8 w-8 cursor-pointer items-center justify-center rounded-lg focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden',
-                  isOperationsMenuOpen ? 'bg-state-base-hover' : 'hover:bg-state-base-hover',
-                )}
-                onClick={(e) => {
-                  e.stopPropagation()
-                  e.preventDefault()
-                }}
-              >
-                <span className="sr-only">{t('operation.more', { ns: 'common' })}</span>
-                <span aria-hidden className="i-ri-more-fill h-[18px] w-[18px] text-text-tertiary" />
-              </DropdownMenuTrigger>
-              <DropdownMenuContent
-                placement="bottom-end"
-                sideOffset={4}
-                popupClassName={operationsMenuWidthClassName}
-              >
-                {systemFeatures.webapp_auth.enabled
-                  ? (
-                      <AppCardOperationsMenuContent
-                        app={app}
-                        shouldShowEditOption={shouldShowEditOption}
-                        shouldShowDuplicateOption={shouldShowDuplicateOption}
-                        shouldShowExportOption={shouldShowExportOption}
-                        shouldShowSwitchOption={shouldShowSwitchOption}
-                        shouldShowAccessControlOption={shouldShowAccessControlOption}
-                        shouldShowAccessConfigOption={shouldShowAccessConfigOption}
-                        shouldShowDeleteOption={shouldShowDeleteOption}
-                        onEdit={handleShowEditModal}
-                        onDuplicate={handleShowDuplicateModal}
-                        onExport={exportCheck}
-                        onSwitch={handleShowSwitchModal}
-                        onDelete={handleShowDeleteConfirm}
-                        onAccessControl={handleShowAccessControl}
-                        onAccessConfig={handleOpenAccessConfig}
-                      />
-                    )
-                  : (
-                      <AppCardOperationsMenu
-                        app={app}
-                        shouldShowEditOption={shouldShowEditOption}
-                        shouldShowDuplicateOption={shouldShowDuplicateOption}
-                        shouldShowExportOption={shouldShowExportOption}
-                        shouldShowSwitchOption={shouldShowSwitchOption}
-                        shouldShowOpenInExploreOption={!app.has_draft_trigger}
-                        shouldShowAccessControlOption={shouldShowAccessControlOption}
-                        shouldShowAccessConfigOption={shouldShowAccessConfigOption}
-                        shouldShowDeleteOption={shouldShowDeleteOption}
-                        onEdit={handleShowEditModal}
-                        onDuplicate={handleShowDuplicateModal}
-                        onExport={exportCheck}
-                        onSwitch={handleShowSwitchModal}
-                        onDelete={handleShowDeleteConfirm}
-                        onAccessControl={handleShowAccessControl}
-                        onAccessConfig={handleOpenAccessConfig}
-                      />
-                    )}
-              </DropdownMenuContent>
-            </DropdownMenu>
-          )}
-        </div>
       </div>
       {showEditModal && (
         <EditAppModal
diff --git a/web/app/components/apps/app-list-header-filters.tsx b/web/app/components/apps/app-list-header-filters.tsx
index df32f57d7ba..ceccb7575f6 100644
--- a/web/app/components/apps/app-list-header-filters.tsx
+++ b/web/app/components/apps/app-list-header-filters.tsx
@@ -8,7 +8,6 @@ import { DropdownMenu, DropdownMenuContent, DropdownMenuItem, DropdownMenuTrigge
 import { useTranslation } from 'react-i18next'
 import { SearchInput } from '@/app/components/base/search-input'
 import { TagFilter } from '@/features/tag-management/components/tag-filter'
-import Link from '@/next/link'
 import { AppSortFilter } from './app-sort-filter'
 import { AppTypeFilter } from './app-type-filter'
 import CreatorsFilter from './creators-filter'
@@ -71,12 +70,6 @@ export function AppListHeaderFilters({
         />
       </div>
       <div className="flex items-center gap-2">
-        <Link
-          href="/snippets"
-          className="flex h-8 items-center rounded-lg px-3 text-sm font-semibold text-text-secondary outline-hidden hover:bg-state-base-hover hover:text-text-primary focus-visible:ring-2 focus-visible:ring-state-accent-solid"
-        >
-          {t('studio.viewSnippets', { ns: 'app' })}
-        </Link>
         {showCreateButton && (
           <DropdownMenu modal={false}>
             <DropdownMenuTrigger
diff --git a/web/app/components/apps/starred-app-card.tsx b/web/app/components/apps/starred-app-card.tsx
index 1d22a3a4b3b..7865e78e13a 100644
--- a/web/app/components/apps/starred-app-card.tsx
+++ b/web/app/components/apps/starred-app-card.tsx
@@ -1,13 +1,19 @@
 'use client'
 
+import type { KeyboardEvent } from 'react'
 import type { App } from '@/types/app'
-import { useMemo } from 'react'
+import { cn } from '@langgenius/dify-ui/cn'
+import { toast } from '@langgenius/dify-ui/toast'
+import { useSuspenseQuery } from '@tanstack/react-query'
+import { useCallback, useMemo } from 'react'
 import { useTranslation } from 'react-i18next'
 import { AppTypeIcon } from '@/app/components/app/type-selector'
 import AppIcon from '@/app/components/base/app-icon'
 import { useSelector as useAppContextSelector } from '@/context/app-context'
+import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import Link from '@/next/link'
 import { getRedirectionPath } from '@/utils/app-redirection'
+import { hasOnlyAppPreviewPermission } from '@/utils/permission'
 import { formatTime } from '@/utils/time'
 import { AppCardActionBar } from './app-card'
 
@@ -20,6 +26,9 @@ export function StarredAppCard({ app, onRefresh }: StarredAppCardProps) {
   const { t } = useTranslation()
   const currentUserId = useAppContextSelector(state => state.userProfile?.id)
   const workspacePermissionKeys = useAppContextSelector(state => state.workspacePermissionKeys)
+  const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
+  const isRbacEnabled = systemFeatures.rbac_enabled
+  const isPreviewOnly = hasOnlyAppPreviewPermission(app.permission_keys)
 
   const editTimeText = useMemo(() => {
     const timestamp = app.updated_at || app.created_at
@@ -36,34 +45,69 @@ export function StarredAppCard({ app, onRefresh }: StarredAppCardProps) {
     currentUserId,
     resourceMaintainer: app.maintainer,
     workspacePermissionKeys,
+    isRbacEnabled,
   })
+  const cardClassName = cn(
+    'flex h-[72px] min-w-0 items-center gap-3 overflow-hidden rounded-xl border-[0.5px] border-components-card-border bg-components-card-bg px-4 py-3 shadow-xs outline-hidden transition-shadow duration-200',
+    isPreviewOnly
+      ? 'cursor-not-allowed opacity-60 focus-visible:ring-2 focus-visible:ring-state-accent-solid'
+      : 'hover:shadow-lg focus-visible:ring-2 focus-visible:ring-state-accent-solid',
+  )
+  const showPreviewOnlyAccessWarning = useCallback(() => {
+    toast.warning(t('noAccessResourcePermission', { ns: 'app' }))
+  }, [t])
+  const handlePreviewOnlyCardKeyDown = useCallback((event: KeyboardEvent<HTMLElement>) => {
+    if (event.key !== 'Enter' && event.key !== ' ')
+      return
+
+    event.preventDefault()
+    showPreviewOnlyAccessWarning()
+  }, [showPreviewOnlyAccessWarning])
+  const cardContent = (
+    <>
+      <div className="relative shrink-0">
+        <AppIcon
+          size="large"
+          iconType={app.icon_type}
+          icon={app.icon}
+          background={app.icon_background}
+          imageUrl={app.icon_url}
+        />
+        <AppTypeIcon type={app.mode} wrapperClassName="absolute -right-0.5 -bottom-0.5 h-4 w-4 shadow-sm" className="size-3" />
+      </div>
+      <div className="flex min-w-0 flex-1 flex-col gap-0.5 py-px">
+        <div className="truncate system-md-semibold text-text-secondary">{app.name}</div>
+        <div className="flex min-w-0 items-center gap-1 system-xs-regular text-text-tertiary">
+          {app.author_name && <span className="shrink-0 truncate">{app.author_name}</span>}
+          {app.author_name && editTimeText && <span className="shrink-0">·</span>}
+          {editTimeText && <span className="min-w-0 truncate">{editTimeText}</span>}
+        </div>
+      </div>
+    </>
+  )
 
   return (
     <div className="group relative">
-      <Link
-        href={href}
-        className="flex h-[72px] min-w-0 items-center gap-3 overflow-hidden rounded-xl border-[0.5px] border-components-card-border bg-components-card-bg px-4 py-3 shadow-xs outline-hidden transition-shadow duration-200 hover:shadow-lg focus-visible:ring-2 focus-visible:ring-state-accent-solid"
-      >
-        <div className="relative shrink-0">
-          <AppIcon
-            size="large"
-            iconType={app.icon_type}
-            icon={app.icon}
-            background={app.icon_background}
-            imageUrl={app.icon_url}
-          />
-          <AppTypeIcon type={app.mode} wrapperClassName="absolute -right-0.5 -bottom-0.5 h-4 w-4 shadow-sm" className="size-3" />
-        </div>
-        <div className="flex min-w-0 flex-1 flex-col gap-0.5 py-px">
-          <div className="truncate system-md-semibold text-text-secondary">{app.name}</div>
-          <div className="flex min-w-0 items-center gap-1 system-xs-regular text-text-tertiary">
-            {app.author_name && <span className="shrink-0 truncate">{app.author_name}</span>}
-            {app.author_name && editTimeText && <span className="shrink-0">·</span>}
-            {editTimeText && <span className="min-w-0 truncate">{editTimeText}</span>}
-          </div>
-        </div>
-      </Link>
-      <AppCardActionBar app={app} onRefresh={onRefresh} />
+      {isPreviewOnly
+        ? (
+            <article
+              role="button"
+              tabIndex={0}
+              aria-disabled="true"
+              aria-label={app.name}
+              className={cardClassName}
+              onClick={showPreviewOnlyAccessWarning}
+              onKeyDown={handlePreviewOnlyCardKeyDown}
+            >
+              {cardContent}
+            </article>
+          )
+        : (
+            <Link href={href} className={cardClassName}>
+              {cardContent}
+            </Link>
+          )}
+      {!isPreviewOnly && <AppCardActionBar app={app} onRefresh={onRefresh} />}
     </div>
   )
 }
diff --git a/web/app/components/base/chat/chat/hooks.ts b/web/app/components/base/chat/chat/hooks.ts
index 85eb1893cee..db0ce1d1251 100644
--- a/web/app/components/base/chat/chat/hooks.ts
+++ b/web/app/components/base/chat/chat/hooks.ts
@@ -64,10 +64,12 @@ export const useChat = (
   stopChat?: (taskId: string) => void,
   clearChatList?: boolean,
   clearChatListCallback?: (state: boolean) => void,
+  initialConversationId?: string,
 ) => {
   const { t } = useTranslation()
   const { formatTime } = useTimestamp()
-  const conversationIdRef = useRef('')
+  const conversationIdRef = useRef(initialConversationId ?? '')
+  const initialConversationIdRef = useRef(initialConversationId ?? '')
   const hasStopRespondedRef = useRef(false)
   const [isResponding, setIsResponding] = useState(false)
   const isRespondingRef = useRef(false)
@@ -145,6 +147,12 @@ export const useChat = (
     }
   }, [])
 
+  useEffect(() => {
+    initialConversationIdRef.current = initialConversationId ?? ''
+    if (initialConversationId && !conversationIdRef.current)
+      conversationIdRef.current = initialConversationId
+  }, [initialConversationId])
+
   /** Find the target node by bfs and then operate on it */
   const produceChatTreeNode = useCallback((targetId: string, operation: (node: ChatItemInTree) => void) => {
     return produce(chatTreeRef.current, (draft) => {
@@ -203,7 +211,7 @@ export const useChat = (
   }, [stopChat, handleResponding])
 
   const handleRestart = useCallback((cb?: any) => {
-    conversationIdRef.current = ''
+    conversationIdRef.current = initialConversationIdRef.current
     taskIdRef.current = ''
     handleStop()
     setChatTree([])
diff --git a/web/app/components/base/chip/__tests__/index.spec.tsx b/web/app/components/base/chip/__tests__/index.spec.tsx
index 133c1ea2a95..95dd3e0e05c 100644
--- a/web/app/components/base/chip/__tests__/index.spec.tsx
+++ b/web/app/components/base/chip/__tests__/index.spec.tsx
@@ -122,7 +122,9 @@ describe('Chip', () => {
     it('should show left icon by default', () => {
       const { container } = renderChip()
 
-      expect(container.querySelector('.i-ri-filter-3-line')).toBeInTheDocument()
+      const icon = container.querySelector('.i-ri-filter-3-line')
+      expect(icon).toBeInTheDocument()
+      expect(icon).toHaveAttribute('aria-hidden')
     })
 
     it('should hide left icon when showLeftIcon is false', () => {
@@ -140,6 +142,7 @@ describe('Chip', () => {
       renderChip({ leftIcon: <CustomIcon /> })
 
       expect(screen.getByTestId('custom-icon'))!.toBeInTheDocument()
+      expect(screen.getByTestId('custom-icon').closest('[aria-hidden="true"]')).toBeInTheDocument()
     })
 
     it('should apply custom className to trigger', () => {
@@ -161,6 +164,15 @@ describe('Chip', () => {
       const panel = document.body.querySelector(`.${customPanelClass}`)
       expect(panel)!.toBeInTheDocument()
     })
+
+    it('should use visible focus styles on the trigger', () => {
+      const { container } = renderChip()
+
+      expect(getTrigger(container)).toHaveClass(
+        'focus-visible:ring-2',
+        'focus-visible:ring-state-accent-solid',
+      )
+    })
   })
 
   describe('State Management', () => {
@@ -207,7 +219,15 @@ describe('Chip', () => {
     it('should call onClear when clear button is clicked', async () => {
       const { user } = renderChip({ value: 'active' })
 
-      const clearButton = screen.getByRole('button', { name: 'common.operation.clear' })
+      const clearButton = screen.getByRole('button', { name: /common\.operation\.clear/ })
+      expect(clearButton).toHaveAccessibleName(/Active/)
+      expect(clearButton).toHaveClass(
+        'outline-hidden',
+        'focus-visible:ring-2',
+        'focus-visible:ring-state-accent-solid',
+        'focus-visible:ring-inset',
+      )
+      expect(clearButton.querySelector('.i-ri-close-circle-fill')).toHaveAttribute('aria-hidden')
 
       await user.click(clearButton)
 
@@ -221,7 +241,7 @@ describe('Chip', () => {
       expect(screen.queryByRole('listbox')).not.toBeInTheDocument()
       expect(trigger).not.toHaveAttribute('data-popup-open')
 
-      const clearButton = screen.getByRole('button', { name: 'common.operation.clear' })
+      const clearButton = screen.getByRole('button', { name: /common\.operation\.clear/ })
 
       await user.click(clearButton)
 
@@ -326,7 +346,7 @@ describe('Chip', () => {
 
       // The trigger should not display any item name text
       expect(trigger?.textContent?.trim()).toBeFalsy()
-      expect(screen.queryByRole('button', { name: 'common.operation.clear' })).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: /common\.operation\.clear/ })).not.toBeInTheDocument()
     })
 
     it('should allow selecting already selected item', async () => {
@@ -368,7 +388,7 @@ describe('Chip', () => {
       renderChip({ value: 0, items: numericItems })
 
       expect(screen.getByRole('combobox', { name: 'Zero' })).toBeInTheDocument()
-      expect(screen.getByRole('button', { name: 'common.operation.clear' })).toBeInTheDocument()
+      expect(screen.getByRole('button', { name: /common\.operation\.clear/ })).toBeInTheDocument()
     })
 
     it('should handle items with additional properties', async () => {
diff --git a/web/app/components/base/chip/index.tsx b/web/app/components/base/chip/index.tsx
index 20507033aba..3aa78cd86f6 100644
--- a/web/app/components/base/chip/index.tsx
+++ b/web/app/components/base/chip/index.tsx
@@ -45,6 +45,9 @@ function Chip<T extends ItemValue>({
   const selectedItem = items.find(item => Object.is(item.value, value))
   const triggerContent = selectedItem?.triggerName || selectedItem?.name || ''
   const hasValue = selectedItem !== undefined && value !== ''
+  const clearLabel = triggerContent
+    ? `${t('operation.clear', { ns: 'common' })} ${triggerContent}`
+    : t('operation.clear', { ns: 'common' })
 
   return (
     <Select
@@ -63,14 +66,14 @@ function Chip<T extends ItemValue>({
         <SelectTrigger
           aria-label={triggerContent || t('placeholder.select', { ns: 'common' })}
           className={cn(
-            'h-auto min-h-8 w-fit max-w-full cursor-pointer items-center rounded-lg border-[0.5px] border-transparent bg-components-input-bg-normal px-2 py-1 hover:bg-state-base-hover-alt focus-visible:bg-state-base-hover-alt data-popup-open:bg-state-base-hover-alt! data-popup-open:hover:bg-state-base-hover-alt [&>*:last-child]:hidden',
+            'h-auto min-h-8 w-fit max-w-full cursor-pointer items-center rounded-lg border-[0.5px] border-transparent bg-components-input-bg-normal px-2 py-1 hover:bg-state-base-hover-alt focus-visible:bg-state-base-hover-alt focus-visible:ring-2 focus-visible:ring-state-accent-solid data-popup-open:bg-state-base-hover-alt! data-popup-open:hover:bg-state-base-hover-alt [&>*:last-child]:hidden',
             hasValue && 'border-components-button-secondary-border! bg-components-button-secondary-bg! pr-6 shadow-xs hover:border-components-button-secondary-border-hover hover:bg-components-button-secondary-bg-hover! data-popup-open:border-components-button-secondary-border-hover! data-popup-open:bg-components-button-secondary-bg-hover! data-popup-open:hover:border-components-button-secondary-border-hover data-popup-open:hover:bg-components-button-secondary-bg-hover!',
             className,
           )}
         >
           <span className="flex min-w-0 grow items-center gap-1 text-left">
             {showLeftIcon && (
-              <span className="p-0.5">
+              <span aria-hidden="true" className="p-0.5">
                 {leftIcon || (
                   <span aria-hidden className={cn('i-ri-filter-3-line block size-4 text-text-tertiary', hasValue && 'text-text-secondary')} />
                 )}
@@ -87,8 +90,8 @@ function Chip<T extends ItemValue>({
         {hasValue && (
           <button
             type="button"
-            aria-label={t('operation.clear', { ns: 'common' })}
-            className="group/clear absolute top-1/2 right-2 -translate-y-1/2 cursor-pointer border-none bg-transparent p-px"
+            aria-label={clearLabel}
+            className="group/clear absolute top-1/2 right-1.5 flex size-5 -translate-y-1/2 cursor-pointer touch-manipulation items-center justify-center rounded-md border-none bg-transparent p-0 outline-hidden focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:ring-inset"
             onClick={onClear}
           >
             <span aria-hidden className="i-ri-close-circle-fill block size-3.5 text-text-quaternary group-hover/clear:text-text-tertiary" />
diff --git a/web/app/components/base/sort/__tests__/index.spec.tsx b/web/app/components/base/sort/__tests__/index.spec.tsx
index ea85e8f3fef..99db843a758 100644
--- a/web/app/components/base/sort/__tests__/index.spec.tsx
+++ b/web/app/components/base/sort/__tests__/index.spec.tsx
@@ -43,7 +43,7 @@ describe('Sort component — real portal integration', () => {
 
     const sortButton = getSortButton()
     expect(sortButton).toBeInstanceOf(HTMLElement)
-    expect(sortButton.querySelector('svg')).toBeInTheDocument()
+    expect(sortButton.querySelector('.i-ri-sort-asc')).toBeInTheDocument()
   })
 
   it('opens and closes the menu', async () => {
@@ -98,8 +98,8 @@ describe('Sort component — real portal integration', () => {
     if (!nameRow)
       throw new Error('Name option row not found in menu')
 
-    expect(statusRow.querySelector('svg')).toBeInTheDocument()
-    expect(nameRow.querySelector('svg')).not.toBeInTheDocument()
+    expect(statusRow.querySelector('.i-ri-check-line')).toBeInTheDocument()
+    expect(nameRow.querySelector('.i-ri-check-line')).not.toBeInTheDocument()
   })
 
   it('shows empty selection label when value is unknown', () => {
diff --git a/web/app/components/base/sort/index.tsx b/web/app/components/base/sort/index.tsx
index 67091379fd4..00f3a51a139 100644
--- a/web/app/components/base/sort/index.tsx
+++ b/web/app/components/base/sort/index.tsx
@@ -6,7 +6,6 @@ import {
   DropdownMenuRadioItem,
   DropdownMenuTrigger,
 } from '@langgenius/dify-ui/dropdown-menu'
-import { RiArrowDownSLine, RiCheckLine, RiSortAsc, RiSortDesc } from '@remixicon/react'
 import { useMemo } from 'react'
 import { useTranslation } from 'react-i18next'
 
@@ -39,7 +38,7 @@ function Sort({
       <DropdownMenu>
         <div className="relative">
           <DropdownMenuTrigger
-            className="flex min-h-8 cursor-pointer items-center rounded-l-lg border-none bg-components-input-bg-normal px-2 py-1 hover:bg-state-base-hover-alt data-popup-open:bg-state-base-hover-alt! data-popup-open:hover:bg-state-base-hover-alt"
+            className="flex min-h-8 cursor-pointer items-center rounded-l-lg border-none bg-components-input-bg-normal px-2 py-1 outline-hidden hover:bg-state-base-hover-alt focus-visible:ring-2 focus-visible:ring-state-accent-solid data-popup-open:bg-state-base-hover-alt! data-popup-open:hover:bg-state-base-hover-alt"
           >
             <div className="flex items-center gap-0.5 px-1">
               <div className="system-sm-regular text-text-tertiary">{t('filter.sortBy', { ns: 'appLog' })}</div>
@@ -47,12 +46,12 @@ function Sort({
                 {triggerContent}
               </div>
             </div>
-            <RiArrowDownSLine className="size-4 text-text-tertiary" />
+            <span aria-hidden className="i-ri-arrow-down-s-line size-4 text-text-tertiary" />
           </DropdownMenuTrigger>
           <DropdownMenuContent
             placement="bottom-start"
             sideOffset={4}
-            popupClassName="relative w-[240px] rounded-xl border-[0.5px] bg-components-panel-bg-blur p-0"
+            popupClassName="relative w-[240px] rounded-xl bg-components-panel-bg-blur p-0"
           >
             <DropdownMenuRadioGroup
               value={value}
@@ -64,10 +63,10 @@ function Sort({
                   key={item.value}
                   value={item.value}
                   closeOnClick
-                  className="gap-2 rounded-lg px-2 py-[6px] pl-3"
+                  className="mx-0 gap-2 rounded-lg px-2 py-[6px]"
                 >
                   <div title={item.name} className="grow truncate system-sm-medium text-text-secondary">{item.name}</div>
-                  {value === item.value && <RiCheckLine className="size-4 shrink-0 text-util-colors-blue-light-blue-light-600" />}
+                  {value === item.value && <span aria-hidden className="i-ri-check-line size-4 shrink-0 text-util-colors-blue-light-blue-light-600" />}
                 </DropdownMenuRadioItem>
               ))}
             </DropdownMenuRadioGroup>
@@ -77,11 +76,11 @@ function Sort({
       <button
         type="button"
         aria-label={t(`filter.${order ? 'ascending' : 'descending'}`, { ns: 'appLog' })}
-        className="ml-px cursor-pointer rounded-r-lg border-none bg-components-button-tertiary-bg p-2 hover:bg-components-button-tertiary-bg-hover focus-visible:ring-1 focus-visible:ring-components-input-border-active focus-visible:outline-hidden"
+        className="ml-px cursor-pointer rounded-r-lg border-none bg-components-button-tertiary-bg p-2 outline-hidden hover:bg-components-button-tertiary-bg-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid"
         onClick={() => onSelect(`${order ? '' : '-'}${value}`)}
       >
-        {!order && <RiSortAsc className="size-4 text-components-button-tertiary-text" aria-hidden="true" />}
-        {order && <RiSortDesc className="size-4 text-components-button-tertiary-text" aria-hidden="true" />}
+        {!order && <span aria-hidden className="i-ri-sort-asc size-4 text-components-button-tertiary-text" />}
+        {order && <span aria-hidden className="i-ri-sort-desc size-4 text-components-button-tertiary-text" />}
       </button>
     </div>
 
diff --git a/web/app/components/base/zendesk/__tests__/utils.spec.ts b/web/app/components/base/zendesk/__tests__/utils.spec.ts
index 7697be3e3fd..da110ff8ecf 100644
--- a/web/app/components/base/zendesk/__tests__/utils.spec.ts
+++ b/web/app/components/base/zendesk/__tests__/utils.spec.ts
@@ -10,6 +10,7 @@ describe('zendesk/utils', () => {
   })
 
   afterEach(() => {
+    vi.useRealTimers()
     // Clean up window.zE after each test
     window.zE = mockZE
   })
@@ -120,4 +121,40 @@ describe('zendesk/utils', () => {
       expect(window.zE).not.toHaveBeenCalled()
     })
   })
+
+  describe('openZendeskWindow', () => {
+    it('should show and open messenger when zE exists', async () => {
+      vi.doMock('@/config', () => ({ IS_CE_EDITION: false }))
+      const { openZendeskWindow } = await import('../utils')
+
+      openZendeskWindow()
+
+      expect(window.zE).toHaveBeenCalledWith('messenger', 'show')
+      expect(window.zE).toHaveBeenCalledWith('messenger', 'open')
+    })
+
+    it('should retry opening until zE is ready', async () => {
+      vi.useFakeTimers()
+      vi.doMock('@/config', () => ({ IS_CE_EDITION: false }))
+      const { openZendeskWindow } = await import('../utils')
+
+      window.zE = undefined
+      openZendeskWindow({ interval: 10, retries: 2 })
+      window.zE = mockZE
+      vi.advanceTimersByTime(10)
+
+      expect(window.zE).toHaveBeenCalledWith('messenger', 'show')
+      expect(window.zE).toHaveBeenCalledWith('messenger', 'open')
+      vi.useRealTimers()
+    })
+
+    it('should not call window.zE when IS_CE_EDITION is true', async () => {
+      vi.doMock('@/config', () => ({ IS_CE_EDITION: true }))
+      const { openZendeskWindow } = await import('../utils')
+
+      openZendeskWindow()
+
+      expect(window.zE).not.toHaveBeenCalled()
+    })
+  })
 })
diff --git a/web/app/components/base/zendesk/utils.ts b/web/app/components/base/zendesk/utils.ts
index 35f3da74113..825cd887569 100644
--- a/web/app/components/base/zendesk/utils.ts
+++ b/web/app/components/base/zendesk/utils.ts
@@ -2,7 +2,7 @@ import { IS_CE_EDITION } from '@/config'
 
 type ConversationField = {
   id: string
-  value: any
+  value: unknown
 }
 
 declare global {
@@ -11,13 +11,13 @@ declare global {
     zE?: (
       command: string,
       value: string,
-      payload?: ConversationField[] | string | string[] | (() => any),
-      callback?: () => any,
+      payload?: ConversationField[] | string | string[] | (() => unknown),
+      callback?: () => unknown,
     ) => void
   }
 }
 
-export const setZendeskConversationFields = (fields: ConversationField[], callback?: () => any) => {
+export const setZendeskConversationFields = (fields: ConversationField[], callback?: () => unknown) => {
   if (!IS_CE_EDITION && window.zE)
     window.zE('messenger:set', 'conversationFields', fields, callback)
 }
@@ -31,3 +31,35 @@ export const toggleZendeskWindow = (open: boolean) => {
   if (!IS_CE_EDITION && window.zE)
     window.zE('messenger', open ? 'open' : 'close')
 }
+
+type OpenZendeskWindowOptions = {
+  interval?: number
+  retries?: number
+}
+
+const openZendeskWindowOnce = () => {
+  if (IS_CE_EDITION || !window.zE)
+    return false
+
+  window.zE('messenger', 'show')
+  window.zE('messenger', 'open')
+  return true
+}
+
+export const openZendeskWindow = ({
+  interval = 100,
+  retries = 20,
+}: OpenZendeskWindowOptions = {}) => {
+  if (IS_CE_EDITION)
+    return
+
+  if (openZendeskWindowOnce())
+    return
+
+  let attempts = 0
+  const timer = window.setInterval(() => {
+    attempts += 1
+    if (openZendeskWindowOnce() || attempts >= retries)
+      window.clearInterval(timer)
+  }, interval)
+}
diff --git a/web/app/components/datasets/access-config/__tests__/index.spec.tsx b/web/app/components/datasets/access-config/__tests__/index.spec.tsx
index e93c0ef9433..eeeec0dcf88 100644
--- a/web/app/components/datasets/access-config/__tests__/index.spec.tsx
+++ b/web/app/components/datasets/access-config/__tests__/index.spec.tsx
@@ -1,5 +1,6 @@
 import type { AccessRulesEditorProps } from '@/app/components/access-rules-editor'
-import { render, screen } from '@testing-library/react'
+import { screen } from '@testing-library/react'
+import { renderWithSystemFeatures } from '@/__tests__/utils/mock-system-features'
 import {
   useDatasetAccessRules,
   useDatasetUserAccessSettings,
@@ -27,6 +28,14 @@ const mockAppContextState = vi.hoisted(() => ({
   workspacePermissionKeys: [] as string[],
 }))
 
+let mockIsRbacEnabled = true
+
+const render = (ui: Parameters<typeof renderWithSystemFeatures>[0]) => renderWithSystemFeatures(ui, {
+  systemFeatures: {
+    rbac_enabled: mockIsRbacEnabled,
+  },
+})
+
 const mockAccessRulesEditor = vi.hoisted(() => ({
   props: null as AccessRulesEditorProps | null,
 }))
@@ -93,6 +102,7 @@ describe('DatasetAccessConfigPage', () => {
     }
     mockAppContextState.userProfile = { id: 'user-1' }
     mockAppContextState.workspacePermissionKeys = []
+    mockIsRbacEnabled = true
     mockAccessRulesEditor.props = null
   })
 
@@ -162,6 +172,16 @@ describe('DatasetAccessConfigPage', () => {
       expect(vi.mocked(useDatasetUserAccessSettings)).toHaveBeenCalledWith('dataset-1', expect.any(String), { enabled: false })
     })
 
+    it('should disable access config queries and hide the editor when RBAC is disabled', () => {
+      mockIsRbacEnabled = false
+
+      render(<DatasetAccessConfigPage datasetId="dataset-1" />)
+
+      expect(screen.queryByTestId('access-rules-editor')).not.toBeInTheDocument()
+      expect(vi.mocked(useDatasetAccessRules)).toHaveBeenCalledWith('dataset-1', expect.any(String), { enabled: false })
+      expect(vi.mocked(useDatasetUserAccessSettings)).toHaveBeenCalledWith('dataset-1', expect.any(String), { enabled: false })
+    })
+
     it('should wire open scope and user policy updates', () => {
       render(<DatasetAccessConfigPage datasetId="dataset-1" />)
 
diff --git a/web/app/components/datasets/access-config/index.tsx b/web/app/components/datasets/access-config/index.tsx
index fd9a851ccf1..b1df8e3eea7 100644
--- a/web/app/components/datasets/access-config/index.tsx
+++ b/web/app/components/datasets/access-config/index.tsx
@@ -2,6 +2,7 @@
 
 import type { ResourceOpenScope } from '@/models/access-control'
 import { ScrollArea } from '@langgenius/dify-ui/scroll-area'
+import { useSuspenseQuery } from '@tanstack/react-query'
 import { useCallback, useMemo, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import AccessRulesEditor from '@/app/components/access-rules-editor'
@@ -9,6 +10,7 @@ import Loading from '@/app/components/base/loading'
 import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { useDatasetDetailContextWithSelector } from '@/context/dataset-detail'
 import { useLocale } from '@/context/i18n'
+import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import { getAccessControlTemplateLanguage } from '@/i18n-config/language'
 import {
   useDatasetAccessRules,
@@ -30,11 +32,14 @@ const DatasetAccessConfigPage = ({ datasetId }: DatasetAccessConfigPageProps) =>
   const dataset = useDatasetDetailContextWithSelector(state => state.dataset)
   const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
   const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
+  const isRbacEnabled = systemFeatures.rbac_enabled
   const canAccessConfig = useMemo(() => getDatasetACLCapabilities(dataset?.permission_keys, {
     currentUserId,
     resourceMaintainer: dataset?.maintainer,
     workspacePermissionKeys,
-  }).canAccessConfig, [currentUserId, dataset?.maintainer, dataset?.permission_keys, workspacePermissionKeys])
+    isRbacEnabled,
+  }).canAccessConfig, [currentUserId, dataset?.maintainer, dataset?.permission_keys, isRbacEnabled, workspacePermissionKeys])
   const { data: datasetAccessRulesResponse, isLoading: isLoadingDatasetAccessRules } = useDatasetAccessRules(datasetId, language, { enabled: canAccessConfig })
   const { data: datasetUserAccessSettingsResponse, isLoading: isLoadingDatasetUserAccessSettings } = useDatasetUserAccessSettings(datasetId, language, { enabled: canAccessConfig })
   const { mutate: updateDatasetOpenScope, isPending: isUpdatingDatasetOpenScope } = useUpdateDatasetOpenScope(datasetId)
diff --git a/web/app/components/datasets/documents/detail/completed/common/drawer.tsx b/web/app/components/datasets/documents/detail/completed/common/drawer.tsx
index 86c40a73677..dac3cef9f2d 100644
--- a/web/app/components/datasets/documents/detail/completed/common/drawer.tsx
+++ b/web/app/components/datasets/documents/detail/completed/common/drawer.tsx
@@ -1,4 +1,4 @@
-import type { ComponentProps, ReactNode } from 'react'
+import type { ReactNode } from 'react'
 import { cn } from '@langgenius/dify-ui/cn'
 import {
   Drawer,
@@ -11,7 +11,6 @@ import {
 
 type DrawerSide = 'right' | 'left' | 'bottom' | 'top'
 type DrawerSwipeDirection = 'right' | 'left' | 'down' | 'up'
-type DrawerOpenChange = NonNullable<ComponentProps<typeof Drawer>['onOpenChange']>
 
 type CompletedDrawerProps = {
   open: boolean
@@ -47,16 +46,6 @@ export function CompletedDrawer({
   panelContentClassName,
   modal = false,
 }: CompletedDrawerProps) {
-  const handleOpenChange: DrawerOpenChange = (nextOpen, eventDetails) => {
-    if (nextOpen)
-      return
-
-    if (eventDetails.reason === 'focus-out' || eventDetails.reason === 'outside-press')
-      return
-
-    onClose()
-  }
-
   if (!open)
     return null
 
@@ -66,7 +55,7 @@ export function CompletedDrawer({
       modal={modal}
       swipeDirection={SIDE_TO_SWIPE_DIRECTION[side]}
       disablePointerDismissal
-      onOpenChange={handleOpenChange}
+      onOpenChange={nextOpen => !nextOpen && onClose()}
     >
       <DrawerPortal>
         {modal && (
diff --git a/web/app/components/datasets/external-knowledge-base/create/__tests__/index.spec.tsx b/web/app/components/datasets/external-knowledge-base/create/__tests__/index.spec.tsx
index e58f1796953..d92bf20da36 100644
--- a/web/app/components/datasets/external-knowledge-base/create/__tests__/index.spec.tsx
+++ b/web/app/components/datasets/external-knowledge-base/create/__tests__/index.spec.tsx
@@ -17,7 +17,7 @@ vi.mock('@/next/navigation', () => ({
 
 // Mock useDocLink hook
 vi.mock('@/context/i18n', () => ({
-  useDocLink: () => (path?: string) => `https://docs.dify.ai/en${path || ''}`,
+  useDocLink: () => (path?: string) => `https://docs.dify.ai/en${path?.startsWith('/use-dify/') ? `/cloud${path}` : path || ''}`,
 }))
 
 // Mock external context providers (these are external dependencies)
@@ -155,7 +155,7 @@ describe('ExternalKnowledgeBaseCreate', () => {
       renderComponent()
 
       const docLink = screen.getByText('dataset.connectHelper.helper4')
-      expect(docLink)!.toHaveAttribute('href', 'https://docs.dify.ai/en/use-dify/knowledge/connect-external-knowledge-base')
+      expect(docLink)!.toHaveAttribute('href', 'https://docs.dify.ai/en/cloud/use-dify/knowledge/connect-external-knowledge-base')
       expect(docLink)!.toHaveAttribute('target', '_blank')
       expect(docLink)!.toHaveAttribute('rel', 'noopener noreferrer')
     })
diff --git a/web/app/components/datasets/list/dataset-card/__tests__/index.spec.tsx b/web/app/components/datasets/list/dataset-card/__tests__/index.spec.tsx
index 4f85e926ea7..46fe308a720 100644
--- a/web/app/components/datasets/list/dataset-card/__tests__/index.spec.tsx
+++ b/web/app/components/datasets/list/dataset-card/__tests__/index.spec.tsx
@@ -4,6 +4,7 @@ import * as React from 'react'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { IndexingType } from '@/app/components/datasets/create/step-two'
 import { ChunkingMode, DatasetPermission, DataSourceType } from '@/models/datasets'
+import { DatasetACLPermission } from '@/utils/permission'
 import DatasetCardFooter from '../components/dataset-card-footer'
 import Description from '../components/description'
 import DatasetCard from '../index'
@@ -21,6 +22,23 @@ vi.mock('@/hooks/use-format-time-from-now', () => ({
 const mockPush = vi.fn()
 const mockOpenAccessConfig = vi.fn()
 const mockCloseAccessConfig = vi.fn()
+const toastMocks = vi.hoisted(() => {
+  const record = vi.fn()
+  const api = Object.assign(vi.fn((message: unknown, options?: Record<string, unknown>) => record({ message, ...options })), {
+    success: vi.fn((message: unknown, options?: Record<string, unknown>) => record({ type: 'success', message, ...options })),
+    error: vi.fn((message: unknown, options?: Record<string, unknown>) => record({ type: 'error', message, ...options })),
+    warning: vi.fn((message: unknown, options?: Record<string, unknown>) => record({ type: 'warning', message, ...options })),
+    info: vi.fn((message: unknown, options?: Record<string, unknown>) => record({ type: 'info', message, ...options })),
+    dismiss: vi.fn(),
+    update: vi.fn(),
+    promise: vi.fn(),
+  })
+  return { record, api }
+})
+
+vi.mock('@langgenius/dify-ui/toast', () => ({
+  toast: toastMocks.api,
+}))
 
 vi.mock('@/next/navigation', () => ({
   useRouter: () => ({ push: mockPush }),
@@ -263,6 +281,11 @@ describe('DatasetCard Integration', () => {
 describe('DatasetCard Component', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockAppContextState = {
+      isCurrentWorkspaceDatasetOperator: false,
+      userProfile: { id: 'user-1' },
+      workspacePermissionKeys: [],
+    }
   })
 
   it('should render and navigate to documents when clicked', () => {
@@ -273,6 +296,52 @@ describe('DatasetCard Component', () => {
     expect(mockPush).toHaveBeenCalledWith('/datasets/dataset-1/documents')
   })
 
+  it('should render preview-only dataset as a dimmed information-only card', () => {
+    const dataset = createMockDataset({
+      name: 'Preview Only Dataset',
+      permission_keys: [DatasetACLPermission.Preview],
+      tags: [{ id: 'tag-preview', name: 'Readonly Tag', type: 'knowledge' as const, binding_count: 0 }],
+    })
+    render(<DatasetCard dataset={dataset} />)
+
+    const card = screen.getByRole('button', { name: 'Preview Only Dataset' })
+    expect(card).toHaveClass('opacity-60')
+    expect(card).toHaveAttribute('aria-disabled', 'true')
+    expect(screen.getByText('Preview Only Dataset')).toBeInTheDocument()
+    const tagArea = screen.getByTestId('tag-area')
+    expect(tagArea).toHaveAttribute('data-can-bind-or-unbind-tags', 'false')
+    expect(screen.queryByTestId('operations-dropdown')).not.toBeInTheDocument()
+
+    fireEvent.click(tagArea)
+
+    expect(mockPush).not.toHaveBeenCalled()
+    expect(toastMocks.record).not.toHaveBeenCalled()
+
+    fireEvent.click(card)
+
+    expect(mockPush).not.toHaveBeenCalled()
+    expect(toastMocks.record).toHaveBeenCalledWith({
+      type: 'warning',
+      message: 'app.noAccessResourcePermission',
+    })
+  })
+
+  it('should not navigate preview-only external dataset to a detail page', () => {
+    const dataset = createMockDataset({
+      provider: 'external',
+      permission_keys: [DatasetACLPermission.Preview],
+    })
+    render(<DatasetCard dataset={dataset} />)
+
+    fireEvent.click(screen.getByRole('button', { name: 'Test Dataset' }))
+
+    expect(mockPush).not.toHaveBeenCalled()
+    expect(toastMocks.record).toHaveBeenCalledWith({
+      type: 'warning',
+      message: 'app.noAccessResourcePermission',
+    })
+  })
+
   it('should use the hover background treatment', () => {
     const dataset = createMockDataset()
     render(<DatasetCard dataset={dataset} />)
@@ -338,6 +407,19 @@ describe('DatasetCard Component', () => {
     expect(screen.getByTestId('tag-area')).toHaveAttribute('data-can-bind-or-unbind-tags', 'true')
   })
 
+  it('should allow tag binding with workspace dataset tag management permission', () => {
+    mockAppContextState = {
+      isCurrentWorkspaceDatasetOperator: false,
+      userProfile: { id: 'user-1' },
+      workspacePermissionKeys: ['dataset.tag.manage'],
+    }
+    const dataset = createMockDataset({ permission_keys: ['dataset.acl.readonly'] })
+
+    render(<DatasetCard dataset={dataset} />)
+
+    expect(screen.getByTestId('tag-area')).toHaveAttribute('data-can-bind-or-unbind-tags', 'true')
+  })
+
   it('should not allow tag binding when dataset lacks edit ACL', () => {
     const dataset = createMockDataset({ permission_keys: ['dataset.acl.readonly'] })
 
diff --git a/web/app/components/datasets/list/dataset-card/components/__tests__/operations-dropdown.spec.tsx b/web/app/components/datasets/list/dataset-card/components/__tests__/operations-dropdown.spec.tsx
index 5a6303d83e9..e15135b4281 100644
--- a/web/app/components/datasets/list/dataset-card/components/__tests__/operations-dropdown.spec.tsx
+++ b/web/app/components/datasets/list/dataset-card/components/__tests__/operations-dropdown.spec.tsx
@@ -1,11 +1,29 @@
 import type { DataSet } from '@/models/datasets'
-import { fireEvent, render, screen } from '@testing-library/react'
+import { fireEvent, screen } from '@testing-library/react'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { renderWithSystemFeatures } from '@/__tests__/utils/mock-system-features'
 import { IndexingType } from '@/app/components/datasets/create/step-two'
 import { ChunkingMode, DatasetPermission, DataSourceType } from '@/models/datasets'
 import { DatasetACLPermission } from '@/utils/permission'
 import OperationsDropdown from '../operations-dropdown'
 
+const mockAppContextState = vi.hoisted(() => ({
+  userProfile: { id: 'user-1' },
+  workspacePermissionKeys: [] as string[],
+}))
+
+let mockIsRbacEnabled = true
+
+const render = (ui: Parameters<typeof renderWithSystemFeatures>[0]) => renderWithSystemFeatures(ui, {
+  systemFeatures: {
+    rbac_enabled: mockIsRbacEnabled,
+  },
+})
+
+vi.mock('@/context/app-context', () => ({
+  useSelector: vi.fn((selector: (state: typeof mockAppContextState) => unknown) => selector(mockAppContextState)),
+}))
+
 describe('OperationsDropdown', () => {
   const createMockDataset = (overrides: Partial<DataSet> = {}): DataSet => ({
     id: 'dataset-1',
@@ -45,6 +63,9 @@ describe('OperationsDropdown', () => {
 
   beforeEach(() => {
     vi.clearAllMocks()
+    mockAppContextState.userProfile = { id: 'user-1' }
+    mockAppContextState.workspacePermissionKeys = []
+    mockIsRbacEnabled = true
   })
 
   describe('Rendering', () => {
@@ -119,6 +140,19 @@ describe('OperationsDropdown', () => {
 
       expect(screen.getByText('common.settings.resourceAccess')).toBeInTheDocument()
     })
+
+    it('should hide resource access option when RBAC is disabled', () => {
+      mockIsRbacEnabled = false
+      const dataset = createMockDataset({
+        permission_keys: [DatasetACLPermission.AccessConfig, DatasetACLPermission.Delete],
+      })
+      render(<OperationsDropdown {...defaultProps} dataset={dataset} />)
+
+      fireEvent.click(screen.getByLabelText('Dataset operations'))
+
+      expect(screen.getByText('common.operation.delete')).toBeInTheDocument()
+      expect(screen.queryByText('common.settings.resourceAccess')).not.toBeInTheDocument()
+    })
   })
 
   describe('Styles', () => {
diff --git a/web/app/components/datasets/list/dataset-card/components/operations-dropdown.tsx b/web/app/components/datasets/list/dataset-card/components/operations-dropdown.tsx
index 4032810a07a..4c7ded2651e 100644
--- a/web/app/components/datasets/list/dataset-card/components/operations-dropdown.tsx
+++ b/web/app/components/datasets/list/dataset-card/components/operations-dropdown.tsx
@@ -5,8 +5,10 @@ import {
   DropdownMenuContent,
   DropdownMenuTrigger,
 } from '@langgenius/dify-ui/dropdown-menu'
+import { useSuspenseQuery } from '@tanstack/react-query'
 import * as React from 'react'
 import { useSelector as useAppContextWithSelector } from '@/context/app-context'
+import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import { getDatasetACLCapabilities } from '@/utils/permission'
 import Operations from '../operations'
 
@@ -28,11 +30,14 @@ const OperationsDropdown = ({
   const [open, setOpen] = React.useState(false)
   const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
   const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
+  const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
+  const isRbacEnabled = systemFeatures.rbac_enabled
   const datasetACLCapabilities = React.useMemo(() => getDatasetACLCapabilities(dataset.permission_keys, {
     currentUserId,
     resourceMaintainer: dataset.maintainer,
     workspacePermissionKeys,
-  }), [dataset.maintainer, dataset.permission_keys, currentUserId, workspacePermissionKeys])
+    isRbacEnabled,
+  }), [dataset.maintainer, dataset.permission_keys, currentUserId, isRbacEnabled, workspacePermissionKeys])
   const canShowOperations = datasetACLCapabilities.canEdit
     || datasetACLCapabilities.canImportExportDSL
     || datasetACLCapabilities.canAccessConfig
diff --git a/web/app/components/datasets/list/dataset-card/index.tsx b/web/app/components/datasets/list/dataset-card/index.tsx
index aee6b54fd93..0e03449aaf5 100644
--- a/web/app/components/datasets/list/dataset-card/index.tsx
+++ b/web/app/components/datasets/list/dataset-card/index.tsx
@@ -1,10 +1,14 @@
 'use client'
+import type { KeyboardEvent, MouseEvent } from 'react'
 import type { DataSet } from '@/models/datasets'
+import { cn } from '@langgenius/dify-ui/cn'
+import { toast } from '@langgenius/dify-ui/toast'
 import { useMemo } from 'react'
+import { useTranslation } from 'react-i18next'
 import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { DatasetCardTags } from '@/features/tag-management/components/dataset-card-tags'
 import { useRouter } from '@/next/navigation'
-import { getDatasetACLCapabilities } from '@/utils/permission'
+import { getDatasetACLCapabilities, hasOnlyDatasetPreviewPermission, hasPermission } from '@/utils/permission'
 import CornerLabels from './components/corner-labels'
 import DatasetCardFooter from './components/dataset-card-footer'
 import DatasetCardHeader from './components/dataset-card-header'
@@ -26,6 +30,7 @@ const DatasetCard = ({
   onSuccess,
   onOpenTagManagement = () => {},
 }: DatasetCardProps) => {
+  const { t } = useTranslation()
   const { push } = useRouter()
   const currentUserId = useAppContextWithSelector(state => state.userProfile?.id)
   const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
@@ -47,14 +52,26 @@ const DatasetCard = ({
   const isPipelineUnpublished = useMemo(() => {
     return dataset.runtime_mode === 'rag_pipeline' && !dataset.is_published
   }, [dataset.runtime_mode, dataset.is_published])
+  const isPreviewOnly = hasOnlyDatasetPreviewPermission(dataset.permission_keys)
   const datasetACLCapabilities = useMemo(() => getDatasetACLCapabilities(dataset.permission_keys, {
     currentUserId,
     resourceMaintainer: dataset.maintainer,
     workspacePermissionKeys,
   }), [dataset.maintainer, dataset.permission_keys, currentUserId, workspacePermissionKeys])
+  const canManageAppTags = hasPermission(workspacePermissionKeys, 'dataset.tag.manage')
+  const canBindOrUnbindTags = !isPreviewOnly && (canManageAppTags || datasetACLCapabilities.canEdit)
 
-  const handleCardClick = (e: React.MouseEvent) => {
+  const showPreviewOnlyAccessWarning = () => {
+    toast.warning(t('noAccessResourcePermission', { ns: 'app' }))
+  }
+
+  const handleCardClick = (e: MouseEvent) => {
     e.preventDefault()
+    if (isPreviewOnly) {
+      showPreviewOnlyAccessWarning()
+      return
+    }
+
     if (isExternalProvider) {
       push(datasetACLCapabilities.canRetrievalRecall
         ? `/datasets/${dataset.id}/hitTesting`
@@ -68,17 +85,36 @@ const DatasetCard = ({
     }
   }
 
-  const handleTagAreaClick = (e: React.MouseEvent) => {
+  const handlePreviewOnlyCardKeyDown = (e: KeyboardEvent<HTMLElement>) => {
+    if (!isPreviewOnly || (e.key !== 'Enter' && e.key !== ' '))
+      return
+
+    e.preventDefault()
+    showPreviewOnlyAccessWarning()
+  }
+
+  const handleTagAreaClick = (e: MouseEvent) => {
     e.stopPropagation()
     e.preventDefault()
   }
+  const cardClassName = cn(
+    'group relative col-span-1 flex h-41.5 flex-col overflow-hidden rounded-xl border-[0.5px] border-solid border-components-card-border bg-components-card-bg shadow-xs shadow-shadow-shadow-3 transition-[background-color,box-shadow] duration-200 ease-in-out',
+    isPreviewOnly
+      ? 'cursor-not-allowed opacity-60 focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden'
+      : 'cursor-pointer hover:bg-components-card-bg-alt hover:shadow-md hover:shadow-shadow-shadow-5',
+  )
 
   return (
     <>
       <div
-        className="group relative col-span-1 flex h-41.5 cursor-pointer flex-col overflow-hidden rounded-xl border-[0.5px] border-solid border-components-card-border bg-components-card-bg shadow-xs shadow-shadow-shadow-3 transition-[background-color,box-shadow] duration-200 ease-in-out hover:bg-components-card-bg-alt hover:shadow-md hover:shadow-shadow-shadow-5"
+        role={isPreviewOnly ? 'button' : undefined}
+        tabIndex={isPreviewOnly ? 0 : undefined}
+        aria-disabled={isPreviewOnly ? 'true' : undefined}
+        aria-label={isPreviewOnly ? dataset.name : undefined}
+        className={cardClassName}
         data-disable-nprogress={true}
         onClick={handleCardClick}
+        onKeyDown={handlePreviewOnlyCardKeyDown}
       >
         <CornerLabels dataset={dataset} />
         <DatasetCardHeader dataset={dataset} />
@@ -90,16 +126,18 @@ const DatasetCard = ({
           onClick={handleTagAreaClick}
           onOpenTagManagement={onOpenTagManagement}
           onTagsChange={onSuccess}
-          canBindOrUnbindTags={datasetACLCapabilities.canEdit}
+          canBindOrUnbindTags={canBindOrUnbindTags}
         />
         <DatasetCardFooter dataset={dataset} />
-        <OperationsDropdown
-          dataset={dataset}
-          openRenameModal={openRenameModal}
-          handleExportPipeline={handleExportPipeline}
-          detectIsUsedByApp={detectIsUsedByApp}
-          openAccessConfig={openAccessConfig}
-        />
+        {!isPreviewOnly && (
+          <OperationsDropdown
+            dataset={dataset}
+            openRenameModal={openRenameModal}
+            handleExportPipeline={handleExportPipeline}
+            detectIsUsedByApp={detectIsUsedByApp}
+            openAccessConfig={openAccessConfig}
+          />
+        )}
       </div>
       <DatasetCardModals
         dataset={dataset}
diff --git a/web/app/components/datasets/preview/__tests__/container.spec.tsx b/web/app/components/datasets/preview/__tests__/container.spec.tsx
index 473d91f8574..9f7ff17522a 100644
--- a/web/app/components/datasets/preview/__tests__/container.spec.tsx
+++ b/web/app/components/datasets/preview/__tests__/container.spec.tsx
@@ -2,7 +2,7 @@ import { render, screen } from '@testing-library/react'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import PreviewContainer from '../container'
 
-// Tests for PreviewContainer - a layout wrapper with header and scrollable main area
+// Tests for PreviewContainer - a layout wrapper with header and scrollable content area
 describe('PreviewContainer', () => {
   beforeEach(() => {
     vi.clearAllMocks()
@@ -17,11 +17,11 @@ describe('PreviewContainer', () => {
       expect(headerEl)!.toBeInTheDocument()
     })
 
-    it('should render children in a main element', () => {
-      render(<PreviewContainer header="Header">Main content</PreviewContainer>)
+    it('should render children in the content area', () => {
+      render(<PreviewContainer header="Header" data-testid="inner-container">Main content</PreviewContainer>)
 
-      const mainEl = screen.getByRole('main')
-      expect(mainEl)!.toHaveTextContent('Main content')
+      const contentEl = screen.getByTestId('inner-container').lastElementChild
+      expect(contentEl)!.toHaveTextContent('Main content')
     })
 
     it('should render both header and children simultaneously', () => {
@@ -36,10 +36,11 @@ describe('PreviewContainer', () => {
     })
 
     it('should render without children', () => {
-      render(<PreviewContainer header="Header" />)
+      render(<PreviewContainer header="Header" data-testid="inner-container" />)
 
-      expect(screen.getByRole('main'))!.toBeInTheDocument()
-      expect(screen.getByRole('main').childElementCount).toBe(0)
+      const contentEl = screen.getByTestId('inner-container').lastElementChild
+      expect(contentEl)!.toBeInTheDocument()
+      expect(contentEl!.childElementCount).toBe(0)
     })
   })
 
@@ -52,16 +53,14 @@ describe('PreviewContainer', () => {
       expect(container.firstElementChild)!.toHaveClass('outer-class')
     })
 
-    it('should apply mainClassName to the main element', () => {
+    it('should apply mainClassName to the content area', () => {
       render(
-        <PreviewContainer header="Header" mainClassName="custom-main">Content</PreviewContainer>,
+        <PreviewContainer header="Header" mainClassName="custom-main" data-testid="inner-container">Content</PreviewContainer>,
       )
 
-      const mainEl = screen.getByRole('main')
-      expect(mainEl)!.toHaveClass('custom-main')
-      // Default classes should still be present
-      // Default classes should still be present
-      expect(mainEl)!.toHaveClass('w-full', 'grow', 'overflow-y-auto', 'px-6', 'py-5')
+      const contentEl = screen.getByTestId('inner-container').lastElementChild
+      expect(contentEl)!.toHaveClass('custom-main')
+      expect(contentEl)!.toHaveClass('w-full', 'grow', 'overflow-y-auto', 'px-6', 'py-5')
     })
 
     it('should forward ref to the inner container div', () => {
@@ -116,10 +115,10 @@ describe('PreviewContainer', () => {
       expect(inner)!.toHaveClass('flex', 'h-full', 'w-full', 'flex-col')
     })
 
-    it('should have main with overflow-y-auto for scrolling', () => {
-      render(<PreviewContainer header="Header">Content</PreviewContainer>)
+    it('should have content area with overflow-y-auto for scrolling', () => {
+      render(<PreviewContainer header="Header" data-testid="inner-container">Content</PreviewContainer>)
 
-      expect(screen.getByRole('main'))!.toHaveClass('overflow-y-auto')
+      expect(screen.getByTestId('inner-container').lastElementChild)!.toHaveClass('overflow-y-auto')
     })
   })
 
@@ -139,9 +138,9 @@ describe('PreviewContainer', () => {
     })
 
     it('should render with null children', () => {
-      render(<PreviewContainer header="Header">{null}</PreviewContainer>)
+      render(<PreviewContainer header="Header" data-testid="inner-container">{null}</PreviewContainer>)
 
-      expect(screen.getByRole('main'))!.toBeInTheDocument()
+      expect(screen.getByTestId('inner-container').lastElementChild)!.toBeInTheDocument()
     })
 
     it('should render with multiple children', () => {
diff --git a/web/app/components/datasets/preview/container.tsx b/web/app/components/datasets/preview/container.tsx
index 742c1e2ac15..c651de6c1f7 100644
--- a/web/app/components/datasets/preview/container.tsx
+++ b/web/app/components/datasets/preview/container.tsx
@@ -19,9 +19,9 @@ const PreviewContainer: FC<PreviewContainerProps> = (props) => {
         <header className="border-b border-divider-subtle pt-4 pr-4 pb-3 pl-5">
           {header}
         </header>
-        <main className={cn('w-full grow overflow-y-auto px-6 py-5', mainClassName)}>
+        <div className={cn('w-full grow overflow-y-auto px-6 py-5', mainClassName)}>
           {children}
-        </main>
+        </div>
       </div>
     </div>
   )
diff --git a/web/app/components/explore/app-list/__tests__/index.spec.tsx b/web/app/components/explore/app-list/__tests__/index.spec.tsx
index 0bc33b5a751..a11efc38143 100644
--- a/web/app/components/explore/app-list/__tests__/index.spec.tsx
+++ b/web/app/components/explore/app-list/__tests__/index.spec.tsx
@@ -34,6 +34,23 @@ let mockIsError = false
 const mockHandleImportDSL = vi.fn()
 const mockHandleImportDSLConfirm = vi.fn()
 const mockTrackCreateApp = vi.fn()
+const toastMocks = vi.hoisted(() => {
+  const record = vi.fn()
+  const api = Object.assign(vi.fn((message: unknown, options?: Record<string, unknown>) => record({ message, ...options })), {
+    success: vi.fn((message: unknown, options?: Record<string, unknown>) => record({ type: 'success', message, ...options })),
+    error: vi.fn((message: unknown, options?: Record<string, unknown>) => record({ type: 'error', message, ...options })),
+    warning: vi.fn((message: unknown, options?: Record<string, unknown>) => record({ type: 'warning', message, ...options })),
+    info: vi.fn((message: unknown, options?: Record<string, unknown>) => record({ type: 'info', message, ...options })),
+    dismiss: vi.fn(),
+    update: vi.fn(),
+    promise: vi.fn(),
+  })
+  return { record, api }
+})
+
+vi.mock('@langgenius/dify-ui/toast', () => ({
+  toast: toastMocks.api,
+}))
 
 vi.mock('@/service/use-explore', () => ({
   useLearnDifyAppList: () => ({
@@ -465,6 +482,36 @@ describe('AppList', () => {
       expect(screen.getByRole('link', { name: 'explore.continueWork.exploreStudio' })).toHaveAttribute('href', '/apps')
     })
 
+    it('should render preview-only continue work app as a dimmed card and warn on click', () => {
+      mockExploreData = {
+        categories: ['Writing'],
+        allList: [createApp()],
+      }
+      mockWorkspaceApps = [
+        createWorkspaceApp({
+          id: 'preview-app',
+          name: 'Preview Only App',
+          author_name: 'Readonly Author',
+          permission_keys: [AppACLPermission.Preview],
+        }),
+      ]
+
+      renderAppList()
+
+      const card = screen.getByRole('button', { name: 'Preview Only App' })
+      expect(card).toHaveClass('opacity-60')
+      expect(card).toHaveAttribute('aria-disabled', 'true')
+      expect(screen.queryByRole('link', { name: /Preview Only App/ })).not.toBeInTheDocument()
+      expect(screen.getByText('Readonly Author')).toBeInTheDocument()
+
+      fireEvent.click(card)
+
+      expect(toastMocks.record).toHaveBeenCalledWith({
+        type: 'warning',
+        message: 'app.noAccessResourcePermission',
+      })
+    })
+
     it('should hide continue work when there are no workspace apps', () => {
       mockExploreData = {
         categories: ['Writing'],
diff --git a/web/app/components/explore/continue-work/__tests__/item.spec.tsx b/web/app/components/explore/continue-work/__tests__/item.spec.tsx
new file mode 100644
index 00000000000..275ee584993
--- /dev/null
+++ b/web/app/components/explore/continue-work/__tests__/item.spec.tsx
@@ -0,0 +1,154 @@
+import type { AnchorHTMLAttributes, ReactNode } from 'react'
+import type { App } from '@/types/app'
+import { fireEvent, screen } from '@testing-library/react'
+import { renderWithSystemFeatures } from '@/__tests__/utils/mock-system-features'
+import { AccessMode } from '@/models/access-control'
+import { AppModeEnum } from '@/types/app'
+import { AppACLPermission } from '@/utils/permission'
+import ContinueWorkItem from '../item'
+
+const mockAppContext = vi.hoisted(() => ({
+  userProfile: { id: 'user-1' },
+  workspacePermissionKeys: ['app.create_and_management'],
+}))
+
+const mockFormatTimeFromNow = vi.hoisted(() => vi.fn(() => '5 minutes ago'))
+
+const toastMocks = vi.hoisted(() => ({
+  warning: vi.fn(),
+}))
+
+vi.mock('@/context/app-context', () => ({
+  useSelector: (selector: (state: typeof mockAppContext) => unknown) => selector(mockAppContext),
+}))
+
+vi.mock('@/hooks/use-format-time-from-now', () => ({
+  useFormatTimeFromNow: () => ({
+    formatTimeFromNow: mockFormatTimeFromNow,
+  }),
+}))
+
+vi.mock('@langgenius/dify-ui/toast', () => ({
+  toast: {
+    warning: toastMocks.warning,
+  },
+}))
+
+vi.mock('@/next/link', () => ({
+  default: ({
+    children,
+    href,
+    className,
+    ...props
+  }: AnchorHTMLAttributes<HTMLAnchorElement> & { children?: ReactNode, href: string }) => (
+    <a href={href} className={className} {...props}>{children}</a>
+  ),
+}))
+
+const createApp = (overrides: Partial<App> = {}): App => ({
+  id: 'app-1',
+  name: 'Continue App',
+  description: 'Continue app description',
+  author_name: 'Alice',
+  icon_type: 'emoji',
+  icon: '🤖',
+  icon_background: '#FFEAD5',
+  icon_url: null,
+  use_icon_as_answer_icon: false,
+  mode: AppModeEnum.CHAT,
+  enable_site: false,
+  enable_api: false,
+  api_rpm: 60,
+  api_rph: 3600,
+  is_demo: false,
+  model_config: {} as App['model_config'],
+  app_model_config: {} as App['app_model_config'],
+  created_at: 100,
+  maintainer: 'maintainer-1',
+  updated_at: 200,
+  site: {} as App['site'],
+  api_base_url: '',
+  tags: [],
+  access_mode: AccessMode.PUBLIC,
+  permission_keys: [AppACLPermission.Edit],
+  ...overrides,
+})
+
+const renderItem = (
+  app: App,
+  systemFeatures: NonNullable<Parameters<typeof renderWithSystemFeatures>[1]>['systemFeatures'] = { rbac_enabled: true },
+) => renderWithSystemFeatures(<ContinueWorkItem app={app} />, { systemFeatures })
+
+describe('ContinueWorkItem', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockAppContext.userProfile = { id: 'user-1' }
+    mockAppContext.workspacePermissionKeys = ['app.create_and_management']
+    mockFormatTimeFromNow.mockReturnValue('5 minutes ago')
+  })
+
+  it('should render a link to the app configuration page when the app is editable', () => {
+    renderItem(createApp())
+
+    const link = screen.getByRole('link', { name: /Continue App/ })
+
+    expect(link).toHaveAttribute('href', '/app/app-1/configuration')
+    expect(screen.getByText('Alice')).toBeInTheDocument()
+    expect(screen.getByText('explore.continueWork.editedAt:{"time":"5 minutes ago"}')).toBeInTheDocument()
+    expect(mockFormatTimeFromNow).toHaveBeenCalledWith(200000)
+  })
+
+  it('should use created time when updated time is missing', () => {
+    renderItem(createApp({ updated_at: 0, created_at: 123 }))
+
+    expect(mockFormatTimeFromNow).toHaveBeenCalledWith(123000)
+  })
+
+  it('should link to access config when RBAC is enabled and only access config permission is available', () => {
+    renderItem(createApp({ permission_keys: [AppACLPermission.AccessConfig] }))
+
+    expect(screen.getByRole('link', { name: /Continue App/ })).toHaveAttribute('href', '/app/app-1/access-config')
+  })
+
+  it('should fall back to develop when RBAC is disabled for an access-config-only app', () => {
+    renderItem(createApp({ permission_keys: [AppACLPermission.AccessConfig] }), { rbac_enabled: false })
+
+    expect(screen.getByRole('link', { name: /Continue App/ })).toHaveAttribute('href', '/app/app-1/develop')
+  })
+
+  it('should render preview-only apps as disabled buttons and warn on click', () => {
+    renderItem(createApp({ permission_keys: [AppACLPermission.Preview] }))
+
+    const card = screen.getByRole('button', { name: 'Continue App' })
+
+    expect(card).toHaveAttribute('aria-disabled', 'true')
+    expect(card).toHaveClass('cursor-not-allowed')
+    expect(card).toHaveClass('opacity-60')
+    expect(screen.queryByRole('link', { name: /Continue App/ })).not.toBeInTheDocument()
+
+    fireEvent.click(card)
+
+    expect(toastMocks.warning).toHaveBeenCalledWith('app.noAccessResourcePermission')
+  })
+
+  it('should warn when activating a preview-only app with Enter or Space', () => {
+    renderItem(createApp({ permission_keys: [AppACLPermission.Preview] }))
+
+    const card = screen.getByRole('button', { name: 'Continue App' })
+
+    fireEvent.keyDown(card, { key: 'Enter' })
+    fireEvent.keyDown(card, { key: ' ' })
+
+    expect(toastMocks.warning).toHaveBeenCalledTimes(2)
+    expect(toastMocks.warning).toHaveBeenNthCalledWith(1, 'app.noAccessResourcePermission')
+    expect(toastMocks.warning).toHaveBeenNthCalledWith(2, 'app.noAccessResourcePermission')
+  })
+
+  it('should ignore other keys on preview-only app cards', () => {
+    renderItem(createApp({ permission_keys: [AppACLPermission.Preview] }))
+
+    fireEvent.keyDown(screen.getByRole('button', { name: 'Continue App' }), { key: 'Escape' })
+
+    expect(toastMocks.warning).not.toHaveBeenCalled()
+  })
+})
diff --git a/web/app/components/explore/continue-work/item.tsx b/web/app/components/explore/continue-work/item.tsx
index 89f09d57a8f..570dae473c1 100644
--- a/web/app/components/explore/continue-work/item.tsx
+++ b/web/app/components/explore/continue-work/item.tsx
@@ -1,14 +1,19 @@
 'use client'
 
 import type { App } from '@/types/app'
+import { cn } from '@langgenius/dify-ui/cn'
+import { toast } from '@langgenius/dify-ui/toast'
+import { useSuspenseQuery } from '@tanstack/react-query'
 import * as React from 'react'
 import { useTranslation } from 'react-i18next'
 import { AppTypeIcon } from '@/app/components/app/type-selector'
 import AppIcon from '@/app/components/base/app-icon'
 import { useSelector as useAppContextSelector } from '@/context/app-context'
+import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import { useFormatTimeFromNow } from '@/hooks/use-format-time-from-now'
 import Link from '@/next/link'
 import { getRedirectionPath } from '@/utils/app-redirection'
+import { hasOnlyAppPreviewPermission } from '@/utils/permission'
 
 type ContinueWorkItemProps = {
   app: App
@@ -21,15 +26,35 @@ const ContinueWorkItem = ({
   const { formatTimeFromNow } = useFormatTimeFromNow()
   const currentUserId = useAppContextSelector(state => state.userProfile?.id)
   const workspacePermissionKeys = useAppContextSelector(state => state.workspacePermissionKeys)
+  const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
+  const isRbacEnabled = systemFeatures.rbac_enabled
   const updatedAt = (app.updated_at || app.created_at) * 1000
+  const isPreviewOnly = hasOnlyAppPreviewPermission(app.permission_keys)
   const href = getRedirectionPath(app, {
     currentUserId,
     resourceMaintainer: app.maintainer,
     workspacePermissionKeys,
+    isRbacEnabled,
   })
+  const cardClassName = cn(
+    'flex min-w-0 items-center gap-3 overflow-hidden rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-bg px-4 pt-4 pb-4 shadow-xs shadow-shadow-shadow-3',
+    isPreviewOnly && 'cursor-not-allowed opacity-60',
+  )
 
-  return (
-    <Link href={href} className="flex min-w-0 items-center gap-3 overflow-hidden rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-bg px-4 pt-4 pb-4 shadow-xs shadow-shadow-shadow-3">
+  const showPreviewOnlyAccessWarning = () => {
+    toast.warning(t('noAccessResourcePermission', { ns: 'app' }))
+  }
+
+  const handlePreviewOnlyCardKeyDown = (event: React.KeyboardEvent<HTMLElement>) => {
+    if (event.key !== 'Enter' && event.key !== ' ')
+      return
+
+    event.preventDefault()
+    showPreviewOnlyAccessWarning()
+  }
+
+  const cardContent = (
+    <>
       <div className="relative shrink-0">
         <AppIcon
           size="large"
@@ -54,6 +79,28 @@ const ContinueWorkItem = ({
           <span className="min-w-0 truncate">{t('continueWork.editedAt', { ns: 'explore', time: formatTimeFromNow(updatedAt) })}</span>
         </div>
       </div>
+    </>
+  )
+
+  if (isPreviewOnly) {
+    return (
+      <div
+        role="button"
+        tabIndex={0}
+        aria-label={app.name}
+        aria-disabled="true"
+        className={cardClassName}
+        onClick={showPreviewOnlyAccessWarning}
+        onKeyDown={handlePreviewOnlyCardKeyDown}
+      >
+        {cardContent}
+      </div>
+    )
+  }
+
+  return (
+    <Link href={href} className={cardClassName}>
+      {cardContent}
     </Link>
   )
 }
diff --git a/web/app/components/goto-anything/actions/commands/__tests__/direct-commands.spec.ts b/web/app/components/goto-anything/actions/commands/__tests__/direct-commands.spec.ts
index f14098e970f..205d93d4124 100644
--- a/web/app/components/goto-anything/actions/commands/__tests__/direct-commands.spec.ts
+++ b/web/app/components/goto-anything/actions/commands/__tests__/direct-commands.spec.ts
@@ -22,6 +22,7 @@ vi.mock('react-i18next', () => ({
 
 vi.mock('@/context/i18n', () => ({
   defaultDocBaseUrl: 'https://docs.dify.ai',
+  getDocHomePath: () => '/home',
 }))
 
 vi.mock('@/i18n-config/language', () => ({
@@ -45,7 +46,7 @@ describe('docsCommand', () => {
     docsCommand.execute?.()
 
     expect(openSpy).toHaveBeenCalledWith(
-      expect.stringContaining('https://docs.dify.ai'),
+      'https://docs.dify.ai/en/home',
       '_blank',
       'noopener,noreferrer',
     )
@@ -85,7 +86,11 @@ describe('docsCommand', () => {
     const handlers = vi.mocked(registerCommands).mock.calls[0]![0]
     await handlers['navigation.doc']!()
 
-    expect(openSpy).toHaveBeenCalledWith('https://docs.dify.ai/en', '_blank', 'noopener,noreferrer')
+    expect(openSpy).toHaveBeenCalledWith(
+      'https://docs.dify.ai/en/home',
+      '_blank',
+      'noopener,noreferrer',
+    )
     openSpy.mockRestore()
   })
 
diff --git a/web/app/components/goto-anything/actions/commands/docs.tsx b/web/app/components/goto-anything/actions/commands/docs.tsx
index 6de7a7f9797..f56e0579aff 100644
--- a/web/app/components/goto-anything/actions/commands/docs.tsx
+++ b/web/app/components/goto-anything/actions/commands/docs.tsx
@@ -2,13 +2,20 @@ import type { SlashCommandHandler } from './types'
 import { RiBookOpenLine } from '@remixicon/react'
 import * as React from 'react'
 import { getI18n } from 'react-i18next'
-import { defaultDocBaseUrl } from '@/context/i18n'
+import { defaultDocBaseUrl, getDocHomePath } from '@/context/i18n'
 import { getDocLanguage } from '@/i18n-config/language'
 import { registerCommands, unregisterCommands } from './command-bus'
 
 // Documentation command dependency types - no external dependencies needed
 type DocDeps = Record<string, never>
 
+const getDocsHomeUrl = () => {
+  const i18n = getI18n()
+  const currentLocale = i18n.language
+  const docLanguage = getDocLanguage(currentLocale)
+  return `${defaultDocBaseUrl}/${docLanguage}${getDocHomePath()}`
+}
+
 /**
  * Documentation command - Opens help documentation
  */
@@ -19,11 +26,7 @@ export const docsCommand: SlashCommandHandler<DocDeps> = {
 
   // Direct execution function
   execute: () => {
-    const i18n = getI18n()
-    const currentLocale = i18n.language
-    const docLanguage = getDocLanguage(currentLocale)
-    const url = `${defaultDocBaseUrl}/${docLanguage}`
-    window.open(url, '_blank', 'noopener,noreferrer')
+    window.open(getDocsHomeUrl(), '_blank', 'noopener,noreferrer')
   },
 
   async search(args: string, locale: string = 'en') {
@@ -43,14 +46,9 @@ export const docsCommand: SlashCommandHandler<DocDeps> = {
   },
 
   register(_deps: DocDeps) {
-    const i18n = getI18n()
     registerCommands({
       'navigation.doc': async (_args) => {
-        // Get the current language from i18n
-        const currentLocale = i18n.language
-        const docLanguage = getDocLanguage(currentLocale)
-        const url = `${defaultDocBaseUrl}/${docLanguage}`
-        window.open(url, '_blank', 'noopener,noreferrer')
+        window.open(getDocsHomeUrl(), '_blank', 'noopener,noreferrer')
       },
     })
   },
diff --git a/web/app/components/header/account-setting/__tests__/index.spec.tsx b/web/app/components/header/account-setting/__tests__/index.spec.tsx
index d59199769ed..ec1ac9887d2 100644
--- a/web/app/components/header/account-setting/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/__tests__/index.spec.tsx
@@ -183,11 +183,13 @@ describe('AccountSetting', () => {
     initialTab?: AccountSettingTab
     onCancel?: () => void
     onTabChange?: (tab: AccountSettingTab) => void
+    rbacEnabled?: boolean
   }) => {
     const {
       initialTab = ACCOUNT_SETTING_TAB.MEMBERS,
       onCancel = mockOnCancel,
       onTabChange = mockOnTabChange,
+      rbacEnabled = true,
     } = props ?? {}
 
     const StatefulAccountSetting = () => {
@@ -211,6 +213,7 @@ describe('AccountSetting', () => {
         branding: { enabled: false },
         enable_marketplace: true,
         enable_collaboration_mode: false,
+        rbac_enabled: rbacEnabled,
       },
     })
   }
@@ -404,6 +407,26 @@ describe('AccountSetting', () => {
       expect(screen.queryByRole('button', { name: 'common.settings.resourceAccess' })).not.toBeInTheDocument()
     })
 
+    it('should hide role and resource access entries when RBAC is disabled', () => {
+      // Act
+      renderAccountSetting({ rbacEnabled: false })
+
+      // Assert
+      expect(screen.getByRole('button', { name: 'common.settings.members' })).toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: 'common.settings.rolesAndPermissions' })).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: 'common.settings.resourceAccess' })).not.toBeInTheDocument()
+    })
+
+    it('should not render direct role pages when RBAC is disabled', () => {
+      // Act
+      renderAccountSetting({ initialTab: ACCOUNT_SETTING_TAB.ACCESS_RULES, rbacEnabled: false })
+
+      // Assert
+      expect(screen.queryByTestId('access-rules-page')).not.toBeInTheDocument()
+      expect(screen.queryByTestId('permissions-page')).not.toBeInTheDocument()
+      expect(screen.getAllByText('common.settings.members').length).toBeGreaterThan(0)
+    })
+
     it('should hide billing and custom tabs when disabled', () => {
       // Arrange
       vi.mocked(useProviderContext).mockReturnValue({
diff --git a/web/app/components/header/account-setting/api-based-extension-page/__tests__/empty.spec.tsx b/web/app/components/header/account-setting/api-based-extension-page/__tests__/empty.spec.tsx
index dbbd2dc07eb..5a7edff09bd 100644
--- a/web/app/components/header/account-setting/api-based-extension-page/__tests__/empty.spec.tsx
+++ b/web/app/components/header/account-setting/api-based-extension-page/__tests__/empty.spec.tsx
@@ -11,8 +11,8 @@ describe('Empty State', () => {
       expect(screen.getByText('common.apiBasedExtension.title')).toBeInTheDocument()
       const link = screen.getByText('common.apiBasedExtension.link')
       expect(link).toBeInTheDocument()
-      // The real useDocLink includes the language prefix (defaulting to /en in tests)
-      expect(link.closest('a')).toHaveAttribute('href', 'https://docs.dify.ai/en/use-dify/workspace/api-extension/api-extension')
+      // The real useDocLink includes language and product prefixes in tests.
+      expect(link.closest('a')).toHaveAttribute('href', 'https://docs.dify.ai/en/self-host/use-dify/workspace/api-extension/api-extension')
     })
   })
 })
diff --git a/web/app/components/header/account-setting/data-source-page-new/__tests__/card.spec.tsx b/web/app/components/header/account-setting/data-source-page-new/__tests__/card.spec.tsx
index 5ce1c8f72c1..0318645ea9f 100644
--- a/web/app/components/header/account-setting/data-source-page-new/__tests__/card.spec.tsx
+++ b/web/app/components/header/account-setting/data-source-page-new/__tests__/card.spec.tsx
@@ -11,7 +11,7 @@ import { useInvalidDataSourceList } from '@/service/use-pipeline'
 import Card from '../card'
 import { useDataSourceAuthUpdate } from '../hooks'
 
-let mockWorkspacePermissionKeys: string[] = ['credential.manage', 'credential.use']
+let mockWorkspacePermissionKeys: string[] = ['credential.use', 'credential.create', 'credential.manage']
 
 vi.mock('@/context/app-context', () => ({
   useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) => selector({
@@ -126,7 +126,7 @@ describe('Card Component', () => {
 
   beforeEach(() => {
     vi.clearAllMocks()
-    mockWorkspacePermissionKeys = ['credential.manage', 'credential.use']
+    mockWorkspacePermissionKeys = ['credential.use', 'credential.create', 'credential.manage']
     mockPluginAuthActionReturn = createMockPluginAuthActionReturn()
 
     vi.mocked(useDataSourceAuthUpdate).mockReturnValue({ handleAuthUpdate: mockHandleAuthUpdate })
@@ -451,7 +451,7 @@ describe('Card Component', () => {
       expectAuthUpdated()
     })
 
-    it('should disable configure credential actions when user lacks credential.manage', () => {
+    it('should disable configure credential actions when user lacks credential.create', () => {
       // Arrange
       mockWorkspacePermissionKeys = ['credential.use']
       const configurableItem: DataSourceAuth = {
diff --git a/web/app/components/header/account-setting/data-source-page-new/card.tsx b/web/app/components/header/account-setting/data-source-page-new/card.tsx
index 0eddcb5d394..a972893e7ec 100644
--- a/web/app/components/header/account-setting/data-source-page-new/card.tsx
+++ b/web/app/components/header/account-setting/data-source-page-new/card.tsx
@@ -50,7 +50,7 @@ const Card = ({
   onPluginUpdate,
 }: CardProps) => {
   const { t } = useTranslation()
-  const { canUseCredential, canManageCredential } = useCredentialPermissions()
+  const { canUseCredential, canCreateCredential, canManageCredential } = useCredentialPermissions()
   const renderI18nObject = useRenderI18nObject()
   const {
     icon,
@@ -178,7 +178,7 @@ const Card = ({
             pluginPayload={pluginPayload}
             item={item}
             onUpdate={handleAuthUpdate}
-            disabled={disabled || !canManageCredential}
+            disabled={disabled || !canCreateCredential}
           />
         </div>
       </div>
diff --git a/web/app/components/header/account-setting/index.tsx b/web/app/components/header/account-setting/index.tsx
index 3d9b0b1a8c9..b04404bde17 100644
--- a/web/app/components/header/account-setting/index.tsx
+++ b/web/app/components/header/account-setting/index.tsx
@@ -3,6 +3,7 @@ import type { AccountSettingTab } from '@/app/components/header/account-setting/
 import { Button } from '@langgenius/dify-ui/button'
 import { cn } from '@langgenius/dify-ui/cn'
 import { ScrollArea } from '@langgenius/dify-ui/scroll-area'
+import { useSuspenseQuery } from '@tanstack/react-query'
 import { useCallback, useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import BillingPage from '@/app/components/billing/billing-page'
@@ -13,6 +14,7 @@ import {
 import MenuDialog from '@/app/components/header/account-setting/menu-dialog'
 import { useAppContext } from '@/context/app-context'
 import { useProviderContext } from '@/context/provider-context'
+import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import useBreakpoints, { MediaType } from '@/hooks/use-breakpoints'
 import { BillingPermission, hasPermission } from '@/utils/permission'
 import AccessRulesPage from './access-rules-page'
@@ -51,12 +53,18 @@ export default function AccountSetting({
   const resetModelProviderListExpanded = useResetModelProviderListExpanded()
   const { t } = useTranslation()
   const { enableBilling, enableReplaceWebAppLogo } = useProviderContext()
+  const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
   const { workspacePermissionKeys } = useAppContext()
-  const canManageWorkspaceRoles = hasPermission(workspacePermissionKeys, 'workspace.role.manage')
+  const isRbacEnabled = systemFeatures.rbac_enabled
+  const canManageWorkspaceRoles = isRbacEnabled && hasPermission(workspacePermissionKeys, 'workspace.role.manage')
   const canViewBilling = enableBilling && hasPermission(workspacePermissionKeys, BillingPermission.View)
-  const activeMenu = activeTab === ACCOUNT_SETTING_TAB.BILLING && !canViewBilling
-    ? ACCOUNT_SETTING_TAB.LANGUAGE
-    : activeTab
+  const activeMenu = (() => {
+    if (activeTab === ACCOUNT_SETTING_TAB.BILLING && !canViewBilling)
+      return ACCOUNT_SETTING_TAB.LANGUAGE
+    if ((activeTab === ACCOUNT_SETTING_TAB.PERMISSIONS || activeTab === ACCOUNT_SETTING_TAB.ACCESS_RULES) && !canManageWorkspaceRoles)
+      return ACCOUNT_SETTING_TAB.MEMBERS
+    return activeTab
+  })()
   const scrollContainerRef = useRef<HTMLDivElement>(null)
 
   const settingItems: GroupItem[] = [
diff --git a/web/app/components/header/account-setting/model-provider-page/model-auth/__tests__/add-credential-in-load-balancing.spec.tsx b/web/app/components/header/account-setting/model-provider-page/model-auth/__tests__/add-credential-in-load-balancing.spec.tsx
index 16b3dc3fb54..c8ec3a1f2a2 100644
--- a/web/app/components/header/account-setting/model-provider-page/model-auth/__tests__/add-credential-in-load-balancing.spec.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/model-auth/__tests__/add-credential-in-load-balancing.spec.tsx
@@ -3,9 +3,13 @@ import { fireEvent, render, screen } from '@testing-library/react'
 import { ConfigurationMethodEnum, ModelTypeEnum } from '@/app/components/header/account-setting/model-provider-page/declarations'
 import AddCredentialInLoadBalancing from '../add-credential-in-load-balancing'
 
+const mockWorkspacePermissionKeys = vi.hoisted(() => ({
+  value: ['credential.use', 'credential.create', 'credential.manage'],
+}))
+
 vi.mock('@/context/app-context', () => ({
   useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) => selector({
-    workspacePermissionKeys: ['credential.use', 'credential.manage'],
+    workspacePermissionKeys: mockWorkspacePermissionKeys.value,
   }),
 }))
 
@@ -15,13 +19,21 @@ vi.mock('@/app/components/header/account-setting/model-provider-page/model-auth'
     authParams,
     items,
     onItemClick,
+    hideAddAction,
+    triggerOnlyOpenModal,
   }: {
     renderTrigger: (open?: boolean) => React.ReactNode
     authParams?: { onUpdate?: (payload?: unknown, formValues?: Record<string, unknown>) => void }
     items: Array<{ credentials: Array<{ credential_id: string, credential_name: string }> }>
     onItemClick?: (credential: { credential_id: string, credential_name: string }) => void
+    hideAddAction?: boolean
+    triggerOnlyOpenModal?: boolean
   }) => (
-    <div>
+    <div
+      data-testid="authorized-mock"
+      data-hide-add-action={String(!!hideAddAction)}
+      data-trigger-only-open-modal={String(!!triggerOnlyOpenModal)}
+    >
       {renderTrigger(false)}
       <button onClick={() => authParams?.onUpdate?.({ provider: 'x' }, { key: 'value' })}>Run update</button>
       <button onClick={() => onItemClick?.(items[0]!.credentials[0]!)}>Select first</button>
@@ -50,6 +62,7 @@ describe('AddCredentialInLoadBalancing', () => {
 
   beforeEach(() => {
     vi.clearAllMocks()
+    mockWorkspacePermissionKeys.value = ['credential.use', 'credential.create', 'credential.manage']
   })
 
   it('should render add credential label', () => {
@@ -103,6 +116,45 @@ describe('AddCredentialInLoadBalancing', () => {
     expect(onSelectCredential).toHaveBeenCalledWith(modelCredential.available_credentials[0])
   })
 
+  it('should render credential menu for manage-only users with existing credentials', () => {
+    mockWorkspacePermissionKeys.value = ['credential.manage']
+
+    render(
+      <AddCredentialInLoadBalancing
+        provider={provider}
+        model={model}
+        configurationMethod={ConfigurationMethodEnum.customizableModel}
+        modelCredential={modelCredential}
+        onSelectCredential={vi.fn()}
+      />,
+    )
+
+    expect(screen.getByText(/modelProvider.auth.addCredential/i))!.toBeInTheDocument()
+    expect(screen.getByTestId('authorized-mock')).toHaveAttribute('data-hide-add-action', 'true')
+    expect(screen.getByTestId('authorized-mock')).toHaveAttribute('data-trigger-only-open-modal', 'false')
+  })
+
+  it('should render nothing for manage-only users without existing credentials', () => {
+    mockWorkspacePermissionKeys.value = ['credential.manage']
+
+    const emptyModelCredential = {
+      ...modelCredential,
+      available_credentials: [],
+    } as ModelCredential
+
+    const { container } = render(
+      <AddCredentialInLoadBalancing
+        provider={provider}
+        model={model}
+        configurationMethod={ConfigurationMethodEnum.customizableModel}
+        modelCredential={emptyModelCredential}
+        onSelectCredential={vi.fn()}
+      />,
+    )
+
+    expect(container).toBeEmptyDOMElement()
+  })
+
   // renderTrigger with open=true: bg-state-base-hover style applied
   it('should apply hover background when trigger is rendered with open=true', async () => {
     vi.doMock('@/app/components/header/account-setting/model-provider-page/model-auth', () => ({
diff --git a/web/app/components/header/account-setting/model-provider-page/model-auth/__tests__/add-custom-model.spec.tsx b/web/app/components/header/account-setting/model-provider-page/model-auth/__tests__/add-custom-model.spec.tsx
index 3bfa1029474..7230be997f4 100644
--- a/web/app/components/header/account-setting/model-provider-page/model-auth/__tests__/add-custom-model.spec.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/model-auth/__tests__/add-custom-model.spec.tsx
@@ -24,9 +24,13 @@ vi.mock('../hooks/use-custom-models', () => ({
   useCanAddedModels: () => mockCanAddedModels,
 }))
 
+const mockWorkspacePermissionKeys = vi.hoisted(() => ({
+  value: ['credential.use', 'credential.create', 'credential.manage'],
+}))
+
 vi.mock('@/context/app-context', () => ({
   useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) => selector({
-    workspacePermissionKeys: ['credential.manage', 'credential.use'],
+    workspacePermissionKeys: mockWorkspacePermissionKeys.value,
   }),
 }))
 
@@ -60,6 +64,7 @@ describe('AddCustomModel', () => {
 
   beforeEach(() => {
     vi.clearAllMocks()
+    mockWorkspacePermissionKeys.value = ['credential.use', 'credential.create', 'credential.manage']
     mockCanAddedModels = []
   })
 
@@ -120,6 +125,31 @@ describe('AddCustomModel', () => {
     expect(mockHandleOpenModalForAddCustomModelToModelList).toHaveBeenCalledWith(undefined, model)
   })
 
+  it('should show existing model rows as disabled for create-only users', () => {
+    const model = { model: 'gpt-4', model_type: 'llm' }
+    mockWorkspacePermissionKeys.value = ['credential.create']
+    mockCanAddedModels = [model]
+
+    render(
+      <AddCustomModel
+        provider={mockProvider}
+        configurationMethod={ConfigurationMethodEnum.predefinedModel}
+      />,
+    )
+
+    fireEvent.click(screen.getByTestId('popover-trigger'))
+
+    const modelRow = screen.getByText('gpt-4').closest('[aria-disabled]')
+    expect(modelRow).toHaveAttribute('aria-disabled', 'true')
+    expect(modelRow).toHaveClass('cursor-not-allowed')
+
+    fireEvent.click(screen.getByText('gpt-4'))
+    expect(mockHandleOpenModalForAddCustomModelToModelList).not.toHaveBeenCalled()
+
+    fireEvent.click(screen.getByText(/modelProvider.auth.addNewModel/))
+    expect(mockHandleOpenModalForAddNewCustomModel).toHaveBeenCalled()
+  })
+
   it('should call handleOpenModalForAddNewCustomModel when clicking "Add New Model" in list', () => {
     mockCanAddedModels = [{ model: 'gpt-4', model_type: 'llm' }]
     render(
diff --git a/web/app/components/header/account-setting/model-provider-page/model-auth/__tests__/switch-credential-in-load-balancing.spec.tsx b/web/app/components/header/account-setting/model-provider-page/model-auth/__tests__/switch-credential-in-load-balancing.spec.tsx
index e871b35954f..3199e26692c 100644
--- a/web/app/components/header/account-setting/model-provider-page/model-auth/__tests__/switch-credential-in-load-balancing.spec.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/model-auth/__tests__/switch-credential-in-load-balancing.spec.tsx
@@ -4,17 +4,40 @@ import userEvent from '@testing-library/user-event'
 import { ModelTypeEnum } from '@/app/components/header/account-setting/model-provider-page/declarations'
 import SwitchCredentialInLoadBalancing from '../switch-credential-in-load-balancing'
 
+const mockWorkspacePermissionKeys = vi.hoisted(() => ({
+  value: ['credential.use', 'credential.create', 'credential.manage'],
+}))
+
 vi.mock('@/context/app-context', () => ({
   useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) => selector({
-    workspacePermissionKeys: ['credential.use', 'credential.manage'],
+    workspacePermissionKeys: mockWorkspacePermissionKeys.value,
   }),
 }))
 
 // Mock components
 vi.mock('../authorized', () => ({
-  default: ({ renderTrigger, onItemClick, items }: { renderTrigger: () => React.ReactNode, onItemClick: (c: unknown) => void, items: { credentials: unknown[] }[] }) => (
-    <div data-testid="authorized-mock">
-      <div data-testid="trigger-container" onClick={() => onItemClick(items[0]!.credentials[0])}>
+  default: ({
+    renderTrigger,
+    onItemClick,
+    items,
+    disabled,
+    hideAddAction,
+    triggerOnlyOpenModal,
+  }: {
+    renderTrigger: () => React.ReactNode
+    onItemClick?: (c: unknown) => void
+    items: { credentials: unknown[] }[]
+    disabled?: boolean
+    hideAddAction?: boolean
+    triggerOnlyOpenModal?: boolean
+  }) => (
+    <div
+      data-testid="authorized-mock"
+      data-disabled={String(!!disabled)}
+      data-hide-add-action={String(!!hideAddAction)}
+      data-trigger-only-open-modal={String(!!triggerOnlyOpenModal)}
+    >
+      <div data-testid="trigger-container" onClick={() => onItemClick?.(items[0]!.credentials[0])}>
         {renderTrigger()}
       </div>
     </div>
@@ -50,6 +73,7 @@ describe('SwitchCredentialInLoadBalancing', () => {
 
   beforeEach(() => {
     vi.clearAllMocks()
+    mockWorkspacePermissionKeys.value = ['credential.use', 'credential.create', 'credential.manage']
   })
 
   it('should render selected credential name correctly', () => {
@@ -82,7 +106,7 @@ describe('SwitchCredentialInLoadBalancing', () => {
     expect(screen.getByTestId('indicator-error'))!.toBeInTheDocument()
   })
 
-  it('should render unavailable status when credentials list is empty', () => {
+  it('should render add credential status when credentials list is empty and create is allowed', () => {
     render(
       <SwitchCredentialInLoadBalancing
         provider={mockProvider}
@@ -93,7 +117,7 @@ describe('SwitchCredentialInLoadBalancing', () => {
       />,
     )
 
-    expect(screen.getByText(/auth.credentialUnavailableInButton/))!.toBeInTheDocument()
+    expect(screen.getByText(/modelProvider.auth.addCredential/))!.toBeInTheDocument()
     expect(screen.queryByTestId(/indicator-/)).not.toBeInTheDocument()
   })
 
@@ -112,6 +136,27 @@ describe('SwitchCredentialInLoadBalancing', () => {
     expect(mockSetCustomModelCredential).toHaveBeenCalledWith(mockCredentials[0])
   })
 
+  it('should keep credential menu available for manage-only users without allowing selection', () => {
+    mockWorkspacePermissionKeys.value = ['credential.manage']
+
+    render(
+      <SwitchCredentialInLoadBalancing
+        provider={mockProvider}
+        model={mockModel}
+        credentials={mockCredentials}
+        customModelCredential={mockCredentials[0]}
+        setCustomModelCredential={mockSetCustomModelCredential}
+      />,
+    )
+
+    expect(screen.getByTestId('authorized-mock')).toHaveAttribute('data-disabled', 'false')
+    expect(screen.getByTestId('authorized-mock')).toHaveAttribute('data-hide-add-action', 'true')
+
+    fireEvent.click(screen.getByTestId('trigger-container'))
+
+    expect(mockSetCustomModelCredential).not.toHaveBeenCalled()
+  })
+
   it('should show tooltip when empty and custom credentials not allowed', async () => {
     const user = userEvent.setup()
     const restrictedProvider = { ...mockProvider, allow_custom_token: false }
@@ -129,8 +174,8 @@ describe('SwitchCredentialInLoadBalancing', () => {
     expect(await screen.findByText('plugin.auth.credentialUnavailable'))!.toBeInTheDocument()
   })
 
-  // Empty credentials with allowed custom: no tooltip but still shows unavailable text
-  it('should show unavailable status without tooltip when custom credentials are allowed', () => {
+  // Empty credentials with allowed custom: no tooltip but still shows add credential text
+  it('should show add credential status without tooltip when custom credentials are allowed', () => {
     // Act
     render(
       <SwitchCredentialInLoadBalancing
@@ -144,7 +189,7 @@ describe('SwitchCredentialInLoadBalancing', () => {
 
     // Assert
     // Assert
-    expect(screen.getByText(/auth.credentialUnavailableInButton/))!.toBeInTheDocument()
+    expect(screen.getByText(/modelProvider.auth.addCredential/))!.toBeInTheDocument()
     expect(screen.queryByText('plugin.auth.credentialUnavailable')).not.toBeInTheDocument()
   })
 
@@ -231,9 +276,8 @@ describe('SwitchCredentialInLoadBalancing', () => {
       />,
     )
 
-    // credentials is undefined → empty=true → unavailable text shown
-    // credentials is undefined → empty=true → unavailable text shown
-    expect(screen.getByText(/auth.credentialUnavailableInButton/))!.toBeInTheDocument()
+    // credentials is undefined -> empty=true -> add credential text shown when creation is allowed.
+    expect(screen.getByText(/modelProvider.auth.addCredential/))!.toBeInTheDocument()
     expect(screen.queryByTestId(/indicator-/)).not.toBeInTheDocument()
   })
 
diff --git a/web/app/components/header/account-setting/model-provider-page/model-auth/add-credential-in-load-balancing.tsx b/web/app/components/header/account-setting/model-provider-page/model-auth/add-credential-in-load-balancing.tsx
index 1f27fc96788..4bf5002f3a9 100644
--- a/web/app/components/header/account-setting/model-provider-page/model-auth/add-credential-in-load-balancing.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/model-auth/add-credential-in-load-balancing.tsx
@@ -13,8 +13,7 @@ import {
 import { useTranslation } from 'react-i18next'
 import { ConfigurationMethodEnum, ModelModalModeEnum } from '@/app/components/header/account-setting/model-provider-page/declarations'
 import { Authorized } from '@/app/components/header/account-setting/model-provider-page/model-auth'
-import { useSelector as useAppContextWithSelector } from '@/context/app-context'
-import { hasPermission } from '@/utils/permission'
+import { useCredentialPermissions } from '@/hooks/use-credential-permissions'
 
 type AddCredentialInLoadBalancingProps = {
   provider: ModelProvider
@@ -36,12 +35,11 @@ const AddCredentialInLoadBalancing = ({
   onRemove,
 }: AddCredentialInLoadBalancingProps) => {
   const { t } = useTranslation()
-  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
-  const canUseCredential = hasPermission(workspacePermissionKeys, ['credential.use', 'credential.manage'])
-  const canManageCredential = hasPermission(workspacePermissionKeys, 'credential.manage')
+  const { canUseCredential, canCreateCredential, canManageCredential } = useCredentialPermissions()
   const {
     available_credentials,
   } = modelCredential
+  const canOpenCredentialMenu = canUseCredential || canCreateCredential || (canManageCredential && !!available_credentials?.length)
   const isCustomModel = configurationMethod === ConfigurationMethodEnum.customizableModel
   const notAllowCustomCredential = provider.allow_custom_token === false
   const handleUpdate = useCallback((payload?: unknown, formValues?: Record<string, unknown>) => {
@@ -63,7 +61,7 @@ const AddCredentialInLoadBalancing = ({
     return Item
   }, [t])
 
-  if (!canUseCredential)
+  if (!canOpenCredentialMenu)
     return null
 
   return (
@@ -76,7 +74,7 @@ const AddCredentialInLoadBalancing = ({
         onUpdate: handleUpdate,
         onRemove,
       }}
-      triggerOnlyOpenModal={!available_credentials?.length && !notAllowCustomCredential && canManageCredential}
+      triggerOnlyOpenModal={!available_credentials?.length && !notAllowCustomCredential && canCreateCredential}
       items={[
         {
           title: isCustomModel ? '' : t('modelProvider.auth.apiKeys', { ns: 'common' }),
@@ -93,7 +91,7 @@ const AddCredentialInLoadBalancing = ({
           }
         : undefined}
       onItemClick={onSelectCredential}
-      hideAddAction={!canManageCredential}
+      hideAddAction={!canCreateCredential}
       placement="bottom-start"
       popupTitle={isCustomModel ? t('modelProvider.auth.modelCredentials', { ns: 'common' }) : ''}
     />
diff --git a/web/app/components/header/account-setting/model-provider-page/model-auth/add-custom-model.tsx b/web/app/components/header/account-setting/model-provider-page/model-auth/add-custom-model.tsx
index d7c677b06c4..def6e42fffe 100644
--- a/web/app/components/header/account-setting/model-provider-page/model-auth/add-custom-model.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/model-auth/add-custom-model.tsx
@@ -24,8 +24,7 @@ import {
 } from 'react'
 import { useTranslation } from 'react-i18next'
 import { ModelModalModeEnum } from '@/app/components/header/account-setting/model-provider-page/declarations'
-import { useSelector as useAppContextWithSelector } from '@/context/app-context'
-import { hasPermission } from '@/utils/permission'
+import { useCredentialPermissions } from '@/hooks/use-credential-permissions'
 import ModelIcon from '../model-icon'
 import { useAuth } from './hooks/use-auth'
 import { useCanAddedModels } from './hooks/use-custom-models'
@@ -46,9 +45,7 @@ const AddCustomModel = ({
   const [open, setOpen] = useState(false)
   const canAddedModels = useCanAddedModels(provider)
   const noModels = !canAddedModels.length
-  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
-  const canUseCredential = hasPermission(workspacePermissionKeys, ['credential.use', 'credential.manage'])
-  const canManageCredential = hasPermission(workspacePermissionKeys, 'credential.manage')
+  const { canUseCredential, canCreateCredential } = useCredentialPermissions()
   const {
     handleOpenModal: handleOpenModalForAddNewCustomModel,
   } = useAuth(
@@ -73,7 +70,9 @@ const AddCustomModel = ({
   )
   const notAllowCustomCredential = provider.allow_custom_token === false
   const renderTrigger = useCallback((open?: boolean, onClick?: () => void) => {
-    const disabled = (noModels && !canManageCredential) || (!noModels && !canUseCredential)
+    const disabled = noModels
+      ? !canCreateCredential
+      : !canUseCredential && !canCreateCredential
     const item = (
       <Button
         variant="ghost"
@@ -99,10 +98,10 @@ const AddCustomModel = ({
       )
     }
     return item
-  }, [canManageCredential, canUseCredential, t, notAllowCustomCredential, noModels])
+  }, [canCreateCredential, canUseCredential, t, notAllowCustomCredential, noModels])
 
   if (noModels) {
-    return renderTrigger(false, notAllowCustomCredential || !canManageCredential ? undefined : handleOpenModalForAddNewCustomModel)
+    return renderTrigger(false, notAllowCustomCredential || !canCreateCredential ? undefined : handleOpenModalForAddNewCustomModel)
   }
 
   return (
@@ -125,7 +124,11 @@ const AddCustomModel = ({
               canAddedModels.map(model => (
                 <div
                   key={model.model}
-                  className="flex h-8 cursor-pointer items-center rounded-lg px-2 hover:bg-state-base-hover"
+                  className={cn(
+                    'flex h-8 items-center rounded-lg px-2',
+                    canUseCredential ? 'cursor-pointer hover:bg-state-base-hover' : 'cursor-not-allowed opacity-50',
+                  )}
+                  aria-disabled={!canUseCredential}
                   onClick={() => {
                     if (!canUseCredential)
                       return
@@ -151,7 +154,7 @@ const AddCustomModel = ({
             }
           </div>
           {
-            !notAllowCustomCredential && canManageCredential && (
+            !notAllowCustomCredential && canCreateCredential && (
               <div
                 className="flex cursor-pointer items-center border-t border-t-divider-subtle p-3 system-xs-medium text-text-accent-light-mode-only"
                 onClick={() => {
diff --git a/web/app/components/header/account-setting/model-provider-page/model-auth/authorized/__tests__/index.spec.tsx b/web/app/components/header/account-setting/model-provider-page/model-auth/authorized/__tests__/index.spec.tsx
index f0058dca99f..ea1ff14d18a 100644
--- a/web/app/components/header/account-setting/model-provider-page/model-auth/authorized/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/model-auth/authorized/__tests__/index.spec.tsx
@@ -11,7 +11,7 @@ const mockHandleConfirmDelete = vi.fn()
 
 let mockDeleteCredentialId: string | null = null
 let mockDoingAction = false
-let mockWorkspacePermissionKeys = ['credential.manage', 'credential.use']
+let mockWorkspacePermissionKeys = ['credential.use', 'credential.create', 'credential.manage']
 
 vi.mock('@/context/app-context', () => ({
   useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) => selector({
@@ -89,7 +89,7 @@ describe('Authorized', () => {
     vi.clearAllMocks()
     mockDeleteCredentialId = null
     mockDoingAction = false
-    mockWorkspacePermissionKeys = ['credential.manage', 'credential.use']
+    mockWorkspacePermissionKeys = ['credential.use', 'credential.create', 'credential.manage']
   })
 
   it('should render trigger and open popup when trigger is clicked', () => {
@@ -219,6 +219,55 @@ describe('Authorized', () => {
     expect(screen.queryByRole('button', { name: /addApiKey/i })).not.toBeInTheDocument()
   })
 
+  it('should allow create-only users to add credentials but not switch, edit, or delete existing credentials', () => {
+    mockWorkspacePermissionKeys = ['credential.create']
+
+    render(
+      <Authorized
+        provider={mockProvider}
+        configurationMethod={ConfigurationMethodEnum.predefinedModel}
+        items={mockItems}
+        renderTrigger={mockRenderTrigger}
+      />,
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: /trigger\s*closed/i }))
+    fireEvent.click(screen.getAllByRole('button', { name: 'Edit' })[0]!)
+    fireEvent.click(screen.getAllByRole('button', { name: 'Delete' })[0]!)
+    fireEvent.click(screen.getAllByRole('button', { name: 'Select' })[0]!)
+    fireEvent.click(screen.getByRole('button', { name: /addApiKey/i }))
+
+    expect(mockHandleActiveCredential).not.toHaveBeenCalled()
+    expect(mockOpenConfirmDelete).not.toHaveBeenCalled()
+    expect(mockHandleOpenModal).toHaveBeenCalledTimes(1)
+    expect(mockHandleOpenModal).toHaveBeenCalledWith(undefined, undefined)
+  })
+
+  it('should allow manage-only users to edit and delete credentials but not switch or add them', () => {
+    mockWorkspacePermissionKeys = ['credential.manage']
+
+    render(
+      <Authorized
+        provider={mockProvider}
+        configurationMethod={ConfigurationMethodEnum.predefinedModel}
+        items={mockItems}
+        renderTrigger={mockRenderTrigger}
+      />,
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: /trigger\s*closed/i }))
+    fireEvent.click(screen.getAllByRole('button', { name: 'Edit' })[0]!)
+    fireEvent.click(screen.getByRole('button', { name: /trigger\s*closed/i }))
+    fireEvent.click(screen.getAllByRole('button', { name: 'Delete' })[0]!)
+    fireEvent.click(screen.getByRole('button', { name: /trigger\s*closed/i }))
+    fireEvent.click(screen.getAllByRole('button', { name: 'Select' })[0]!)
+
+    expect(mockHandleOpenModal).toHaveBeenCalledWith(mockCredentials[0], mockItems[0]!.model)
+    expect(mockOpenConfirmDelete).toHaveBeenCalledWith(mockCredentials[0], mockItems[0]!.model)
+    expect(mockHandleActiveCredential).not.toHaveBeenCalled()
+    expect(screen.queryByRole('button', { name: /addApiKey/i })).not.toBeInTheDocument()
+  })
+
   it('should show confirm dialog and call confirm handler when delete is confirmed', () => {
     mockDeleteCredentialId = 'cred-1'
 
diff --git a/web/app/components/header/account-setting/model-provider-page/model-auth/authorized/index.tsx b/web/app/components/header/account-setting/model-provider-page/model-auth/authorized/index.tsx
index 042d6771097..8e3af2cdeee 100644
--- a/web/app/components/header/account-setting/model-provider-page/model-auth/authorized/index.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/model-auth/authorized/index.tsx
@@ -30,8 +30,7 @@ import {
   useState,
 } from 'react'
 import { useTranslation } from 'react-i18next'
-import { useSelector as useAppContextWithSelector } from '@/context/app-context'
-import { hasPermission } from '@/utils/permission'
+import { useCredentialPermissions } from '@/hooks/use-credential-permissions'
 import { useAuth } from '../hooks'
 import AuthorizedItem from './authorized-item'
 
@@ -101,9 +100,7 @@ const Authorized = ({
   disableDeleteTip,
 }: AuthorizedProps) => {
   const { t } = useTranslation()
-  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
-  const canUseCredential = hasPermission(workspacePermissionKeys, ['credential.use', 'credential.manage'])
-  const canManageCredential = hasPermission(workspacePermissionKeys, 'credential.manage')
+  const { canUseCredential, canCreateCredential, canManageCredential } = useCredentialPermissions()
   const [isLocalOpen, setIsLocalOpen] = useState(false)
   const mergedIsOpen = isOpen ?? isLocalOpen
   const setMergedIsOpen = useCallback((open: boolean) => {
@@ -139,12 +136,12 @@ const Authorized = ({
   )
 
   const handleEdit = useCallback((credential?: Credential, model?: CustomModel) => {
-    if (!canManageCredential)
+    if (credential ? !canManageCredential : !canCreateCredential)
       return
 
     setMergedIsOpen(false)
     handleOpenModal(credential, model)
-  }, [canManageCredential, handleOpenModal, setMergedIsOpen])
+  }, [canCreateCredential, canManageCredential, handleOpenModal, setMergedIsOpen])
   const handleDelete = useCallback((credential?: Credential, model?: CustomModel) => {
     if (!canManageCredential)
       return
@@ -179,11 +176,11 @@ const Authorized = ({
       return
 
     event.preventDefault()
-    if (!canManageCredential)
+    if (!canCreateCredential)
       return
 
     handleOpenModal()
-  }, [canManageCredential, handleOpenModal, triggerOnlyOpenModal])
+  }, [canCreateCredential, handleOpenModal, triggerOnlyOpenModal])
 
   return (
     <>
@@ -224,7 +221,7 @@ const Authorized = ({
                       title={item.title}
                       model={item.model}
                       credentials={item.credentials}
-                      disabled={disabled || !canUseCredential}
+                      disabled={disabled}
                       disableEdit={!canManageCredential}
                       disableDelete={!canManageCredential}
                       onDelete={handleDelete}
@@ -233,7 +230,7 @@ const Authorized = ({
                       onEdit={handleEdit}
                       showItemSelectedIcon={showItemSelectedIcon}
                       selectedCredentialId={item.selectedCredential?.credential_id}
-                      onItemClick={handleItemClick}
+                      onItemClick={canUseCredential ? handleItemClick : undefined}
                       showModelTitle={showModelTitle}
                     />
                     {
@@ -247,7 +244,7 @@ const Authorized = ({
             </div>
             <div className="h-px bg-divider-subtle"></div>
             {
-              isModelCredential && !notAllowCustomCredential && !hideAddAction && canManageCredential && (
+              isModelCredential && !notAllowCustomCredential && !hideAddAction && canCreateCredential && (
                 <div
                   onClick={() => handleEdit(
                     undefined,
@@ -266,7 +263,7 @@ const Authorized = ({
               )
             }
             {
-              !isModelCredential && !notAllowCustomCredential && !hideAddAction && canManageCredential && (
+              !isModelCredential && !notAllowCustomCredential && !hideAddAction && canCreateCredential && (
                 <div className="p-2">
                   <Button
                     onClick={() => handleEdit()}
diff --git a/web/app/components/header/account-setting/model-provider-page/model-auth/switch-credential-in-load-balancing.tsx b/web/app/components/header/account-setting/model-provider-page/model-auth/switch-credential-in-load-balancing.tsx
index 1a9fd752683..241f9198b49 100644
--- a/web/app/components/header/account-setting/model-provider-page/model-auth/switch-credential-in-load-balancing.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/model-auth/switch-credential-in-load-balancing.tsx
@@ -16,8 +16,7 @@ import {
 import { useTranslation } from 'react-i18next'
 import Badge from '@/app/components/base/badge'
 import { ConfigurationMethodEnum, ModelModalModeEnum } from '@/app/components/header/account-setting/model-provider-page/declarations'
-import { useSelector as useAppContextWithSelector } from '@/context/app-context'
-import { hasPermission } from '@/utils/permission'
+import { useCredentialPermissions } from '@/hooks/use-credential-permissions'
 import Authorized from './authorized'
 
 type SwitchCredentialInLoadBalancingProps = {
@@ -40,9 +39,8 @@ const SwitchCredentialInLoadBalancing = ({
 }: SwitchCredentialInLoadBalancingProps) => {
   const { t } = useTranslation()
   const notAllowCustomCredential = provider.allow_custom_token === false
-  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
-  const canUseCredential = hasPermission(workspacePermissionKeys, ['credential.use', 'credential.manage'])
-  const canManageCredential = hasPermission(workspacePermissionKeys, 'credential.manage')
+  const { canUseCredential, canCreateCredential, canManageCredential } = useCredentialPermissions()
+  const canOpenCredentialMenu = canUseCredential || canCreateCredential || canManageCredential
   const handleItemClick = useCallback((credential: Credential) => {
     if (!canUseCredential)
       return
@@ -67,7 +65,7 @@ const SwitchCredentialInLoadBalancing = ({
         className={cn(
           'shrink-0 space-x-1',
           (authRemoved || unavailable) && 'text-components-button-destructive-secondary-text',
-          (empty || !canUseCredential) && 'cursor-not-allowed opacity-50',
+          (!canOpenCredentialMenu || (empty && !canCreateCredential)) && 'cursor-not-allowed opacity-50',
         )}
       >
         {
@@ -82,7 +80,13 @@ const SwitchCredentialInLoadBalancing = ({
           authRemoved && t('modelProvider.auth.authRemoved', { ns: 'common' })
         }
         {
-          (unavailable || empty) && t('auth.credentialUnavailableInButton', { ns: 'plugin' })
+          unavailable && t('auth.credentialUnavailableInButton', { ns: 'plugin' })
+        }
+        {
+          empty && canCreateCredential && !notAllowCustomCredential && t('modelProvider.auth.addCredential', { ns: 'common' })
+        }
+        {
+          empty && (!canCreateCredential || notAllowCustomCredential) && t('auth.credentialUnavailableInButton', { ns: 'plugin' })
         }
         {
           !authRemoved && !unavailable && !empty && customModelCredential?.credential_name
@@ -95,7 +99,7 @@ const SwitchCredentialInLoadBalancing = ({
         <span className="i-ri-arrow-down-s-line size-4" />
       </Button>
     )
-    if ((empty && notAllowCustomCredential) || !canUseCredential) {
+    if ((empty && notAllowCustomCredential) || !canOpenCredentialMenu) {
       return (
         <Tooltip>
           <TooltipTrigger render={Item} />
@@ -106,7 +110,7 @@ const SwitchCredentialInLoadBalancing = ({
       )
     }
     return Item
-  }, [canUseCredential, customModelCredential, t, credentials, notAllowCustomCredential])
+  }, [canCreateCredential, canOpenCredentialMenu, customModelCredential, t, credentials, notAllowCustomCredential])
 
   return (
     <Authorized
@@ -140,10 +144,9 @@ const SwitchCredentialInLoadBalancing = ({
       onItemClick={handleItemClick}
       enableAddModelCredential
       showItemSelectedIcon
-      disabled={!canUseCredential}
-      hideAddAction={!canManageCredential}
+      hideAddAction={!canCreateCredential}
       popupTitle={t('modelProvider.auth.modelCredentials', { ns: 'common' })}
-      triggerOnlyOpenModal={!credentials?.length && canManageCredential}
+      triggerOnlyOpenModal={!credentials?.length && canCreateCredential}
     />
   )
 }
diff --git a/web/app/components/header/account-setting/model-provider-page/model-modal/__tests__/dialog.spec.tsx b/web/app/components/header/account-setting/model-provider-page/model-modal/__tests__/dialog.spec.tsx
index cfb241be7d5..e1a8ac24cf2 100644
--- a/web/app/components/header/account-setting/model-provider-page/model-modal/__tests__/dialog.spec.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/model-modal/__tests__/dialog.spec.tsx
@@ -79,7 +79,7 @@ vi.mock('../../model-auth/hooks', () => ({
 
 vi.mock('@/context/app-context', () => ({
   useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) =>
-    selector({ workspacePermissionKeys: ['credential.manage', 'credential.use'] }),
+    selector({ workspacePermissionKeys: ['credential.use', 'credential.create', 'credential.manage'] }),
 }))
 
 vi.mock('@/hooks/use-i18n', () => ({
diff --git a/web/app/components/header/account-setting/model-provider-page/model-modal/__tests__/index.spec.tsx b/web/app/components/header/account-setting/model-provider-page/model-modal/__tests__/index.spec.tsx
index f1d672299c0..b3dad54e25e 100644
--- a/web/app/components/header/account-setting/model-provider-page/model-modal/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/model-modal/__tests__/index.spec.tsx
@@ -29,7 +29,7 @@ const mockState = vi.hoisted(() => ({
   credentialData: { credentials: {}, available_credentials: [] } as CredentialData,
   doingAction: false,
   deleteCredentialId: null as string | null,
-  workspacePermissionKeys: ['credential.manage', 'credential.use'] as string[],
+  workspacePermissionKeys: ['credential.use', 'credential.create', 'credential.manage'] as string[],
   formSchemas: [] as CredentialFormSchema[],
   formValues: {} as Record<string, unknown>,
   modelNameAndTypeFormSchemas: [] as CredentialFormSchema[],
@@ -184,7 +184,7 @@ describe('ModelModal', () => {
     mockState.credentialData = { credentials: {}, available_credentials: [] }
     mockState.doingAction = false
     mockState.deleteCredentialId = null
-    mockState.workspacePermissionKeys = ['credential.manage', 'credential.use']
+    mockState.workspacePermissionKeys = ['credential.use', 'credential.create', 'credential.manage']
     mockState.formSchemas = []
     mockState.formValues = {}
     mockState.modelNameAndTypeFormSchemas = []
diff --git a/web/app/components/header/account-setting/model-provider-page/model-modal/index.tsx b/web/app/components/header/account-setting/model-provider-page/model-modal/index.tsx
index 0c7f68fb361..245554c5c1b 100644
--- a/web/app/components/header/account-setting/model-provider-page/model-modal/index.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/model-modal/index.tsx
@@ -41,9 +41,8 @@ import {
   useCredentialData,
 } from '@/app/components/header/account-setting/model-provider-page/model-auth/hooks'
 import ModelIcon from '@/app/components/header/account-setting/model-provider-page/model-icon'
-import { useSelector as useAppContextWithSelector } from '@/context/app-context'
+import { useCredentialPermissions } from '@/hooks/use-credential-permissions'
 import { useRenderI18nObject } from '@/hooks/use-i18n'
-import { hasPermission } from '@/utils/permission'
 import {
   ConfigurationMethodEnum,
   FormTypeEnum,
@@ -107,9 +106,7 @@ const ModelModal: FC<ModelModalProps> = ({
     available_credentials,
   } = credentialData as any
 
-  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
-  const canUseCredential = hasPermission(workspacePermissionKeys, ['credential.use', 'credential.manage'])
-  const canManageCredential = hasPermission(workspacePermissionKeys, 'credential.manage')
+  const { canUseCredential, canCreateCredential, canManageCredential } = useCredentialPermissions()
   const { t } = useTranslation()
   const language = useLanguage()
   const {
@@ -135,7 +132,8 @@ const ModelModal: FC<ModelModalProps> = ({
       return
     }
 
-    if (!canManageCredential)
+    const canSubmitCredentialForm = credential ? canManageCredential : canCreateCredential
+    if (!canSubmitCredentialForm)
       return
 
     let modelNameAndTypeIsCheckValidated = true
@@ -197,7 +195,7 @@ const ModelModal: FC<ModelModalProps> = ({
       })
     }
     onSave(values)
-  }, [mode, selectedCredential, model, canUseCredential, canManageCredential, onSave, handleActiveCredential, onCancel, handleSaveCredential, credential?.credential_id])
+  }, [mode, selectedCredential, model, canUseCredential, canCreateCredential, canManageCredential, onSave, handleActiveCredential, onCancel, handleSaveCredential, credential])
 
   const modalTitle = useMemo(() => {
     let label = t('modelProvider.auth.apiKeyModal.title', { ns: 'common' })
@@ -277,7 +275,7 @@ const ModelModal: FC<ModelModalProps> = ({
   }, [mode, t])
   const canSaveCredentialChange = mode === ModelModalModeEnum.addCustomModelToModelList && selectedCredential && !selectedCredential.addNewCredential
     ? canUseCredential
-    : canManageCredential
+    : credential ? canManageCredential : canCreateCredential
 
   const handleDeleteCredential = useCallback(() => {
     handleConfirmDelete()
@@ -339,7 +337,7 @@ const ModelModal: FC<ModelModalProps> = ({
                 onSelect={setSelectedCredential}
                 selectedCredential={selectedCredential}
                 disabled={isLoading}
-                notAllowAddNewCredential={notAllowCustomCredential || !canManageCredential}
+                notAllowAddNewCredential={notAllowCustomCredential || !canCreateCredential}
               />
             )
           }
diff --git a/web/app/components/header/account-setting/model-provider-page/model-selector/__tests__/popup-item.spec.tsx b/web/app/components/header/account-setting/model-provider-page/model-selector/__tests__/popup-item.spec.tsx
index f8511a17855..291b903f62a 100644
--- a/web/app/components/header/account-setting/model-provider-page/model-selector/__tests__/popup-item.spec.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/model-selector/__tests__/popup-item.spec.tsx
@@ -72,10 +72,13 @@ vi.mock('@/context/provider-context', () => ({
 }))
 
 const mockUseAppContext = vi.hoisted(() => vi.fn())
+const mockWorkspacePermissionKeys = vi.hoisted(() => ({
+  value: ['credential.use', 'credential.create', 'credential.manage'],
+}))
 vi.mock('@/context/app-context', () => ({
   useAppContext: mockUseAppContext,
   useSelector: (selector: (state: { workspacePermissionKeys: string[] }) => unknown) => selector({
-    workspacePermissionKeys: ['credential.manage', 'credential.use'],
+    workspacePermissionKeys: mockWorkspacePermissionKeys.value,
   }),
 }))
 
@@ -136,6 +139,7 @@ const renderWithCombobox = (
 describe('PopupItem', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockWorkspacePermissionKeys.value = ['credential.use', 'credential.create', 'credential.manage']
     mockUseLanguage.mockReturnValue('en_US')
     mockUseProviderContext.mockReturnValue({
       modelProviders: [makeProvider()],
@@ -412,4 +416,18 @@ describe('PopupItem', () => {
 
     expect(onHide).toHaveBeenCalled()
   })
+
+  it('should keep the credential dropdown enabled for manage-only users', () => {
+    mockWorkspacePermissionKeys.value = ['credential.manage']
+
+    renderWithCombobox(<PopupItem {...previewCardProps()} model={makeModel()} onHide={vi.fn()} />)
+
+    const trigger = screen.getByRole('button', { name: /my-api-key/ })
+
+    expect(trigger).not.toBeDisabled()
+
+    fireEvent.click(trigger)
+
+    expect(screen.getByRole('button', { name: 'close dropdown' })).toBeInTheDocument()
+  })
 })
diff --git a/web/app/components/header/account-setting/model-provider-page/model-selector/popup-item.tsx b/web/app/components/header/account-setting/model-provider-page/model-selector/popup-item.tsx
index a957ae16577..f0d99838c55 100644
--- a/web/app/components/header/account-setting/model-provider-page/model-selector/popup-item.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/model-selector/popup-item.tsx
@@ -8,10 +8,9 @@ import { StatusDot } from '@langgenius/dify-ui/status-dot'
 import { useCallback, useMemo, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import { CreditsCoin } from '@/app/components/base/icons/src/vender/line/financeAndECommerce'
-import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { useModalContext } from '@/context/modal-context'
 import { useProviderContext } from '@/context/provider-context'
-import { hasPermission } from '@/utils/permission'
+import { useCredentialPermissions } from '@/hooks/use-credential-permissions'
 import { ConfigurationMethodEnum, ModelStatusEnum } from '../declarations'
 import { useLanguage, useUpdateModelList, useUpdateModelProviders } from '../hooks'
 import ModelIcon from '../model-icon'
@@ -50,11 +49,10 @@ function PopupItem({
   const updateModelList = useUpdateModelList()
   const updateModelProviders = useUpdateModelProviders()
   const currentProvider = modelProviders.find(provider => provider.provider === model.provider)
-  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
-  const canUseCredentials = hasPermission(workspacePermissionKeys, ['credential.manage', 'credential.use'])
-  const canManageCredentials = hasPermission(workspacePermissionKeys, 'credential.manage')
+  const { canUseCredential, canCreateCredential, canManageCredential } = useCredentialPermissions()
+  const canOpenCredentialDropdown = canUseCredential || canCreateCredential || canManageCredential
   const handleOpenModelModal = () => {
-    if (!canManageCredentials)
+    if (!canCreateCredential)
       return
 
     if (!currentProvider)
@@ -110,7 +108,7 @@ function PopupItem({
         </button>
         <Popover open={dropdownOpen} onOpenChange={setDropdownOpen}>
           <PopoverTrigger
-            disabled={!canUseCredentials}
+            disabled={!canOpenCredentialDropdown}
             render={(
               <button type="button" className="flex max-w-[50%] min-w-0 shrink-0 cursor-pointer items-center rounded-md px-1.5 py-1 system-xs-medium text-text-tertiary hover:bg-components-button-ghost-bg-hover">
                 {isUsingCredits
@@ -142,7 +140,7 @@ function PopupItem({
                           <span className="ml-1 truncate text-text-tertiary">{t('modelProvider.selector.configureRequired', { ns: 'common' })}</span>
                         </>
                       )}
-                {canUseCredentials && <span className="i-ri-arrow-down-s-line size-3.5! shrink-0 translate-y-px text-text-tertiary" />}
+                {canOpenCredentialDropdown && <span className="i-ri-arrow-down-s-line size-3.5! shrink-0 translate-y-px text-text-tertiary" />}
               </button>
             )}
           />
@@ -193,7 +191,7 @@ function PopupItem({
                 onPointerDown={onPreviewCardClose}
               >
                 {rowContent}
-                {canManageCredentials && (
+                {canCreateCredential && (
                   <button
                     type="button"
                     className="hidden cursor-pointer text-xs font-medium text-text-accent group-hover:block"
diff --git a/web/app/components/header/account-setting/model-provider-page/provider-added-card/__tests__/index.spec.tsx b/web/app/components/header/account-setting/model-provider-page/provider-added-card/__tests__/index.spec.tsx
index 01886f0db8a..66f60949904 100644
--- a/web/app/components/header/account-setting/model-provider-page/provider-added-card/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/provider-added-card/__tests__/index.spec.tsx
@@ -8,7 +8,7 @@ import { ConfigurationMethodEnum } from '../../declarations'
 import ProviderAddedCard from '../index'
 
 let mockIsCurrentWorkspaceManager = true
-let mockWorkspacePermissionKeys: string[] = ['plugin.manage', 'credential.manage', 'credential.use']
+let mockWorkspacePermissionKeys: string[] = ['plugin.manage', 'credential.use', 'credential.create', 'credential.manage']
 const mockFetchModelProviderModels = vi.fn()
 const mockQueryOptions = vi.fn(({ input, ...options }: { input: { params: { provider: string } }, enabled?: boolean }) => ({
   queryKey: ['console', 'modelProviders', 'models', input.params.provider],
@@ -105,7 +105,7 @@ describe('ProviderAddedCard', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mockIsCurrentWorkspaceManager = true
-    mockWorkspacePermissionKeys = ['plugin.manage', 'credential.manage', 'credential.use']
+    mockWorkspacePermissionKeys = ['plugin.manage', 'credential.use', 'credential.create', 'credential.manage']
   })
 
   it('should render provider added card component', () => {
@@ -213,7 +213,7 @@ describe('ProviderAddedCard', () => {
 
     unmount()
     mockIsCurrentWorkspaceManager = false
-    mockWorkspacePermissionKeys = ['credential.manage', 'credential.use']
+    mockWorkspacePermissionKeys = ['credential.use', 'credential.create', 'credential.manage']
     renderWithQueryClient(<ProviderAddedCard provider={customConfigProvider} />)
     expect(screen.queryByTestId('manage-custom-model')).not.toBeInTheDocument()
   })
diff --git a/web/app/components/header/account-setting/model-provider-page/provider-added-card/index.tsx b/web/app/components/header/account-setting/model-provider-page/provider-added-card/index.tsx
index 696c9c623d7..c91db81e6b7 100644
--- a/web/app/components/header/account-setting/model-provider-page/provider-added-card/index.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/provider-added-card/index.tsx
@@ -16,6 +16,7 @@ import {
 import { IS_CE_EDITION } from '@/config'
 import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { useProviderContextSelector } from '@/context/provider-context'
+import { useCredentialPermissions } from '@/hooks/use-credential-permissions'
 import { renderI18nObject } from '@/i18n-config'
 import { consoleQuery } from '@/service/client'
 import { hasPermission } from '@/utils/permission'
@@ -69,8 +70,9 @@ const ProviderAddedCard: FC<ProviderAddedCardProps> = ({
   const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
   const showModelProvider = systemConfig.enabled && MODEL_PROVIDER_QUOTA_GET_PAID.includes(currentProviderName as ModelProviderQuotaGetPaid) && !IS_CE_EDITION
   const canManagePlugins = hasPermission(workspacePermissionKeys, 'plugin.manage')
-  const canUseCredentials = hasPermission(workspacePermissionKeys, ['credential.manage', 'credential.use'])
-  const showCredential = supportsPredefinedModel && canUseCredentials
+  const { canUseCredential, canCreateCredential, canManageCredential } = useCredentialPermissions()
+  const canAccessCredentials = canUseCredential || canCreateCredential || canManageCredential
+  const showCredential = supportsPredefinedModel && canAccessCredentials
   const showCustomModelActions = supportsCustomizableModel && canManagePlugins
 
   const refreshModelList = useCallback((targetProviderName: string) => {
diff --git a/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-auth-dropdown/__tests__/api-key-section.spec.tsx b/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-auth-dropdown/__tests__/api-key-section.spec.tsx
index 03224ac09f3..0ad4a494285 100644
--- a/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-auth-dropdown/__tests__/api-key-section.spec.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-auth-dropdown/__tests__/api-key-section.spec.tsx
@@ -5,7 +5,7 @@ import ApiKeySection from '../api-key-section'
 
 vi.mock('@/context/app-context', () => ({
   useSelector: <T,>(selector: (state: { workspacePermissionKeys: string[] }) => T): T => selector({
-    workspacePermissionKeys: ['credential.manage', 'credential.use'],
+    workspacePermissionKeys: ['credential.use', 'credential.create', 'credential.manage'],
   }),
 }))
 
diff --git a/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-auth-dropdown/__tests__/dropdown-content.spec.tsx b/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-auth-dropdown/__tests__/dropdown-content.spec.tsx
index 5e16edba5e4..f50d654f82e 100644
--- a/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-auth-dropdown/__tests__/dropdown-content.spec.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-auth-dropdown/__tests__/dropdown-content.spec.tsx
@@ -10,7 +10,7 @@ const mockOpenConfirmDelete = vi.fn()
 const mockCloseConfirmDelete = vi.fn()
 const mockHandleConfirmDelete = vi.fn()
 let mockDeleteCredentialId: string | null = null
-let mockWorkspacePermissionKeys = ['credential.manage', 'credential.use']
+let mockWorkspacePermissionKeys = ['credential.use', 'credential.create', 'credential.manage']
 
 vi.mock('../../use-trial-credits', () => ({
   useTrialCredits: () => ({ credits: 0, totalCredits: 10_000, isExhausted: true, isLoading: false }),
@@ -53,7 +53,7 @@ vi.mock('../../../model-auth/authorized/credential-item', () => ({
   }) => (
     <div data-testid={`credential-${credential.credential_id}`}>
       <span>{credential.credential_name}</span>
-      <button data-testid={`click-${credential.credential_id}`} onClick={() => onItemClick?.(credential)}>select</button>
+      <button data-testid={`click-${credential.credential_id}`} disabled={disabled} onClick={() => onItemClick?.(credential)}>select</button>
       <button data-testid={`edit-${credential.credential_id}`} disabled={disabled || disableEdit} onClick={() => onEdit?.(credential)}>edit</button>
       <button data-testid={`delete-${credential.credential_id}`} disabled={disabled || disableDelete} onClick={() => onDelete?.(credential)}>delete</button>
     </div>
@@ -97,7 +97,7 @@ describe('DropdownContent', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mockDeleteCredentialId = null
-    mockWorkspacePermissionKeys = ['credential.manage', 'credential.use']
+    mockWorkspacePermissionKeys = ['credential.use', 'credential.create', 'credential.manage']
   })
 
   describe('UsagePrioritySection visibility', () => {
@@ -397,6 +397,58 @@ describe('DropdownContent', () => {
       expect(mockHandleOpenModal).not.toHaveBeenCalled()
       expect(mockOpenConfirmDelete).not.toHaveBeenCalled()
     })
+
+    it('should allow create-only users to add credentials but not switch, edit, or delete existing credentials', () => {
+      mockWorkspacePermissionKeys = ['credential.create']
+
+      render(
+        <DropdownContent
+          provider={createProvider()}
+          state={createState()}
+          isChangingPriority={false}
+          onChangePriority={onChangePriority}
+          onClose={onClose}
+        />,
+      )
+
+      fireEvent.click(screen.getByTestId('click-cred-2'))
+      fireEvent.click(screen.getByTestId('edit-cred-2'))
+      fireEvent.click(screen.getByTestId('delete-cred-2'))
+      fireEvent.click(screen.getByRole('button', { name: /addApiKey/ }))
+
+      expect(mockActivate).not.toHaveBeenCalled()
+      expect(mockOpenConfirmDelete).not.toHaveBeenCalled()
+      expect(mockHandleOpenModal).toHaveBeenCalledTimes(1)
+      expect(mockHandleOpenModal).toHaveBeenCalledWith()
+      expect(onClose).toHaveBeenCalledTimes(1)
+    })
+
+    it('should allow manage-only users to edit and delete credentials but not switch or add them', () => {
+      mockWorkspacePermissionKeys = ['credential.manage']
+
+      render(
+        <DropdownContent
+          provider={createProvider()}
+          state={createState()}
+          isChangingPriority={false}
+          onChangePriority={onChangePriority}
+          onClose={onClose}
+        />,
+      )
+
+      fireEvent.click(screen.getByTestId('click-cred-2'))
+      fireEvent.click(screen.getByTestId('edit-cred-2'))
+      fireEvent.click(screen.getByTestId('delete-cred-2'))
+
+      expect(mockActivate).not.toHaveBeenCalled()
+      expect(mockHandleOpenModal).toHaveBeenCalledWith(
+        expect.objectContaining({ credential_id: 'cred-2' }),
+      )
+      expect(mockOpenConfirmDelete).toHaveBeenCalledWith(
+        expect.objectContaining({ credential_id: 'cred-2' }),
+      )
+      expect(screen.queryByRole('button', { name: /addApiKey/ })).not.toBeInTheDocument()
+    })
   })
 
   describe('Add API Key', () => {
diff --git a/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-auth-dropdown/api-key-section.tsx b/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-auth-dropdown/api-key-section.tsx
index eba042cb48f..57caf2c1c2c 100644
--- a/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-auth-dropdown/api-key-section.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-auth-dropdown/api-key-section.tsx
@@ -2,8 +2,7 @@ import type { Credential, CustomModel, ModelProvider } from '../../declarations'
 import { Button } from '@langgenius/dify-ui/button'
 import { memo } from 'react'
 import { useTranslation } from 'react-i18next'
-import { useSelector as useAppContextWithSelector } from '@/context/app-context'
-import { hasPermission } from '@/utils/permission'
+import { useCredentialPermissions } from '@/hooks/use-credential-permissions'
 import CredentialItem from '../../model-auth/authorized/credential-item'
 
 type ApiKeySectionProps = {
@@ -29,8 +28,7 @@ function ApiKeySection({
 }: ApiKeySectionProps) {
   const { t } = useTranslation()
   const notAllowCustomCredential = provider.allow_custom_token === false
-  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
-  const canManageCredential = hasPermission(workspacePermissionKeys, 'credential.manage')
+  const { canUseCredential, canCreateCredential, canManageCredential } = useCredentialPermissions()
 
   if (!credentials.length) {
     return (
@@ -45,7 +43,7 @@ function ApiKeySection({
             </div>
           </div>
         </div>
-        {!notAllowCustomCredential && canManageCredential && (
+        {!notAllowCustomCredential && canCreateCredential && (
           <Button
             onClick={onAdd}
             className="w-full"
@@ -71,7 +69,7 @@ function ApiKeySection({
               disabled={isActivating}
               showSelectedIcon
               selectedCredentialId={selectedCredentialId}
-              onItemClick={onItemClick}
+              onItemClick={canUseCredential ? onItemClick : undefined}
               onEdit={onEdit}
               onDelete={onDelete}
               disableEdit={!canManageCredential}
@@ -80,7 +78,7 @@ function ApiKeySection({
           ))}
         </div>
       </div>
-      {!notAllowCustomCredential && canManageCredential && (
+      {!notAllowCustomCredential && canCreateCredential && (
         <div className="p-2">
           <Button
             onClick={onAdd}
diff --git a/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-auth-dropdown/dropdown-content.tsx b/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-auth-dropdown/dropdown-content.tsx
index 0e0f3a67b17..a571ee85030 100644
--- a/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-auth-dropdown/dropdown-content.tsx
+++ b/web/app/components/header/account-setting/model-provider-page/provider-added-card/model-auth-dropdown/dropdown-content.tsx
@@ -11,6 +11,7 @@ import {
 } from '@langgenius/dify-ui/alert-dialog'
 import { memo, useCallback } from 'react'
 import { useTranslation } from 'react-i18next'
+import { useCredentialPermissions } from '@/hooks/use-credential-permissions'
 import { ConfigurationMethodEnum } from '../../declarations'
 import { useAuth } from '../../model-auth/hooks'
 import ApiKeySection from './api-key-section'
@@ -38,6 +39,7 @@ function DropdownContent({
 }: DropdownContentProps) {
   const { t } = useTranslation()
   const { available_credentials } = provider.custom_configuration
+  const { canUseCredential, canCreateCredential, canManageCredential } = useCredentialPermissions()
 
   const {
     openConfirmDelete,
@@ -51,19 +53,28 @@ function DropdownContent({
   const { selectedCredentialId, isActivating, activate } = useActivateCredential(provider)
 
   const handleEdit = useCallback((credential?: Credential) => {
+    if (credential ? !canManageCredential : !canCreateCredential)
+      return
+
     handleOpenModal(credential)
     onClose()
-  }, [handleOpenModal, onClose])
+  }, [canCreateCredential, canManageCredential, handleOpenModal, onClose])
 
   const handleDelete = useCallback((credential?: Credential) => {
+    if (!canManageCredential)
+      return
+
     if (credential)
       openConfirmDelete(credential)
-  }, [openConfirmDelete])
+  }, [canManageCredential, openConfirmDelete])
 
   const handleAdd = useCallback(() => {
+    if (!canCreateCredential)
+      return
+
     handleOpenModal()
     onClose()
-  }, [handleOpenModal, onClose])
+  }, [canCreateCredential, handleOpenModal, onClose])
 
   const showCreditsExhaustedAlert = state.isCreditsExhausted && state.supportsCredits
   const hasApiKeyFallback = state.variant === 'api-fallback'
@@ -79,7 +90,7 @@ function DropdownContent({
         {state.showPrioritySwitcher && (
           <UsagePrioritySection
             value={state.priority}
-            disabled={isChangingPriority}
+            disabled={isChangingPriority || !canUseCredential}
             onSelect={onChangePriority}
           />
         )}
diff --git a/web/app/components/integrations/__tests__/page.spec.tsx b/web/app/components/integrations/__tests__/page.spec.tsx
index 13c1f89bc16..18ab1a80403 100644
--- a/web/app/components/integrations/__tests__/page.spec.tsx
+++ b/web/app/components/integrations/__tests__/page.spec.tsx
@@ -578,7 +578,7 @@ describe('IntegrationsPage', () => {
     expect(screen.getAllByText('common.toolsPage.toolPlugin')).toHaveLength(2)
     expect(screen.getByText('common.toolsPage.description')).toBeInTheDocument()
     expect(screen.getByText('common.toolsPage.description').closest('[class*="max-w-[1600px]"]')).toHaveClass('px-6')
-    expect(screen.getByRole('link', { name: /common\.modelProvider\.learnMore/i })).toHaveAttribute('href', 'https://docs.dify.ai/en/use-dify/workspace/tools')
+    expect(screen.getByRole('link', { name: /common\.modelProvider\.learnMore/i })).toHaveAttribute('href', 'https://docs.dify.ai/en/self-host/use-dify/workspace/tools')
   })
 
   it('aligns model provider headers to the unified content frame', () => {
@@ -600,7 +600,7 @@ describe('IntegrationsPage', () => {
 
     expect(screen.getAllByText('MCP')).toHaveLength(2)
     expect(screen.getByText('common.mcpPage.description')).toBeInTheDocument()
-    expect(screen.getByRole('link', { name: /common\.modelProvider\.learnMore/i })).toHaveAttribute('href', 'https://docs.dify.ai/en/use-dify/build/mcp')
+    expect(screen.getByRole('link', { name: /common\.modelProvider\.learnMore/i })).toHaveAttribute('href', 'https://docs.dify.ai/en/self-host/use-dify/build/mcp')
     expect(screen.queryByText('common.toolsPage.description')).not.toBeInTheDocument()
   })
 
@@ -609,7 +609,7 @@ describe('IntegrationsPage', () => {
 
     expect(screen.getAllByText('common.settings.swaggerAPIAsTool')).toHaveLength(2)
     expect(screen.getByText('common.swaggerAPIAsToolPage.description')).toBeInTheDocument()
-    expect(screen.getByRole('link', { name: /common\.modelProvider\.learnMore/i })).toHaveAttribute('href', 'https://docs.dify.ai/en/use-dify/workspace/tools#custom-tool')
+    expect(screen.getByRole('link', { name: /common\.modelProvider\.learnMore/i })).toHaveAttribute('href', 'https://docs.dify.ai/en/self-host/use-dify/workspace/tools#custom-tool')
     expect(screen.queryByText('common.toolsPage.description')).not.toBeInTheDocument()
   })
 
@@ -630,7 +630,7 @@ describe('IntegrationsPage', () => {
     expect(screen.getAllByText('common.settings.customEndpoint')).toHaveLength(2)
     expect(screen.getByText('common.apiBasedExtensionPage.description')).toBeInTheDocument()
     expect(screen.getByTestId('api-extension-toolbar')).toBeInTheDocument()
-    expect(screen.getByRole('link', { name: /common\.modelProvider\.learnMore/i })).toHaveAttribute('href', 'https://docs.dify.ai/en/use-dify/workspace/api-extension/api-extension')
+    expect(screen.getByRole('link', { name: /common\.modelProvider\.learnMore/i })).toHaveAttribute('href', 'https://docs.dify.ai/en/self-host/use-dify/workspace/api-extension/api-extension')
     expect(screen.queryByText('common.toolsPage.description')).not.toBeInTheDocument()
   })
 
@@ -652,7 +652,7 @@ describe('IntegrationsPage', () => {
 
     expect(screen.getAllByText('workflow.common.workflowAsTool')).toHaveLength(2)
     expect(screen.getByText('common.workflowAsToolPage.description')).toBeInTheDocument()
-    expect(screen.getByRole('link', { name: /common\.modelProvider\.learnMore/i })).toHaveAttribute('href', 'https://docs.dify.ai/en/use-dify/workspace/tools#workflow-tool')
+    expect(screen.getByRole('link', { name: /common\.modelProvider\.learnMore/i })).toHaveAttribute('href', 'https://docs.dify.ai/en/self-host/use-dify/workspace/tools#workflow-tool')
     expect(screen.queryByText('common.toolsPage.description')).not.toBeInTheDocument()
   })
 
diff --git a/web/app/components/main-nav/__tests__/index.spec.tsx b/web/app/components/main-nav/__tests__/index.spec.tsx
index cf68d4cac8a..d0ef0b0b67c 100644
--- a/web/app/components/main-nav/__tests__/index.spec.tsx
+++ b/web/app/components/main-nav/__tests__/index.spec.tsx
@@ -194,6 +194,8 @@ vi.mock('@/config', async (importOriginal) => {
   return {
     ...actual,
     IS_CLOUD_EDITION: true,
+    SUPPORT_EMAIL_ADDRESS: '',
+    ZENDESK_WIDGET_KEY: '',
   }
 })
 
@@ -284,10 +286,15 @@ const appContextValue: AppContextValue = {
   workspacePermissionKeys: ownerWorkspacePermissionKeys,
 }
 
-type MainNavSystemFeatures = NonNullable<Parameters<typeof renderWithSystemFeatures>[1]>['systemFeatures']
+type MainNavSystemFeatures = Exclude<NonNullable<Parameters<typeof renderWithSystemFeatures>[1]>['systemFeatures'], null | undefined>
+
+const defaultMainNavSystemFeatures: MainNavSystemFeatures = {
+  branding: { enabled: false },
+  enable_marketplace: true,
+}
 
 const renderMainNav = (
-  systemFeatures: MainNavSystemFeatures = { branding: { enabled: false } },
+  systemFeatures: MainNavSystemFeatures = defaultMainNavSystemFeatures,
   options: { store?: ReturnType<typeof createStore>, extra?: ReactNode } = {},
 ) => {
   const queryClient = createTestQueryClient()
@@ -295,12 +302,20 @@ const renderMainNav = (
   const currentAppContext = getMockAppContext() as AppContextValue
   queryClient.setQueryData(consoleQuery.workspaces.current.post.queryKey(), currentAppContext.currentWorkspace)
   queryClient.setQueryData(consoleQuery.workspaces.get.queryKey(), { workspaces: mockWorkspaces })
+  const resolvedSystemFeatures = {
+    ...defaultMainNavSystemFeatures,
+    ...systemFeatures,
+    branding: {
+      ...defaultMainNavSystemFeatures.branding,
+      ...systemFeatures.branding,
+    },
+  }
   return renderWithSystemFeatures(
     <JotaiProvider store={options.store}>
       <MainNav />
       {options.extra}
     </JotaiProvider>,
-    { systemFeatures, queryClient },
+    { systemFeatures: resolvedSystemFeatures, queryClient },
   )
 }
 
@@ -381,6 +396,12 @@ describe('MainNav', () => {
     expect(screen.queryByRole('link', { name: /common.menus.roster/ })).not.toBeInTheDocument()
   })
 
+  it('hides the marketplace entry when marketplace is disabled', () => {
+    renderMainNav({ enable_marketplace: false })
+
+    expect(screen.queryByRole('link', { name: /common.mainNav.marketplace/ })).not.toBeInTheDocument()
+  })
+
   it('renders deployments in primary navigation when app deploy is enabled', () => {
     renderMainNav({ branding: { enabled: false }, enable_app_deploy: true })
 
@@ -925,6 +946,20 @@ describe('MainNav', () => {
     })
   })
 
+  it('closes the help menu from the support upgrade action', async () => {
+    renderMainNav()
+
+    fireEvent.click(screen.getByRole('button', { name: 'common.mainNav.help.openMenu' }))
+    expect(await screen.findByText('common.userProfile.contactUs')).toBeInTheDocument()
+
+    fireEvent.click(screen.getByRole('button', { name: 'billing.upgradeBtn.encourageShort' }))
+
+    await waitFor(() => {
+      expect(screen.queryByText('common.userProfile.forum')).not.toBeInTheDocument()
+    })
+    expect(mockSetShowPricingModal).toHaveBeenCalled()
+  })
+
   it('hides the help menu when branding is enabled', () => {
     renderMainNav({ branding: { enabled: true } })
 
diff --git a/web/app/components/main-nav/__tests__/layout.spec.tsx b/web/app/components/main-nav/__tests__/layout.spec.tsx
index 0157235b6f2..02d2da91c90 100644
--- a/web/app/components/main-nav/__tests__/layout.spec.tsx
+++ b/web/app/components/main-nav/__tests__/layout.spec.tsx
@@ -1,5 +1,5 @@
 import type { ReactNode } from 'react'
-import { render, screen } from '@testing-library/react'
+import { fireEvent, render, screen } from '@testing-library/react'
 import MainNavLayout from '../layout'
 
 vi.mock('@/app/components/header', () => ({
@@ -10,6 +10,12 @@ vi.mock('@/app/components/header/header-wrapper', () => ({
   default: ({ children }: { children: ReactNode }) => <div data-testid="header-wrapper">{children}</div>,
 }))
 
+vi.mock('react-i18next', () => ({
+  useTranslation: () => ({
+    t: (key: string) => key,
+  }),
+}))
+
 vi.mock('../index', () => ({
   default: ({ className }: { className?: string }) => <aside className={className} data-testid="main-nav">MainNav</aside>,
 }))
@@ -34,4 +40,37 @@ describe('MainNavLayout', () => {
     expect(screen.queryByTestId('header-wrapper')).not.toBeInTheDocument()
     expect(screen.queryByTestId('desktop-header')).not.toBeInTheDocument()
   })
+
+  it('renders one main landmark as the skip navigation target', () => {
+    render(<MainNavLayout><div>content</div></MainNavLayout>)
+
+    const main = screen.getByRole('main')
+
+    expect(screen.getAllByRole('main')).toHaveLength(1)
+    expect(main).toHaveAttribute('id', 'main-content')
+    expect(main).toHaveAttribute('tabIndex', '-1')
+    expect(main).toHaveClass('outline-hidden', 'focus:outline-hidden', 'focus-visible:outline-hidden')
+    expect(main).toHaveTextContent('content')
+  })
+
+  it('renders skip navigation before the repeated main navigation', () => {
+    const { container } = render(<MainNavLayout><div>content</div></MainNavLayout>)
+
+    const skipLink = screen.getByRole('link', { name: 'navigation.skipToMain' })
+
+    expect(skipLink).toHaveAttribute('href', '#main-content')
+    expect(skipLink).toHaveClass('outline-hidden', 'focus-visible:ring-2', 'focus-visible:ring-state-accent-solid')
+    expect(container.querySelector('a, button, input, select, textarea, [tabindex]:not([tabindex="-1"])')).toBe(skipLink)
+  })
+
+  it('moves focus to the main content when skip navigation is activated', () => {
+    render(<MainNavLayout><div>content</div></MainNavLayout>)
+
+    const skipLink = screen.getByRole('link', { name: 'navigation.skipToMain' })
+    const main = screen.getByRole('main')
+
+    fireEvent.click(skipLink)
+
+    expect(main).toHaveFocus()
+  })
 })
diff --git a/web/app/components/main-nav/__tests__/skip-nav.spec.tsx b/web/app/components/main-nav/__tests__/skip-nav.spec.tsx
new file mode 100644
index 00000000000..3bd072f3c93
--- /dev/null
+++ b/web/app/components/main-nav/__tests__/skip-nav.spec.tsx
@@ -0,0 +1,15 @@
+import { render, screen } from '@testing-library/react'
+import { SkipNav } from '../skip-nav'
+
+describe('SkipNav', () => {
+  it('keeps the shadow hidden until the link is visible', () => {
+    render(<SkipNav>Skip to main content</SkipNav>)
+
+    const link = screen.getByRole('link', { name: 'Skip to main content' })
+
+    expect(link).not.toHaveClass('shadow-lg')
+    expect(link).not.toHaveClass('shadow-shadow-shadow-5')
+    expect(link).toHaveClass('focus-visible:shadow-lg')
+    expect(link).toHaveClass('focus-visible:shadow-shadow-shadow-5')
+  })
+})
diff --git a/web/app/components/main-nav/components/__tests__/support-menu.spec.tsx b/web/app/components/main-nav/components/__tests__/support-menu.spec.tsx
index 8d06d44ef0f..f37580748ad 100644
--- a/web/app/components/main-nav/components/__tests__/support-menu.spec.tsx
+++ b/web/app/components/main-nav/components/__tests__/support-menu.spec.tsx
@@ -1,30 +1,203 @@
+import type { Mock } from 'vitest'
 import { DropdownMenu, DropdownMenuContent, DropdownMenuTrigger } from '@langgenius/dify-ui/dropdown-menu'
-import { render, screen } from '@testing-library/react'
+import { fireEvent, render, screen } from '@testing-library/react'
+import { openZendeskWindow } from '@/app/components/base/zendesk/utils'
+import { Plan } from '@/app/components/billing/type'
+import { mailToSupport } from '@/app/components/header/utils/util'
+import { useAppContext } from '@/context/app-context'
+import { useModalContext } from '@/context/modal-context'
+import { useProviderContext } from '@/context/provider-context'
 import SupportMenu from '../support-menu'
 
+const { mockConfig, mockOpenZendeskWindow, mockMailToSupport, mockSetShowPricingModal } = vi.hoisted(() => ({
+  mockConfig: {
+    isCloudEdition: true,
+    supportEmailAddress: '',
+    zendeskWidgetKey: 'zendesk-key',
+  },
+  mockOpenZendeskWindow: vi.fn(),
+  mockMailToSupport: vi.fn(),
+  mockSetShowPricingModal: vi.fn(),
+}))
+
+vi.mock('@/app/components/base/zendesk/utils', () => ({
+  openZendeskWindow: mockOpenZendeskWindow,
+}))
+
+vi.mock('@/app/components/header/utils/util', () => ({
+  mailToSupport: mockMailToSupport,
+}))
+
+vi.mock('@/config', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@/config')>()
+  return {
+    ...actual,
+    get IS_CLOUD_EDITION() {
+      return mockConfig.isCloudEdition
+    },
+    get SUPPORT_EMAIL_ADDRESS() {
+      return mockConfig.supportEmailAddress
+    },
+    get ZENDESK_WIDGET_KEY() {
+      return mockConfig.zendeskWidgetKey
+    },
+  }
+})
+
+vi.mock('@/context/app-context', () => ({
+  useAppContext: vi.fn(),
+}))
+
+vi.mock('@/context/modal-context', () => ({
+  useModalContext: vi.fn(),
+}))
+
+vi.mock('@/context/provider-context', () => ({
+  useProviderContext: vi.fn(),
+}))
+
 describe('SupportMenu', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockConfig.isCloudEdition = true
+    mockConfig.supportEmailAddress = ''
+    mockConfig.zendeskWidgetKey = 'zendesk-key'
+    ;(useAppContext as Mock).mockReturnValue({
+      langGeniusVersionInfo: { current_version: '1.0.0' },
+      userProfile: { email: 'user@example.com' },
+    })
+    ;(useProviderContext as Mock).mockReturnValue({
+      enableBilling: true,
+      plan: { type: Plan.team },
+    })
+    ;(useModalContext as Mock).mockReturnValue({
+      setShowPricingModal: mockSetShowPricingModal,
+    })
+    ;(mailToSupport as Mock).mockReturnValue('mailto:support@example.com')
   })
 
-  const renderSupportMenu = () => {
+  const renderSupportMenu = (onContactUsClick = vi.fn()) => {
     return render(
       <DropdownMenu open={true} onOpenChange={() => { }}>
         <DropdownMenuTrigger>open</DropdownMenuTrigger>
         <DropdownMenuContent>
-          <SupportMenu />
+          <SupportMenu onContactUsClick={onContactUsClick} />
         </DropdownMenuContent>
       </DropdownMenu>,
     )
   }
 
-  it('renders support entries as flat main nav help menu items', () => {
+  it('renders contact us before community support entries when Zendesk is configured', () => {
+    const onContactUsClick = vi.fn()
+    renderSupportMenu(onContactUsClick)
+
+    expect(screen.getByText('common.userProfile.contactUs')).toBeInTheDocument()
+    expect(screen.getByText('common.userProfile.forum')).toBeInTheDocument()
+    expect(screen.getByText('common.userProfile.community')).toBeInTheDocument()
+    expect(screen.getByText('common.userProfile.contactUs').compareDocumentPosition(screen.getByText('common.userProfile.forum'))).toBe(Node.DOCUMENT_POSITION_FOLLOWING)
+    expect(screen.getByRole('menuitem', { name: 'common.userProfile.forum' })).toHaveClass('mx-0', 'px-3')
+
+    fireEvent.click(screen.getByRole('menuitem', { name: 'common.userProfile.contactUs' }))
+
+    expect(openZendeskWindow).toHaveBeenCalled()
+    expect(onContactUsClick).toHaveBeenCalled()
+  })
+
+  it('renders contact us with upgrade badge for Cloud sandbox plan without dedicated support', () => {
+    ;(useProviderContext as Mock).mockReturnValue({
+      enableBilling: true,
+      plan: { type: Plan.sandbox },
+    })
+
+    const onContactUsClick = vi.fn()
+    renderSupportMenu(onContactUsClick)
+
+    expect(screen.getByText('common.userProfile.contactUs')).toHaveClass('text-text-disabled')
+    expect(screen.getByText('billing.upgradeBtn.encourageShort')).toHaveClass('system-xs-semibold-uppercase', 'text-saas-dify-blue-accessible')
+    expect(screen.queryByText('common.userProfile.emailSupport')).not.toBeInTheDocument()
+
+    fireEvent.click(screen.getByRole('menuitem', { name: 'common.userProfile.contactUs billing.upgradeBtn.encourageShort' }))
+
+    expect(mockSetShowPricingModal).not.toHaveBeenCalled()
+    expect(onContactUsClick).not.toHaveBeenCalled()
+
+    fireEvent.click(screen.getByRole('button', { name: 'billing.upgradeBtn.encourageShort' }))
+
+    expect(mockSetShowPricingModal).toHaveBeenCalled()
+    expect(openZendeskWindow).not.toHaveBeenCalled()
+    expect(onContactUsClick).toHaveBeenCalled()
+  })
+
+  it('hides upgrade contact for Cloud sandbox plan when billing is disabled', () => {
+    ;(useProviderContext as Mock).mockReturnValue({
+      enableBilling: false,
+      plan: { type: Plan.sandbox },
+    })
+
     renderSupportMenu()
 
     expect(screen.queryByText('common.userProfile.contactUs')).not.toBeInTheDocument()
+    expect(screen.queryByText('billing.upgradeBtn.encourageShort')).not.toBeInTheDocument()
+    expect(screen.queryByText('common.userProfile.emailSupport')).not.toBeInTheDocument()
     expect(screen.getByText('common.userProfile.forum')).toBeInTheDocument()
-    expect(screen.getByText('common.userProfile.community')).toBeInTheDocument()
-    expect(screen.getByRole('menuitem', { name: 'common.userProfile.forum' })).toHaveClass('mx-0', 'px-3')
+  })
+
+  it('keeps Zendesk contact us for Cloud sandbox plan with support email and Zendesk configured', () => {
+    mockConfig.supportEmailAddress = 'support@example.com'
+    ;(useProviderContext as Mock).mockReturnValue({
+      enableBilling: true,
+      plan: { type: Plan.sandbox },
+    })
+
+    renderSupportMenu()
+
+    expect(screen.getByText('common.userProfile.contactUs')).toBeInTheDocument()
+    expect(screen.queryByText('billing.upgradeBtn.encourageShort')).not.toBeInTheDocument()
+    fireEvent.click(screen.getByRole('menuitem', { name: 'common.userProfile.contactUs' }))
+
+    expect(openZendeskWindow).toHaveBeenCalled()
+    expect(mockSetShowPricingModal).not.toHaveBeenCalled()
+  })
+
+  it('keeps email support for Cloud sandbox plan with support email and no Zendesk configured', () => {
+    mockConfig.supportEmailAddress = 'support@example.com'
+    mockConfig.zendeskWidgetKey = ''
+    ;(useProviderContext as Mock).mockReturnValue({
+      enableBilling: true,
+      plan: { type: Plan.sandbox },
+    })
+
+    renderSupportMenu()
+
+    expect(screen.queryByText('common.userProfile.contactUs')).not.toBeInTheDocument()
+    expect(screen.getByText('common.userProfile.emailSupport')).toBeInTheDocument()
+    expect(screen.queryByText('billing.upgradeBtn.encourageShort')).not.toBeInTheDocument()
+    expect(mailToSupport).toHaveBeenCalledWith('user@example.com', Plan.sandbox, '1.0.0', 'support@example.com')
+  })
+
+  it('hides dedicated support channels for non-Cloud sandbox plan without support email', () => {
+    mockConfig.isCloudEdition = false
+    ;(useProviderContext as Mock).mockReturnValue({
+      enableBilling: true,
+      plan: { type: Plan.sandbox },
+    })
+
+    renderSupportMenu()
+
+    expect(screen.queryByText('common.userProfile.contactUs')).not.toBeInTheDocument()
+    expect(screen.queryByText('common.userProfile.emailSupport')).not.toBeInTheDocument()
+    expect(screen.getByText('common.userProfile.forum')).toBeInTheDocument()
+  })
+
+  it('renders email support when Zendesk is not configured for a dedicated support channel', () => {
+    mockConfig.zendeskWidgetKey = ''
+
+    renderSupportMenu()
+
+    expect(screen.queryByText('common.userProfile.contactUs')).not.toBeInTheDocument()
+    expect(screen.getByText('common.userProfile.emailSupport')).toBeInTheDocument()
+    expect(mailToSupport).toHaveBeenCalledWith('user@example.com', Plan.team, '1.0.0', '')
+    expect(screen.getByRole('menuitem', { name: 'common.userProfile.emailSupport' })).toHaveAttribute('href', 'mailto:support@example.com')
   })
 
   it('has correct forum and community links', () => {
diff --git a/web/app/components/main-nav/components/help-menu.tsx b/web/app/components/main-nav/components/help-menu.tsx
index 2f74454fd2e..647ef49bdb2 100644
--- a/web/app/components/main-nav/components/help-menu.tsx
+++ b/web/app/components/main-nav/components/help-menu.tsx
@@ -124,7 +124,7 @@ const HelpMenu = ({
             </DropdownMenuGroup>
             <DropdownMenuSeparator className="my-0!" />
             <DropdownMenuGroup className="p-1">
-              <SupportMenu />
+              <SupportMenu onContactUsClick={() => setOpen(false)} />
             </DropdownMenuGroup>
             <DropdownMenuSeparator className="my-0!" />
             <DropdownMenuGroup className="p-1">
diff --git a/web/app/components/main-nav/components/support-menu.tsx b/web/app/components/main-nav/components/support-menu.tsx
index cd904a300d3..e55b90ca43e 100644
--- a/web/app/components/main-nav/components/support-menu.tsx
+++ b/web/app/components/main-nav/components/support-menu.tsx
@@ -1,12 +1,87 @@
-import { DropdownMenuLinkItem } from '@langgenius/dify-ui/dropdown-menu'
+import { DropdownMenuItem, DropdownMenuLinkItem } from '@langgenius/dify-ui/dropdown-menu'
 import { useTranslation } from 'react-i18next'
+import { openZendeskWindow } from '@/app/components/base/zendesk/utils'
+import { Plan } from '@/app/components/billing/type'
 import { ExternalLinkIndicator, MenuItemContent } from '@/app/components/header/account-dropdown/menu-item-content'
+import { mailToSupport } from '@/app/components/header/utils/util'
+import { IS_CLOUD_EDITION, SUPPORT_EMAIL_ADDRESS, ZENDESK_WIDGET_KEY } from '@/config'
+import { useAppContext } from '@/context/app-context'
+import { useModalContext } from '@/context/modal-context'
+import { useProviderContext } from '@/context/provider-context'
 
-export default function SupportMenu() {
+type SupportMenuProps = {
+  onContactUsClick?: () => void
+}
+
+export default function SupportMenu({ onContactUsClick }: SupportMenuProps) {
   const { t } = useTranslation()
+  const { enableBilling, plan } = useProviderContext()
+  const { userProfile, langGeniusVersionInfo } = useAppContext()
+  const { setShowPricingModal } = useModalContext()
+  const hasDedicatedChannel = plan.type !== Plan.sandbox || Boolean(SUPPORT_EMAIL_ADDRESS.trim())
+  const shouldShowUpgradeContact = IS_CLOUD_EDITION && enableBilling && plan.type === Plan.sandbox && !hasDedicatedChannel
+  const hasZendeskWidget = Boolean(ZENDESK_WIDGET_KEY.trim())
 
   return (
     <>
+      {shouldShowUpgradeContact && (
+        <DropdownMenuItem
+          className="mx-0 h-8 cursor-default gap-1 px-3 py-1"
+          onClick={(event) => {
+            event.preventDefault()
+          }}
+        >
+          <MenuItemContent
+            iconClassName="i-ri-chat-smile-2-line text-text-disabled"
+            label={(
+              <span className="text-text-disabled">
+                {t('userProfile.contactUs', { ns: 'common' })}
+              </span>
+            )}
+            trailing={(
+              <button
+                type="button"
+                className="max-w-30 shrink-0 truncate px-1 system-xs-semibold-uppercase text-saas-dify-blue-accessible transition-colors hover:text-saas-dify-blue-static-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden focus-visible:ring-inset"
+                onClick={(event) => {
+                  event.stopPropagation()
+                  setShowPricingModal()
+                  onContactUsClick?.()
+                }}
+              >
+                {t('upgradeBtn.encourageShort', { ns: 'billing' })}
+              </button>
+            )}
+          />
+        </DropdownMenuItem>
+      )}
+      {!shouldShowUpgradeContact && hasDedicatedChannel && hasZendeskWidget && (
+        <DropdownMenuItem
+          className="mx-0 h-8 gap-1 px-3 py-1"
+          onClick={() => {
+            openZendeskWindow()
+            onContactUsClick?.()
+          }}
+        >
+          <MenuItemContent
+            iconClassName="i-ri-chat-smile-2-line"
+            label={t('userProfile.contactUs', { ns: 'common' })}
+          />
+        </DropdownMenuItem>
+      )}
+      {!shouldShowUpgradeContact && hasDedicatedChannel && !hasZendeskWidget && (
+        <DropdownMenuLinkItem
+          className="mx-0 h-8 gap-1 px-3 py-1"
+          href={mailToSupport(userProfile.email, plan.type, langGeniusVersionInfo?.current_version, SUPPORT_EMAIL_ADDRESS)}
+          rel="noopener noreferrer"
+          target="_blank"
+        >
+          <MenuItemContent
+            iconClassName="i-ri-mail-send-line"
+            label={t('userProfile.emailSupport', { ns: 'common' })}
+            trailing={<ExternalLinkIndicator />}
+          />
+        </DropdownMenuLinkItem>
+      )}
       <DropdownMenuLinkItem
         className="mx-0 h-8 gap-1 px-3 py-1"
         href="https://forum.dify.ai/"
diff --git a/web/app/components/main-nav/index.tsx b/web/app/components/main-nav/index.tsx
index 6e11df51839..209f6bb91e8 100644
--- a/web/app/components/main-nav/index.tsx
+++ b/web/app/components/main-nav/index.tsx
@@ -181,6 +181,7 @@ const MainNav = ({
       agentV2Enabled,
       canUseAppDeploy,
       isCurrentWorkspaceDatasetOperator,
+      marketplaceEnabled: systemFeatures.enable_marketplace,
     }))
     .map(route => ({
       href: route.href,
@@ -188,7 +189,7 @@ const MainNav = ({
       active: route.active,
       icon: route.icon,
       activeIcon: route.activeIcon,
-    })), [agentV2Enabled, canUseAppDeploy, isCurrentWorkspaceDatasetOperator, t])
+    })), [agentV2Enabled, canUseAppDeploy, isCurrentWorkspaceDatasetOperator, systemFeatures.enable_marketplace, t])
 
   const renderLogo = () => {
     const appTitle = systemFeatures.branding.enabled && systemFeatures.branding.application_title ? systemFeatures.branding.application_title : 'Dify'
diff --git a/web/app/components/main-nav/layout.tsx b/web/app/components/main-nav/layout.tsx
index d01af10f271..44730fe7468 100644
--- a/web/app/components/main-nav/layout.tsx
+++ b/web/app/components/main-nav/layout.tsx
@@ -1,7 +1,9 @@
 'use client'
 
 import type { ReactNode } from 'react'
+import { useTranslation } from 'react-i18next'
 import MainNav from './index'
+import { MAIN_CONTENT_ID, SkipNav } from './skip-nav'
 
 type MainNavLayoutProps = {
   children: ReactNode
@@ -10,12 +12,19 @@ type MainNavLayoutProps = {
 const MainNavLayout = ({
   children,
 }: MainNavLayoutProps) => {
+  const { t } = useTranslation('common')
+
   return (
     <div className="flex h-0 min-h-0 grow overflow-hidden bg-background-body">
+      <SkipNav>{t('navigation.skipToMain')}</SkipNav>
       <MainNav />
-      <div className="flex min-w-0 grow flex-col overflow-hidden">
+      <main
+        id={MAIN_CONTENT_ID}
+        tabIndex={-1}
+        className="flex min-w-0 grow flex-col overflow-hidden outline-hidden focus:outline-hidden focus-visible:outline-hidden"
+      >
         {children}
-      </div>
+      </main>
     </div>
   )
 }
diff --git a/web/app/components/main-nav/routes.ts b/web/app/components/main-nav/routes.ts
index 438094a581e..fce275974fd 100644
--- a/web/app/components/main-nav/routes.ts
+++ b/web/app/components/main-nav/routes.ts
@@ -10,13 +10,14 @@ export type MainNavRouteConfig = {
   icon: string
   activeIcon: string
   visibility: MainNavRouteVisibility
-  feature?: 'agentV2'
+  feature?: 'agentV2' | 'marketplace'
 }
 
 export type MainNavRouteVisibilityOptions = {
   agentV2Enabled: boolean
   canUseAppDeploy: boolean
   isCurrentWorkspaceDatasetOperator: boolean
+  marketplaceEnabled: boolean
 }
 
 function isPathUnderRoute(pathname: string, route: string) {
@@ -78,6 +79,7 @@ export const MAIN_NAV_ROUTES = [
     icon: 'i-custom-vender-main-nav-marketplace',
     activeIcon: 'i-custom-vender-main-nav-marketplace-active',
     visibility: 'all',
+    feature: 'marketplace',
   },
   {
     key: 'deployments',
@@ -94,6 +96,9 @@ export function isMainNavRouteVisible(route: MainNavRouteConfig, options: MainNa
   if (route.feature === 'agentV2' && !options.agentV2Enabled)
     return false
 
+  if (route.feature === 'marketplace' && !options.marketplaceEnabled)
+    return false
+
   if (route.visibility === 'all')
     return true
 
diff --git a/web/app/components/main-nav/skip-nav.tsx b/web/app/components/main-nav/skip-nav.tsx
new file mode 100644
index 00000000000..6bdb82c6563
--- /dev/null
+++ b/web/app/components/main-nav/skip-nav.tsx
@@ -0,0 +1,37 @@
+'use client'
+
+import type { ComponentProps, MouseEventHandler } from 'react'
+import { cn } from '@langgenius/dify-ui/cn'
+
+export const MAIN_CONTENT_ID = 'main-content'
+const MAIN_CONTENT_HREF = `#${MAIN_CONTENT_ID}`
+
+export function SkipNav({
+  className,
+  children,
+  onClick,
+  ...props
+}: ComponentProps<'a'>) {
+  const handleClick: MouseEventHandler<HTMLAnchorElement> = (event) => {
+    onClick?.(event)
+
+    if (event.defaultPrevented)
+      return
+
+    document.getElementById(MAIN_CONTENT_ID)?.focus()
+  }
+
+  return (
+    <a
+      href={MAIN_CONTENT_HREF}
+      onClick={handleClick}
+      className={cn(
+        'fixed top-2 left-2 z-60 inline-flex h-9 -translate-y-[calc(100%+0.75rem)] items-center justify-center rounded-lg border-[0.5px] border-components-button-secondary-border bg-components-button-secondary-bg px-3 system-sm-medium text-components-button-secondary-text outline-hidden transition-transform duration-150 focus-visible:translate-y-0 focus-visible:shadow-lg focus-visible:ring-2 focus-visible:shadow-shadow-shadow-5 focus-visible:ring-state-accent-solid motion-reduce:transition-none',
+        className,
+      )}
+      {...props}
+    >
+      {children}
+    </a>
+  )
+}
diff --git a/web/app/components/plugins/plugin-auth/__tests__/plugin-auth-in-agent.spec.tsx b/web/app/components/plugins/plugin-auth/__tests__/plugin-auth-in-agent.spec.tsx
index 6f8125ac132..c7b66119c79 100644
--- a/web/app/components/plugins/plugin-auth/__tests__/plugin-auth-in-agent.spec.tsx
+++ b/web/app/components/plugins/plugin-auth/__tests__/plugin-auth-in-agent.spec.tsx
@@ -46,7 +46,7 @@ vi.mock('@/context/app-context', () => ({
   useSelector: (selector: (state: { userProfile: typeof mockUserProfile, workspacePermissionKeys: string[] }) => unknown) =>
     selector({
       userProfile: mockUserProfile,
-      workspacePermissionKeys: ['credential.manage', 'credential.use'],
+      workspacePermissionKeys: ['credential.use', 'credential.create', 'credential.manage'],
     }),
 }))
 
diff --git a/web/app/components/plugins/plugin-auth/__tests__/plugin-auth.spec.tsx b/web/app/components/plugins/plugin-auth/__tests__/plugin-auth.spec.tsx
index 97d94cbd86d..b7bd28875c5 100644
--- a/web/app/components/plugins/plugin-auth/__tests__/plugin-auth.spec.tsx
+++ b/web/app/components/plugins/plugin-auth/__tests__/plugin-auth.spec.tsx
@@ -7,7 +7,7 @@ import { AuthCategory } from '../types'
 const mockUsePluginAuth = vi.fn()
 const mockSetShowAccountSettingModal = vi.fn()
 const mockAppContext = vi.hoisted(() => ({
-  workspacePermissionKeys: ['credential.manage', 'credential.use'] as string[],
+  workspacePermissionKeys: ['credential.use', 'credential.create', 'credential.manage'] as string[],
 }))
 
 vi.mock('../hooks/use-plugin-auth', () => ({
@@ -44,7 +44,7 @@ const defaultPayload = {
 describe('PluginAuth', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    mockAppContext.workspacePermissionKeys = ['credential.manage', 'credential.use']
+    mockAppContext.workspacePermissionKeys = ['credential.use', 'credential.create', 'credential.manage']
   })
 
   afterEach(() => {
@@ -142,7 +142,7 @@ describe('PluginAuth', () => {
     expect(mockUsePluginAuth).toHaveBeenCalledWith(defaultPayload, true)
   })
 
-  it('renders permission hint and disables authorization configuration when credential.manage is missing', () => {
+  it('renders permission hint and disables authorization configuration when credential.create is missing', () => {
     mockAppContext.workspacePermissionKeys = ['credential.use']
     mockUsePluginAuth.mockReturnValue({
       isAuthorized: false,
diff --git a/web/app/components/plugins/plugin-auth/authorize/__tests__/index.spec.tsx b/web/app/components/plugins/plugin-auth/authorize/__tests__/index.spec.tsx
index aad6a174730..64813aac2a4 100644
--- a/web/app/components/plugins/plugin-auth/authorize/__tests__/index.spec.tsx
+++ b/web/app/components/plugins/plugin-auth/authorize/__tests__/index.spec.tsx
@@ -29,7 +29,7 @@ const createWrapper = () => {
 // Mock API hooks - only mock network-related hooks
 const mockGetPluginOAuthClientSchema = vi.fn()
 const mockAppContext = vi.hoisted(() => ({
-  workspacePermissionKeys: ['credential.manage', 'credential.use'] as string[],
+  workspacePermissionKeys: ['credential.use', 'credential.create', 'credential.manage'] as string[],
 }))
 
 vi.mock('../../hooks/use-credential', () => ({
@@ -94,7 +94,7 @@ const createPluginPayload = (overrides: Partial<PluginPayload> = {}): PluginPayl
 describe('Authorize', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    mockAppContext.workspacePermissionKeys = ['credential.manage', 'credential.use']
+    mockAppContext.workspacePermissionKeys = ['credential.use', 'credential.create', 'credential.manage']
     mockGetPluginOAuthClientSchema.mockReturnValue({
       schema: [],
       is_oauth_custom_client_enabled: false,
@@ -251,8 +251,8 @@ describe('Authorize', () => {
       })
     })
 
-    describe('credential.manage permission', () => {
-      it('should disable OAuth button when credential.manage is missing', () => {
+    describe('credential.create permission', () => {
+      it('should disable OAuth button when credential.create is missing', () => {
         const pluginPayload = createPluginPayload()
         mockAppContext.workspacePermissionKeys = ['credential.use']
 
@@ -267,7 +267,7 @@ describe('Authorize', () => {
         expect(screen.getByRole('button')).toBeDisabled()
       })
 
-      it('should disable API Key button when credential.manage is missing', () => {
+      it('should disable API Key button when credential.create is missing', () => {
         const pluginPayload = createPluginPayload()
         mockAppContext.workspacePermissionKeys = ['credential.use']
 
@@ -282,7 +282,7 @@ describe('Authorize', () => {
         expect(screen.getByRole('button')).toBeDisabled()
       })
 
-      it('should not disable buttons when credential.manage is present', () => {
+      it('should not disable buttons when credential.create is present', () => {
         const pluginPayload = createPluginPayload()
 
         render(
@@ -548,7 +548,7 @@ describe('Authorize', () => {
       }).not.toThrow()
     })
 
-    it('should stay disabled when credential.manage is missing and custom credentials are unavailable', () => {
+    it('should stay disabled when credential.create is missing and custom credentials are unavailable', () => {
       const pluginPayload = createPluginPayload()
       mockAppContext.workspacePermissionKeys = ['credential.use']
 
diff --git a/web/app/components/plugins/plugin-auth/authorize/index.tsx b/web/app/components/plugins/plugin-auth/authorize/index.tsx
index e09afd2d860..be320dad670 100644
--- a/web/app/components/plugins/plugin-auth/authorize/index.tsx
+++ b/web/app/components/plugins/plugin-auth/authorize/index.tsx
@@ -8,8 +8,7 @@ import {
   useMemo,
 } from 'react'
 import { useTranslation } from 'react-i18next'
-import { useSelector as useAppContextWithSelector } from '@/context/app-context'
-import { hasPermission } from '@/utils/permission'
+import { useCredentialPermissions } from '@/hooks/use-credential-permissions'
 import AddApiKeyButton from './add-api-key-button'
 import AddOAuthButton from './add-oauth-button'
 
@@ -40,8 +39,7 @@ const Authorize = ({
   onApiKeyClick,
 }: AuthorizeProps) => {
   const { t } = useTranslation()
-  const workspacePermissionKeys = useAppContextWithSelector(s => s.workspacePermissionKeys)
-  const canManageCredential = hasPermission(workspacePermissionKeys, 'credential.manage')
+  const { canCreateCredential } = useCredentialPermissions()
 
   const oAuthButtonProps: AddOAuthButtonProps = useMemo(() => {
     if (theme === 'secondary') {
@@ -84,7 +82,7 @@ const Authorize = ({
       <div className={cn('min-w-0 flex-1', notAllowCustomCredential && 'opacity-50')}>
         <AddOAuthButton
           {...oAuthButtonProps}
-          disabled={!canManageCredential || notAllowCustomCredential}
+          disabled={!canCreateCredential || notAllowCustomCredential}
           onUpdate={onUpdate}
         />
       </div>
@@ -101,14 +99,14 @@ const Authorize = ({
       )
     }
     return Item
-  }, [notAllowCustomCredential, oAuthButtonProps, canManageCredential, onUpdate, t])
+  }, [notAllowCustomCredential, oAuthButtonProps, canCreateCredential, onUpdate, t])
 
   const ApiKeyButton = useMemo(() => {
     const Item = (
       <div className={cn('min-w-0 flex-1', notAllowCustomCredential && 'opacity-50')}>
         <AddApiKeyButton
           {...apiKeyButtonProps}
-          disabled={!canManageCredential || notAllowCustomCredential}
+          disabled={!canCreateCredential || notAllowCustomCredential}
           onUpdate={onUpdate}
         />
       </div>
@@ -125,7 +123,7 @@ const Authorize = ({
       )
     }
     return Item
-  }, [notAllowCustomCredential, apiKeyButtonProps, canManageCredential, onUpdate, t])
+  }, [notAllowCustomCredential, apiKeyButtonProps, canCreateCredential, onUpdate, t])
 
   return (
     <>
diff --git a/web/app/components/plugins/plugin-auth/authorized/__tests__/index.spec.tsx b/web/app/components/plugins/plugin-auth/authorized/__tests__/index.spec.tsx
index 62e34ae2b6c..2ab81fceb94 100644
--- a/web/app/components/plugins/plugin-auth/authorized/__tests__/index.spec.tsx
+++ b/web/app/components/plugins/plugin-auth/authorized/__tests__/index.spec.tsx
@@ -77,7 +77,7 @@ vi.mock('@langgenius/dify-ui/popover', async () => await import('@/__mocks__/bas
 
 const mockAppContext = vi.hoisted(() => ({
   userProfile: { id: 'test-user', name: 'Test User', email: 'test@example.com', avatar_url: '' },
-  workspacePermissionKeys: ['credential.manage', 'credential.use'] as string[],
+  workspacePermissionKeys: ['credential.use', 'credential.create', 'credential.manage'] as string[],
 }))
 vi.mock('@/context/app-context', () => ({
   useSelector: (selector: (state: {
@@ -141,7 +141,7 @@ const createCredential = (overrides: Partial<Credential> = {}): Credential => ({
 describe('Authorized Component', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    mockAppContext.workspacePermissionKeys = ['credential.manage', 'credential.use']
+    mockAppContext.workspacePermissionKeys = ['credential.use', 'credential.create', 'credential.manage']
     mockDeletePluginCredential.mockResolvedValue({})
     mockSetPluginDefaultCredential.mockResolvedValue({})
     mockUpdatePluginCredential.mockResolvedValue({})
diff --git a/web/app/components/plugins/plugin-auth/authorized/__tests__/item.spec.tsx b/web/app/components/plugins/plugin-auth/authorized/__tests__/item.spec.tsx
index e42b4317c44..58fbe6dfeac 100644
--- a/web/app/components/plugins/plugin-auth/authorized/__tests__/item.spec.tsx
+++ b/web/app/components/plugins/plugin-auth/authorized/__tests__/item.spec.tsx
@@ -12,7 +12,7 @@ vi.mock('@/context/app-context', () => ({
   useSelector: (selector: (state: { userProfile: typeof mockUserProfile, workspacePermissionKeys: string[] }) => unknown) =>
     selector({
       userProfile: mockUserProfile,
-      workspacePermissionKeys: ['credential.manage', 'credential.use'],
+      workspacePermissionKeys: ['credential.use', 'credential.create', 'credential.manage'],
     }),
 }))
 
diff --git a/web/app/components/plugins/plugin-auth/authorized/index.tsx b/web/app/components/plugins/plugin-auth/authorized/index.tsx
index 7a72e36a4fa..05082315e43 100644
--- a/web/app/components/plugins/plugin-auth/authorized/index.tsx
+++ b/web/app/components/plugins/plugin-auth/authorized/index.tsx
@@ -79,7 +79,7 @@ const Authorized = ({
   notAllowCustomCredential,
 }: AuthorizedProps) => {
   const { t } = useTranslation()
-  const { canUseCredential, canManageCredential } = useCredentialPermissions()
+  const { canUseCredential, canCreateCredential, canManageCredential } = useCredentialPermissions()
   const [isLocalOpen, setIsLocalOpen] = useState(false)
   const mergedIsOpen = isOpen ?? isLocalOpen
   const setMergedIsOpen = useCallback((open: boolean) => {
@@ -152,12 +152,12 @@ const Authorized = ({
   // popover closes due to outside-click detection on the modal's portal.
   const [isAddApiKeyOpen, setIsAddApiKeyOpen] = useState(false)
   const handleAddApiKeyClick = useCallback(() => {
-    if (!canManageCredential)
+    if (!canCreateCredential)
       return
 
     setMergedIsOpen(false)
     setIsAddApiKeyOpen(true)
-  }, [canManageCredential, setMergedIsOpen])
+  }, [canCreateCredential, setMergedIsOpen])
   const handleRemove = useCallback(() => {
     if (!canManageCredential)
       return
@@ -394,7 +394,7 @@ const Authorized = ({
             onOpenChange={setIsAddApiKeyOpen}
             pluginPayload={pluginPayload}
             onClose={() => setIsAddApiKeyOpen(false)}
-            disabled={!canManageCredential || doingAction}
+            disabled={!canCreateCredential || doingAction}
             onUpdate={onUpdate}
           />
         )
diff --git a/web/app/components/plugins/plugin-auth/authorized/item.tsx b/web/app/components/plugins/plugin-auth/authorized/item.tsx
index 88edd05b6b8..03f8695449b 100644
--- a/web/app/components/plugins/plugin-auth/authorized/item.tsx
+++ b/web/app/components/plugins/plugin-auth/authorized/item.tsx
@@ -16,7 +16,7 @@ import ActionButton from '@/app/components/base/action-button'
 import Badge from '@/app/components/base/badge'
 import Input from '@/app/components/base/input'
 import { useSelector as useAppContextWithSelector } from '@/context/app-context'
-import { hasPermission } from '@/utils/permission'
+import { useCredentialPermissions } from '@/hooks/use-credential-permissions'
 import { CredentialTypeEnum } from '../types'
 
 type ItemProps = {
@@ -55,9 +55,7 @@ const Item = ({
   const { t } = useTranslation()
   const [renaming, setRenaming] = useState(false)
   const [renameValue, setRenameValue] = useState(credential.name)
-  const workspacePermissionKeys = useAppContextWithSelector(s => s.workspacePermissionKeys)
-  const canManageCredential = hasPermission(workspacePermissionKeys, 'credential.manage')
-  const canUseCredential = hasPermission(workspacePermissionKeys, ['credential.use', 'credential.manage'])
+  const { canUseCredential, canManageCredential } = useCredentialPermissions()
   const isOAuth = credential.credential_type === CredentialTypeEnum.OAUTH2
   const isPersonal = credential.visibility === 'only_me'
   const userProfile = useAppContextWithSelector(state => state.userProfile)
diff --git a/web/app/components/tools/provider/__tests__/custom-create-card.spec.tsx b/web/app/components/tools/provider/__tests__/custom-create-card.spec.tsx
index c15ddb95550..0092eebdd6c 100644
--- a/web/app/components/tools/provider/__tests__/custom-create-card.spec.tsx
+++ b/web/app/components/tools/provider/__tests__/custom-create-card.spec.tsx
@@ -15,7 +15,7 @@ vi.mock('@/context/app-context', () => ({
 // Mock useLocale and useDocLink
 vi.mock('@/context/i18n', () => ({
   useLocale: () => 'en-US',
-  useDocLink: () => (path: string) => `https://docs.dify.ai/en/${path?.startsWith('/') ? path.slice(1) : path}`,
+  useDocLink: () => (path?: string) => `https://docs.dify.ai/en${path?.startsWith('/use-dify/') ? `/cloud${path}` : path || ''}`,
 }))
 
 // Mock getLanguage
@@ -132,7 +132,7 @@ describe('CustomCreateCard', () => {
       render(<CustomCreateCard onRefreshData={mockOnRefreshData} />)
 
       const docLink = screen.getByText('tools.swaggerAPIAsToolTip').closest('a')
-      expect(docLink).toHaveAttribute('href', 'https://docs.dify.ai/en/use-dify/workspace/tools#custom-tool')
+      expect(docLink).toHaveAttribute('href', 'https://docs.dify.ai/en/cloud/use-dify/workspace/tools#custom-tool')
       expect(docLink).toHaveAttribute('target', '_blank')
       expect(docLink).toHaveAttribute('rel', 'noopener noreferrer')
     })
diff --git a/web/app/components/tools/provider/__tests__/detail.spec.tsx b/web/app/components/tools/provider/__tests__/detail.spec.tsx
index 9aca087cf7d..9bce3c0845d 100644
--- a/web/app/components/tools/provider/__tests__/detail.spec.tsx
+++ b/web/app/components/tools/provider/__tests__/detail.spec.tsx
@@ -14,7 +14,7 @@ vi.mock('@/i18n-config/language', () => ({
 
 const mockIsCurrentWorkspaceManager = vi.fn(() => true)
 const mockAppContextState = vi.hoisted(() => ({
-  workspacePermissionKeys: ['tool.manage', 'credential.manage', 'credential.use'] as string[],
+  workspacePermissionKeys: ['tool.manage', 'credential.use', 'credential.create', 'credential.manage'] as string[],
 }))
 vi.mock('@/context/app-context', () => ({
   useAppContext: () => ({
@@ -173,7 +173,7 @@ describe('ProviderDetail', () => {
     ])
     mockFetchCustomToolList.mockResolvedValue([])
     mockFetchModelToolList.mockResolvedValue([])
-    mockAppContextState.workspacePermissionKeys = ['tool.manage', 'credential.manage', 'credential.use']
+    mockAppContextState.workspacePermissionKeys = ['tool.manage', 'credential.use', 'credential.create', 'credential.manage']
   })
 
   afterEach(() => {
@@ -535,8 +535,8 @@ describe('ProviderDetail', () => {
       expect(screen.getByTestId('config-credential'))!.toBeInTheDocument()
     })
 
-    it('does not open setup credential drawer without credential.manage', async () => {
-      mockAppContextState.workspacePermissionKeys = ['tool.manage', 'credential.use']
+    it('does not open setup credential drawer without credential.create', async () => {
+      mockAppContextState.workspacePermissionKeys = ['tool.manage', 'credential.use', 'credential.manage']
 
       render(
         <ProviderDetail
diff --git a/web/app/components/tools/provider/__tests__/empty.spec.tsx b/web/app/components/tools/provider/__tests__/empty.spec.tsx
index 20738bec0f2..55dbf965a71 100644
--- a/web/app/components/tools/provider/__tests__/empty.spec.tsx
+++ b/web/app/components/tools/provider/__tests__/empty.spec.tsx
@@ -84,7 +84,7 @@ describe('Empty', () => {
 
       expect(screen.getByRole('link', { name: /tools\.workflowToolEmpty\.goToStudio/i })).toHaveAttribute('href', '/apps')
       expect(screen.getByRole('link', { name: /tools\.workflowToolEmpty\.learnMore/i })).toHaveAttribute('target', '_blank')
-      expect(screen.getByRole('link', { name: /tools\.workflowToolEmpty\.learnMore/i })).toHaveAttribute('href', 'https://docs.dify.ai/en/use-dify/workspace/tools#workflow-tool')
+      expect(screen.getByRole('link', { name: /tools\.workflowToolEmpty\.learnMore/i })).toHaveAttribute('href', 'https://docs.dify.ai/en/self-host/use-dify/workspace/tools#workflow-tool')
     })
   })
 
diff --git a/web/app/components/tools/provider/detail.tsx b/web/app/components/tools/provider/detail.tsx
index adf993c44d8..747bdff90d8 100644
--- a/web/app/components/tools/provider/detail.tsx
+++ b/web/app/components/tools/provider/detail.tsx
@@ -82,8 +82,9 @@ const ProviderDetail = ({
   const isAuthed = collection.is_team_authorization
   const isBuiltIn = collection.type === CollectionType.builtIn
   const isModel = collection.type === CollectionType.model
-  const { canUseCredential, canManageCredential } = useCredentialPermissions()
-  const canOpenCredentialSettings = isAuthed ? canUseCredential : canManageCredential
+  const { canUseCredential, canCreateCredential, canManageCredential } = useCredentialPermissions()
+  const canOpenCredentialSettings = isAuthed ? canUseCredential : canCreateCredential
+  const canSaveCredentialSettings = isAuthed ? canManageCredential : canCreateCredential
   const canManageTools = useCanManageTools()
   const invalidateAllWorkflowTools = useInvalidateAllWorkflowTools()
   const [isDetailLoading, setIsDetailLoading] = useState(false)
@@ -432,7 +433,7 @@ const ProviderDetail = ({
                     collection={collection}
                     onCancel={() => setShowSettingAuth(false)}
                     onSaved={async (value) => {
-                      if (!canManageCredential)
+                      if (!canSaveCredentialSettings)
                         return
 
                       await updateBuiltInToolCredential(collection.name, value)
@@ -449,7 +450,7 @@ const ProviderDetail = ({
                       await onRefreshData()
                       setShowSettingAuth(false)
                     }}
-                    readonly={!canManageCredential}
+                    readonly={!canSaveCredentialSettings}
                   />
                 )}
                 {isShowEditCollectionToolModal && canManageTools && (
diff --git a/web/app/components/workflow-app/components/workflow-header/__tests__/features-trigger.spec.tsx b/web/app/components/workflow-app/components/workflow-header/__tests__/features-trigger.spec.tsx
index a2d3ba5c750..72850ab8355 100644
--- a/web/app/components/workflow-app/components/workflow-header/__tests__/features-trigger.spec.tsx
+++ b/web/app/components/workflow-app/components/workflow-header/__tests__/features-trigger.spec.tsx
@@ -501,6 +501,15 @@ describe('FeaturesTrigger', () => {
         expect(mockInvalidateQueries).toHaveBeenCalledWith({
           queryKey: consoleQuery.agent.get.key(),
         })
+        expect(mockInvalidateQueries).toHaveBeenCalledWith({
+          queryKey: consoleQuery.agent.byAgentId.referencingWorkflows.get.queryOptions({
+            input: {
+              params: {
+                agent_id: 'agent-1',
+              },
+            },
+          }).queryKey,
+        })
       })
     })
 
@@ -535,6 +544,15 @@ describe('FeaturesTrigger', () => {
       expect(mockInvalidateQueries).not.toHaveBeenCalledWith({
         queryKey: consoleQuery.agent.get.key(),
       })
+      expect(mockInvalidateQueries).not.toHaveBeenCalledWith({
+        queryKey: consoleQuery.agent.byAgentId.referencingWorkflows.get.queryOptions({
+          input: {
+            params: {
+              agent_id: 'agent-1',
+            },
+          },
+        }).queryKey,
+      })
     })
 
     it('should pass publish params to workflow publish mutation', async () => {
diff --git a/web/app/components/workflow-app/components/workflow-header/features-trigger.tsx b/web/app/components/workflow-app/components/workflow-header/features-trigger.tsx
index ab41536fd85..1c751385912 100644
--- a/web/app/components/workflow-app/components/workflow-header/features-trigger.tsx
+++ b/web/app/components/workflow-app/components/workflow-header/features-trigger.tsx
@@ -29,7 +29,7 @@ import {
   // useWorkflowRunValidation,
 } from '@/app/components/workflow/hooks'
 import { useHooksStore } from '@/app/components/workflow/hooks-store'
-import { hasValidRosterAgentBinding, isAgentV2NodeData } from '@/app/components/workflow/nodes/agent-v2/types'
+import { isAgentV2NodeData } from '@/app/components/workflow/nodes/agent-v2/types'
 import {
   useStore,
   useWorkflowStore,
@@ -64,6 +64,20 @@ const FeaturesTrigger = () => {
   const lastPublishedHasUserInput = useStore(s => s.lastPublishedHasUserInput)
 
   const nodes = useNodes()
+  const rosterAgentIds = useMemo(() => {
+    return Array.from(new Set(nodes.flatMap((node) => {
+      const binding = isAgentV2NodeData(node.data) ? node.data.agent_binding : undefined
+      if (
+        binding?.binding_type !== 'roster_agent'
+        || typeof binding.agent_id !== 'string'
+        || binding.agent_id.length === 0
+      ) {
+        return []
+      }
+
+      return [binding.agent_id]
+    })))
+  }, [nodes])
   const hasWorkflowNodes = nodes.length > 0
   const startNode = nodes.find(node => node.data.type === BlockEnum.Start)
   const endNode = nodes.find(node => node.data.type === BlockEnum.End)
@@ -169,10 +183,19 @@ const FeaturesTrigger = () => {
         updatePublishedWorkflow(appID!)
         updateAppDetail()
         invalidateAppTriggers(appID!)
-        if (nodes.some(node => isAgentV2NodeData(node.data) && hasValidRosterAgentBinding(node.data))) {
+        if (rosterAgentIds.length > 0) {
           void queryClient.invalidateQueries({
             queryKey: consoleQuery.agent.get.key(),
           })
+          void Promise.all(rosterAgentIds.map(agentId => queryClient.invalidateQueries({
+            queryKey: consoleQuery.agent.byAgentId.referencingWorkflows.get.queryOptions({
+              input: {
+                params: {
+                  agent_id: agentId,
+                },
+              },
+            }).queryKey,
+          })))
         }
         workflowStore.getState().setPublishedAt(res.created_at)
         workflowStore.getState().setLastPublishedHasUserInput(hasUserInputNode)
@@ -182,7 +205,7 @@ const FeaturesTrigger = () => {
     else {
       throw new Error('Checklist failed')
     }
-  }, [needWarningNodes, handleCheckBeforePublish, publishWorkflow, appID, t, updatePublishedWorkflow, updateAppDetail, invalidateAppTriggers, nodes, queryClient, workflowStore, hasUserInputNode, resetWorkflowVersionHistory])
+  }, [needWarningNodes, handleCheckBeforePublish, publishWorkflow, appID, t, updatePublishedWorkflow, updateAppDetail, invalidateAppTriggers, rosterAgentIds, queryClient, workflowStore, hasUserInputNode, resetWorkflowVersionHistory])
 
   const onPublisherToggle = useCallback((state: boolean) => {
     if (state)
diff --git a/web/app/components/workflow-app/hooks/__tests__/use-available-nodes-meta-data.spec.ts b/web/app/components/workflow-app/hooks/__tests__/use-available-nodes-meta-data.spec.ts
index 17083cc87b9..4afcbd07387 100644
--- a/web/app/components/workflow-app/hooks/__tests__/use-available-nodes-meta-data.spec.ts
+++ b/web/app/components/workflow-app/hooks/__tests__/use-available-nodes-meta-data.spec.ts
@@ -54,6 +54,18 @@ describe('useAvailableNodesMetaData', () => {
     })
   })
 
+  it('should use explicit docs pages and skip nodes without generated docs pages', () => {
+    mockUseIsChatMode.mockReturnValue(false)
+
+    const { result } = renderHook(() => useAvailableNodesMetaData())
+
+    expect(result.current.nodesMap?.[BlockEnum.End]?.metaData.helpLinkUri).toBe('/docs/use-dify/nodes/output')
+    expect(result.current.nodesMap?.[BlockEnum.IterationStart]?.metaData.helpLinkUri).toBeUndefined()
+    expect(result.current.nodesMap?.[BlockEnum.LoopStart]?.metaData.helpLinkUri).toBeUndefined()
+    expect(result.current.nodesMap?.[BlockEnum.LoopEnd]?.metaData.helpLinkUri).toBeUndefined()
+    expect(result.current.nodesMap?.[BlockEnum.Start]?.metaData.helpLinkUri).toBe('/docs/use-dify/nodes/user-input')
+  })
+
   it('should expose Agent v2 instead of legacy Agent when Agent v2 is enabled', () => {
     mockUseIsChatMode.mockReturnValue(false)
 
diff --git a/web/app/components/workflow-app/hooks/use-available-nodes-meta-data.ts b/web/app/components/workflow-app/hooks/use-available-nodes-meta-data.ts
index b001c381898..798181df3c7 100644
--- a/web/app/components/workflow-app/hooks/use-available-nodes-meta-data.ts
+++ b/web/app/components/workflow-app/hooks/use-available-nodes-meta-data.ts
@@ -14,8 +14,20 @@ import TriggerWebhookDefault from '@/app/components/workflow/nodes/trigger-webho
 import { BlockEnum } from '@/app/components/workflow/types'
 import { useDocLink } from '@/context/i18n'
 import { isAgentV2Enabled } from '@/features/agent-v2/feature-flag'
+import { docPathProductAvailability } from '@/types/doc-paths'
 import { useIsChatMode } from './use-is-chat-mode'
 
+const getNodeHelpLinkPath = (helpLinkUri?: string): DocPathWithoutLang | undefined => {
+  if (!helpLinkUri)
+    return undefined
+
+  const helpLinkPath = `/use-dify/nodes/${helpLinkUri}`
+  if (!docPathProductAvailability[helpLinkPath])
+    return undefined
+
+  return helpLinkPath as DocPathWithoutLang
+}
+
 export const useAvailableNodesMetaData = () => {
   const { t } = useTranslation()
   const isChatMode = useIsChatMode()
@@ -57,14 +69,14 @@ export const useAvailableNodesMetaData = () => {
     const { metaData } = node
     const title = t(`blocks.${metaData.type}`, { ns: 'workflow' })
     const description = t(`blocksAbout.${metaData.type}` as I18nKeysWithPrefix<'workflow', 'blocksAbout.'>, { ns: 'workflow' })
-    const helpLinkPath = `/use-dify/nodes/${metaData.helpLinkUri}` as DocPathWithoutLang
+    const helpLinkPath = getNodeHelpLinkPath(metaData.helpLinkUri)
     return {
       ...node,
       metaData: {
         ...metaData,
         title,
         description,
-        helpLinkUri: docLink(helpLinkPath),
+        helpLinkUri: helpLinkPath ? docLink(helpLinkPath) : undefined,
       },
       defaultValue: {
         ...node.defaultValue,
diff --git a/web/app/components/workflow/__tests__/selection-contextmenu.spec.tsx b/web/app/components/workflow/__tests__/selection-contextmenu.spec.tsx
index 3ae8851a23f..b58fa5efc51 100644
--- a/web/app/components/workflow/__tests__/selection-contextmenu.spec.tsx
+++ b/web/app/components/workflow/__tests__/selection-contextmenu.spec.tsx
@@ -3,10 +3,8 @@ import { ContextMenu } from '@langgenius/dify-ui/context-menu'
 import { act, fireEvent, screen, waitFor } from '@testing-library/react'
 import { useEffect } from 'react'
 import { useNodes } from 'reactflow'
-import { PipelineInputVarType } from '@/models/pipeline'
 import { SelectionContextmenu } from '../selection-contextmenu'
 import { useWorkflowStore } from '../store'
-import { BlockEnum } from '../types'
 import { useWorkflowHistoryStore } from '../workflow-history-store'
 import { createEdge, createNode } from './fixtures'
 import { renderWorkflowFlowComponent } from './workflow-test-env'
@@ -17,48 +15,6 @@ const mockGetNodesReadOnly = vi.fn()
 const mockHandleNodesCopy = vi.fn()
 const mockHandleNodesDuplicate = vi.fn()
 const mockHandleNodesDelete = vi.fn()
-const mockHandleCreateSnippet = vi.fn()
-const mockCreateSnippetDialogRender = vi.fn()
-const mockWorkspacePermissionKeys = vi.hoisted(() => ({
-  value: ['snippets.create_and_modify'] as string[],
-}))
-
-vi.mock('@/context/app-context', () => ({
-  useSelector: <T,>(selector: (state: { workspacePermissionKeys: string[] }) => T): T => selector({
-    workspacePermissionKeys: mockWorkspacePermissionKeys.value,
-  }),
-}))
-
-vi.mock('@/app/components/snippets/hooks/use-create-snippet', async () => {
-  const React = await vi.importActual<typeof import('react')>('react')
-
-  return {
-    useCreateSnippet: () => {
-      const [isOpen, setIsOpen] = React.useState(false)
-
-      return {
-        createSnippetMutation: { isPending: false },
-        handleCloseCreateSnippetDialog: () => setIsOpen(false),
-        handleCreateSnippet: mockHandleCreateSnippet,
-        handleOpenCreateSnippetDialog: () => setIsOpen(true),
-        isCreateSnippetDialogOpen: isOpen,
-        isCreatingSnippet: false,
-      }
-    },
-  }
-})
-
-vi.mock('@/app/components/snippets/create-snippet-dialog', () => ({
-  default: (props: {
-    isOpen: boolean
-    selectedGraph?: { nodes: Node[], edges: Edge[], viewport: { x: number, y: number, zoom: number } }
-    inputFields?: Array<{ variable: string }>
-  }) => {
-    mockCreateSnippetDialogRender(props)
-
-    return props.isOpen ? <div data-testid="create-snippet-dialog" /> : null
-  },
-}))
 
 vi.mock('../hooks', async () => {
   const actual = await vi.importActual<typeof import('../hooks')>('../hooks')
@@ -142,9 +98,6 @@ describe('SelectionContextmenu', () => {
     mockHandleNodesCopy.mockReset()
     mockHandleNodesDuplicate.mockReset()
     mockHandleNodesDelete.mockReset()
-    mockHandleCreateSnippet.mockReset()
-    mockCreateSnippetDialogRender.mockReset()
-    mockWorkspacePermissionKeys.value = ['snippets.create_and_modify']
   })
 
   it('should not render when selection context menu target is absent', () => {
@@ -203,41 +156,7 @@ describe('SelectionContextmenu', () => {
     expect(store.getState().contextMenuTarget).toBeUndefined()
   })
 
-  it('should open create snippet dialog with selected graph from the top menu item', async () => {
-    const nodes = [
-      createNode({ id: 'n1', selected: true, width: 80, height: 40 }),
-      createNode({ id: 'n2', selected: true, position: { x: 140, y: 0 }, width: 80, height: 40 }),
-      createNode({ id: 'n3', selected: false, position: { x: 260, y: 0 }, width: 80, height: 40 }),
-    ]
-    const edges = [
-      createEdge({ source: 'n1', target: 'n2' }),
-      createEdge({ source: 'n2', target: 'n3' }),
-    ]
-    const { store } = renderSelectionMenu({ nodes, edges })
-
-    act(() => {
-      store.setState({ contextMenuTarget: { type: 'selection' } })
-    })
-
-    fireEvent.click(await screen.findByRole('menuitem', { name: /Create Snippet|snippet\.createDialogTitle/ }))
-
-    expect(screen.getByTestId('create-snippet-dialog')).toBeInTheDocument()
-    expect(store.getState().contextMenuTarget).toBeUndefined()
-
-    const dialogProps = mockCreateSnippetDialogRender.mock.calls.at(-1)?.[0]
-    expect(dialogProps.selectedGraph.nodes.map((node: Node) => node.id)).toEqual(['n1', 'n2'])
-    expect(dialogProps.selectedGraph.nodes.every((node: Node) => node.selected === false)).toBe(true)
-    expect(dialogProps.selectedGraph.edges).toHaveLength(1)
-    expect(dialogProps.selectedGraph.viewport).toEqual({ x: 490, y: 380, zoom: 1 })
-    expect(dialogProps.selectedGraph.edges[0]).toEqual(expect.objectContaining({
-      source: 'n1',
-      target: 'n2',
-      selected: false,
-    }))
-  })
-
-  it('should hide create snippet action without snippets create-and-modify permission', async () => {
-    mockWorkspacePermissionKeys.value = []
+  it('should hide create snippet action for selected nodes', async () => {
     const nodes = [
       createNode({ id: 'n1', selected: true, width: 80, height: 40 }),
       createNode({ id: 'n2', selected: true, position: { x: 140, y: 0 }, width: 80, height: 40 }),
@@ -252,76 +171,7 @@ describe('SelectionContextmenu', () => {
       expect(screen.getByRole('menuitem', { name: /common.copy/ })).toBeInTheDocument()
     })
     expect(screen.queryByRole('menuitem', { name: /Create Snippet|snippet\.createDialogTitle/ })).not.toBeInTheDocument()
-  })
-
-  it('should add input fields for variable references outside of the selected graph', async () => {
-    const nodes = [
-      createNode({
-        id: 'n1',
-        selected: true,
-        width: 80,
-        height: 40,
-        data: {
-          prompt_template: 'Use {{#source-node.topic#}} and {{#n2.answer#}}',
-          query_variable_selector: ['source-node', 'topic'],
-          env_reference: '{{#env.API_KEY#}}',
-        },
-      }),
-      createNode({
-        id: 'n2',
-        selected: true,
-        position: { x: 140, y: 0 },
-        width: 80,
-        height: 40,
-      }),
-    ]
-    const { store } = renderSelectionMenu({ nodes })
-
-    act(() => {
-      store.setState({ contextMenuTarget: { type: 'selection' } })
-    })
-
-    fireEvent.click(await screen.findByRole('menuitem', { name: /Create Snippet|snippet\.createDialogTitle/ }))
-
-    const dialogProps = mockCreateSnippetDialogRender.mock.calls.at(-1)?.[0]
-    expect(dialogProps.inputFields).toEqual([
-      {
-        label: 'topic',
-        variable: 'topic',
-        type: PipelineInputVarType.textInput,
-        required: true,
-      },
-      {
-        label: 'API_KEY',
-        variable: 'API_KEY',
-        type: PipelineInputVarType.textInput,
-        required: true,
-      },
-    ])
-    expect(dialogProps.selectedGraph.nodes[0].data.prompt_template).toBe('Use {{#start.topic#}} and {{#n2.answer#}}')
-    expect(dialogProps.selectedGraph.nodes[0].data.query_variable_selector).toEqual(['start', 'topic'])
-    expect(dialogProps.selectedGraph.nodes[0].data.env_reference).toBe('{{#start.API_KEY#}}')
-  })
-
-  it.each([
-    BlockEnum.Answer,
-    BlockEnum.End,
-    BlockEnum.Start,
-  ])('should hide create snippet when selection contains %s node', async (nodeType) => {
-    const nodes = [
-      createNode({ id: 'n1', selected: true, width: 80, height: 40, data: { type: nodeType } }),
-      createNode({ id: 'n2', selected: true, position: { x: 140, y: 0 }, width: 80, height: 40 }),
-    ]
-    const { store } = renderSelectionMenu({ nodes })
-
-    act(() => {
-      store.setState({ contextMenuTarget: { type: 'selection' } })
-    })
-
-    await waitFor(() => {
-      expect(screen.getByRole('menuitem', { name: /common.copy/ })).toBeInTheDocument()
-    })
-    expect(screen.queryByRole('menuitem', { name: /Create Snippet|snippet\.createDialogTitle/ })).not.toBeInTheDocument()
+    expect(screen.queryByTestId('create-snippet-dialog')).not.toBeInTheDocument()
   })
 
   it('should stay hidden when only one node is selected', async () => {
diff --git a/web/app/components/workflow/block-selector/__tests__/blocks.spec.tsx b/web/app/components/workflow/block-selector/__tests__/blocks.spec.tsx
index a417f974ba8..d9dfc4fa04e 100644
--- a/web/app/components/workflow/block-selector/__tests__/blocks.spec.tsx
+++ b/web/app/components/workflow/block-selector/__tests__/blocks.spec.tsx
@@ -356,7 +356,7 @@ describe('Blocks', () => {
     )
 
     await user.click(screen.getByRole('button', { name: 'Agent' }))
-    await user.click(await screen.findByRole('button', { name: 'agentV2.roster.nodeSelector.startFromScratch' }))
+    await user.click(await screen.findByRole('option', { name: 'agentV2.roster.nodeSelector.startFromScratch' }))
 
     expect(onSelect).toHaveBeenCalledWith(BlockEnum.AgentV2, {
       agent_binding: {
diff --git a/web/app/components/workflow/block-selector/__tests__/main.spec.tsx b/web/app/components/workflow/block-selector/__tests__/main.spec.tsx
index aaf26eedc56..b7248dcb90a 100644
--- a/web/app/components/workflow/block-selector/__tests__/main.spec.tsx
+++ b/web/app/components/workflow/block-selector/__tests__/main.spec.tsx
@@ -106,6 +106,7 @@ describe('NodeSelector', () => {
     await user.click(trigger)
 
     const searchInput = screen.getByPlaceholderText('workflow.tabs.searchBlock')
+    expect(screen.queryByText('workflow.tabs.snippets')).not.toBeInTheDocument()
     expect(screen.getByText('LLM')).toBeInTheDocument()
     expect(screen.getByText('End')).toBeInTheDocument()
 
@@ -317,7 +318,7 @@ describe('NodeSelector', () => {
     expect(await screen.findByText('workflow.tabs.unconfiguredStartDisabledTip')).toBeInTheDocument()
     expect(screen.getByRole('link', { name: 'workflow.tabs.startDisabledTipLearnMore' })).toHaveAttribute(
       'href',
-      'https://docs.dify.ai/en/use-dify/nodes/trigger/overview',
+      'https://docs.dify.ai/en/self-host/use-dify/nodes/trigger/overview',
     )
     expect(screen.getByPlaceholderText('workflow.tabs.searchBlock')).toBeInTheDocument()
   })
diff --git a/web/app/components/workflow/block-selector/agent-selector.tsx b/web/app/components/workflow/block-selector/agent-selector.tsx
index 05268025ee5..1239b559b87 100644
--- a/web/app/components/workflow/block-selector/agent-selector.tsx
+++ b/web/app/components/workflow/block-selector/agent-selector.tsx
@@ -5,7 +5,6 @@ import type { AgentRosterNodeData } from './types'
 import { cn } from '@langgenius/dify-ui/cn'
 import {
   Combobox,
-  ComboboxEmpty,
   ComboboxInput,
   ComboboxInputGroup,
   ComboboxItem,
@@ -32,6 +31,14 @@ import BlockIcon from '../block-icon'
 
 const AGENT_SELECTOR_PAGE_SIZE = 8
 
+type AgentSelectorOption
+  = | AgentInviteOptionResponse
+    | AgentSelectorActionOption
+
+type AgentSelectorActionOption
+  = | 'start-from-scratch'
+    | 'manage-in-agent-console'
+
 export function AgentSelectorContent({
   open,
   onOpenChange,
@@ -60,20 +67,41 @@ export function AgentSelectorContent({
     }),
   })
   const agents = agentsQuery.data?.data ?? []
+  const actionOptions: AgentSelectorActionOption[] = onStartFromScratch
+    ? ['start-from-scratch', 'manage-in-agent-console']
+    : ['manage-in-agent-console']
+  const options: AgentSelectorOption[] = [...agents, ...actionOptions]
+  const getOptionLabel = (option: AgentSelectorOption) => {
+    if (isAgentSelectorActionOption(option)) {
+      if (option === 'start-from-scratch')
+        return t('roster.nodeSelector.startFromScratch', { ns: 'agentV2' })
+
+      return t('roster.nodeSelector.manageInAgentConsole', { ns: 'agentV2' })
+    }
+
+    return option.name
+  }
   const handleInputValueChange = (nextSearchText: string, details: ComboboxRootChangeEventDetails) => {
     if (details.reason !== 'item-press')
       setSearchText(nextSearchText)
   }
-  const handleValueChange = (agent: AgentInviteOptionResponse | null) => {
-    if (!agent)
+  const handleValueChange = (option: AgentSelectorOption | null) => {
+    if (!option)
       return
 
-    if (!agent.active_config_snapshot_id) {
+    if (isAgentSelectorActionOption(option)) {
+      if (option === 'start-from-scratch')
+        onStartFromScratch?.()
+
+      return
+    }
+
+    if (!option.active_config_snapshot_id) {
       toast.error(t('nodes.agent.modelNotSelected', { ns: 'workflow' }))
       return
     }
 
-    onSelect(toAgentRosterNodeData(agent))
+    onSelect(toAgentRosterNodeData(option))
   }
   const handleOpenChange = (nextOpen: boolean) => {
     if (!nextOpen)
@@ -83,12 +111,12 @@ export function AgentSelectorContent({
 
   return (
     <div className="w-60 overflow-hidden rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-bg-blur shadow-lg backdrop-blur-sm">
-      <Combobox<AgentInviteOptionResponse>
+      <Combobox<AgentSelectorOption>
         filter={null}
         inputValue={searchText}
-        items={agents}
-        itemToStringLabel={getAgentLabel}
-        itemToStringValue={getAgentValue}
+        items={options}
+        itemToStringLabel={getOptionLabel}
+        itemToStringValue={getAgentSelectorOptionValue}
         open={open}
         value={null}
         onInputValueChange={handleInputValueChange}
@@ -105,54 +133,38 @@ export function AgentSelectorContent({
             />
           </ComboboxInputGroup>
         </div>
-        <div className="max-h-54 overflow-y-auto p-1">
-          {isLoading && (
-            <AgentSelectorLoadingSkeleton label={t('loading', { ns: 'common' })} />
-          )}
-          {!isLoading && agentsQuery.isError && (
-            <ComboboxStatus className="px-3 py-2 system-xs-regular">
-              {t('roster.loadingError', { ns: 'agentV2' })}
-            </ComboboxStatus>
-          )}
-          {!isLoading && !agentsQuery.isError && (
-            <>
-              <ComboboxList className="max-h-none overflow-visible p-0">
-                {(agent: AgentInviteOptionResponse) => (
-                  <AgentSelectorItem key={agent.id} agent={agent} />
+        <ComboboxList className="max-h-none overflow-visible p-0">
+          <div role="presentation" className="max-h-54 overflow-y-auto p-1">
+            {isLoading && (
+              <AgentSelectorLoadingSkeleton label={t('loading', { ns: 'common' })} />
+            )}
+            {!isLoading && agentsQuery.isError && (
+              <ComboboxStatus className="px-3 py-2 system-xs-regular">
+                {t('roster.loadingError', { ns: 'agentV2' })}
+              </ComboboxStatus>
+            )}
+            {!isLoading && !agentsQuery.isError && (
+              <>
+                {agents.length === 0 && (
+                  <ComboboxStatus className="px-3 py-2 system-xs-regular">
+                    {debouncedSearchText
+                      ? t('roster.emptySearch', { ns: 'agentV2' })
+                      : t('roster.empty', { ns: 'agentV2' })}
+                  </ComboboxStatus>
                 )}
-              </ComboboxList>
-              <ComboboxEmpty className="px-3 py-2 system-xs-regular">
-                {debouncedSearchText
-                  ? t('roster.emptySearch', { ns: 'agentV2' })
-                  : t('roster.empty', { ns: 'agentV2' })}
-              </ComboboxEmpty>
-            </>
-          )}
-        </div>
+                {agents.map(agent => (
+                  <AgentSelectorItem key={agent.id} agent={agent} />
+                ))}
+              </>
+            )}
+          </div>
+          <div role="presentation" className="border-t border-divider-subtle p-1">
+            {actionOptions.map(option => (
+              <AgentSelectorActionItem key={option} option={option} />
+            ))}
+          </div>
+        </ComboboxList>
       </Combobox>
-      <div className="border-t border-divider-subtle p-1">
-        {onStartFromScratch && (
-          <button
-            type="button"
-            className="flex min-h-7 w-full cursor-pointer items-center gap-2 rounded-md px-2 py-1.5 text-left system-sm-regular text-text-secondary hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
-            onClick={onStartFromScratch}
-          >
-            <span aria-hidden className="i-ri-add-line size-4 shrink-0 text-text-tertiary" />
-            <span className="min-w-0 flex-1 truncate">
-              {t('roster.nodeSelector.startFromScratch', { ns: 'agentV2' })}
-            </span>
-          </button>
-        )}
-        <Link
-          href="/roster"
-          className="flex min-h-7 w-full items-center gap-2 rounded-md px-2 py-1.5 system-sm-regular text-text-secondary hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
-        >
-          <span aria-hidden className="i-ri-arrow-right-up-line size-4 shrink-0 text-text-tertiary" />
-          <span className="min-w-0 flex-1 truncate">
-            {t('roster.nodeSelector.manageInAgentConsole', { ns: 'agentV2' })}
-          </span>
-        </Link>
-      </div>
     </div>
   )
 }
@@ -189,12 +201,15 @@ function AgentSelectorLoadingSkeleton({
   )
 }
 
-function getAgentLabel(agent: AgentInviteOptionResponse) {
-  return agent.name
+function getAgentSelectorOptionValue(option: AgentSelectorOption) {
+  if (isAgentSelectorActionOption(option))
+    return option
+
+  return option.id
 }
 
-function getAgentValue(agent: AgentInviteOptionResponse) {
-  return agent.id
+function isAgentSelectorActionOption(option: AgentSelectorOption): option is AgentSelectorActionOption {
+  return typeof option === 'string'
 }
 
 function toAgentRosterNodeData(agent: AgentInviteOptionResponse): AgentRosterNodeData {
@@ -252,6 +267,38 @@ function AgentSelectorItem({
   )
 }
 
+function AgentSelectorActionItem({
+  option,
+}: {
+  option: AgentSelectorActionOption
+}) {
+  const { t } = useTranslation('agentV2')
+  const isStartFromScratch = option === 'start-from-scratch'
+
+  return (
+    <ComboboxItem
+      value={option}
+      render={isStartFromScratch ? undefined : <Link href="/roster" />}
+      className="flex min-h-7 w-full grid-cols-none items-center gap-2 rounded-md px-2 py-1.5 text-left system-sm-regular text-text-secondary hover:bg-state-base-hover hover:text-text-secondary focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden data-highlighted:bg-state-base-hover data-highlighted:text-text-secondary"
+    >
+      <ComboboxItemText className="flex items-center gap-2 px-0 system-sm-regular text-text-secondary">
+        <span
+          aria-hidden
+          className={cn(
+            'size-4 shrink-0 text-text-tertiary',
+            isStartFromScratch ? 'i-ri-add-line' : 'i-ri-arrow-right-up-line',
+          )}
+        />
+        <span className="min-w-0 flex-1 truncate">
+          {isStartFromScratch
+            ? t('roster.nodeSelector.startFromScratch')
+            : t('roster.nodeSelector.manageInAgentConsole')}
+        </span>
+      </ComboboxItemText>
+    </ComboboxItem>
+  )
+}
+
 export function AgentBlockItem({
   block,
   onSelect,
diff --git a/web/app/components/workflow/block-selector/main.tsx b/web/app/components/workflow/block-selector/main.tsx
index 595426a262b..6678f081fe9 100644
--- a/web/app/components/workflow/block-selector/main.tsx
+++ b/web/app/components/workflow/block-selector/main.tsx
@@ -132,7 +132,7 @@ function NodeSelector({
   const defaultAllowUserInputSelection = !hasUserInputNode && !hasTriggerNode
   const canSelectUserInput = allowUserInputSelection ?? defaultAllowUserInputSelection
   const disableStartTab = flowType === FlowType.snippet
-  const disableSnippetsTab = flowType === FlowType.snippet
+  const disableSnippetsTab = true
   const {
     activeTab,
     resetActiveTab,
diff --git a/web/app/components/workflow/nodes/_base/components/agent-strategy-selector.tsx b/web/app/components/workflow/nodes/_base/components/agent-strategy-selector.tsx
index 9ef2dafd8e5..b432213061b 100644
--- a/web/app/components/workflow/nodes/_base/components/agent-strategy-selector.tsx
+++ b/web/app/components/workflow/nodes/_base/components/agent-strategy-selector.tsx
@@ -236,7 +236,7 @@ export const AgentStrategySelector = memo((props: AgentStrategySelectorProps) =>
             <SearchInput placeholder={t('nodes.agent.strategy.searchPlaceholder', { ns: 'workflow' })} value={query} onValueChange={setQuery} className="w-full" />
             <ViewTypeSelect viewType={viewType} onChange={setViewType} />
           </header>
-          <main className="relative flex w-full flex-col overflow-hidden md:max-h-75 xl:max-h-100 2xl:max-h-141" ref={wrapElemRef}>
+          <div className="relative flex w-full flex-col overflow-hidden md:max-h-75 xl:max-h-100 2xl:max-h-141" ref={wrapElemRef}>
             <Tools
               tools={filteredTools}
               viewType={viewType}
@@ -268,7 +268,7 @@ export const AgentStrategySelector = memo((props: AgentStrategySelectorProps) =>
                 disableMaxWidth
               />
             )}
-          </main>
+          </div>
         </div>
       </PopoverContent>
     </Popover>
diff --git a/web/app/components/workflow/nodes/agent-v2/__tests__/hooks.spec.tsx b/web/app/components/workflow/nodes/agent-v2/__tests__/hooks.spec.tsx
index 16963ba9011..6031e3d8b41 100644
--- a/web/app/components/workflow/nodes/agent-v2/__tests__/hooks.spec.tsx
+++ b/web/app/components/workflow/nodes/agent-v2/__tests__/hooks.spec.tsx
@@ -132,6 +132,9 @@ describe('useCreateInlineAgentBinding', () => {
       body: {
         variant: 'workflow',
         save_strategy: 'node_job_only',
+        binding: {
+          binding_type: 'inline_agent',
+        },
         soul_lock: {
           locked: false,
         },
@@ -189,6 +192,9 @@ describe('useCreateInlineAgentBinding', () => {
       body: {
         variant: 'workflow',
         save_strategy: 'node_job_only',
+        binding: {
+          binding_type: 'inline_agent',
+        },
         soul_lock: {
           locked: false,
         },
diff --git a/web/app/components/workflow/nodes/agent-v2/__tests__/node.spec.tsx b/web/app/components/workflow/nodes/agent-v2/__tests__/node.spec.tsx
index f1799608382..5b2a15c8ac1 100644
--- a/web/app/components/workflow/nodes/agent-v2/__tests__/node.spec.tsx
+++ b/web/app/components/workflow/nodes/agent-v2/__tests__/node.spec.tsx
@@ -128,7 +128,7 @@ describe('agent/node', () => {
     expect(robotIcon?.parentElement).toHaveClass('size-8', 'rounded-full', 'bg-background-default-burn')
   })
 
-  it('renders inline agent name from workflow composer state', () => {
+  it('renders the fixed inline setup name when workflow composer state is loaded', () => {
     render(
       <AgentV2Node
         id="agent-node"
@@ -144,7 +144,8 @@ describe('agent/node', () => {
 
     expect(mockUseAgentRosterDetail).toHaveBeenCalledWith(undefined)
     expect(mockUseWorkflowInlineAgentDetail).toHaveBeenCalledWith('agent-node', 'inline-agent-1')
-    expect(screen.getByText('Workflow Agent 1')).toHaveClass('system-xs-regular', 'text-text-secondary')
+    expect(screen.queryByText('Workflow Agent 1')).not.toBeInTheDocument()
+    expect(screen.getByText('workflow.nodes.agent.roster.inlineSetup.name')).toHaveClass('system-xs-regular', 'text-text-secondary')
     expect(screen.getByText('workflow.nodes.agent.roster.inlineSetup.type')).toHaveClass('system-2xs-regular', 'text-text-tertiary')
   })
 
diff --git a/web/app/components/workflow/nodes/agent-v2/__tests__/panel.spec.tsx b/web/app/components/workflow/nodes/agent-v2/__tests__/panel.spec.tsx
index 522e53235f1..1b824eb7510 100644
--- a/web/app/components/workflow/nodes/agent-v2/__tests__/panel.spec.tsx
+++ b/web/app/components/workflow/nodes/agent-v2/__tests__/panel.spec.tsx
@@ -14,6 +14,7 @@ const {
   mockInsertNodes,
   mockOrchestrateDrawerPanelProps,
   mockPromptEditorProps,
+  mockCreateInlineAgentBinding,
   mockSetInputs,
   mockStoreState,
   mockUseAgentRosterDetail,
@@ -33,6 +34,7 @@ const {
     open: boolean
   }>,
   mockPromptEditorProps: [] as PromptEditorProps[],
+  mockCreateInlineAgentBinding: vi.fn(),
   mockSetInputs: vi.fn(),
   mockStoreState: {
     openInlineAgentPanelNodeId: undefined as string | undefined,
@@ -100,6 +102,7 @@ vi.mock('../../_base/hooks/use-node-crud', () => ({
 vi.mock('@/app/components/workflow/block-selector/agent-selector', () => ({
   AgentSelectorContent: ({
     onSelect,
+    onStartFromScratch,
   }: {
     onSelect: (agent: {
       description: string
@@ -110,26 +113,38 @@ vi.mock('@/app/components/workflow/block-selector/agent-selector', () => ({
       name: string
       role: string
     }) => void
+    onStartFromScratch?: () => void
   }) => (
-    <button
-      type="button"
-      onClick={() => onSelect({
-        id: 'agent-2',
-        name: 'Mara',
-        description: 'Tender Analyst',
-        icon: 'M',
-        icon_background: '#D1E9FF',
-        icon_type: 'emoji',
-        role: 'Analyst',
-      })}
-    >
-      Select Mara
-    </button>
+    <>
+      <button
+        type="button"
+        onClick={() => onSelect({
+          id: 'agent-2',
+          name: 'Mara',
+          description: 'Tender Analyst',
+          icon: 'M',
+          icon_background: '#D1E9FF',
+          icon_type: 'emoji',
+          role: 'Analyst',
+        })}
+      >
+        Select Mara
+      </button>
+      {onStartFromScratch && (
+        <button type="button" onClick={onStartFromScratch}>
+          Start from Scratch
+        </button>
+      )}
+    </>
   ),
 }))
 
 vi.mock('../hooks', () => ({
   useAgentRosterDetail: (agentId?: string) => mockUseAgentRosterDetail(agentId),
+  useCreateInlineAgentBinding: () => ({
+    createInlineAgentBinding: mockCreateInlineAgentBinding,
+    isCreatingInlineAgent: false,
+  }),
   useWorkflowInlineAgentDetail: (nodeId?: string, agentId?: string | null) => mockUseWorkflowInlineAgentDetail(nodeId, agentId),
 }))
 
@@ -201,6 +216,7 @@ describe('agent/panel', () => {
     mockPromptEditorProps.length = 0
     mockOrchestrateDrawerPanelProps.length = 0
     mockStoreState.openInlineAgentPanelNodeId = undefined
+    mockCreateInlineAgentBinding.mockImplementation(() => {})
     mockUseNodeCrud.mockImplementation((_id: string, data: AgentV2NodeType) => ({
       inputs: data,
       setInputs: mockSetInputs,
@@ -346,14 +362,17 @@ describe('agent/panel', () => {
     expect(mockUseAgentRosterDetail).toHaveBeenCalledWith(undefined)
     expect(mockUseWorkflowInlineAgentDetail).toHaveBeenCalledWith('agent-node', 'inline-agent-1')
     expect(screen.queryByText('Workflow Agent 1')).not.toBeInTheDocument()
-    expect(screen.getByText('workflow.nodes.agent.roster.inlineSetup.name')).toBeInTheDocument()
-    expect(screen.getByText('workflow.nodes.agent.roster.inlineSetup.type')).toBeInTheDocument()
+    const trigger = screen.getByRole('button', { name: /^workflow\.nodes\.agent\.roster\.openPanel/ })
+    expect(within(trigger).getByText('workflow.nodes.agent.roster.inlineSetup.name')).toBeInTheDocument()
+    expect(within(trigger).getByText('workflow.nodes.agent.roster.inlineSetup.type')).toBeInTheDocument()
+    const panel = screen.getByRole('dialog', { name: 'workflow.nodes.agent.roster.inlineSetup.name' })
+    const panelRobotIcon = panel.querySelector('.i-custom-vender-agent-v2-robot-3')
     expect(container.querySelector('.i-custom-vender-agent-v2-robot-3')).toHaveClass('size-5')
     expect(container.querySelector('.i-custom-vender-agent-v2-robot-3')?.parentElement).toHaveClass('size-8', 'rounded-full', 'bg-background-default-burn')
-    expect(screen.getByText('workflow.nodes.agent.roster.inlineSetup.title')).toBeInTheDocument()
+    expect(panelRobotIcon).toHaveClass('size-5')
+    expect(panelRobotIcon?.parentElement).toHaveClass('size-9', 'rounded-full', 'bg-background-default-burn')
+    expect(screen.queryByText('workflow.nodes.agent.roster.inlineSetup.title')).not.toBeInTheDocument()
     expect(screen.getByText('workflow.nodes.agent.roster.inlineSetup.description')).toBeInTheDocument()
-    expect(screen.getByRole('button', { name: /^workflow\.nodes\.agent\.roster\.openPanel/ })).toBeInTheDocument()
-    expect(screen.getByRole('dialog', { name: 'workflow.nodes.agent.roster.inlineSetup.title' })).toBeInTheDocument()
     expect(screen.getByRole('region', { name: 'inline-orchestrate-panel' })).toBeInTheDocument()
     expect(mockOrchestrateDrawerPanelProps.at(-1)).toMatchObject({
       agentId: 'inline-agent-1',
@@ -399,9 +418,11 @@ describe('agent/panel', () => {
       />,
     )
 
-    const panel = screen.getByRole('dialog', { name: 'Workflow Agent 1' })
+    const panel = screen.getByRole('dialog', { name: 'workflow.nodes.agent.roster.inlineSetup.name' })
     expect(panel).toBeInTheDocument()
     expect(panel.querySelector('header')).not.toHaveClass('h-[108px]')
+    expect(panel.querySelector('.i-custom-vender-agent-v2-robot-3')?.parentElement).toHaveClass('size-9', 'rounded-full', 'bg-background-default-burn')
+    expect(within(panel).queryByText('Workflow Agent 1')).not.toBeInTheDocument()
     expect(within(panel).getByText('workflow.nodes.agent.roster.inlineSetup.type')).toBeInTheDocument()
     expect(within(panel).queryByText('workflow.nodes.agent.roster.inlineSetup.title')).not.toBeInTheDocument()
     expect(within(panel).queryByText('workflow.nodes.agent.roster.inlineSetup.description')).not.toBeInTheDocument()
@@ -410,6 +431,26 @@ describe('agent/panel', () => {
     expect(screen.getByRole('region', { name: 'inline-orchestrate-panel' })).toBeInTheDocument()
   })
 
+  it('does not show start from scratch for an existing inline agent binding', () => {
+    render(
+      <AgentV2Panel
+        id="agent-node"
+        data={createData({
+          agent_binding: {
+            binding_type: 'inline_agent',
+            agent_id: 'inline-agent-1',
+            current_snapshot_id: 'snapshot-1',
+          },
+        })}
+        panelProps={panelProps}
+      />,
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: 'workflow.nodes.agent.roster.change' }))
+
+    expect(screen.queryByRole('button', { name: 'Start from Scratch' })).not.toBeInTheDocument()
+  })
+
   it('opens the inline panel while workflow composer state is still loading', () => {
     mockStoreState.openInlineAgentPanelNodeId = 'agent-node'
     mockUseWorkflowInlineAgentDetail.mockReturnValue({ data: undefined })
@@ -430,8 +471,7 @@ describe('agent/panel', () => {
 
     expect(mockUseWorkflowInlineAgentDetail).toHaveBeenCalledWith('agent-node', 'inline-agent-1')
     expect(container.querySelector('[aria-busy="true"]')).toBeInTheDocument()
-    expect(screen.queryByText('workflow.nodes.agent.roster.inlineSetup.name')).not.toBeInTheDocument()
-    expect(screen.getByRole('dialog', { name: 'workflow.nodes.agent.roster.inlineSetup.title' })).toBeInTheDocument()
+    expect(screen.getByRole('dialog', { name: 'workflow.nodes.agent.roster.inlineSetup.name' })).toBeInTheDocument()
     expect(screen.getByRole('region', { name: 'inline-orchestrate-panel' })).toBeInTheDocument()
     expect(mockOrchestrateDrawerPanelProps.at(-1)).toMatchObject({
       agentId: 'inline-agent-1',
@@ -498,6 +538,66 @@ describe('agent/panel', () => {
     )
   })
 
+  it('switches a roster agent to a workflow-only inline agent from the selector', () => {
+    mockCreateInlineAgentBinding.mockImplementation((_nodeId: string, options?: {
+      onSuccess?: (binding: {
+        binding_type: 'inline_agent'
+        agent_id: string
+        current_snapshot_id: string
+      }) => void
+    }) => {
+      options?.onSuccess?.({
+        binding_type: 'inline_agent',
+        agent_id: 'inline-agent-1',
+        current_snapshot_id: 'inline-snapshot-1',
+      })
+    })
+
+    render(
+      <AgentV2Panel
+        id="agent-node"
+        data={createData({
+          agent_task: 'Keep this task',
+          agent_declared_outputs: [{
+            name: 'summary',
+            type: 'string',
+          }],
+        })}
+        panelProps={panelProps}
+      />,
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: 'workflow.nodes.agent.roster.change' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Start from Scratch' }))
+
+    expect(mockCreateInlineAgentBinding).toHaveBeenCalledWith('agent-node', expect.objectContaining({
+      onSuccess: expect.any(Function),
+    }))
+    expect(mockStoreState.setOpenInlineAgentPanelNodeId).toHaveBeenCalledWith('agent-node')
+    expect(mockHandleNodeDataUpdateWithSyncDraft).toHaveBeenCalledWith(
+      {
+        id: 'agent-node',
+        data: expect.objectContaining({
+          agent_binding: {
+            binding_type: 'inline_agent',
+            agent_id: 'inline-agent-1',
+            current_snapshot_id: 'inline-snapshot-1',
+          },
+          agent_task: 'Keep this task',
+          agent_declared_outputs: [{
+            name: 'summary',
+            type: 'string',
+          }],
+          _openInlineAgentPanel: true,
+        }),
+      },
+      expect.objectContaining({
+        sync: true,
+        notRefreshWhenSyncError: true,
+      }),
+    )
+  })
+
   it('does not fall back to the roster agent description when role is empty', () => {
     mockUseAgentRosterDetail.mockReturnValue({
       data: {
diff --git a/web/app/components/workflow/nodes/agent-v2/components/agent-orchestrate-drawer-panel.tsx b/web/app/components/workflow/nodes/agent-v2/components/agent-orchestrate-drawer-panel.tsx
index f04899116b0..0b174d02280 100644
--- a/web/app/components/workflow/nodes/agent-v2/components/agent-orchestrate-drawer-panel.tsx
+++ b/web/app/components/workflow/nodes/agent-v2/components/agent-orchestrate-drawer-panel.tsx
@@ -79,6 +79,7 @@ function AgentOrchestrateDrawerPanelContent({
     <AgentOrchestratePanel
       agentId={agentId}
       appId={isInline ? appId : undefined}
+      nodeId={isInline ? nodeId : undefined}
       activeConfigSnapshot={activeConfigSnapshot}
       agentSoulConfig={agentSoulConfig as AgentSoulConfig}
       agentName={composerState?.agent?.name}
diff --git a/web/app/components/workflow/nodes/agent-v2/components/agent-roster-field.tsx b/web/app/components/workflow/nodes/agent-v2/components/agent-roster-field.tsx
index 5a933f63830..b95617ff4a3 100644
--- a/web/app/components/workflow/nodes/agent-v2/components/agent-roster-field.tsx
+++ b/web/app/components/workflow/nodes/agent-v2/components/agent-roster-field.tsx
@@ -84,6 +84,7 @@ function InlineSetupAvatar({
 function AgentRosterDrawer({
   agent,
   children,
+  isInlineSetup = false,
   mode = 'detail',
   open,
   portalContainerRef,
@@ -94,6 +95,7 @@ function AgentRosterDrawer({
 }: {
   agent: AgentRosterDisplayData
   children?: ReactNode
+  isInlineSetup?: boolean
   mode?: AgentRosterDrawerMode
   open: boolean
   portalContainerRef: RefObject<HTMLDivElement | null>
@@ -104,7 +106,7 @@ function AgentRosterDrawer({
 }) {
   const { t } = useTranslation()
   const isSetup = mode === 'setup'
-  const title = isSetup ? t(`${i18nPrefix}.roster.inlineSetup.title`, { ns: 'workflow' }) : agent.name
+  const title = isInlineSetup ? t(`${i18nPrefix}.roster.inlineSetup.name`, { ns: 'workflow' }) : agent.name
   const description = isSetup ? t(`${i18nPrefix}.roster.inlineSetup.description`, { ns: 'workflow' }) : agent.role
 
   return (
@@ -139,8 +141,10 @@ function AgentRosterDrawer({
                 )}
               >
                 <div className="flex min-w-0 items-start justify-between">
-                  <div className={cn('flex min-w-0 flex-1', isSetup ? 'min-w-px flex-col' : 'h-10 items-center gap-2 px-0.5 py-0.5')}>
-                    {!isSetup && <AgentRosterAvatar agent={agent} size="md" className="size-9" />}
+                  <div className={cn('flex min-w-0 flex-1', isSetup ? 'min-w-px items-center gap-2' : 'h-10 items-center gap-2 px-0.5 py-0.5')}>
+                    {isInlineSetup
+                      ? <InlineSetupAvatar className="size-9" />
+                      : <AgentRosterAvatar agent={agent} size="md" className="size-9" />}
                     <div className={cn('flex min-w-0 flex-1 flex-col', isSetup ? '' : 'gap-0.5 py-px')}>
                       <div className="flex min-w-0 items-center gap-1">
                         <DrawerTitle className={cn('truncate', isSetup ? 'system-xl-semibold text-text-primary' : 'system-sm-medium text-text-secondary')}>
@@ -227,6 +231,7 @@ export function AgentRosterField({
   portalContainerRef,
   onChange,
   onPanelOpenChange,
+  onStartFromScratch,
 }: {
   agent?: AgentRosterDisplayData
   agentId?: string
@@ -241,6 +246,7 @@ export function AgentRosterField({
   portalContainerRef: RefObject<HTMLDivElement | null>
   onChange: (agent: AgentRosterNodeData) => void
   onPanelOpenChange?: (open: boolean) => void
+  onStartFromScratch?: () => void
 }) {
   const { t } = useTranslation()
   const [localPanelOpen, setLocalPanelOpen] = useState(false)
@@ -317,6 +323,12 @@ export function AgentRosterField({
                 setIsSelectorOpen(false)
                 onChange(nextAgent)
               }}
+              onStartFromScratch={onStartFromScratch
+                ? () => {
+                    setIsSelectorOpen(false)
+                    onStartFromScratch()
+                  }
+                : undefined}
             />
           </PopoverContent>
         </Popover>
@@ -340,6 +352,7 @@ export function AgentRosterField({
                     </button>
                     <AgentRosterDrawer
                       agent={agent}
+                      isInlineSetup={isInlineSetup}
                       mode={panelMode}
                       open={panelOpen}
                       portalContainerRef={portalContainerRef}
diff --git a/web/app/components/workflow/nodes/agent-v2/hooks.ts b/web/app/components/workflow/nodes/agent-v2/hooks.ts
index 6d9bbbd3d44..7df158bda9f 100644
--- a/web/app/components/workflow/nodes/agent-v2/hooks.ts
+++ b/web/app/components/workflow/nodes/agent-v2/hooks.ts
@@ -74,6 +74,9 @@ export function useCreateInlineAgentBinding() {
         body: {
           variant: 'workflow',
           save_strategy: 'node_job_only',
+          binding: {
+            binding_type: 'inline_agent',
+          },
           soul_lock: {
             locked: false,
           },
diff --git a/web/app/components/workflow/nodes/agent-v2/node.tsx b/web/app/components/workflow/nodes/agent-v2/node.tsx
index 95e0c03ecfd..33dcd303832 100644
--- a/web/app/components/workflow/nodes/agent-v2/node.tsx
+++ b/web/app/components/workflow/nodes/agent-v2/node.tsx
@@ -50,17 +50,15 @@ function AgentNodeAvatarPlaceholder() {
 function AgentNodeModel({
   data,
   agent,
-  inlineAgentName,
   isLoading,
 }: {
   data: AgentV2NodeType
   agent?: ReturnType<typeof useAgentRosterDetail>['data']
-  inlineAgentName?: string
   isLoading: boolean
 }) {
   const { t } = useTranslation()
   const isInlineAgent = hasInlineAgentBinding(data)
-  const name = isInlineAgent ? (inlineAgentName || t('nodes.agent.roster.inlineSetup.name', { ns: 'workflow' })) : agent?.name
+  const name = isInlineAgent ? t('nodes.agent.roster.inlineSetup.name', { ns: 'workflow' }) : agent?.name
   const role = isInlineAgent ? t('nodes.agent.roster.inlineSetup.type', { ns: 'workflow' }) : ''
   const showPlaceholder = isLoading || (!isInlineAgent && !agent)
 
@@ -110,7 +108,7 @@ export function AgentV2Node({ id, data }: NodeProps<AgentV2NodeType>) {
   const isInlineAgentDetailLoading = isInlineAgent && !!inlineAgentId && inlineAgentQuery.isPending
 
   if (isInlineAgent || hasValidAgent)
-    return <AgentNodeModel data={data} agent={rosterAgentQuery.data} inlineAgentName={inlineAgentQuery.data?.agent?.name} isLoading={isInlineAgentDetailLoading} />
+    return <AgentNodeModel data={data} agent={rosterAgentQuery.data} isLoading={isInlineAgentDetailLoading} />
 
   return (
     <div className="mb-1 space-y-1 px-3">
diff --git a/web/app/components/workflow/nodes/agent-v2/panel.tsx b/web/app/components/workflow/nodes/agent-v2/panel.tsx
index c01c46fe513..c80c021407d 100644
--- a/web/app/components/workflow/nodes/agent-v2/panel.tsx
+++ b/web/app/components/workflow/nodes/agent-v2/panel.tsx
@@ -16,7 +16,7 @@ import { AgentOrchestrateDrawerPanel } from './components/agent-orchestrate-draw
 import { AgentOutputVariables } from './components/agent-output-variables'
 import { AgentRosterField } from './components/agent-roster-field'
 import { AgentTaskField } from './components/agent-task-field'
-import { useAgentRosterDetail, useWorkflowInlineAgentDetail } from './hooks'
+import { useAgentRosterDetail, useCreateInlineAgentBinding, useWorkflowInlineAgentDetail } from './hooks'
 import { getAgentV2DeclaredOutputs } from './output-variables'
 import { hasValidInlineAgentBinding } from './types'
 
@@ -43,9 +43,12 @@ export function AgentV2Panel({
   const isInlineAgentPanelOpen = isInlineAgentReady && openInlineAgentPanelNodeId === id
   const rosterAgentQuery = useAgentRosterDetail(rosterAgentId)
   const inlineAgentQuery = useWorkflowInlineAgentDetail(id, inlineAgentId)
+  const { createInlineAgentBinding, isCreatingInlineAgent } = useCreateInlineAgentBinding()
   const inlineAgent = inlineAgentQuery.data?.agent
   const isAgentPanelOpen = isInlineAgentReady ? isInlineAgentPanelOpen : isRosterAgentPanelOpen
   const isInlineAgentLoading = isInlineAgentReady && !inlineAgent
+  const isAgentBindingPending = isInlineAgentPending || isCreatingInlineAgent
+  const canStartFromScratch = inputs.agent_binding?.binding_type !== 'inline_agent'
   const displayedAgent = rosterAgentQuery.data ?? (inlineAgentId && isInlineAgentReady
     ? {
         id: inlineAgentId,
@@ -110,6 +113,33 @@ export function AgentV2Panel({
     )
   }, [handleNodeDataUpdateWithSyncDraft, id, inputs, setOpenInlineAgentPanelNodeId])
 
+  const handleStartFromScratch = useCallback(() => {
+    createInlineAgentBinding(id, {
+      onSuccess: (binding) => {
+        setIsRosterAgentPanelOpen(false)
+        setIsInlineAgentPanelOpenedFromTrigger(false)
+        setOpenInlineAgentPanelNodeId(id)
+
+        const newInputs = produce(inputsRef.current, (draft) => {
+          delete (draft as AgentV2NodeType & { agent_roster?: unknown }).agent_roster
+          draft.agent_binding = binding
+          draft._openInlineAgentPanel = true
+        })
+        inputsRef.current = newInputs
+        handleNodeDataUpdateWithSyncDraft(
+          {
+            id,
+            data: newInputs,
+          },
+          {
+            sync: true,
+            notRefreshWhenSyncError: true,
+          },
+        )
+      },
+    })
+  }, [createInlineAgentBinding, handleNodeDataUpdateWithSyncDraft, id, setOpenInlineAgentPanelNodeId])
+
   const handleAgentPanelOpenChange = useCallback((open: boolean) => {
     if (isInlineAgentReady) {
       if (open)
@@ -171,7 +201,7 @@ export function AgentV2Panel({
           isInlineSetup={isInlineAgentReady}
           isLoading={isInlineAgentLoading}
           isPanelOpen={isAgentPanelOpen}
-          isPending={isInlineAgentPending}
+          isPending={isAgentBindingPending}
           panelBody={isAgentPanelOpen && displayedAgent
             ? (
                 <AgentOrchestrateDrawerPanel
@@ -189,6 +219,7 @@ export function AgentV2Panel({
           showPanelDetailActions={!isInlineAgentReady}
           onChange={handleRosterChange}
           onPanelOpenChange={handleAgentPanelOpenChange}
+          onStartFromScratch={canStartFromScratch ? handleStartFromScratch : undefined}
         />
       </div>
       <div
diff --git a/web/app/components/workflow/nodes/end/default.ts b/web/app/components/workflow/nodes/end/default.ts
index 146ffc6797b..98dcbc2637d 100644
--- a/web/app/components/workflow/nodes/end/default.ts
+++ b/web/app/components/workflow/nodes/end/default.ts
@@ -6,6 +6,7 @@ import { genNodeMetaData } from '@/app/components/workflow/utils'
 const metaData = genNodeMetaData({
   sort: 2.1,
   type: BlockEnum.End,
+  helpLinkUri: 'output',
   isRequired: false,
 })
 const nodeDefault: NodeDefault<EndNodeType> = {
diff --git a/web/app/components/workflow/selection-contextmenu.tsx b/web/app/components/workflow/selection-contextmenu.tsx
index dffbd31a5e1..0478b0e12f5 100644
--- a/web/app/components/workflow/selection-contextmenu.tsx
+++ b/web/app/components/workflow/selection-contextmenu.tsx
@@ -12,15 +12,11 @@ import {
 } from 'react'
 import { useTranslation } from 'react-i18next'
 import { useStore as useReactFlowStore } from 'reactflow'
-import { useCreateSnippetFromSelection } from '@/app/components/snippets/hooks/use-create-snippet-from-selection'
-import { canCreateAndModifySnippets } from '@/app/components/snippets/utils/permission'
 import { useCollaborativeWorkflow } from '@/app/components/workflow/hooks/use-collaborative-workflow'
-import { useSelector as useAppContextWithSelector } from '@/context/app-context'
 import { useNodesInteractions, useNodesReadOnly, useNodesSyncDraft } from './hooks'
 import { useWorkflowHistory, WorkflowHistoryEvent } from './hooks/use-workflow-history'
 import { ShortcutKbd } from './shortcuts/shortcut-kbd'
 import { useStore, useWorkflowStore } from './store'
-import { BlockEnum } from './types'
 
 const AlignType = {
   Bottom: 'bottom',
@@ -75,14 +71,6 @@ const menuSections: MenuSection[] = [
   },
 ]
 
-const unsupportedSnippetNodeTypes = new Set([
-  BlockEnum.Answer,
-  BlockEnum.End,
-  BlockEnum.Start,
-  BlockEnum.HumanInput,
-  BlockEnum.KnowledgeRetrieval,
-])
-
 const getAlignableNodes = (nodes: Node[], selectedNodes: Node[]) => {
   const selectedNodeIds = new Set(selectedNodes.map(node => node.id))
   const childNodeIds = new Set<string>()
@@ -235,7 +223,6 @@ export function SelectionContextmenu({
 }) {
   const { t } = useTranslation()
   const { getNodesReadOnly } = useNodesReadOnly()
-  const workspacePermissionKeys = useAppContextWithSelector(state => state.workspacePermissionKeys)
   const { handleNodesCopy, handleNodesDelete, handleNodesDuplicate } = useNodesInteractions()
   const isSelectionContextMenu = useStore(s => s.contextMenuTarget?.type === 'selection')
 
@@ -247,20 +234,8 @@ export function SelectionContextmenu({
   const selectedNodes = useReactFlowStore(state =>
     state.getNodes().filter(node => node.selected),
   )
-  const edges = useReactFlowStore(state => state.edges)
   const { handleSyncWorkflowDraft } = useNodesSyncDraft()
   const { saveStateToHistory } = useWorkflowHistory()
-  const {
-    createSnippetDialog,
-    handleOpenCreateSnippet,
-    isCreateSnippetDialogOpen,
-  } = useCreateSnippetFromSelection({
-    edges,
-    selectedNodes,
-    onClose,
-  })
-  const canCreateSnippet = canCreateAndModifySnippets(workspacePermissionKeys)
-    && selectedNodes.every(node => !unsupportedSnippetNodeTypes.has(node.data.type))
 
   const handleCopyNodes = useCallback(() => {
     handleNodesCopy()
@@ -370,24 +345,11 @@ export function SelectionContextmenu({
   }, [collaborativeWorkflow, workflowStore, selectedNodes, getNodesReadOnly, handleSyncWorkflowDraft, saveStateToHistory, onClose])
 
   if (!isSelectionContextMenu || selectedNodes.length <= 1)
-    return isCreateSnippetDialogOpen ? createSnippetDialog : null
+    return null
 
   return (
     <>
       <ContextMenuContent popupClassName="w-[240px]" sideOffset={4}>
-        {canCreateSnippet && (
-          <>
-            <ContextMenuGroup>
-              <ContextMenuItem
-                className="px-3 text-text-secondary"
-                onClick={handleOpenCreateSnippet}
-              >
-                <span>{t('snippet.createDialogTitle', { defaultValue: 'Create Snippet', ns: 'workflow' })}</span>
-              </ContextMenuItem>
-            </ContextMenuGroup>
-            <ContextMenuSeparator />
-          </>
-        )}
         <ContextMenuGroup>
           <ContextMenuItem
             className="justify-between px-3 text-text-secondary"
@@ -436,7 +398,6 @@ export function SelectionContextmenu({
           </ContextMenuGroup>
         ))}
       </ContextMenuContent>
-      {createSnippetDialog}
     </>
   )
 }
diff --git a/web/app/components/workflow/workflow-generator/index.tsx b/web/app/components/workflow/workflow-generator/index.tsx
index fade26f0482..e96fe5306ae 100644
--- a/web/app/components/workflow/workflow-generator/index.tsx
+++ b/web/app/components/workflow/workflow-generator/index.tsx
@@ -15,6 +15,7 @@ import { Button } from '@langgenius/dify-ui/button'
 import { Dialog, DialogContent } from '@langgenius/dify-ui/dialog'
 import { Textarea } from '@langgenius/dify-ui/textarea'
 import { toast } from '@langgenius/dify-ui/toast'
+import { useSuspenseQuery } from '@tanstack/react-query'
 import { useBoolean } from 'ahooks'
 import * as React from 'react'
 import { useCallback, useEffect, useRef, useState } from 'react'
@@ -25,6 +26,7 @@ import { ModelTypeEnum } from '@/app/components/header/account-setting/model-pro
 import { useModelListAndDefaultModelAndCurrentProviderAndModel } from '@/app/components/header/account-setting/model-provider-page/hooks'
 import ModelParameterModal from '@/app/components/header/account-setting/model-provider-page/model-parameter-modal'
 import WorkflowPreview from '@/app/components/workflow/workflow-preview'
+import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import { useRouter } from '@/next/navigation'
 import { generateWorkflow } from '@/service/debug'
 import { fetchWorkflowDraft } from '@/service/workflow'
@@ -97,6 +99,8 @@ const RecoveryDialog = ({ open, onOpenChange, title, description, cancelLabel, c
 const WorkflowGeneratorModal: React.FC = () => {
   const { t } = useTranslation('workflow')
   const router = useRouter()
+  const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
+  const isRbacEnabled = systemFeatures.rbac_enabled
 
   const isOpen = useWorkflowGeneratorStore(s => s.isOpen)
   const mode = useWorkflowGeneratorStore(s => s.mode)
@@ -347,7 +351,7 @@ const WorkflowGeneratorModal: React.FC = () => {
       })
       toast.success(t('workflowGenerator.applied'))
       closeGenerator()
-      router.push(getRedirectionPath({ id: appId, mode: appMode, permission_keys: permissionKeys }))
+      router.push(getRedirectionPath({ id: appId, mode: appMode, permission_keys: permissionKeys }, { isRbacEnabled }))
     }
     catch (e: unknown) {
       if (e instanceof WorkflowApplyOrphanError) {
@@ -364,7 +368,7 @@ const WorkflowGeneratorModal: React.FC = () => {
     finally {
       setApplyingFalse()
     }
-  }, [current, instruction, mode, router, closeGenerator, t, isApplying, setApplyingTrue, setApplyingFalse])
+  }, [current, instruction, mode, router, closeGenerator, t, isApplying, isRbacEnabled, setApplyingTrue, setApplyingFalse])
 
   const handleApplyToCurrentConfirmed = useCallback(async () => {
     if (!current?.graph || !currentAppId || isApplying)
diff --git a/web/context/i18n.spec.ts b/web/context/i18n.spec.ts
index 83e510f040c..0fc0ae5c809 100644
--- a/web/context/i18n.spec.ts
+++ b/web/context/i18n.spec.ts
@@ -5,6 +5,10 @@ import { useTranslation } from '#i18n'
 import { getDocLanguage } from '@/i18n-config/language'
 import { defaultDocBaseUrl, useDocLink } from './i18n'
 
+const mockConfig = vi.hoisted(() => ({
+  IS_CLOUD_EDITION: true,
+}))
+
 // Mock dependencies
 vi.mock('#i18n', () => ({
   useTranslation: vi.fn(() => ({
@@ -12,6 +16,12 @@ vi.mock('#i18n', () => ({
   })),
 }))
 
+vi.mock('@/config', () => ({
+  get IS_CLOUD_EDITION() {
+    return mockConfig.IS_CLOUD_EDITION
+  },
+}))
+
 vi.mock('@/i18n-config/language', () => ({
   getDocLanguage: vi.fn((locale: string) => {
     const map: Record<string, string> = {
@@ -28,6 +38,7 @@ vi.mock('@/i18n-config/language', () => ({
 describe('useDocLink', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockConfig.IS_CLOUD_EDITION = true
     vi.mocked(useTranslation).mockReturnValue({
       i18n: { language: 'en-US' },
     } as ReturnType<typeof useTranslation>)
@@ -45,28 +56,28 @@ describe('useDocLink', () => {
     it('should use default base URL when no baseUrl provided', () => {
       const { result } = renderHook(() => useDocLink())
       const url = result.current()
-      expect(url).toBe(`${defaultDocBaseUrl}/en`)
+      expect(url).toBe(`${defaultDocBaseUrl}/en/home`)
     })
 
     it('should use custom base URL when provided', () => {
       const customBaseUrl = 'https://custom.docs.com'
       const { result } = renderHook(() => useDocLink(customBaseUrl))
       const url = result.current()
-      expect(url).toBe(`${customBaseUrl}/en`)
+      expect(url).toBe(`${customBaseUrl}/en/home`)
     })
 
     it('should remove trailing slash from base URL', () => {
       const baseUrlWithSlash = 'https://docs.dify.ai/'
       const { result } = renderHook(() => useDocLink(baseUrlWithSlash))
       const url = result.current('/use-dify/getting-started/introduction')
-      expect(url).toBe('https://docs.dify.ai/en/use-dify/getting-started/introduction')
+      expect(url).toBe('https://docs.dify.ai/en/cloud/use-dify/getting-started/introduction')
     })
 
     it('should handle base URL without trailing slash', () => {
       const baseUrlWithoutSlash = 'https://docs.dify.ai'
       const { result } = renderHook(() => useDocLink(baseUrlWithoutSlash))
       const url = result.current('/use-dify/getting-started/introduction')
-      expect(url).toBe('https://docs.dify.ai/en/use-dify/getting-started/introduction')
+      expect(url).toBe('https://docs.dify.ai/en/cloud/use-dify/getting-started/introduction')
     })
   })
 
@@ -74,19 +85,31 @@ describe('useDocLink', () => {
     it('should handle path parameter', () => {
       const { result } = renderHook(() => useDocLink())
       const url = result.current('/use-dify/getting-started/introduction')
-      expect(url).toBe(`${defaultDocBaseUrl}/en/use-dify/getting-started/introduction`)
+      expect(url).toBe(`${defaultDocBaseUrl}/en/cloud/use-dify/getting-started/introduction`)
     })
 
     it('should handle empty path', () => {
       const { result } = renderHook(() => useDocLink())
       const url = result.current()
-      expect(url).toBe(`${defaultDocBaseUrl}/en`)
+      expect(url).toBe(`${defaultDocBaseUrl}/en/home`)
     })
 
     it('should handle undefined path', () => {
       const { result } = renderHook(() => useDocLink())
       const url = result.current(undefined)
-      expect(url).toBe(`${defaultDocBaseUrl}/en`)
+      expect(url).toBe(`${defaultDocBaseUrl}/en/home`)
+    })
+
+    it('should keep common docs path without product prefix', () => {
+      const { result } = renderHook(() => useDocLink())
+      const url = result.current('/learn/key-concepts' as DocPathWithoutLang)
+      expect(url).toBe(`${defaultDocBaseUrl}/en/learn/key-concepts`)
+    })
+
+    it('should keep explicit product docs path without adding another product prefix', () => {
+      const { result } = renderHook(() => useDocLink())
+      const url = result.current('/cloud/use-dify/build/mcp' as DocPathWithoutLang)
+      expect(url).toBe(`${defaultDocBaseUrl}/en/cloud/use-dify/build/mcp`)
     })
   })
 
@@ -99,12 +122,12 @@ describe('useDocLink', () => {
 
       const pathMap: DocPathMap = {
         'zh-Hans': '/use-dify/getting-started/introduction',
-        'en-US': '/use-dify/getting-started/quick-start',
+        'en-US': '/use-dify/build/mcp',
       }
 
       const { result } = renderHook(() => useDocLink())
-      const url = result.current('/use-dify/getting-started/quick-start' as DocPathWithoutLang, pathMap)
-      expect(url).toBe(`${defaultDocBaseUrl}/zh/use-dify/getting-started/introduction`)
+      const url = result.current('/use-dify/build/mcp', pathMap)
+      expect(url).toBe(`${defaultDocBaseUrl}/zh/cloud/use-dify/getting-started/introduction`)
     })
 
     it('should use default path when locale not in pathMap', () => {
@@ -115,18 +138,76 @@ describe('useDocLink', () => {
 
       const pathMap: DocPathMap = {
         'zh-Hans': '/use-dify/getting-started/introduction',
-        'en-US': '/use-dify/getting-started/quick-start',
+        'en-US': '/use-dify/build/mcp',
       }
 
       const { result } = renderHook(() => useDocLink())
-      const url = result.current('/use-dify/getting-started/quick-start' as DocPathWithoutLang, pathMap)
-      expect(url).toBe(`${defaultDocBaseUrl}/ja/use-dify/getting-started/quick-start`)
+      const url = result.current('/use-dify/build/mcp', pathMap)
+      expect(url).toBe(`${defaultDocBaseUrl}/ja/cloud/use-dify/build/mcp`)
     })
 
     it('should handle undefined pathMap', () => {
       const { result } = renderHook(() => useDocLink())
       const url = result.current('/use-dify/getting-started/introduction', undefined)
-      expect(url).toBe(`${defaultDocBaseUrl}/en/use-dify/getting-started/introduction`)
+      expect(url).toBe(`${defaultDocBaseUrl}/en/cloud/use-dify/getting-started/introduction`)
+    })
+  })
+
+  describe('Product prefix handling', () => {
+    it('should add cloud product prefix for product docs available in both editions', () => {
+      mockConfig.IS_CLOUD_EDITION = true
+
+      const { result } = renderHook(() => useDocLink())
+      const url = result.current('/use-dify/build/mcp')
+      expect(url).toBe(`${defaultDocBaseUrl}/en/cloud/use-dify/build/mcp`)
+    })
+
+    it('should add self-host product prefix for product docs available in both editions outside cloud edition', () => {
+      mockConfig.IS_CLOUD_EDITION = false
+
+      const { result } = renderHook(() => useDocLink())
+      const url = result.current('/use-dify/build/mcp')
+      expect(url).toBe(`${defaultDocBaseUrl}/en/self-host/use-dify/build/mcp`)
+    })
+
+    it('should use the existing cloud docs path for cloud-only product docs outside cloud edition', () => {
+      mockConfig.IS_CLOUD_EDITION = false
+
+      const { result } = renderHook(() => useDocLink())
+      const url = result.current('/use-dify/workspace/subscription-management#dify-for-education')
+      expect(url).toBe(`${defaultDocBaseUrl}/en/cloud/use-dify/workspace/subscription-management#dify-for-education`)
+    })
+
+    it('should use the existing self-host docs path for self-host-only product docs in cloud edition', () => {
+      mockConfig.IS_CLOUD_EDITION = true
+
+      const { result } = renderHook(() => useDocLink())
+      const url = result.current('/deploy/overview')
+      expect(url).toBe(`${defaultDocBaseUrl}/en/self-host/deploy/overview`)
+    })
+
+    it('should not add a product prefix for unknown productless paths', () => {
+      mockConfig.IS_CLOUD_EDITION = false
+
+      const { result } = renderHook(() => useDocLink())
+      const url = result.current('/use-dify/unknown-page' as DocPathWithoutLang)
+      expect(url).toBe(`${defaultDocBaseUrl}/en/use-dify/unknown-page`)
+    })
+
+    it('should open shared docs home when no path is provided outside cloud edition', () => {
+      mockConfig.IS_CLOUD_EDITION = false
+
+      const { result } = renderHook(() => useDocLink())
+      const url = result.current()
+      expect(url).toBe(`${defaultDocBaseUrl}/en/home`)
+    })
+
+    it('should keep self-host deploy paths without adding use-dify product prefix', () => {
+      mockConfig.IS_CLOUD_EDITION = true
+
+      const { result } = renderHook(() => useDocLink())
+      const url = result.current('/self-host/deploy/overview' as DocPathWithoutLang)
+      expect(url).toBe(`${defaultDocBaseUrl}/en/self-host/deploy/overview`)
     })
   })
 
@@ -232,7 +313,7 @@ describe('useDocLink', () => {
 
       const { result } = renderHook(() => useDocLink())
       const url = result.current('/use-dify/getting-started/introduction')
-      expect(url).toBe(`${defaultDocBaseUrl}/zh/use-dify/getting-started/introduction`)
+      expect(url).toBe(`${defaultDocBaseUrl}/zh/cloud/use-dify/getting-started/introduction`)
     })
   })
 
@@ -240,15 +321,15 @@ describe('useDocLink', () => {
     it('should handle path with anchor', () => {
       const { result } = renderHook(() => useDocLink())
       const url = result.current('/use-dify/getting-started/introduction#overview' as DocPathWithoutLang)
-      expect(url).toBe(`${defaultDocBaseUrl}/en/use-dify/getting-started/introduction#overview`)
+      expect(url).toBe(`${defaultDocBaseUrl}/en/cloud/use-dify/getting-started/introduction#overview`)
     })
 
     it('should handle multiple calls with same hook instance', () => {
       const { result } = renderHook(() => useDocLink())
       const url1 = result.current('/use-dify/getting-started/introduction')
-      const url2 = result.current('/use-dify/getting-started/quick-start')
-      expect(url1).toBe(`${defaultDocBaseUrl}/en/use-dify/getting-started/introduction`)
-      expect(url2).toBe(`${defaultDocBaseUrl}/en/use-dify/getting-started/quick-start`)
+      const url2 = result.current('/use-dify/build/mcp')
+      expect(url1).toBe(`${defaultDocBaseUrl}/en/cloud/use-dify/getting-started/introduction`)
+      expect(url2).toBe(`${defaultDocBaseUrl}/en/cloud/use-dify/build/mcp`)
     })
   })
 })
diff --git a/web/context/i18n.ts b/web/context/i18n.ts
index ac11f44f323..a8f7dfa5959 100644
--- a/web/context/i18n.ts
+++ b/web/context/i18n.ts
@@ -1,9 +1,10 @@
 import type { Locale } from '@/i18n-config/language'
-import type { DocPathWithoutLang } from '@/types/doc-paths'
+import type { DocPathWithoutLang, DocsProduct } from '@/types/doc-paths'
 import { useCallback } from 'react'
 import { useTranslation } from '#i18n'
+import { IS_CLOUD_EDITION } from '@/config'
 import { getDocLanguage, getLanguage, getPricingPageLanguage } from '@/i18n-config/language'
-import { apiReferencePathTranslations } from '@/types/doc-paths'
+import { apiReferencePathTranslations, docPathProductAvailability } from '@/types/doc-paths'
 
 export const useLocale = () => {
   const { i18n } = useTranslation()
@@ -24,6 +25,44 @@ export const useGetPricingPageLanguage = () => {
 export const defaultDocBaseUrl = 'https://docs.dify.ai'
 export type DocPathMap = Partial<Record<Locale, DocPathWithoutLang>>
 
+export const getDocHomePath = () => '/home'
+
+const getCurrentDocsProduct = (): DocsProduct => {
+  return IS_CLOUD_EDITION ? 'cloud' : 'self-host'
+}
+
+const splitPathHash = (path: string) => {
+  const hashIndex = path.indexOf('#')
+  if (hashIndex === -1) {
+    return {
+      pathname: path,
+      hash: '',
+    }
+  }
+
+  return {
+    pathname: path.slice(0, hashIndex),
+    hash: path.slice(hashIndex),
+  }
+}
+
+const getProductAwarePath = (path: string): string => {
+  const { pathname, hash } = splitPathHash(path)
+  const availableProducts = docPathProductAvailability[pathname]
+  if (!availableProducts?.length)
+    return path
+
+  const currentProduct = getCurrentDocsProduct()
+  const targetProduct = availableProducts.includes(currentProduct)
+    ? currentProduct
+    : availableProducts[0]
+
+  if (!targetProduct)
+    return path
+
+  return `/${targetProduct}${pathname}${hash}`
+}
+
 export const useDocLink = (baseUrl?: string): ((path?: DocPathWithoutLang, pathMap?: DocPathMap) => string) => {
   let baseDocUrl = baseUrl || defaultDocBaseUrl
   baseDocUrl = (baseDocUrl.endsWith('/')) ? baseDocUrl.slice(0, -1) : baseDocUrl
@@ -44,6 +83,12 @@ export const useDocLink = (baseUrl?: string): ((path?: DocPathWithoutLang, pathM
           }
         }
       }
+      else if (!targetPath) {
+        targetPath = getDocHomePath()
+      }
+      else {
+        targetPath = getProductAwarePath(targetPath)
+      }
 
       return `${baseDocUrl}${languagePrefix}${targetPath}`
     },
diff --git a/web/contract/console/agent-drive.ts b/web/contract/console/agent-drive.ts
new file mode 100644
index 00000000000..b80af71ba24
--- /dev/null
+++ b/web/contract/console/agent-drive.ts
@@ -0,0 +1,123 @@
+import { type } from '@orpc/contract'
+import { base } from '../base'
+
+type AgentDriveSkillItem = {
+  path: string
+  skill_md_key: string
+  archive_key?: string | null
+  name: string
+  description: string
+  size?: number | null
+  mime_type?: string | null
+  hash?: string | null
+  created_at?: number | null
+}
+
+type AgentDriveSkillFile = {
+  available_in_drive: boolean
+  drive_key?: string | null
+  name: string
+  path: string
+  type: string
+}
+
+type AgentDriveSkillMarkdown = {
+  binary: boolean
+  key: string
+  size?: number | null
+  text?: string | null
+  truncated: boolean
+}
+
+type AgentDriveSkillInspect = AgentDriveSkillItem & {
+  file_tree?: Array<Record<string, unknown>>
+  files?: AgentDriveSkillFile[]
+  skill_md: AgentDriveSkillMarkdown
+  source: string
+  warnings?: string[]
+}
+
+const agentDriveSkillsByAgentContract = base
+  .route({
+    path: '/agent/{agent_id}/drive/skills',
+    method: 'GET',
+  })
+  .input(type<{
+    params: {
+      agent_id: string
+    }
+  }>())
+  .output(type<{ items: AgentDriveSkillItem[] }>())
+
+const agentDriveSkillInspectByAgentContract = base
+  .route({
+    path: '/agent/{agent_id}/drive/skills/{skill_path}/inspect',
+    method: 'GET',
+  })
+  .input(type<{
+    params: {
+      agent_id: string
+      skill_path: string
+    }
+  }>())
+  .output(type<AgentDriveSkillInspect>())
+
+const agentDriveSkillsByAppContract = base
+  .route({
+    path: '/apps/{app_id}/agent/drive/skills',
+    method: 'GET',
+  })
+  .input(type<{
+    params: {
+      app_id: string
+    }
+    query?: {
+      node_id?: string
+    }
+  }>())
+  .output(type<{ items: AgentDriveSkillItem[] }>())
+
+const agentDriveSkillInspectByAppContract = base
+  .route({
+    path: '/apps/{app_id}/agent/drive/skills/{skill_path}/inspect',
+    method: 'GET',
+  })
+  .input(type<{
+    params: {
+      app_id: string
+      skill_path: string
+    }
+    query?: {
+      node_id?: string
+    }
+  }>())
+  .output(type<AgentDriveSkillInspect>())
+
+export const agentDriveContracts = {
+  byAgentId: {
+    drive: {
+      skills: {
+        get: agentDriveSkillsByAgentContract,
+        bySkillPath: {
+          inspect: {
+            get: agentDriveSkillInspectByAgentContract,
+          },
+        },
+      },
+    },
+  },
+  byAppId: {
+    agent: {
+      drive: {
+        skills: {
+          get: agentDriveSkillsByAppContract,
+          bySkillPath: {
+            inspect: {
+              get: agentDriveSkillInspectByAppContract,
+            },
+          },
+        },
+      },
+    },
+  },
+}
diff --git a/web/contract/router.ts b/web/contract/router.ts
index 2f9b5de318d..c00657892f0 100644
--- a/web/contract/router.ts
+++ b/web/contract/router.ts
@@ -2,6 +2,7 @@ import type { InferContractRouterInputs } from '@orpc/contract'
 import { contract as communityContract } from '@dify/contracts/api/console/orpc.gen'
 import { contract as enterpriseContract } from '@dify/contracts/enterprise/orpc.gen'
 import { rbacAccessConfigContract } from './console/access-control'
+import { agentDriveContracts } from './console/agent-drive'
 import {
   appDeleteContract,
   appListContract,
@@ -114,9 +115,26 @@ export const consoleRouterContract = {
     workflowOnlineUsers: workflowOnlineUsersContract,
     byAppId: {
       ...communityContract.apps.byAppId,
+      agent: {
+        ...communityContract.apps.byAppId.agent,
+        ...agentDriveContracts.byAppId.agent,
+        drive: {
+          ...communityContract.apps.byAppId.agent.drive,
+          ...agentDriveContracts.byAppId.agent.drive,
+        },
+      },
+    },
+  },
+  agent: {
+    ...communityContract.agent,
+    byAgentId: {
+      ...communityContract.agent.byAgentId,
+      drive: {
+        ...communityContract.agent.byAgentId.drive,
+        ...agentDriveContracts.byAgentId.drive,
+      },
     },
   },
-  agent: communityContract.agent,
   explore: {
     ...communityContract.explore,
     apps: exploreAppsContract,
diff --git a/web/features/agent-v2/agent-composer/__tests__/store.spec.ts b/web/features/agent-v2/agent-composer/__tests__/store.spec.ts
index 302d04c2888..a48369d876a 100644
--- a/web/features/agent-v2/agent-composer/__tests__/store.spec.ts
+++ b/web/features/agent-v2/agent-composer/__tests__/store.spec.ts
@@ -50,27 +50,6 @@ describe('agent composer store conversions', () => {
       prompt: {
         system_prompt: 'Be precise.',
       },
-      skills_files: {
-        files: [
-          {
-            id: 'file-1',
-            name: 'guide.md',
-            type: 'markdown',
-          },
-        ],
-        skills: [
-          {
-            id: 'skill-1',
-            file_id: 'archive-file-1',
-            full_archive_file_id: 'archive-file-1',
-            full_archive_key: 'research-skill/.DIFY-SKILL-FULL.zip',
-            name: 'Research Skill',
-            path: 'research-skill',
-            skill_md_file_id: 'skill-md-file-1',
-            skill_md_key: 'research-skill/SKILL.md',
-          },
-        ],
-      },
       tools: {
         cli_tools: [
           {
@@ -119,25 +98,6 @@ describe('agent composer store conversions', () => {
         provider: 'openai',
         plugin_id: 'openai',
       },
-      skills: [
-        {
-          fileId: 'archive-file-1',
-          fullArchiveFileId: 'archive-file-1',
-          fullArchiveKey: 'research-skill/.DIFY-SKILL-FULL.zip',
-          id: 'skill-1',
-          name: 'Research Skill',
-          path: 'research-skill',
-          skillMdFileId: 'skill-md-file-1',
-          skillMdKey: 'research-skill/SKILL.md',
-        },
-      ],
-      files: [
-        {
-          id: 'file-1',
-          name: 'guide.md',
-          icon: 'markdown',
-        },
-      ],
       knowledgeRetrievals: [
         expect.objectContaining({
           id: 'dataset-1',
@@ -181,7 +141,7 @@ describe('agent composer store conversions', () => {
       used_in_agent_nodes: true,
     })
 
-    expect(publishConfig.skills_files).toMatchObject(baseConfig.skills_files!)
+    expect(publishConfig).not.toHaveProperty('skills_files')
     expect(publishConfig.tools?.dify_tools).toEqual([
       expect.objectContaining({
         provider: 'DuckDuckGo',
diff --git a/web/features/agent-v2/agent-composer/conversions.ts b/web/features/agent-v2/agent-composer/conversions.ts
index 3411bd6556c..e9d0fe9fecd 100644
--- a/web/features/agent-v2/agent-composer/conversions.ts
+++ b/web/features/agent-v2/agent-composer/conversions.ts
@@ -1,10 +1,8 @@
 import type { AgentSoulConfig } from '@dify/contracts/api/console/agent/types.gen'
 import type {
   AgentCliTool,
-  AgentFileNode,
   AgentKnowledgeRetrievalItem,
   AgentProviderTool,
-  AgentSkill,
   AgentSoulConfigFormState,
   AgentTool,
   EnvVariable,
@@ -16,79 +14,8 @@ import { defaultAgentSoulConfigFormState } from './form-state'
 type AgentSoulDifyToolConfig = NonNullable<NonNullable<AgentSoulConfig['tools']>['dify_tools']>[number]
 type AgentSoulCliToolConfig = NonNullable<NonNullable<AgentSoulConfig['tools']>['cli_tools']>[number]
 type AgentSoulToolRuntimeParameterValue = NonNullable<AgentSoulDifyToolConfig['runtime_parameters']>[string]
-type AgentSoulFileRefConfig = NonNullable<NonNullable<AgentSoulConfig['skills_files']>['files']>[number]
 type AgentSoulEnvVariableConfig = NonNullable<NonNullable<AgentSoulConfig['env']>['variables']>[number]
 
-const flattenFileNodes = (files: AgentFileNode[]): AgentFileNode[] => files.flatMap(file => [
-  file,
-  ...flattenFileNodes(file.children ?? []),
-])
-
-const toSkillRefs = (skills: AgentSkill[]) => skills.map(skill => ({
-  description: skill.description,
-  file_id: skill.fileId,
-  full_archive_file_id: skill.fullArchiveFileId,
-  full_archive_key: skill.fullArchiveKey,
-  id: skill.id,
-  manifest_files: skill.files,
-  name: skill.name,
-  path: skill.path,
-  skill_md_file_id: skill.skillMdFileId,
-  skill_md_key: skill.skillMdKey,
-}))
-
-const toSkillFormState = (config?: AgentSoulConfig): AgentSkill[] => (
-  config?.skills_files?.skills ?? []
-).flatMap((skill) => {
-  const id = skill.id ?? skill.file_id ?? skill.path
-  if (!id)
-    return []
-
-  return [{
-    description: skill.description ?? undefined,
-    fileId: skill.file_id ?? undefined,
-    files: skill.manifest_files ?? undefined,
-    fullArchiveFileId: skill.full_archive_file_id ?? undefined,
-    fullArchiveKey: skill.full_archive_key ?? undefined,
-    id,
-    name: skill.name ?? id,
-    path: skill.path ?? undefined,
-    skillMdFileId: skill.skill_md_file_id ?? undefined,
-    skillMdKey: skill.skill_md_key ?? undefined,
-  }]
-})
-
-const toFileIcon = (file: AgentSoulFileRefConfig): AgentFileNode['icon'] => {
-  const type = file.type?.toLowerCase()
-
-  if (type === 'image' || type === 'pdf' || type === 'markdown' || type === 'json' || type === 'table' || type === 'archive' || type === 'code' || type === 'text' || type === 'folder')
-    return type
-
-  return 'file'
-}
-
-const toFileFormState = (config?: AgentSoulConfig): AgentFileNode[] => (
-  config?.skills_files?.files ?? []
-).flatMap((file) => {
-  const id = file.id ?? file.file_id ?? file.upload_file_id ?? file.reference ?? file.remote_url ?? file.url
-  if (!id)
-    return []
-
-  return [{
-    id,
-    name: file.name ?? id,
-    icon: toFileIcon(file),
-    driveKey: file.drive_key ?? undefined,
-  }]
-})
-
-const toFileRefs = (files: AgentFileNode[]) => flattenFileNodes(files).map(file => ({
-  ...(file.driveKey ? { drive_key: file.driveKey } : {}),
-  id: file.id,
-  name: file.name,
-  type: file.icon,
-}))
-
 const getKnowledgeRetrievalName = (item: AgentKnowledgeRetrievalItem) => item.name ?? item.nameKey ?? item.id
 
 const toKnowledgeDatasets = (knowledgeRetrievals: AgentKnowledgeRetrievalItem[]) => knowledgeRetrievals.flatMap((item) => {
@@ -448,34 +375,31 @@ export const formStateToAgentSoulConfig = ({
   baseConfig?: AgentSoulConfig
   formState: AgentSoulConfigFormState
   currentModel?: DefaultModel
-}): AgentSoulConfig => ({
-  ...baseConfig,
-  prompt: {
-    ...baseConfig?.prompt,
-    system_prompt: formState.prompt,
-  },
-  model: currentModel
-    ? {
-        ...baseConfig?.model,
-        model_provider: currentModel.provider,
-        model: currentModel.model,
-        plugin_id: getModelProviderPluginId(currentModel, baseConfig?.model),
-      }
-    : baseConfig?.model,
-  skills_files: {
-    ...baseConfig?.skills_files,
-    skills: toSkillRefs(formState.skills),
-    files: toFileRefs(formState.files),
-  },
-  tools: {
-    ...baseConfig?.tools,
-    dify_tools: toDifyToolConfigs(formState.tools, formState.toolSettings),
-    cli_tools: toCliToolConfigs(formState.tools),
-  },
-  app_features: formState.appFeatures ?? baseConfig?.app_features,
-  knowledge: toKnowledgeConfig(baseConfig?.knowledge, formState.knowledgeRetrievals),
-  env: toEnvConfig(formState.envVariables),
-})
+}): AgentSoulConfig => {
+  return {
+    ...baseConfig,
+    prompt: {
+      ...baseConfig?.prompt,
+      system_prompt: formState.prompt,
+    },
+    model: currentModel
+      ? {
+          ...baseConfig?.model,
+          model_provider: currentModel.provider,
+          model: currentModel.model,
+          plugin_id: getModelProviderPluginId(currentModel, baseConfig?.model),
+        }
+      : baseConfig?.model,
+    tools: {
+      ...baseConfig?.tools,
+      dify_tools: toDifyToolConfigs(formState.tools, formState.toolSettings),
+      cli_tools: toCliToolConfigs(formState.tools),
+    },
+    app_features: formState.appFeatures ?? baseConfig?.app_features,
+    knowledge: toKnowledgeConfig(baseConfig?.knowledge, formState.knowledgeRetrievals),
+    env: toEnvConfig(formState.envVariables),
+  }
+}
 
 export const agentSoulConfigToFormState = (
   config?: AgentSoulConfig,
@@ -488,8 +412,6 @@ export const agentSoulConfigToFormState = (
     prompt: config?.prompt?.system_prompt ?? '',
     model: toDraftModel(config),
     appFeatures: config?.app_features,
-    skills: toSkillFormState(config),
-    files: toFileFormState(config),
     tools: [
       ...providerToolState.tools,
       ...toCliToolFormState(config),
diff --git a/web/features/agent-v2/agent-composer/form-state.ts b/web/features/agent-v2/agent-composer/form-state.ts
index e75c3491f91..80429d8be84 100644
--- a/web/features/agent-v2/agent-composer/form-state.ts
+++ b/web/features/agent-v2/agent-composer/form-state.ts
@@ -24,14 +24,10 @@ export type EnvVariable = {
 
 export type AgentSkill = {
   description?: string
-  files?: string[]
-  fileId?: string
-  fullArchiveFileId?: string
-  fullArchiveKey?: string
+  archiveKey?: string
   id: string
   name: string
   path?: string
-  skillMdFileId?: string
   skillMdKey?: string
 }
 
@@ -100,8 +96,6 @@ export type AgentSoulConfigFormState = {
   prompt: string
   model?: DefaultModel
   appFeatures?: AgentSoulAppFeaturesConfig
-  skills: AgentSkill[]
-  files: AgentFileNode[]
   tools: AgentTool[]
   knowledgeRetrievals: AgentKnowledgeRetrievalItem[]
   envVariables: EnvVariable[]
@@ -110,8 +104,6 @@ export type AgentSoulConfigFormState = {
 
 export const defaultAgentSoulConfigFormState: AgentSoulConfigFormState = {
   prompt: '',
-  skills: [],
-  files: [],
   tools: [],
   knowledgeRetrievals: [],
   envVariables: [],
diff --git a/web/features/agent-v2/agent-composer/store-modules/files.ts b/web/features/agent-v2/agent-composer/store-modules/files.ts
deleted file mode 100644
index b54f28f1c49..00000000000
--- a/web/features/agent-v2/agent-composer/store-modules/files.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-import type { AgentFileNode } from '../form-state'
-import type { DraftFieldUpdate } from './utils'
-import { atom } from 'jotai'
-import { agentComposerDraftAtom } from '../store'
-import { resolveDraftFieldUpdate } from './utils'
-
-export const agentComposerFilesAtom = atom(
-  get => get(agentComposerDraftAtom).files,
-  (get, set, filesUpdate: DraftFieldUpdate<AgentFileNode[]>) => {
-    const draft = get(agentComposerDraftAtom)
-
-    set(agentComposerDraftAtom, {
-      ...draft,
-      files: resolveDraftFieldUpdate(draft.files, filesUpdate),
-    })
-  },
-)
diff --git a/web/features/agent-v2/agent-composer/store-modules/skills.ts b/web/features/agent-v2/agent-composer/store-modules/skills.ts
deleted file mode 100644
index e35c03d3aec..00000000000
--- a/web/features/agent-v2/agent-composer/store-modules/skills.ts
+++ /dev/null
@@ -1,26 +0,0 @@
-import type { AgentSkill } from '../form-state'
-import type { DraftFieldUpdate } from './utils'
-import { atom, useSetAtom } from 'jotai'
-import { useCallback } from 'react'
-import { agentComposerDraftAtom } from '../store'
-import { resolveDraftFieldUpdate } from './utils'
-
-export const agentComposerSkillsAtom = atom(
-  get => get(agentComposerDraftAtom).skills,
-  (get, set, skillsUpdate: DraftFieldUpdate<AgentSkill[]>) => {
-    const draft = get(agentComposerDraftAtom)
-
-    set(agentComposerDraftAtom, {
-      ...draft,
-      skills: resolveDraftFieldUpdate(draft.skills, skillsUpdate),
-    })
-  },
-)
-
-export function useRemoveSkill() {
-  const setSkills = useSetAtom(agentComposerSkillsAtom)
-
-  return useCallback((skillId: string) => {
-    setSkills(skills => skills.filter(skill => skill.id !== skillId))
-  }, [setSkills])
-}
diff --git a/web/features/agent-v2/agent-detail/access/access-sources.ts b/web/features/agent-v2/agent-detail/access/access-sources.ts
deleted file mode 100644
index b3e758e4e10..00000000000
--- a/web/features/agent-v2/agent-detail/access/access-sources.ts
+++ /dev/null
@@ -1,34 +0,0 @@
-import type { AgentAppDetailWithSite } from '@dify/contracts/api/console/agent/types.gen'
-import type { I18nKeysWithPrefix } from '@/types/i18n'
-
-export type AgentAccessSource = {
-  id: string
-  nameKey: I18nKeysWithPrefix<'agentV2', 'agentDetail.access.entries.'>
-  descriptionKey: I18nKeysWithPrefix<'agentV2', 'agentDetail.access.entries.'>
-  reference: string
-  status: 'enabled' | 'disabled'
-  icon: string
-}
-
-const getStatus = (agent: AgentAppDetailWithSite): AgentAccessSource['status'] =>
-  agent.id ? 'enabled' : 'disabled'
-
-export const getAgentAccessSources = (agent?: AgentAppDetailWithSite): AgentAccessSource[] => {
-  if (!agent)
-    return []
-
-  const sources: AgentAccessSource[] = []
-
-  if (agent.id) {
-    sources.push({
-      id: 'agent-app',
-      nameKey: 'agentDetail.access.entries.agentApp.name',
-      descriptionKey: 'agentDetail.access.entries.agentApp.description',
-      reference: agent.id,
-      status: getStatus(agent),
-      icon: 'i-ri-window-line',
-    })
-  }
-
-  return sources
-}
diff --git a/web/features/agent-v2/agent-detail/access/page.tsx b/web/features/agent-v2/agent-detail/access/page.tsx
index 6b3e2af6a06..a22373e7bfe 100644
--- a/web/features/agent-v2/agent-detail/access/page.tsx
+++ b/web/features/agent-v2/agent-detail/access/page.tsx
@@ -84,7 +84,7 @@ export function AgentAccessPage({
           <p className="mt-1 flex min-w-0 flex-wrap items-center gap-x-0.5 system-xs-regular text-text-tertiary">
             <span>{t('agentDetail.access.description')}</span>
             <a
-              href={docLink('/use-dify/publish/webapp/web-app-access')}
+              href={docLink('/use-dify/publish/webapp/web-app-settings')}
               target="_blank"
               rel="noreferrer"
               className="inline-flex shrink-0 items-center gap-0.5 rounded-sm text-text-accent hover:underline focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
diff --git a/web/features/agent-v2/agent-detail/configure/__tests__/page.spec.tsx b/web/features/agent-v2/agent-detail/configure/__tests__/page.spec.tsx
index 1214f186497..e40ddfadd0d 100644
--- a/web/features/agent-v2/agent-detail/configure/__tests__/page.spec.tsx
+++ b/web/features/agent-v2/agent-detail/configure/__tests__/page.spec.tsx
@@ -1,3 +1,4 @@
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
 import { render, screen } from '@testing-library/react'
 import { AgentConfigurePage } from '../page'
 
@@ -15,13 +16,13 @@ const mocks = vi.hoisted(() => ({
       isSuccess: true,
     },
     composer: {
-      data: undefined,
+      data: undefined as unknown,
       isFetching: true,
       isPending: true,
       isSuccess: false,
     },
     version: {
-      data: undefined,
+      data: undefined as unknown,
       isFetching: false,
       isPending: false,
       isSuccess: false,
@@ -60,10 +61,15 @@ vi.mock('@/service/client', () => ({
       byAgentId: {
         get: {
           queryOptions: () => ({ queryKey: ['agent'] }),
+          queryKey: () => ['agent'],
         },
         composer: {
           get: {
             queryOptions: () => ({ queryKey: ['composer'] }),
+            queryKey: () => ['composer'],
+          },
+          put: {
+            mutationOptions: () => ({ mutationFn: vi.fn() }),
           },
         },
         versions: {
@@ -72,6 +78,9 @@ vi.mock('@/service/client', () => ({
               queryOptions: () => ({ queryKey: ['version'] }),
             },
           },
+          get: {
+            key: () => ['versions'],
+          },
         },
       },
     },
@@ -102,7 +111,9 @@ vi.mock('../components/preview/header', () => ({
 }))
 
 vi.mock('../components/preview/versions-panel', () => ({
-  AgentPreviewVersionsPanel: () => null,
+  AgentPreviewVersionsPanel: (props: { onSelectVersion: (versionId: string) => void }) => (
+    <button type="button" onClick={() => props.onSelectVersion('snapshot-2')}>select version</button>
+  ),
 }))
 
 describe('AgentConfigurePage', () => {
@@ -120,13 +131,13 @@ describe('AgentConfigurePage', () => {
       isSuccess: true,
     }
     mocks.queryState.composer = {
-      data: undefined,
+      data: undefined as unknown,
       isFetching: true,
       isPending: true,
       isSuccess: false,
     }
     mocks.queryState.version = {
-      data: undefined,
+      data: undefined as unknown,
       isFetching: false,
       isPending: false,
       isSuccess: false,
@@ -135,7 +146,13 @@ describe('AgentConfigurePage', () => {
 
   describe('Loading state', () => {
     it('should show loading instead of the configure panels while composer data is pending', () => {
-      render(<AgentConfigurePage agentId="agent-1" />)
+      const queryClient = new QueryClient()
+
+      render(
+        <QueryClientProvider client={queryClient}>
+          <AgentConfigurePage agentId="agent-1" />
+        </QueryClientProvider>,
+      )
 
       expect(screen.getByRole('status', { name: 'appApi.loading' })).toBeInTheDocument()
       expect(screen.queryByRole('region', { name: 'orchestrate-panel' })).not.toBeInTheDocument()
diff --git a/web/features/agent-v2/agent-detail/configure/__tests__/use-agent-configure-sync.spec.tsx b/web/features/agent-v2/agent-detail/configure/__tests__/use-agent-configure-sync.spec.tsx
index cde113dda3d..69f8ff0735a 100644
--- a/web/features/agent-v2/agent-detail/configure/__tests__/use-agent-configure-sync.spec.tsx
+++ b/web/features/agent-v2/agent-detail/configure/__tests__/use-agent-configure-sync.spec.tsx
@@ -34,6 +34,15 @@ const composerPutMutationOptions = vi.hoisted(() => vi.fn((options?: {
   },
 })))
 
+function createDeferredPromise<T>() {
+  let resolve!: (value: T) => void
+  const promise = new Promise<T>((promiseResolve) => {
+    resolve = promiseResolve
+  })
+
+  return { promise, resolve }
+}
+
 vi.mock('@/service/client', () => ({
   consoleQuery: {
     agent: {
@@ -213,4 +222,40 @@ describe('useAgentConfigureSync', () => {
       name: 'Agent',
     })
   })
+
+  it('should expose publishing status from the publish mutation while publish is pending', async () => {
+    const publishDeferred = createDeferredPromise<{ agent_soul: Record<string, unknown> }>()
+    composerPutMutationFn.mockReturnValueOnce(publishDeferred.promise)
+    const { result } = renderUseAgentConfigureSync()
+    const publishPayload = {
+      agent_id: 'agent-1',
+      config_snapshot: {
+        prompt: {
+          system_prompt: 'Published prompt',
+        },
+      },
+    }
+
+    let publishPromise!: Promise<void>
+    act(() => {
+      publishPromise = result.current.publishDraft(publishPayload)
+    })
+
+    await act(async () => {
+      await Promise.resolve()
+      await vi.advanceTimersByTimeAsync(0)
+    })
+
+    expect(result.current.isPublishing).toBe(true)
+
+    await act(async () => {
+      publishDeferred.resolve({
+        agent_soul: publishPayload.config_snapshot,
+      })
+      await publishPromise
+      await vi.advanceTimersByTimeAsync(0)
+    })
+
+    expect(result.current.isPublishing).toBe(false)
+  })
 })
diff --git a/web/features/agent-v2/agent-detail/configure/components/__tests__/agent-prompt-editor.spec.tsx b/web/features/agent-v2/agent-detail/configure/components/__tests__/agent-prompt-editor.spec.tsx
index 7043cda75f0..bc10dec2ac7 100644
--- a/web/features/agent-v2/agent-detail/configure/components/__tests__/agent-prompt-editor.spec.tsx
+++ b/web/features/agent-v2/agent-detail/configure/components/__tests__/agent-prompt-editor.spec.tsx
@@ -91,6 +91,19 @@ vi.mock('@/hooks/use-theme', () => ({
   default: () => ({ theme: 'light' }),
 }))
 
+vi.mock('../orchestrate/drive-context', () => ({
+  useAgentDriveSkills: () => ({
+    skills: [
+      {
+        id: 'playwright/SKILL.md',
+        name: 'Playwright',
+        skillMdKey: 'playwright/SKILL.md',
+      },
+    ],
+  }),
+  useAgentDriveFiles: () => ({ files: [] }),
+}))
+
 const duckDuckGoSearchAction = {
   id: 'duckduckgo-search',
   name: 'DuckDuckGo Search',
@@ -112,12 +125,6 @@ const duckDuckGoProviderTool: AgentTool = {
 
 const promptEditorDraft = {
   ...defaultAgentSoulConfigFormState,
-  skills: [
-    {
-      id: 'playwright',
-      name: 'Playwright',
-    },
-  ],
   tools: [duckDuckGoProviderTool],
 } satisfies typeof defaultAgentSoulConfigFormState
 
@@ -268,7 +275,7 @@ describe('AgentPromptEditor', () => {
 
       fireEvent.click(screen.getByRole('button', { name: /Playwright/i }))
 
-      expect(store.get(agentComposerPromptAtom)).toBe('Review these tenders [§skill:playwright:Playwright§]')
+      expect(store.get(agentComposerPromptAtom)).toBe('Review these tenders [§skill:playwright%2FSKILL.md:Playwright§]')
       await waitFor(() => {
         expect(screen.queryByRole('button', { name: /Playwright/i })).not.toBeInTheDocument()
       })
@@ -305,7 +312,7 @@ describe('AgentPromptEditor', () => {
           files={[]}
           tools={[]}
           onToolsChange={vi.fn()}
-          onAddSkill={options => options?.onAdded?.({ id: 'skill-1', name: 'Skill One' })}
+          onAddSkill={options => options?.onAdded?.({ id: 'skill-1', name: 'Skill One', skillMdKey: 'skills/skill-1/SKILL.md' })}
           retrievals={[]}
           onBack={vi.fn()}
           onOpenCategory={vi.fn()}
@@ -313,7 +320,7 @@ describe('AgentPromptEditor', () => {
         />,
       )
       fireEvent.click(screen.getByRole('button', { name: /agentDetail\.configure\.skills\.add/i }))
-      expect(onSelect).toHaveBeenCalledWith('[§skill:skill-1:Skill One§]')
+      expect(onSelect).toHaveBeenCalledWith('[§skill:skills%2Fskill-1%2FSKILL.md:Skill One§]')
 
       rerender(
         <AgentPromptSlashMenu
@@ -323,7 +330,7 @@ describe('AgentPromptEditor', () => {
           files={[]}
           tools={[]}
           onToolsChange={vi.fn()}
-          onAddFile={options => options?.onAdded?.({ id: 'file-1', name: 'Guide.md', icon: 'markdown' })}
+          onAddFile={options => options?.onAdded?.({ id: 'file-1', name: 'Guide.md', icon: 'markdown', driveKey: 'files/Guide.md' })}
           retrievals={[]}
           onBack={vi.fn()}
           onOpenCategory={vi.fn()}
@@ -331,7 +338,7 @@ describe('AgentPromptEditor', () => {
         />,
       )
       fireEvent.click(screen.getByRole('button', { name: /agentDetail\.configure\.files\.add/i }))
-      expect(onSelect).toHaveBeenCalledWith('[§file:file-1:Guide.md§]')
+      expect(onSelect).toHaveBeenCalledWith('[§file:files%2FGuide.md:Guide.md§]')
 
       rerender(
         <AgentPromptSlashMenu
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/__tests__/empty-sections.spec.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/__tests__/empty-sections.spec.tsx
index ef583288a07..705b83e6039 100644
--- a/web/features/agent-v2/agent-detail/configure/components/orchestrate/__tests__/empty-sections.spec.tsx
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/__tests__/empty-sections.spec.tsx
@@ -8,6 +8,14 @@ import { AgentKnowledgeRetrieval } from '../knowledge'
 import { AgentSkills } from '../skills'
 import { AgentTools } from '../tools'
 
+vi.mock('../drive-context', () => ({
+  FILES_DRIVE_PREFIX: 'files/',
+  getAgentDriveFileName: (key: string) => key.split('/').pop() ?? key,
+  useAgentDriveApiContext: () => ({ agentId: 'agent-1' }),
+  useAgentDriveFiles: () => ({ files: [], query: { refetch: vi.fn() } }),
+  useAgentDriveSkills: () => ({ skills: [], query: { refetch: vi.fn() } }),
+}))
+
 function renderEmptySections() {
   const queryClient = new QueryClient()
 
@@ -16,14 +24,12 @@ function renderEmptySections() {
       <AgentComposerProvider
         initialDraft={{
           ...defaultAgentSoulConfigFormState,
-          files: [],
           knowledgeRetrievals: [],
-          skills: [],
           tools: [],
         }}
       >
-        <AgentSkills agentId="agent-1" />
-        <AgentFiles agentId="agent-1" />
+        <AgentSkills />
+        <AgentFiles />
         <AgentTools />
         <AgentKnowledgeRetrieval />
       </AgentComposerProvider>
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/__tests__/publish-bar.spec.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/__tests__/publish-bar.spec.tsx
index 5e4fe175882..6beb7cc649c 100644
--- a/web/features/agent-v2/agent-detail/configure/components/orchestrate/__tests__/publish-bar.spec.tsx
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/__tests__/publish-bar.spec.tsx
@@ -19,10 +19,24 @@ const hotkeyRegistrations = vi.hoisted(() => new Map<string, {
 
 const mockFormatForDisplay = vi.hoisted(() => vi.fn((hotkey: string) => `display:${hotkey}`))
 const mockFormatTimeFromNow = vi.hoisted(() => vi.fn(() => 'just now'))
+const mockFormatTime = vi.hoisted(() => vi.fn((timestamp: number) => `formatted:${timestamp}`))
+const restoreVersionMutation = vi.hoisted(() => vi.fn(async (_input: unknown) => ({
+  active_config_snapshot_id: 'snapshot-2',
+  result: 'success',
+})))
+const toastMock = vi.hoisted(() => ({
+  error: vi.fn(),
+  success: vi.fn(),
+}))
 const workflowReferences = vi.hoisted(() => ({
+  fetchCount: 0,
   data: [] as AgentReferencingWorkflowResponse[],
 }))
 
+vi.mock('@langgenius/dify-ui/toast', () => ({
+  toast: toastMock,
+}))
+
 vi.mock('@tanstack/react-hotkeys', async (importOriginal) => {
   const actual = await importOriginal<typeof import('@tanstack/react-hotkeys')>()
   return {
@@ -40,68 +54,51 @@ vi.mock('@/hooks/use-format-time-from-now', () => ({
   }),
 }))
 
+vi.mock('@/hooks/use-timestamp', () => ({
+  default: () => ({
+    formatTime: mockFormatTime,
+  }),
+}))
+
 vi.mock('@/service/client', () => ({
   consoleQuery: {
     agent: {
       byAgentId: {
+        get: {
+          queryKey: ({ input }: { input: { params: { agent_id: string } } }) => ['agent', input],
+        },
+        composer: {
+          get: {
+            queryKey: ({ input }: { input: { params: { agent_id: string } } }) => ['agent-composer', input],
+          },
+        },
         referencingWorkflows: {
           get: {
             queryOptions: ({ input }: { input: { params: { agent_id: string } } }) => ({
               queryKey: ['agent-referencing-workflows', input],
               queryFn: async () => ({
-                data: workflowReferences.data,
+                data: (workflowReferences.fetchCount++, workflowReferences.data),
               }),
             }),
           },
         },
+        versions: {
+          byVersionId: {
+            restore: {
+              post: {
+                mutationOptions: () => ({ mutationFn: restoreVersionMutation }),
+              },
+            },
+          },
+          get: {
+            key: () => ['agent-versions'],
+          },
+        },
       },
     },
   },
 }))
 
-vi.mock('@langgenius/dify-ui/popover', async () => {
-  const React = await import('react')
-  const ReactDOM = await import('react-dom')
-  const PopoverContext = React.createContext<{
-    open: boolean
-    onOpenChange?: (open: boolean) => void
-  }>({
-    open: false,
-  })
-
-  return {
-    Popover: ({
-      children,
-      open,
-      onOpenChange,
-    }: {
-      children: React.ReactNode
-      open?: boolean
-      onOpenChange?: (open: boolean) => void
-    }) => (
-      <PopoverContext value={{ open: !!open, onOpenChange }}>
-        {children}
-      </PopoverContext>
-    ),
-    PopoverContent: ({
-      children,
-    }: {
-      children: React.ReactNode
-    }) => {
-      const context = React.use(PopoverContext)
-      if (!context.open)
-        return null
-
-      return ReactDOM.createPortal(<div data-testid="publish-impact-popover">{children}</div>, document.body)
-    },
-    PopoverTrigger: ({
-      render: trigger,
-    }: {
-      render: React.ReactElement
-    }) => trigger,
-  }
-})
-
 const activeConfigSnapshot: AgentConfigSnapshotSummaryResponse = {
   id: 'snapshot-1',
   agent_id: 'agent-1',
@@ -111,11 +108,12 @@ const activeConfigSnapshot: AgentConfigSnapshotSummaryResponse = {
 
 const originalDraftWithFile = {
   ...defaultAgentSoulConfigFormState,
-  files: [
+  tools: [
     {
-      id: 'preview-image',
-      name: 'agent-roster-skill-detail-dialog-preview-image.png',
-      icon: 'image',
+      id: 'cli-1',
+      kind: 'cli',
+      name: 'Run tests',
+      installCommand: 'pnpm test',
     },
   ],
 } satisfies typeof defaultAgentSoulConfigFormState
@@ -123,6 +121,7 @@ const originalDraftWithFile = {
 const publishedReferences: AgentReferencingWorkflowResponse[] = [
   {
     app_id: 'app-python',
+    app_updated_at: 1710000100,
     app_mode: 'workflow',
     app_name: 'Python bug fixer',
     workflow_id: 'workflow-python',
@@ -136,19 +135,31 @@ const publishedReferences: AgentReferencingWorkflowResponse[] = [
     app_icon_type: 'emoji',
     app_mode: 'workflow',
     app_name: 'Translation Workflow',
+    app_updated_at: 1710000200,
     workflow_id: 'workflow-translation',
     workflow_version: '1',
     node_ids: ['node-translation'],
   },
 ]
 
+function createDeferredPromise() {
+  let resolve!: () => void
+  const promise = new Promise<void>((promiseResolve) => {
+    resolve = promiseResolve
+  })
+
+  return { promise, resolve }
+}
+
 function renderPublishBar({
   activeConfigIsPublished,
   activeConfigSnapshot,
   draftSavedAt,
   isPublishing,
   onPublish = vi.fn<PublishHandler>(),
+  onExitVersions = vi.fn(),
   prompt = '',
+  selectedVersionSnapshot,
   setupStore,
   usedByAppReferences = [],
 }: {
@@ -157,7 +168,9 @@ function renderPublishBar({
   draftSavedAt?: number
   isPublishing?: boolean
   onPublish?: PublishMock
+  onExitVersions?: Mock<() => void>
   prompt?: string
+  selectedVersionSnapshot?: AgentConfigSnapshotSummaryResponse | null
   setupStore?: (store: ReturnType<typeof createStore>) => void
   usedByAppReferences?: AgentReferencingWorkflowResponse[]
 } = {}) {
@@ -172,7 +185,9 @@ function renderPublishBar({
   store.set(agentComposerPromptAtom, prompt)
   setupStore?.(store)
 
-  render(
+  const renderPublishBarTree = (nextProps?: {
+    isPublishing?: boolean
+  }) => (
     <QueryClientProvider client={queryClient}>
       <JotaiProvider store={store}>
         <AgentConfigurePublishBar
@@ -181,16 +196,23 @@ function renderPublishBar({
           activeConfigSnapshot={activeConfigSnapshot}
           draftSavedAt={draftSavedAt}
           agentName="Iris"
-          isPublishing={isPublishing}
+          isPublishing={nextProps?.isPublishing ?? isPublishing}
+          selectedVersionSnapshot={selectedVersionSnapshot}
           onPublish={onPublish}
+          onExitVersions={onExitVersions}
           onOpenVersions={vi.fn()}
         />
       </JotaiProvider>
-    </QueryClientProvider>,
+    </QueryClientProvider>
   )
+  const view = render(renderPublishBarTree())
 
   return {
+    ...view,
+    queryClient,
+    onExitVersions,
     onPublish,
+    rerenderPublishBar: renderPublishBarTree,
   }
 }
 
@@ -198,7 +220,12 @@ describe('AgentConfigurePublishBar', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     hotkeyRegistrations.clear()
+    restoreVersionMutation.mockResolvedValue({
+      active_config_snapshot_id: 'snapshot-2',
+      result: 'success',
+    })
     workflowReferences.data = []
+    workflowReferences.fetchCount = 0
     vi.spyOn(console, 'log').mockImplementation(() => {})
   })
 
@@ -221,6 +248,37 @@ describe('AgentConfigurePublishBar', () => {
     )
   })
 
+  it('should restore the selected version from view-only mode', async () => {
+    const selectedVersionSnapshot = {
+      ...activeConfigSnapshot,
+      id: 'snapshot-2',
+      version: 2,
+      version_note: 'Stable version',
+      created_by: 'Alice',
+    }
+
+    const { onExitVersions } = renderPublishBar({
+      selectedVersionSnapshot,
+    })
+
+    expect(screen.getByText('Stable version')).toBeInTheDocument()
+    expect(screen.getByText('agentV2.agentDetail.versionHistory.viewOnly')).toBeInTheDocument()
+    expect(screen.getByText('formatted:1710000000 · Alice')).toBeInTheDocument()
+    fireEvent.click(screen.getByRole('button', { name: 'agentV2.agentDetail.versionHistory.restore' }))
+
+    await waitFor(() => {
+      expect(restoreVersionMutation).toHaveBeenCalled()
+    })
+    expect(restoreVersionMutation.mock.calls[0]?.[0]).toEqual({
+      params: {
+        agent_id: 'agent-1',
+        version_id: 'snapshot-2',
+      },
+    })
+    expect(onExitVersions).toHaveBeenCalled()
+    expect(toastMock.success).toHaveBeenCalledWith('common.api.actionSuccess')
+  })
+
   it('should render saved time from the latest draft save timestamp', () => {
     renderPublishBar({ draftSavedAt: 1710000100000 })
 
@@ -236,7 +294,7 @@ describe('AgentConfigurePublishBar', () => {
 
     expect(screen.getByText('agentV2.agentDetail.configure.publishBar.upToDate')).toBeInTheDocument()
     expect(screen.getByText(/agentV2\.agentDetail\.configure\.publishBar\.publishedAt/)).toBeInTheDocument()
-    expect(screen.getByRole('button', { name: 'agentV2.agentDetail.configure.publishBar.published' })).toHaveAttribute('aria-disabled', 'true')
+    expect(screen.getByRole('button', { name: 'agentV2.agentDetail.configure.publishBar.published' })).toBeDisabled()
     expect(screen.queryByText('display:Mod')).not.toBeInTheDocument()
     expect(mockFormatTimeFromNow).toHaveBeenCalledWith(1710000000 * 1000)
     expect(hotkeyRegistrations.get('Mod+Shift+P')?.options).toEqual(
@@ -255,6 +313,7 @@ describe('AgentConfigurePublishBar', () => {
     })
 
     expect(screen.getByText('agentV2.agentDetail.configure.publishBar.unpublishedChanges')).toBeInTheDocument()
+    expect(screen.getByText('agentV2.agentDetail.configure.publishBar.saved')).toBeInTheDocument()
     expect(screen.getByRole('button', { name: /agentV2\.agentDetail\.configure\.publishBar\.publishUpdate/ })).toBeInTheDocument()
     expect(hotkeyRegistrations.get('Mod+Shift+P')?.options).toEqual(
       expect.objectContaining({ enabled: true, ignoreInputs: false }),
@@ -267,6 +326,9 @@ describe('AgentConfigurePublishBar', () => {
         agent_id: 'agent-1',
       }))
     })
+    expect(screen.queryByRole('region', {
+      name: /agentV2\.agentDetail\.configure\.publishImpact\.title/,
+    })).not.toBeInTheDocument()
   })
 
   it('should publish the current draft payload from the unpublished changes state', async () => {
@@ -299,7 +361,7 @@ describe('AgentConfigurePublishBar', () => {
         store.set(agentComposerOriginalDraftAtom, originalDraftWithFile)
         store.set(agentComposerDraftAtom, {
           ...originalDraftWithFile,
-          files: [],
+          tools: [],
         })
       },
     })
@@ -335,46 +397,93 @@ describe('AgentConfigurePublishBar', () => {
 
     expect(screen.getByText('agentV2.agentDetail.configure.publishBar.publishing')).toBeInTheDocument()
     expect(screen.getByRole('button', { name: 'agentV2.agentDetail.configure.publishBar.publishing' })).toHaveAttribute('aria-disabled', 'true')
+    expect(screen.getByRole('button', { name: 'agentV2.agentDetail.configure.publishBar.publishing' })).toHaveAttribute('aria-busy', 'true')
     expect(screen.queryByText('display:Mod')).not.toBeInTheDocument()
     expect(hotkeyRegistrations.get('Mod+Shift+P')?.options).toEqual(
       expect.objectContaining({ enabled: false, ignoreInputs: false }),
     )
   })
 
-  it('should show affected workflow references when clicking a publishable agent in use', async () => {
+  it('should expand affected workflow details above the publish toolbar when clicking a publishable agent in use', async () => {
     const { onPublish } = renderPublishBar({
       activeConfigSnapshot,
       prompt: 'Updated system prompt',
       usedByAppReferences: publishedReferences,
     })
 
-    expect(screen.queryByTestId('publish-impact-popover')).not.toBeInTheDocument()
-    const publishBar = screen.getByText('agentV2.agentDetail.configure.publishBar.unpublishedChanges').closest('[aria-hidden]')
-    expect(publishBar).toHaveAttribute('aria-hidden', 'false')
+    expect(screen.queryByRole('region', {
+      name: /agentV2\.agentDetail\.configure\.publishImpact\.title/,
+    })).not.toBeInTheDocument()
+    await waitFor(() => {
+      expect(workflowReferences.fetchCount).toBe(1)
+    })
 
-    fireEvent.click(screen.getByRole('button', { name: /agentV2\.agentDetail\.configure\.publishBar\.publishUpdate/ }))
+    const publishButton = screen.getByRole('button', { name: /agentV2\.agentDetail\.configure\.publishBar\.publishUpdate/ })
+    fireEvent.click(publishButton)
 
     expect(onPublish).not.toHaveBeenCalled()
-    const impactPopover = await screen.findByTestId('publish-impact-popover')
-    expect(impactPopover).toBeInTheDocument()
-    expect(publishBar).toHaveAttribute('aria-hidden', 'false')
-    await waitFor(() => {
-      expect(publishBar).toHaveAttribute('aria-hidden', 'true')
-      expect(publishBar).toHaveClass('opacity-0')
+    expect(publishButton).not.toHaveAttribute('aria-busy')
+    const impactDetails = await screen.findByRole('region', {
+      name: /agentV2\.agentDetail\.configure\.publishImpact\.title/,
     })
+    expect(impactDetails).toBeInTheDocument()
+    expect(workflowReferences.fetchCount).toBe(1)
+    expect(screen.getAllByRole('button', { name: /agentV2\.agentDetail\.configure\.publishBar\.publishUpdate/ })).toHaveLength(1)
+    expect(screen.getByRole('button', { name: 'agentV2.agentDetail.configure.publishImpact.cancel' })).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'agentV2.agentDetail.configure.publishBar.versionHistory' })).toHaveClass('group-data-open/publish-bar:hidden')
     expect(screen.getByText(/agentV2\.agentDetail\.configure\.publishImpact\.title/)).toBeInTheDocument()
     expect(screen.getByText(/agentV2\.agentDetail\.configure\.publishImpact\.descriptionPrefix/)).toBeInTheDocument()
     expect(screen.getByText(/agentV2\.agentDetail\.configure\.publishImpact\.workflowCount/)).toBeInTheDocument()
     expect(screen.getByText('Python bug fixer')).toBeInTheDocument()
     expect(screen.getByText('Translation Workflow')).toBeInTheDocument()
-    expect(screen.getByRole('link', { name: 'Python bug fixer' })).toHaveAttribute('target', '_blank')
-    expect(screen.getByRole('link', { name: 'Python bug fixer' })).toHaveAttribute('rel', 'noopener noreferrer')
-    expect(within(impactPopover).getByText('display:Mod')).toBeInTheDocument()
-    expect(within(impactPopover).getByText('display:Shift')).toBeInTheDocument()
-    expect(within(impactPopover).getByText('display:P')).toBeInTheDocument()
+    expect(screen.getByRole('link', { name: /Python bug fixer/ })).toHaveAttribute('target', '_blank')
+    expect(screen.getByRole('link', { name: /Python bug fixer/ })).toHaveAttribute('rel', 'noopener noreferrer')
+    expect(within(impactDetails).getAllByText('just now')).toHaveLength(2)
+    expect(screen.getByText('display:Mod')).toBeInTheDocument()
+    expect(screen.getByText('display:Shift')).toBeInTheDocument()
+    expect(screen.getByText('display:P')).toBeInTheDocument()
   })
 
-  it('should publish from the affected workflow popover action', async () => {
+  it('should publish from the fixed toolbar action after affected workflow details expand', async () => {
+    const publishDeferred = createDeferredPromise()
+    const onPublish = vi.fn<PublishHandler>(() => publishDeferred.promise)
+    const { rerender, rerenderPublishBar } = renderPublishBar({
+      activeConfigSnapshot,
+      onPublish,
+      prompt: 'Updated system prompt',
+      usedByAppReferences: publishedReferences,
+    })
+
+    fireEvent.click(screen.getByRole('button', { name: /agentV2\.agentDetail\.configure\.publishBar\.publishUpdate/ }))
+    expect(await screen.findByRole('region', {
+      name: /agentV2\.agentDetail\.configure\.publishImpact\.title/,
+    })).toBeInTheDocument()
+    fireEvent.click(screen.getByRole('button', { name: /agentV2\.agentDetail\.configure\.publishBar\.publishUpdate/ }))
+
+    expect(onPublish).toHaveBeenCalledWith(expect.objectContaining({
+      agent_id: 'agent-1',
+    }))
+    expect(screen.getByRole('region', {
+      name: /agentV2\.agentDetail\.configure\.publishImpact\.title/,
+    })).toBeInTheDocument()
+    rerender(rerenderPublishBar({ isPublishing: true }))
+    expect(await screen.findByRole('button', {
+      name: 'agentV2.agentDetail.configure.publishBar.publishing',
+    })).toHaveAttribute('aria-busy', 'true')
+
+    await act(async () => {
+      publishDeferred.resolve()
+      await publishDeferred.promise
+    })
+
+    await waitFor(() => {
+      expect(screen.queryByRole('region', {
+        name: /agentV2\.agentDetail\.configure\.publishImpact\.title/,
+      })).not.toBeInTheDocument()
+    })
+  })
+
+  it('should collapse affected workflow details from the expanded footer cancel action', async () => {
     const { onPublish } = renderPublishBar({
       activeConfigSnapshot,
       prompt: 'Updated system prompt',
@@ -382,16 +491,21 @@ describe('AgentConfigurePublishBar', () => {
     })
 
     fireEvent.click(screen.getByRole('button', { name: /agentV2\.agentDetail\.configure\.publishBar\.publishUpdate/ }))
-    fireEvent.click(within(await screen.findByTestId('publish-impact-popover')).getByRole('button', {
-      name: /agentV2\.agentDetail\.configure\.publishBar\.publishUpdate/,
-    }))
+    expect(await screen.findByRole('region', {
+      name: /agentV2\.agentDetail\.configure\.publishImpact\.title/,
+    })).toBeInTheDocument()
 
-    expect(onPublish).toHaveBeenCalledWith(expect.objectContaining({
-      agent_id: 'agent-1',
-    }))
+    fireEvent.click(screen.getByRole('button', { name: 'agentV2.agentDetail.configure.publishImpact.cancel' }))
+
+    await waitFor(() => {
+      expect(screen.queryByRole('region', {
+        name: /agentV2\.agentDetail\.configure\.publishImpact\.title/,
+      })).not.toBeInTheDocument()
+    })
+    expect(onPublish).not.toHaveBeenCalled()
   })
 
-  it('should open the affected workflow popover from the publish shortcut before publishing', async () => {
+  it('should show affected workflow details from the publish shortcut before publishing', async () => {
     const { onPublish } = renderPublishBar({
       activeConfigSnapshot,
       prompt: 'Updated system prompt',
@@ -404,7 +518,9 @@ describe('AgentConfigurePublishBar', () => {
     })
 
     expect(onPublish).not.toHaveBeenCalled()
-    expect(await screen.findByTestId('publish-impact-popover')).toBeInTheDocument()
+    expect(await screen.findByRole('region', {
+      name: /agentV2\.agentDetail\.configure\.publishImpact\.title/,
+    })).toBeInTheDocument()
 
     await act(async () => {
       await hotkeyRegistrations.get('Mod+Shift+P')?.callback({ preventDefault: vi.fn() })
@@ -414,4 +530,23 @@ describe('AgentConfigurePublishBar', () => {
       agent_id: 'agent-1',
     }))
   })
+
+  it('should publish directly from the publish shortcut when no workflows reference the agent', async () => {
+    const { onPublish } = renderPublishBar({
+      activeConfigSnapshot,
+      prompt: 'Updated system prompt',
+    })
+    const publishShortcut = hotkeyRegistrations.get('Mod+Shift+P')
+
+    await act(async () => {
+      await publishShortcut?.callback({ preventDefault: vi.fn() })
+    })
+
+    expect(screen.queryByRole('region', {
+      name: /agentV2\.agentDetail\.configure\.publishImpact\.title/,
+    })).not.toBeInTheDocument()
+    expect(onPublish).toHaveBeenCalledWith(expect.objectContaining({
+      agent_id: 'agent-1',
+    }))
+  })
 })
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/advanced/__tests__/index.spec.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/advanced/__tests__/index.spec.tsx
new file mode 100644
index 00000000000..c7b423ecf59
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/advanced/__tests__/index.spec.tsx
@@ -0,0 +1,28 @@
+import { fireEvent, render, screen } from '@testing-library/react'
+import { AgentAdvancedSettings } from '../index'
+
+vi.mock('../env', () => ({
+  AgentEnvEditor: () => <div>advanced-env-editor</div>,
+}))
+
+vi.mock('../content-moderation', () => ({
+  AgentContentModerationSettings: () => <div>advanced-content-moderation</div>,
+}))
+
+describe('AgentAdvancedSettings', () => {
+  it('should render collapsed by default and expand from the section trigger', () => {
+    render(<AgentAdvancedSettings />)
+
+    const label = 'agentV2.agentDetail.configure.advancedSettings.label'
+    const triggers = screen.getAllByRole('button', { name: label })
+
+    expect(triggers[0]).not.toHaveAttribute('data-panel-open')
+    expect(screen.queryByText('advanced-env-editor')).not.toBeInTheDocument()
+    expect(screen.queryByText('advanced-content-moderation')).not.toBeInTheDocument()
+
+    fireEvent.click(triggers[0]!)
+
+    expect(screen.getByText('advanced-env-editor')).toBeInTheDocument()
+    expect(screen.getByText('advanced-content-moderation')).toBeInTheDocument()
+  })
+})
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/advanced/content-moderation.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/advanced/content-moderation.tsx
index 532627f25dd..7a5578fbff1 100644
--- a/web/features/agent-v2/agent-detail/configure/components/orchestrate/advanced/content-moderation.tsx
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/advanced/content-moderation.tsx
@@ -14,6 +14,7 @@ import { useModalContext } from '@/context/modal-context'
 import { useAppFeatures, useSetAppFeatures } from '@/features/agent-v2/agent-composer/store-modules/app-features'
 import { useCodeBasedExtensions } from '@/service/use-common'
 import { ConfigureSection } from '../common/section'
+import { useAgentOrchestrateReadOnly } from '../read-only-context'
 
 const defaultModerationConfig: ModerationConfig = {
   enabled: true,
@@ -30,6 +31,7 @@ function AgentContentModerationSettingsContent() {
   const { t } = useTranslation()
   const locale = useLocale()
   const featuresStore = useFeaturesStore()
+  const readOnly = useAgentOrchestrateReadOnly()
   const setAppFeatures = useSetAppFeatures()
   const { setShowModerationSettingModal } = useModalContext()
   const moderation = useFeatures(state => state.features.moderation)
@@ -112,25 +114,27 @@ function AgentContentModerationSettingsContent() {
       rootClassName="gap-1 border-t border-divider-subtle py-3"
       headerClassName="mb-0 gap-1 px-3"
       panelContentClassName="px-3 pt-1"
-      actions={(
-        <div className="flex shrink-0 items-center gap-2">
-          {!!moderation?.enabled && (
-            <Button
-              size="small"
-              variant="ghost"
-              className="h-6 gap-0.5 px-1.5 py-1 text-text-tertiary"
-              onClick={() => openSettings()}
-            >
-              <span className="i-ri-equalizer-2-line size-3.5" aria-hidden />
-              <span className="px-0.5 system-xs-medium">
-                {t('operation.settings', { ns: 'common' })}
-              </span>
-            </Button>
-          )}
-          <div className="h-3 w-px bg-divider-regular" />
-          <Switch checked={!!moderation?.enabled} onCheckedChange={handleEnabledChange} size="sm" />
-        </div>
-      )}
+      actions={!readOnly
+        ? (
+            <div className="flex shrink-0 items-center gap-2">
+              {!!moderation?.enabled && (
+                <Button
+                  size="small"
+                  variant="ghost"
+                  className="h-6 gap-0.5 px-1.5 py-1 text-text-tertiary"
+                  onClick={() => openSettings()}
+                >
+                  <span className="i-ri-equalizer-2-line size-3.5" aria-hidden />
+                  <span className="px-0.5 system-xs-medium">
+                    {t('operation.settings', { ns: 'common' })}
+                  </span>
+                </Button>
+              )}
+              <div className="h-3 w-px bg-divider-regular" />
+              <Switch checked={!!moderation?.enabled} onCheckedChange={handleEnabledChange} size="sm" />
+            </div>
+          )
+        : undefined}
     >
       {moderation?.enabled
         ? (
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/advanced/index.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/advanced/index.tsx
index 92b8950fdce..7c1aa1ce52d 100644
--- a/web/features/agent-v2/agent-detail/configure/components/orchestrate/advanced/index.tsx
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/advanced/index.tsx
@@ -15,6 +15,7 @@ export function AgentAdvancedSettings() {
       labelId="agent-configure-advanced-settings-label"
       panelId={advancedSettingsPanelId}
       description={t('agentDetail.configure.advancedSettings.description')}
+      defaultOpen={false}
       rootClassName="gap-2 pt-1 pb-3"
       headerClassName="mb-0 pt-2"
       titleRowClassName="min-h-6"
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/common/configurable-item.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/common/configurable-item.tsx
index 337d7be8e32..5eb42972cec 100644
--- a/web/features/agent-v2/agent-detail/configure/components/orchestrate/common/configurable-item.tsx
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/common/configurable-item.tsx
@@ -32,7 +32,7 @@ export function ConfigureSectionConfigurableItem({
         </span>
       </div>
       {!readOnly && (
-        <div className="pointer-events-none flex shrink-0 items-center gap-1 opacity-0 transition-opacity group-focus-within:pointer-events-auto group-focus-within:opacity-100 group-hover:pointer-events-auto group-hover:opacity-100">
+        <div className="hidden shrink-0 items-center gap-1 group-focus-within:flex group-hover:flex">
           <button
             type="button"
             aria-label={editAriaLabel}
@@ -52,7 +52,7 @@ export function ConfigureSectionConfigurableItem({
         </div>
       )}
       {hasBadge && (
-        <span className="shrink-0 rounded-[5px] border border-divider-deep bg-components-badge-bg-dimm px-1 py-0.5 system-2xs-medium-uppercase text-text-tertiary transition-opacity group-focus-within:opacity-0 group-hover:opacity-0">
+        <span className="shrink-0 rounded-[5px] border border-divider-deep bg-components-badge-bg-dimm px-1 py-0.5 system-2xs-medium-uppercase text-text-tertiary group-focus-within:hidden group-hover:hidden">
           {badge}
         </span>
       )}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/common/section.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/common/section.tsx
index 49b43817d82..22ab3e0946c 100644
--- a/web/features/agent-v2/agent-detail/configure/components/orchestrate/common/section.tsx
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/common/section.tsx
@@ -15,6 +15,7 @@ type ConfigureSectionBaseProps = {
   children: ReactNode
   actions?: ReactNode
   description?: ReactNode
+  defaultOpen?: boolean
   headingLevel?: 'h3' | 'h4'
   panelId?: string
   rootClassName?: string
@@ -40,6 +41,7 @@ export function ConfigureSection({
   children,
   actions,
   description,
+  defaultOpen = true,
   headingLevel = 'h3',
   panelId,
   tip,
@@ -56,7 +58,7 @@ export function ConfigureSection({
   return (
     <CollapsibleRoot
       render={<section />}
-      defaultOpen
+      defaultOpen={defaultOpen}
       className={rootClassName}
       aria-labelledby={labelId}
     >
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/drive-context.ts b/web/features/agent-v2/agent-detail/configure/components/orchestrate/drive-context.ts
new file mode 100644
index 00000000000..d94a0632471
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/drive-context.ts
@@ -0,0 +1,146 @@
+'use client'
+
+import type { AgentDriveItemResponse } from '@dify/contracts/api/console/agent/types.gen'
+import type { AgentFileNode, AgentSkill } from '@/features/agent-v2/agent-composer/form-state'
+import { useQuery } from '@tanstack/react-query'
+import { createContext, use, useMemo } from 'react'
+import { consoleQuery } from '@/service/client'
+import { getDriveFileIconType } from './files/file-icon'
+
+export type AgentDriveApiContext = {
+  agentId: string
+  workflow?: {
+    appId: string
+    nodeId: string
+  }
+}
+
+export const FILES_DRIVE_PREFIX = 'files/'
+
+const AgentDriveApiContext = createContext<AgentDriveApiContext | null>(null)
+
+export const AgentDriveApiContextProvider = AgentDriveApiContext.Provider
+
+const getAgentDriveFileName = (key: string) => {
+  const normalizedKey = key.endsWith('/') ? key.slice(0, -1) : key
+  return normalizedKey.split('/').pop() || normalizedKey
+}
+
+const toAgentSkill = (item: {
+  archive_key?: string | null
+  description: string
+  name: string
+  path: string
+  skill_md_key: string
+}): AgentSkill => ({
+  id: item.skill_md_key,
+  name: item.name,
+  description: item.description || undefined,
+  path: item.path,
+  skillMdKey: item.skill_md_key,
+  archiveKey: item.archive_key ?? undefined,
+})
+
+const toAgentFileNodeFromDriveItem = (item: {
+  file_kind: string
+  key: string
+  mime_type?: string | null
+}): AgentFileNode => ({
+  id: item.key,
+  name: getAgentDriveFileName(item.key),
+  icon: getDriveFileIconType({
+    fileKind: item.file_kind,
+    fileName: getAgentDriveFileName(item.key),
+    mimeType: item.mime_type,
+  }),
+  driveKey: item.key,
+})
+
+export const useAgentDriveApiContext = () => {
+  const context = use(AgentDriveApiContext)
+  if (!context)
+    throw new Error('AgentDriveApiContextProvider is required for drive-backed UI.')
+
+  return context
+}
+
+export const useAgentDriveSkills = () => {
+  const apiContext = useAgentDriveApiContext()
+  const agentSkillsQuery = useQuery({
+    ...consoleQuery.agent.byAgentId.drive.skills.get.queryOptions({
+      input: {
+        params: {
+          agent_id: apiContext.agentId,
+        },
+      },
+    }),
+    enabled: !apiContext.workflow,
+  })
+  const workflowSkillsQuery = useQuery({
+    ...consoleQuery.apps.byAppId.agent.drive.skills.get.queryOptions({
+      input: {
+        params: {
+          app_id: apiContext.workflow?.appId ?? '',
+        },
+        query: {
+          node_id: apiContext.workflow?.nodeId,
+        },
+      },
+    }),
+    enabled: !!apiContext.workflow,
+  })
+  const query = apiContext.workflow ? workflowSkillsQuery : agentSkillsQuery
+  const skills = useMemo(() => (query.data?.items ?? []).map(toAgentSkill), [query.data?.items])
+
+  return {
+    apiContext,
+    query,
+    skills,
+  }
+}
+
+export const useAgentDriveFiles = ({
+  prefix = FILES_DRIVE_PREFIX,
+}: {
+  prefix?: string
+} = {}) => {
+  const apiContext = useAgentDriveApiContext()
+  const agentFilesQuery = useQuery({
+    ...consoleQuery.agent.byAgentId.drive.files.get.queryOptions({
+      input: {
+        params: {
+          agent_id: apiContext.agentId,
+        },
+        query: {
+          prefix,
+        },
+      },
+    }),
+    enabled: !apiContext.workflow,
+  })
+  const workflowFilesQuery = useQuery({
+    ...consoleQuery.apps.byAppId.agent.drive.files.get.queryOptions({
+      input: {
+        params: {
+          app_id: apiContext.workflow?.appId ?? '',
+        },
+        query: {
+          node_id: apiContext.workflow?.nodeId,
+          prefix,
+        },
+      },
+    }),
+    enabled: !!apiContext.workflow,
+  })
+  const query = apiContext.workflow ? workflowFilesQuery : agentFilesQuery
+  const files = useMemo(
+    () => (query.data?.items ?? []).map((item: AgentDriveItemResponse) => toAgentFileNodeFromDriveItem(item)),
+    [query.data?.items],
+  )
+
+  return {
+    apiContext,
+    query,
+    files,
+  }
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/__tests__/index.spec.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/__tests__/index.spec.tsx
index 9961ba7d242..b8728fe9572 100644
--- a/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/__tests__/index.spec.tsx
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/__tests__/index.spec.tsx
@@ -4,6 +4,7 @@ import { fireEvent, render, screen, waitFor, within } from '@testing-library/rea
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { defaultAgentSoulConfigFormState } from '@/features/agent-v2/agent-composer/form-state'
 import { AgentComposerProvider } from '@/features/agent-v2/agent-composer/provider'
+import { AgentDriveApiContextProvider } from '../../drive-context'
 import { AgentOrchestrateReadOnlyContext } from '../../read-only-context'
 import { AgentFiles } from '../index'
 
@@ -100,38 +101,10 @@ vi.mock('@/service/client', () => ({
 
 const agentFilesDraft = {
   ...defaultAgentSoulConfigFormState,
-  files: [
-    {
-      id: 'preview-image',
-      name: 'agent-roster-skill-detail-dialog-preview-image.png',
-      icon: 'image',
-      driveKey: 'files/agent-roster-skill-detail-dialog-preview-image.png',
-    },
-    {
-      id: 'brief',
-      name: 'brief.md',
-      icon: 'markdown',
-      driveKey: 'files/brief.md',
-    },
-  ],
 } satisfies AgentSoulConfigFormState
 
 const agentSkillFilesDraft = {
   ...defaultAgentSoulConfigFormState,
-  files: [
-    {
-      id: 'script',
-      name: 'run.py',
-      icon: 'file',
-      driveKey: 'files/run.py',
-    },
-    {
-      id: 'skill-md',
-      name: 'SKILL.md',
-      icon: 'markdown',
-      driveKey: 'files/SKILL.md',
-    },
-  ],
 } satisfies AgentSoulConfigFormState
 
 function renderAgentFiles(initialDraft: AgentSoulConfigFormState = agentFilesDraft) {
@@ -145,9 +118,11 @@ function renderAgentFiles(initialDraft: AgentSoulConfigFormState = agentFilesDra
 
   return render(
     <QueryClientProvider client={queryClient}>
-      <AgentComposerProvider initialDraft={initialDraft}>
-        <AgentFiles agentId="agent-1" />
-      </AgentComposerProvider>
+      <AgentDriveApiContextProvider value={{ agentId: 'agent-1' }}>
+        <AgentComposerProvider initialDraft={initialDraft}>
+          <AgentFiles />
+        </AgentComposerProvider>
+      </AgentDriveApiContextProvider>
     </QueryClientProvider>,
   )
 }
@@ -163,11 +138,33 @@ function renderReadonlyAgentFiles() {
 
   return render(
     <QueryClientProvider client={queryClient}>
-      <AgentComposerProvider initialDraft={agentFilesDraft}>
-        <AgentOrchestrateReadOnlyContext value>
-          <AgentFiles agentId="agent-1" />
-        </AgentOrchestrateReadOnlyContext>
-      </AgentComposerProvider>
+      <AgentDriveApiContextProvider value={{ agentId: 'agent-1' }}>
+        <AgentComposerProvider initialDraft={agentFilesDraft}>
+          <AgentOrchestrateReadOnlyContext value>
+            <AgentFiles />
+          </AgentOrchestrateReadOnlyContext>
+        </AgentComposerProvider>
+      </AgentDriveApiContextProvider>
+    </QueryClientProvider>,
+  )
+}
+
+function renderWorkflowAgentFiles(initialDraft: AgentSoulConfigFormState = agentFilesDraft) {
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: {
+        retry: false,
+      },
+    },
+  })
+
+  return render(
+    <QueryClientProvider client={queryClient}>
+      <AgentDriveApiContextProvider value={{ agentId: 'agent-1', workflow: { appId: 'app-1', nodeId: 'node-1' } }}>
+        <AgentComposerProvider initialDraft={initialDraft}>
+          <AgentFiles />
+        </AgentComposerProvider>
+      </AgentDriveApiContextProvider>
     </QueryClientProvider>,
   )
 }
@@ -175,13 +172,31 @@ function renderReadonlyAgentFiles() {
 describe('AgentFiles', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    const baseItems = [
+      {
+        file_kind: 'file',
+        key: 'files/agent-roster-skill-detail-dialog-preview-image.png',
+        mime_type: 'image/png',
+      },
+      {
+        file_kind: 'file',
+        key: 'files/brief.md',
+        mime_type: 'text/markdown',
+      },
+    ]
     mocks.agentDriveFilesQueryOptions.mockImplementation(({ input }) => ({
       queryKey: ['agent-drive-files', input],
-      queryFn: () => new Promise(() => {}),
+      initialData: { items: baseItems },
+      queryFn: async () => ({
+        items: baseItems,
+      }),
     }))
     mocks.workflowAgentDriveFilesQueryOptions.mockImplementation(({ input }) => ({
       queryKey: ['workflow-agent-drive-files', input],
-      queryFn: () => new Promise(() => {}),
+      initialData: { items: baseItems },
+      queryFn: async () => ({
+        items: baseItems,
+      }),
     }))
     mocks.agentFilePreviewQueryOptions.mockImplementation(({ input }) => ({
       queryKey: ['agent-file-preview', input],
@@ -264,6 +279,22 @@ describe('AgentFiles', () => {
     })
   })
 
+  it('should list workflow-node drive files under the files prefix', () => {
+    renderWorkflowAgentFiles()
+
+    expect(mocks.workflowAgentDriveFilesQueryOptions).toHaveBeenCalledWith({
+      input: {
+        params: {
+          app_id: 'app-1',
+        },
+        query: {
+          node_id: 'node-1',
+          prefix: 'files/',
+        },
+      },
+    })
+  })
+
   it('should keep the file preview trigger focus ring inside the row bounds', () => {
     renderAgentFiles()
 
@@ -300,6 +331,21 @@ describe('AgentFiles', () => {
   })
 
   it('should preview the clicked file when SKILL.md also exists', async () => {
+    mocks.agentDriveFilesQueryOptions.mockImplementation(({ input }) => ({
+      queryKey: ['agent-drive-files', input],
+      initialData: {
+        items: [
+          { file_kind: 'file', key: 'files/run.py', mime_type: 'text/x-python' },
+          { file_kind: 'file', key: 'files/SKILL.md', mime_type: 'text/markdown' },
+        ],
+      },
+      queryFn: async () => ({
+        items: [
+          { file_kind: 'file', key: 'files/run.py', mime_type: 'text/x-python' },
+          { file_kind: 'file', key: 'files/SKILL.md', mime_type: 'text/markdown' },
+        ],
+      }),
+    }))
     renderAgentFiles(agentSkillFilesDraft)
 
     fireEvent.click(screen.getByRole('button', {
@@ -322,6 +368,21 @@ describe('AgentFiles', () => {
   })
 
   it('should preview the selected file from the detail file tree', async () => {
+    mocks.agentDriveFilesQueryOptions.mockImplementation(({ input }) => ({
+      queryKey: ['agent-drive-files', input],
+      initialData: {
+        items: [
+          { file_kind: 'file', key: 'files/run.py', mime_type: 'text/x-python' },
+          { file_kind: 'file', key: 'files/SKILL.md', mime_type: 'text/markdown' },
+        ],
+      },
+      queryFn: async () => ({
+        items: [
+          { file_kind: 'file', key: 'files/run.py', mime_type: 'text/x-python' },
+          { file_kind: 'file', key: 'files/SKILL.md', mime_type: 'text/markdown' },
+        ],
+      }),
+    }))
     renderAgentFiles(agentSkillFilesDraft)
 
     fireEvent.click(screen.getByRole('button', {
@@ -368,13 +429,7 @@ describe('AgentFiles', () => {
       name: 'agent-roster-skill-detail-dialog-preview-image.png',
     }))
 
-    const image = await screen.findByRole('img', {
-      name: 'agent-roster-skill-detail-dialog-preview-image.png',
-    })
-
-    expect(image).toHaveAttribute('src', 'https://signed.example/files/agent-roster-skill-detail-dialog-preview-image.png')
-    expect(screen.queryByRole('link', { name: /common\.operation\.download/ })).not.toBeInTheDocument()
-    expect(screen.queryByText('image preview should not render as text')).not.toBeInTheDocument()
+    expect(screen.getByRole('dialog')).toBeInTheDocument()
     expect(mocks.agentFileDownloadQueryOptions).toHaveBeenCalledWith({
       input: {
         params: {
@@ -411,10 +466,89 @@ describe('AgentFiles', () => {
     expect(screen.queryByText('Preview content for files/brief.md')).not.toBeInTheDocument()
   })
 
+  it('should use workflow preview and download routes when workflow context is active', async () => {
+    mocks.workflowAgentFilePreviewQueryOptions.mockImplementation(({ input }) => ({
+      queryKey: ['workflow-agent-file-preview', input],
+      queryFn: async () => ({
+        binary: true,
+        key: input.query.key,
+        size: 12345,
+        text: null,
+        truncated: false,
+      }),
+    }))
+    renderWorkflowAgentFiles()
+
+    fireEvent.click(screen.getByRole('button', {
+      name: 'brief.md',
+    }))
+
+    expect(mocks.workflowAgentFilePreviewQueryOptions).toHaveBeenCalledWith({
+      input: {
+        params: {
+          app_id: 'app-1',
+        },
+        query: {
+          node_id: 'node-1',
+          key: 'files/brief.md',
+        },
+      },
+    })
+    expect(mocks.workflowAgentFileDownloadQueryOptions).toHaveBeenCalledWith({
+      input: {
+        params: {
+          app_id: 'app-1',
+        },
+        query: {
+          node_id: 'node-1',
+          key: 'files/brief.md',
+        },
+      },
+    })
+    expect(await screen.findByRole('link', { name: 'common.operation.download' })).toHaveAttribute(
+      'href',
+      'https://signed.example/files/brief.md',
+    )
+  })
+
   it('should commit an uploaded file to the Agent App drive before adding it to the composer draft', async () => {
+    const driveFiles = [
+      {
+        file_kind: 'file',
+        key: 'files/agent-roster-skill-detail-dialog-preview-image.png',
+        mime_type: 'image/png',
+      },
+      {
+        file_kind: 'file',
+        key: 'files/brief.md',
+        mime_type: 'text/markdown',
+      },
+    ]
+    mocks.agentDriveFilesQueryOptions.mockImplementation(({ input }) => ({
+      queryKey: ['agent-drive-files', input],
+      initialData: { items: [...driveFiles] },
+      queryFn: async () => ({ items: [...driveFiles] }),
+    }))
+    mocks.agentFileCommitMutationOptions.mockReturnValue({
+      mutationFn: mocks.agentFileCommitMutationFn.mockImplementation(async () => {
+        driveFiles.push({
+          file_kind: 'file',
+          key: 'files/uploaded.md',
+          mime_type: 'text/markdown',
+        })
+        return {
+          file: {
+            drive_key: 'files/uploaded.md',
+            file_id: 'drive-file-1',
+            mime_type: 'text/markdown',
+            name: 'uploaded.md',
+          },
+        }
+      }),
+      mutationKey: ['commit-agent-file'],
+    })
     renderAgentFiles({
       ...defaultAgentSoulConfigFormState,
-      files: [],
     })
 
     fireEvent.click(screen.getByRole('button', { name: 'agentV2.agentDetail.configure.files.add' }))
@@ -441,31 +575,188 @@ describe('AgentFiles', () => {
         expect.anything(),
       )
     })
+    expect(await screen.findByRole('button', { name: 'uploaded.md' })).toBeInTheDocument()
+  })
+
+  it('should commit an uploaded file through workflow-node drive endpoints and refresh the list', async () => {
+    const driveFiles = [
+      {
+        file_kind: 'file',
+        key: 'files/agent-roster-skill-detail-dialog-preview-image.png',
+        mime_type: 'image/png',
+      },
+      {
+        file_kind: 'file',
+        key: 'files/brief.md',
+        mime_type: 'text/markdown',
+      },
+    ]
+    mocks.workflowAgentDriveFilesQueryOptions.mockImplementation(({ input }) => ({
+      queryKey: ['workflow-agent-drive-files', input],
+      initialData: { items: [...driveFiles] },
+      queryFn: async () => ({ items: [...driveFiles] }),
+    }))
+    mocks.workflowAgentFileCommitMutationOptions.mockReturnValue({
+      mutationFn: mocks.workflowAgentFileCommitMutationFn.mockImplementation(async () => {
+        driveFiles.push({
+          file_kind: 'file',
+          key: 'files/uploaded.md',
+          mime_type: 'text/markdown',
+        })
+        return {
+          file: {
+            drive_key: 'files/uploaded.md',
+            file_id: 'drive-file-1',
+            mime_type: 'text/markdown',
+            name: 'uploaded.md',
+          },
+        }
+      }),
+      mutationKey: ['commit-workflow-agent-file'],
+    })
+    renderWorkflowAgentFiles({
+      ...defaultAgentSoulConfigFormState,
+    })
+
+    fireEvent.click(screen.getByRole('button', { name: 'agentV2.agentDetail.configure.files.add' }))
+    const input = document.querySelector('input[type="file"]')
+    expect(input).toBeInstanceOf(HTMLInputElement)
+
+    fireEvent.change(input!, {
+      target: {
+        files: [new File(['# Uploaded'], 'uploaded.md', { type: 'text/markdown' })],
+      },
+    })
+    fireEvent.click(screen.getByRole('button', { name: 'agentV2.agentDetail.configure.files.upload.action' }))
+
+    await waitFor(() => {
+      expect(mocks.workflowAgentFileCommitMutationFn).toHaveBeenCalledWith(
+        {
+          params: {
+            app_id: 'app-1',
+          },
+          query: {
+            node_id: 'node-1',
+          },
+          body: {
+            upload_file_id: 'upload-file-1',
+          },
+        },
+        expect.anything(),
+      )
+    })
+    expect(await screen.findByRole('button', { name: 'uploaded.md' })).toBeInTheDocument()
   })
 
   // File rows expose a hover/focus remove action that updates the composer draft.
-  it('should remove the file from the list when the remove action is clicked', () => {
+  it('should delete the file when the remove action is clicked', async () => {
+    const driveFiles = [
+      {
+        file_kind: 'file',
+        key: 'files/agent-roster-skill-detail-dialog-preview-image.png',
+        mime_type: 'image/png',
+      },
+      {
+        file_kind: 'file',
+        key: 'files/brief.md',
+        mime_type: 'text/markdown',
+      },
+    ]
+    mocks.agentDriveFilesQueryOptions.mockImplementation(({ input }) => ({
+      queryKey: ['agent-drive-files', input],
+      initialData: { items: [...driveFiles] },
+      queryFn: async () => ({ items: [...driveFiles] }),
+    }))
+    mocks.agentFileDeleteMutationOptions.mockReturnValue({
+      mutationFn: mocks.agentFileDeleteMutationFn.mockImplementation(async () => {
+        driveFiles.splice(0, 1)
+        return { result: 'success' }
+      }),
+      mutationKey: ['delete-agent-file'],
+    })
     renderAgentFiles()
 
-    expect(screen.getByText('agent-roster-skill-detail-dialog-preview-image.png')).toBeInTheDocument()
-
     fireEvent.click(screen.getByRole('button', {
       name: /agentV2\.agentDetail\.configure\.files\.remove.*agent-roster-skill-detail-dialog-preview-image\.png/,
     }))
 
-    expect(screen.queryByText('agent-roster-skill-detail-dialog-preview-image.png')).not.toBeInTheDocument()
-    expect(screen.getByText('brief.md')).toBeInTheDocument()
+    await waitFor(() => {
+      expect(mocks.agentFileDeleteMutationFn).toHaveBeenCalledWith(
+        {
+          params: {
+            agent_id: 'agent-1',
+          },
+          query: {
+            key: 'files/agent-roster-skill-detail-dialog-preview-image.png',
+          },
+        },
+        expect.anything(),
+      )
+    })
+    await waitFor(() => {
+      expect(screen.queryByRole('button', { name: 'agent-roster-skill-detail-dialog-preview-image.png' })).not.toBeInTheDocument()
+    })
+    expect(screen.getByRole('button', { name: 'brief.md' })).toBeInTheDocument()
   })
 
-  it('should render the empty state after removing every file', () => {
-    renderAgentFiles()
+  it('should delete a workflow-node file through workflow endpoints and refresh the list', async () => {
+    const driveFiles = [
+      {
+        file_kind: 'file',
+        key: 'files/agent-roster-skill-detail-dialog-preview-image.png',
+        mime_type: 'image/png',
+      },
+      {
+        file_kind: 'file',
+        key: 'files/brief.md',
+        mime_type: 'text/markdown',
+      },
+    ]
+    mocks.workflowAgentDriveFilesQueryOptions.mockImplementation(({ input }) => ({
+      queryKey: ['workflow-agent-drive-files', input],
+      initialData: { items: [...driveFiles] },
+      queryFn: async () => ({ items: [...driveFiles] }),
+    }))
+    mocks.workflowAgentFileDeleteMutationOptions.mockReturnValue({
+      mutationFn: mocks.workflowAgentFileDeleteMutationFn.mockImplementation(async () => {
+        driveFiles.splice(0, 1)
+        return { result: 'success' }
+      }),
+      mutationKey: ['delete-workflow-agent-file'],
+    })
+    renderWorkflowAgentFiles()
 
     fireEvent.click(screen.getByRole('button', {
       name: /agentV2\.agentDetail\.configure\.files\.remove.*agent-roster-skill-detail-dialog-preview-image\.png/,
     }))
-    fireEvent.click(screen.getByRole('button', {
-      name: /agentV2\.agentDetail\.configure\.files\.remove.*brief\.md/,
+
+    await waitFor(() => {
+      expect(mocks.workflowAgentFileDeleteMutationFn).toHaveBeenCalledWith(
+        {
+          params: {
+            app_id: 'app-1',
+          },
+          query: {
+            node_id: 'node-1',
+            key: 'files/agent-roster-skill-detail-dialog-preview-image.png',
+          },
+        },
+        expect.anything(),
+      )
+    })
+    await waitFor(() => {
+      expect(screen.queryByRole('button', { name: 'agent-roster-skill-detail-dialog-preview-image.png' })).not.toBeInTheDocument()
+    })
+    expect(screen.getByRole('button', { name: 'brief.md' })).toBeInTheDocument()
+  })
+
+  it('should render the empty state when the drive file query returns no items', () => {
+    mocks.agentDriveFilesQueryOptions.mockImplementation(({ input }) => ({
+      queryKey: ['agent-drive-files', input],
+      initialData: { items: [] },
+      queryFn: async () => ({ items: [] }),
     }))
+    renderAgentFiles()
 
     expect(screen.getByText('agentV2.agentDetail.configure.files.empty.title')).toBeInTheDocument()
   })
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/api-context.ts b/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/api-context.ts
deleted file mode 100644
index 886dd16841e..00000000000
--- a/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/api-context.ts
+++ /dev/null
@@ -1,7 +0,0 @@
-export type AgentFileApiContext = {
-  agentId: string
-  workflow?: {
-    appId: string
-    nodeId: string
-  }
-}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/index.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/index.tsx
index 4d61b51f9ec..da8ff756469 100644
--- a/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/index.tsx
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/index.tsx
@@ -2,7 +2,7 @@
 
 import type { ReactNode } from 'react'
 import type { AgentOrchestrateAddActionOptions } from '../add-actions-context'
-import type { AgentFileApiContext } from './api-context'
+import type { AgentDriveApiContext } from '../drive-context'
 import type { AgentFileNode } from '@/features/agent-v2/agent-composer/form-state'
 import {
   Dialog,
@@ -12,30 +12,19 @@ import {
   FileTreeGuide,
 } from '@langgenius/dify-ui/file-tree'
 import { useMutation, useQuery } from '@tanstack/react-query'
-import { useAtom } from 'jotai'
-import { useCallback, useMemo, useRef, useState } from 'react'
+import { useCallback, useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
-import { agentComposerFilesAtom } from '@/features/agent-v2/agent-composer/store-modules/files'
 import { consoleQuery } from '@/service/client'
 import { useRegisterAgentOrchestrateAddAction } from '../add-actions-context'
 import { ConfigureSectionAddButton } from '../common/add-button'
 import { ConfigureSectionEmpty } from '../common/empty'
 import { ConfigureSection } from '../common/section'
+import { FILES_DRIVE_PREFIX, useAgentDriveApiContext, useAgentDriveFiles } from '../drive-context'
 import { useAgentOrchestrateReadOnly } from '../read-only-context'
 import { AgentSkillDetailDialog } from '../skills/detail-dialog'
-import { getDriveFileIconType } from './file-icon'
 import { AgentFileTree } from './tree'
 import { AgentFileUploadDialog } from './upload-dialog'
 
-const removeFileNode = (files: AgentFileNode[], fileId: string): AgentFileNode[] => files
-  .filter(file => file.id !== fileId)
-  .map(file => ({
-    ...file,
-    children: file.children ? removeFileNode(file.children, fileId) : undefined,
-  }))
-
-const FILES_DRIVE_PREFIX = 'files/'
-
 const getAgentFilePreviewKey = (file: AgentFileNode) => file.driveKey ?? file.id
 
 const findAgentFileNode = (files: AgentFileNode[], fileId: string): AgentFileNode | undefined => {
@@ -49,26 +38,6 @@ const findAgentFileNode = (files: AgentFileNode[], fileId: string): AgentFileNod
   }
 }
 
-const getAgentDriveFileName = (key: string) => {
-  const normalizedKey = key.endsWith('/') ? key.slice(0, -1) : key
-  return normalizedKey.split('/').pop() || normalizedKey
-}
-
-const toAgentFileNodeFromDriveItem = (item: {
-  file_kind: string
-  key: string
-  mime_type?: string | null
-}): AgentFileNode => ({
-  id: item.key,
-  name: getAgentDriveFileName(item.key),
-  icon: getDriveFileIconType({
-    fileKind: item.file_kind,
-    fileName: getAgentDriveFileName(item.key),
-    mimeType: item.mime_type,
-  }),
-  driveKey: item.key,
-})
-
 function AgentFileItem({
   children,
   depth,
@@ -82,7 +51,7 @@ function AgentFileItem({
   depth: number
   file: AgentFileNode
   files: AgentFileNode[]
-  apiContext: AgentFileApiContext
+  apiContext: AgentDriveApiContext
   onRemove: (fileId: string) => void
   selected: boolean
 }) {
@@ -217,68 +186,20 @@ function AgentFileItem({
   )
 }
 
-export function AgentFiles({
-  agentId,
-  appId,
-  nodeId,
-}: {
-  agentId: string
-  appId?: string
-  nodeId?: string
-}) {
+export function AgentFiles() {
   const { t } = useTranslation('agentV2')
-  const [draftFiles, setDraftFiles] = useAtom(agentComposerFilesAtom)
   const filesTip = t('agentDetail.configure.files.tip')
   const filesTreeId = 'agent-configure-files-tree'
   const [isUploadOpen, setIsUploadOpen] = useState(false)
   const promptAddCallbackRef = useRef<AgentOrchestrateAddActionOptions['onAdded']>(undefined)
-  const apiContext: AgentFileApiContext = useMemo(() => appId && nodeId
-    ? {
-        agentId,
-        workflow: {
-          appId,
-          nodeId,
-        },
-      }
-    : { agentId }, [agentId, appId, nodeId])
-  const agentDriveFilesQuery = useQuery({
-    ...consoleQuery.agent.byAgentId.drive.files.get.queryOptions({
-      input: {
-        params: {
-          agent_id: agentId,
-        },
-        query: {
-          prefix: FILES_DRIVE_PREFIX,
-        },
-      },
-    }),
-    enabled: !apiContext.workflow,
-  })
-  const workflowDriveFilesQuery = useQuery({
-    ...consoleQuery.apps.byAppId.agent.drive.files.get.queryOptions({
-      input: {
-        params: {
-          app_id: appId ?? '',
-        },
-        query: {
-          node_id: nodeId,
-          prefix: FILES_DRIVE_PREFIX,
-        },
-      },
-    }),
-    enabled: !!apiContext.workflow,
-  })
-  const driveFilesQuery = apiContext.workflow ? workflowDriveFilesQuery : agentDriveFilesQuery
+  const apiContext = useAgentDriveApiContext()
+  const { query: driveFilesQuery, files } = useAgentDriveFiles({ prefix: FILES_DRIVE_PREFIX })
   const { mutate: deleteAgentFile } = useMutation(consoleQuery.agent.byAgentId.files.delete.mutationOptions())
   const { mutate: deleteWorkflowAgentFile } = useMutation(consoleQuery.apps.byAppId.agent.files.delete.mutationOptions())
-  const files = driveFilesQuery.isSuccess
-    ? (driveFilesQuery.data.items ?? []).map(toAgentFileNodeFromDriveItem)
-    : draftFiles
   const removeFile = useCallback((fileId: string) => {
     const file = findAgentFileNode(files, fileId)
     const driveKey = file?.driveKey
 
-    setDraftFiles(removeFileNode(draftFiles, fileId))
     if (!driveKey)
       return
 
@@ -306,18 +227,17 @@ export function AgentFiles({
         key: driveKey,
       },
     }, { onSuccess })
-  }, [apiContext, deleteAgentFile, deleteWorkflowAgentFile, draftFiles, driveFilesQuery, files, setDraftFiles])
+  }, [apiContext, deleteAgentFile, deleteWorkflowAgentFile, driveFilesQuery, files])
   const handleOpenUpload = useCallback((options?: AgentOrchestrateAddActionOptions) => {
     promptAddCallbackRef.current = options?.onAdded
     setIsUploadOpen(true)
   }, [])
   useRegisterAgentOrchestrateAddAction('files', handleOpenUpload)
   const handleUploaded = useCallback((file: AgentFileNode) => {
-    setDraftFiles([...draftFiles, file])
     void driveFilesQuery.refetch()
     promptAddCallbackRef.current?.(file)
     promptAddCallbackRef.current = undefined
-  }, [draftFiles, driveFilesQuery, setDraftFiles])
+  }, [driveFilesQuery])
   const handleUploadOpenChange = useCallback((open: boolean) => {
     if (!open)
       promptAddCallbackRef.current = undefined
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/upload-dialog.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/upload-dialog.tsx
index ac25c742af9..3abb5fdabba 100644
--- a/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/upload-dialog.tsx
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/files/upload-dialog.tsx
@@ -1,7 +1,7 @@
 'use client'
 
 import type { FileResponse } from '@dify/contracts/api/console/files/types.gen'
-import type { AgentFileApiContext } from './api-context'
+import type { AgentDriveApiContext } from '../drive-context'
 import type { AgentFileNode } from '@/features/agent-v2/agent-composer/form-state'
 import { Button } from '@langgenius/dify-ui/button'
 import { cn } from '@langgenius/dify-ui/cn'
@@ -137,7 +137,7 @@ export function AgentFileUploadDialog({
   onOpenChange,
   onUploaded,
 }: {
-  apiContext: AgentFileApiContext
+  apiContext: AgentDriveApiContext
   open: boolean
   onOpenChange: (open: boolean) => void
   onUploaded: (file: AgentFileNode) => void
@@ -220,8 +220,8 @@ export function AgentFileUploadDialog({
   }
 
   return (
-    <Dialog open={open} onOpenChange={handleOpenChange}>
-      <DialogContent>
+    <Dialog open={open} onOpenChange={handleOpenChange} disablePointerDismissal>
+      <DialogContent backdropProps={{ forceRender: true }} backdropClassName="fixed">
         <DialogCloseButton />
         <DialogTitle className="title-2xl-semi-bold text-text-primary">
           {t('agentDetail.configure.files.upload.title')}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/index.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/index.tsx
index 81c2653657a..cddbec00d68 100644
--- a/web/features/agent-v2/agent-detail/configure/components/orchestrate/index.tsx
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/index.tsx
@@ -5,9 +5,11 @@ import type { AgentConfigurePublishPayload } from './publish-bar'
 import type { DefaultModel, Model } from '@/app/components/header/account-setting/model-provider-page/declarations'
 import { cn } from '@langgenius/dify-ui/cn'
 import { ScrollArea } from '@langgenius/dify-ui/scroll-area'
+import { useMemo } from 'react'
 import { useTranslation } from 'react-i18next'
 import { AgentOrchestrateAddActionsProvider } from './add-actions'
 import { AgentAdvancedSettings } from './advanced'
+import { AgentDriveApiContextProvider } from './drive-context'
 import { AgentFiles } from './files'
 import { AgentOrchestrateHeader } from './header'
 import { AgentKnowledgeRetrieval } from './knowledge'
@@ -21,6 +23,7 @@ import { AgentTools } from './tools'
 type AgentOrchestratePanelProps = {
   agentId: string
   appId?: string
+  nodeId?: string
   activeConfigIsPublished?: boolean
   activeConfigSnapshot?: AgentConfigSnapshotSummaryResponse | null
   agentSoulConfig?: AgentConfigSnapshotDetailResponse['config_snapshot']
@@ -31,16 +34,19 @@ type AgentOrchestratePanelProps = {
   isPublishing?: boolean
   className?: string
   readOnly?: boolean
+  selectedVersionSnapshot?: AgentConfigSnapshotSummaryResponse | null
   showHeader?: boolean
   showPublishBar?: boolean
   onSelectModel: (model: DefaultModel) => void
   onPublish: (payload: AgentConfigurePublishPayload) => void | Promise<void>
+  onExitVersions?: () => void
   onOpenVersions: () => void
 }
 
 export function AgentOrchestratePanel({
   agentId,
   appId,
+  nodeId,
   activeConfigIsPublished,
   activeConfigSnapshot,
   agentSoulConfig,
@@ -51,18 +57,29 @@ export function AgentOrchestratePanel({
   isPublishing,
   className,
   readOnly = false,
+  selectedVersionSnapshot,
   showHeader = true,
   showPublishBar = true,
   onSelectModel,
   onPublish,
+  onExitVersions,
   onOpenVersions,
 }: AgentOrchestratePanelProps) {
   const { t } = useTranslation('agentV2')
   const orchestrateHeadingId = 'agent-configure-orchestrate-heading'
   const orchestrateLabel = t('agentDetail.configure.orchestrate')
+  const driveApiContext = useMemo(() => appId && nodeId
+    ? {
+        agentId,
+        workflow: {
+          appId,
+          nodeId,
+        },
+      }
+    : { agentId }, [agentId, appId, nodeId])
 
   return (
-    <div className={cn('flex max-w-140 min-w-90 flex-[0_0_min(41.08280255%,560px)] flex-col overflow-hidden rounded-lg border-[0.5px] border-components-panel-border bg-components-panel-bg', className)}>
+    <div className={cn('relative flex max-w-140 min-w-90 flex-[0_0_min(41.08280255%,560px)] flex-col overflow-hidden rounded-lg border-[0.5px] border-components-panel-border bg-components-panel-bg', className)}>
       {showHeader && <AgentOrchestrateHeader headingId={orchestrateHeadingId} />}
 
       <AgentOrchestrateReadOnlyContext value={readOnly}>
@@ -76,25 +93,25 @@ export function AgentOrchestratePanel({
             labelledBy={showHeader ? orchestrateHeadingId : undefined}
             slotClassNames={{
               viewport: 'overscroll-contain',
-              content: 'min-h-full px-4 py-3',
+              content: cn('min-h-full px-4 py-3', showPublishBar && 'pb-20'),
+              scrollbar: showPublishBar ? 'z-20' : undefined,
             }}
           >
-            <AgentOrchestrateAddActionsProvider>
-              <AgentModelField
-                currentModel={currentModel}
-                textGenerationModelList={textGenerationModelList}
-                onSelect={onSelectModel}
-              />
-              <AgentPromptEditor />
-              <AgentSkills agentId={agentId} />
-              <AgentFiles
-                agentId={agentId}
-                appId={appId}
-              />
-              <AgentTools />
-              <AgentKnowledgeRetrieval />
-              <AgentAdvancedSettings />
-            </AgentOrchestrateAddActionsProvider>
+            <AgentDriveApiContextProvider value={driveApiContext}>
+              <AgentOrchestrateAddActionsProvider>
+                <AgentModelField
+                  currentModel={currentModel}
+                  textGenerationModelList={textGenerationModelList}
+                  onSelect={onSelectModel}
+                />
+                <AgentPromptEditor />
+                <AgentSkills />
+                <AgentFiles />
+                <AgentTools />
+                <AgentKnowledgeRetrieval />
+                <AgentAdvancedSettings />
+              </AgentOrchestrateAddActionsProvider>
+            </AgentDriveApiContextProvider>
           </ScrollArea>
         </div>
       </AgentOrchestrateReadOnlyContext>
@@ -109,7 +126,9 @@ export function AgentOrchestratePanel({
           currentModel={currentModel}
           draftSavedAt={draftSavedAt}
           isPublishing={isPublishing}
+          selectedVersionSnapshot={selectedVersionSnapshot}
           onPublish={onPublish}
+          onExitVersions={onExitVersions}
           onOpenVersions={onOpenVersions}
         />
       )}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/knowledge/__tests__/index.spec.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/knowledge/__tests__/index.spec.tsx
index cce4132779a..8f3e683002e 100644
--- a/web/features/agent-v2/agent-detail/configure/components/orchestrate/knowledge/__tests__/index.spec.tsx
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/knowledge/__tests__/index.spec.tsx
@@ -78,7 +78,7 @@ describe('AgentKnowledgeRetrieval', () => {
       })).not.toBeInTheDocument()
     })
 
-    it('should keep row actions focusable while visually hidden until hover or focus', () => {
+    it('should keep row actions out of layout until hover or focus', () => {
       renderKnowledgeRetrieval()
 
       const editButton = screen.getByRole('button', {
@@ -89,12 +89,10 @@ describe('AgentKnowledgeRetrieval', () => {
       })
       const actionGroup = editButton.parentElement
 
-      expect(actionGroup).toHaveClass('flex')
-      expect(actionGroup).not.toHaveClass('hidden')
+      expect(actionGroup).toHaveClass('hidden')
       expect(actionGroup).toHaveClass(
-        'opacity-0',
-        'group-focus-within:opacity-100',
-        'group-hover:opacity-100',
+        'group-focus-within:flex',
+        'group-hover:flex',
       )
       expect(removeButton).toHaveClass(
         'hover:bg-state-destructive-hover',
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/prompt-editor/index.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/prompt-editor/index.tsx
index 8e0d8b66586..8ca5b8f5efb 100644
--- a/web/features/agent-v2/agent-detail/configure/components/orchestrate/prompt-editor/index.tsx
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/prompt-editor/index.tsx
@@ -16,14 +16,13 @@ import { Infotip } from '@/app/components/base/infotip'
 import PromptEditor from '@/app/components/base/prompt-editor'
 import BlockIcon from '@/app/components/workflow/block-icon'
 import { BlockEnum } from '@/app/components/workflow/types'
-import { agentComposerFilesAtom } from '@/features/agent-v2/agent-composer/store-modules/files'
 import { agentComposerKnowledgeRetrievalsAtom } from '@/features/agent-v2/agent-composer/store-modules/knowledge'
 import { agentComposerPromptAtom } from '@/features/agent-v2/agent-composer/store-modules/prompt'
-import { agentComposerSkillsAtom } from '@/features/agent-v2/agent-composer/store-modules/skills'
 import { agentComposerToolsAtom } from '@/features/agent-v2/agent-composer/store-modules/tools'
 import useTheme from '@/hooks/use-theme'
 import { Theme } from '@/types/app'
 import { useAgentOrchestrateAddActions } from '../add-actions-context'
+import { useAgentDriveFiles, useAgentDriveSkills } from '../drive-context'
 import { useAgentOrchestrateReadOnly } from '../read-only-context'
 import { replaceTrailingSlashWithToken } from './options'
 import { AgentPromptSlashMenu } from './slash'
@@ -151,8 +150,8 @@ export function AgentPromptEditor() {
   const { t } = useTranslation('agentV2')
   const readOnly = useAgentOrchestrateReadOnly()
   const [value, setValue] = useAtom(agentComposerPromptAtom)
-  const skills = useAtomValue(agentComposerSkillsAtom)
-  const files = useAtomValue(agentComposerFilesAtom)
+  const { skills } = useAgentDriveSkills()
+  const { files } = useAgentDriveFiles()
   const [tools, setTools] = useAtom(agentComposerToolsAtom)
   const retrievals = useAtomValue(agentComposerKnowledgeRetrievalsAtom)
   const addActions = useAgentOrchestrateAddActions()
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/prompt-editor/slash.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/prompt-editor/slash.tsx
index 449ae6f7288..9aee10696ef 100644
--- a/web/features/agent-v2/agent-detail/configure/components/orchestrate/prompt-editor/slash.tsx
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/prompt-editor/slash.tsx
@@ -53,6 +53,10 @@ const createReferenceToken = (kind: string, id: string, label?: string) => (
   `[§${kind}:${id}${label ? `:${label}` : ''}§]`
 )
 
+const createDriveReferenceToken = (kind: 'skill' | 'file', driveKey: string, label: string) => (
+  createReferenceToken(kind, encodeURIComponent(driveKey), label)
+)
+
 const isPromptReferenceItem = (item: AgentOrchestrateAddedItem): item is AgentFileNode | AgentSkill => (
   'id' in item && 'name' in item
 )
@@ -87,8 +91,8 @@ export function AgentPromptSlashMenu({
     if (view === 'skills') {
       onAddSkill?.({
         onAdded: (item) => {
-          if (isPromptReferenceItem(item))
-            onSelect(createReferenceToken('skill', item.id, item.name))
+          if (isPromptReferenceItem(item) && 'skillMdKey' in item && typeof item.skillMdKey === 'string')
+            onSelect(createDriveReferenceToken('skill', item.skillMdKey, item.name))
         },
       })
       return
@@ -97,8 +101,8 @@ export function AgentPromptSlashMenu({
     if (view === 'files') {
       onAddFile?.({
         onAdded: (item) => {
-          if (isPromptReferenceItem(item))
-            onSelect(createReferenceToken('file', item.id, item.name))
+          if (isPromptReferenceItem(item) && 'driveKey' in item && typeof item.driveKey === 'string')
+            onSelect(createDriveReferenceToken('file', item.driveKey, item.name))
         },
       })
       return
@@ -224,7 +228,7 @@ function AgentPromptSkillRows({
           key={skill.id}
           icon="i-ri-box-3-line"
           label={skill.name}
-          onClick={() => onSelect(createReferenceToken('skill', skill.id, skill.name))}
+          onClick={() => skill.skillMdKey && onSelect(createDriveReferenceToken('skill', skill.skillMdKey, skill.name))}
         />
       ))}
     </>
@@ -249,7 +253,7 @@ function AgentPromptFileRows({
             label={file.name}
             depth={depth}
             hasChildren={!!file.children?.length}
-            onClick={() => onSelect(createReferenceToken('file', file.id, file.name))}
+            onClick={() => file.driveKey && onSelect(createDriveReferenceToken('file', file.driveKey, file.name))}
           />
           {!!file.children?.length && (
             <AgentPromptFileRows files={file.children} depth={depth + 1} onSelect={onSelect} />
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/publish-bar/index.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/publish-bar/index.tsx
index 8ab77ecda3f..44a4e9fdf8f 100644
--- a/web/features/agent-v2/agent-detail/configure/components/orchestrate/publish-bar/index.tsx
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/publish-bar/index.tsx
@@ -1,20 +1,24 @@
 'use client'
 
-import type { AgentConfigSnapshotDetailResponse, AgentConfigSnapshotSummaryResponse, AgentSoulConfig } from '@dify/contracts/api/console/agent/types.gen'
+import type { AgentConfigSnapshotDetailResponse, AgentConfigSnapshotSummaryResponse, AgentReferencingWorkflowResponse, AgentReferencingWorkflowsResponse, AgentSoulConfig } from '@dify/contracts/api/console/agent/types.gen'
 import type { RegisterableHotkey } from '@tanstack/react-hotkeys'
+import type { ReactNode } from 'react'
 import { Button } from '@langgenius/dify-ui/button'
-import { cn } from '@langgenius/dify-ui/cn'
+import { CollapsiblePanel, CollapsibleRoot } from '@langgenius/dify-ui/collapsible'
 import { Kbd, KbdGroup } from '@langgenius/dify-ui/kbd'
 import { StatusDot } from '@langgenius/dify-ui/status-dot'
-import { formatForDisplay } from '@tanstack/react-hotkeys'
-import { useEffect, useRef, useState } from 'react'
+import { toast } from '@langgenius/dify-ui/toast'
+import { formatForDisplay, useHotkey } from '@tanstack/react-hotkeys'
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
+import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import { useConfigPublishPayload, useHasAgentComposerUnpublishedChanges } from '@/features/agent-v2/agent-composer/store'
 import { useFormatTimeFromNow } from '@/hooks/use-format-time-from-now'
-import { AgentPublishImpactPopover } from './publish-impact-popover'
+import useTimestamp from '@/hooks/use-timestamp'
+import { consoleQuery } from '@/service/client'
+import { AgentPublishImpactDetails } from './publish-impact-details'
 
 const PUBLISH_AGENT_HOTKEY = 'Mod+Shift+P' satisfies RegisterableHotkey
-const PUBLISH_IMPACT_BAR_HIDE_DELAY = 160
 
 export type AgentConfigurePublishPayload = {
   agent_id: string
@@ -23,6 +27,9 @@ export type AgentConfigurePublishPayload = {
 
 type AgentConfigurePublishState = 'draft' | 'publishing' | 'published' | 'unpublished'
 
+type PublishBarMode = { status: 'compact' }
+  | { status: 'confirmingImpact', references: AgentReferencingWorkflowResponse[] }
+
 type AgentConfigurePublishBarProps = {
   agentId: string
   activeConfigIsPublished?: boolean
@@ -35,7 +42,9 @@ type AgentConfigurePublishBarProps = {
   }
   draftSavedAt?: number
   isPublishing?: boolean
+  selectedVersionSnapshot?: AgentConfigSnapshotSummaryResponse | null
   onPublish?: (payload: AgentConfigurePublishPayload) => void | Promise<void>
+  onExitVersions?: () => void
   onOpenVersions: () => void
 }
 
@@ -81,54 +90,136 @@ export function AgentConfigurePublishBar({
   currentModel,
   draftSavedAt,
   isPublishing = false,
+  selectedVersionSnapshot,
   onPublish,
+  onExitVersions,
   onOpenVersions,
 }: AgentConfigurePublishBarProps) {
   const { t } = useTranslation('agentV2')
+  const { t: tCommon } = useTranslation('common')
   const { formatTimeFromNow } = useFormatTimeFromNow()
-  const [shouldHidePublishBar, setShouldHidePublishBar] = useState(false)
-  const hidePublishBarTimerRef = useRef<ReturnType<typeof setTimeout> | undefined>(undefined)
+  const queryClient = useQueryClient()
+  const [publishBarMode, setPublishBarMode] = useState<PublishBarMode>({ status: 'compact' })
   const hasUnpublishedChanges = useHasAgentComposerUnpublishedChanges()
   const publishPayload = useConfigPublishPayload({
     agentId,
     baseConfig: agentSoulConfig,
     currentModel,
   })
+  const publishableState = getPublishState({
+    activeConfigIsPublished,
+    activeConfigSnapshot,
+    isDirty: hasUnpublishedChanges,
+    isPublishing: false,
+  })
   const publishState = getPublishState({
     activeConfigIsPublished,
     activeConfigSnapshot,
     isDirty: hasUnpublishedChanges,
     isPublishing,
   })
-  const canPublish = publishState === 'draft' || publishState === 'unpublished'
+  const publishIsAvailable = !isPublishing && (publishableState === 'draft' || publishableState === 'unpublished')
+  const workflowReferencesQueryOptions = consoleQuery.agent.byAgentId.referencingWorkflows.get.queryOptions({
+    input: {
+      params: {
+        agent_id: agentId,
+      },
+    },
+  })
+  const workflowReferencesQuery = useQuery({
+    ...workflowReferencesQueryOptions,
+    enabled: publishIsAvailable && !selectedVersionSnapshot,
+  })
+  const restoreVersionMutation = useMutation(consoleQuery.agent.byAgentId.versions.byVersionId.restore.post.mutationOptions())
+  const canPublish = publishIsAvailable
 
-  const handleImpactPopoverOpenChange = (open: boolean) => {
-    if (hidePublishBarTimerRef.current)
-      clearTimeout(hidePublishBarTimerRef.current)
-
-    if (!open) {
-      setShouldHidePublishBar(false)
+  const handleRestoreVersion = (versionId: string) => {
+    if (restoreVersionMutation.isPending)
       return
-    }
 
-    hidePublishBarTimerRef.current = setTimeout(() => {
-      setShouldHidePublishBar(true)
-    }, PUBLISH_IMPACT_BAR_HIDE_DELAY)
+    restoreVersionMutation.mutate({
+      params: {
+        agent_id: agentId,
+        version_id: versionId,
+      },
+    }, {
+      onSuccess: () => {
+        void queryClient.invalidateQueries({
+          queryKey: consoleQuery.agent.byAgentId.get.queryKey({
+            input: {
+              params: {
+                agent_id: agentId,
+              },
+            },
+          }),
+        })
+        void queryClient.invalidateQueries({
+          queryKey: consoleQuery.agent.byAgentId.composer.get.queryKey({
+            input: {
+              params: {
+                agent_id: agentId,
+              },
+            },
+          }),
+        })
+        void queryClient.invalidateQueries({
+          queryKey: consoleQuery.agent.byAgentId.versions.get.key(),
+        })
+        onExitVersions?.()
+        toast.success(tCommon('api.actionSuccess'))
+      },
+      onError: () => {
+        toast.error(tCommon('api.actionFailed'))
+      },
+    })
   }
 
-  const handlePublish = () => {
+  const handlePublish = async () => {
     if (!canPublish)
       return
 
-    void onPublish?.(publishPayload)
+    await onPublish?.(publishPayload)
+    setPublishBarMode({ status: 'compact' })
   }
 
-  useEffect(() => {
-    return () => {
-      if (hidePublishBarTimerRef.current)
-        clearTimeout(hidePublishBarTimerRef.current)
+  const handlePublishRequest = async () => {
+    if (!canPublish)
+      return
+
+    if (publishBarMode.status === 'confirmingImpact') {
+      await handlePublish()
+      return
     }
-  }, [])
+
+    const cachedReferences = queryClient.getQueryData<AgentReferencingWorkflowsResponse>(workflowReferencesQueryOptions.queryKey)
+    const references = (cachedReferences ?? workflowReferencesQuery.data ?? await queryClient.ensureQueryData(workflowReferencesQueryOptions))?.data ?? []
+
+    if (references.length > 0) {
+      setPublishBarMode({ status: 'confirmingImpact', references })
+      return
+    }
+
+    await handlePublish()
+  }
+
+  useHotkey(PUBLISH_AGENT_HOTKEY, (event) => {
+    event.preventDefault()
+    void handlePublishRequest()
+  }, {
+    enabled: canPublish && !selectedVersionSnapshot,
+    ignoreInputs: false,
+  })
+
+  if (selectedVersionSnapshot) {
+    return (
+      <AgentVersionRestoreBar
+        version={selectedVersionSnapshot}
+        isRestoring={restoreVersionMutation.isPending}
+        onExitVersions={onExitVersions}
+        onRestoreVersion={handleRestoreVersion}
+      />
+    )
+  }
 
   const publishedMeta = activeConfigSnapshot?.created_at
     ? t('agentDetail.configure.publishBar.publishedAt', {
@@ -150,7 +241,7 @@ export function AgentConfigurePublishBar({
       statusLabel: t('agentDetail.configure.publishBar.draft'),
     },
     publishing: {
-      actionIcon: 'i-ri-loader-2-line animate-spin motion-reduce:animate-none',
+      actionIcon: null,
       actionLabel: t('agentDetail.configure.publishBar.publishing'),
       dotStatus: 'disabled',
       metaLabel: savedMeta,
@@ -182,60 +273,195 @@ export function AgentConfigurePublishBar({
     statusLabel: string
   }>
   const currentStateMeta = stateMeta[publishState]
+  const isConfirmingImpact = publishBarMode.status === 'confirmingImpact' && (canPublish || isPublishing)
+  const impactReferences = publishBarMode.status === 'confirmingImpact' ? publishBarMode.references : []
 
   return (
-    <div className="flex h-16 shrink-0 items-center justify-center px-4 pt-2 pb-3">
-      <div
-        className={cn(
-          'flex max-w-full min-w-0 items-center gap-2 rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-bg-blur p-2 shadow-lg shadow-shadow-shadow-5 backdrop-blur-[5px]',
-          shouldHidePublishBar && 'pointer-events-none opacity-0',
-        )}
-        aria-hidden={shouldHidePublishBar}
+    <PublishBarBottomActions>
+      <CollapsibleRoot
+        open={isConfirmingImpact}
+        className="group/publish-bar pointer-events-auto w-full overflow-hidden rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-bg-blur shadow-lg shadow-shadow-shadow-5 backdrop-blur-[5px]"
       >
-        <div className="flex min-w-0 items-center gap-1 px-2 system-xs-regular text-text-tertiary">
-          <span className="flex size-4 shrink-0 items-center justify-center">
-            <StatusDot size="small" status={currentStateMeta.dotStatus} />
-          </span>
-          <span className="shrink-0">{currentStateMeta.statusLabel}</span>
-          <span aria-hidden className="shrink-0">·</span>
-          <span className="min-w-0 truncate">
-            {currentStateMeta.metaLabel}
-          </span>
-        </div>
-        <button
-          type="button"
-          aria-label={t('agentDetail.configure.publishBar.versionHistory')}
-          className="flex size-8 shrink-0 items-center justify-center rounded-lg text-text-tertiary hover:bg-state-base-hover hover:text-text-secondary focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
-          onClick={onOpenVersions}
-        >
-          <span aria-hidden className="i-ri-history-line size-4" />
-        </button>
-        <AgentPublishImpactPopover
+        <CollapsiblePanel className="system-sm-regular text-text-secondary">
+          <AgentPublishImpactDetails
+            publishActionLabel={currentStateMeta.actionLabel}
+            agentName={agentName}
+            references={impactReferences}
+          />
+        </CollapsiblePanel>
+        <PublishBarActions
+          actionIcon={currentStateMeta.actionIcon}
           actionLabel={currentStateMeta.actionLabel}
-          actionShortcut={currentStateMeta.showShortcut ? <PublishShortcut /> : null}
-          hotkey={PUBLISH_AGENT_HOTKEY}
-          agentId={agentId}
-          agentName={agentName}
-          disabled={!canPublish}
-          onOpenChange={handleImpactPopoverOpenChange}
-          onPublish={handlePublish}
-          trigger={(
-            <Button
-              type="button"
-              variant="primary"
-              aria-disabled={!canPublish}
-              className="h-8 gap-1 rounded-lg px-3 aria-disabled:cursor-not-allowed"
-              onClick={handlePublish}
-            >
-              {currentStateMeta.actionIcon && (
-                <span aria-hidden className={cn('size-4 shrink-0', currentStateMeta.actionIcon)} />
-              )}
-              <span className="shrink-0">{currentStateMeta.actionLabel}</span>
-              {currentStateMeta.showShortcut && <PublishShortcut />}
-            </Button>
-          )}
+          dotStatus={currentStateMeta.dotStatus}
+          isPublishing={isPublishing}
+          metaLabel={currentStateMeta.metaLabel}
+          showShortcut={currentStateMeta.showShortcut}
+          statusLabel={currentStateMeta.statusLabel}
+          canPublish={canPublish}
+          onCancelImpact={() => setPublishBarMode({ status: 'compact' })}
+          onOpenVersions={onOpenVersions}
+          onPublishRequest={handlePublishRequest}
         />
+      </CollapsibleRoot>
+    </PublishBarBottomActions>
+  )
+}
+
+function PublishBarBottomActions({
+  children,
+}: {
+  children: ReactNode
+}) {
+  return (
+    <div
+      className="pointer-events-none absolute inset-x-0 bottom-0 z-10 flex h-[72px] flex-col items-center justify-end px-4 pt-4 pb-2 transition-[height] duration-150 ease-out has-[[data-open]]:h-[307px] motion-reduce:transition-none"
+    >
+      <div
+        aria-hidden
+        className="pointer-events-none absolute inset-0 z-0 bg-gradient-to-t from-components-panel-bg to-components-panel-bg-transparent [mask-image:linear-gradient(to_top,black,transparent)] backdrop-blur-[2px] [-webkit-mask-image:linear-gradient(to_top,black,transparent)]"
+      />
+      <div
+        className="relative z-10 flex w-full max-w-[506px] flex-col items-center justify-end transition-[max-width] duration-150 ease-out has-[[data-open]]:max-w-96 motion-reduce:transition-none"
+      >
+        {children}
       </div>
     </div>
   )
 }
+
+function PublishBarActions({
+  actionIcon,
+  actionLabel,
+  dotStatus,
+  isPublishing,
+  metaLabel,
+  showShortcut,
+  statusLabel,
+  canPublish,
+  onCancelImpact,
+  onOpenVersions,
+  onPublishRequest,
+}: {
+  actionIcon: string | null
+  actionLabel: string
+  dotStatus: 'disabled' | 'success' | 'warning'
+  isPublishing: boolean
+  metaLabel: string
+  showShortcut: boolean
+  statusLabel: string
+  canPublish: boolean
+  onCancelImpact: () => void
+  onOpenVersions: () => void
+  onPublishRequest: () => void | Promise<void>
+}) {
+  const { t } = useTranslation('agentV2')
+
+  return (
+    <div className="flex w-full min-w-0 items-center justify-between gap-2 p-2 group-data-open/publish-bar:justify-end group-data-open/publish-bar:px-4 group-data-open/publish-bar:pt-2 group-data-open/publish-bar:pb-4">
+      <div className="flex min-w-0 flex-1 items-center gap-1 px-2 system-xs-regular text-text-tertiary group-data-open/publish-bar:hidden">
+        <span className="flex size-4 shrink-0 items-center justify-center">
+          <StatusDot size="small" status={dotStatus} />
+        </span>
+        <span className="shrink-0">{statusLabel}</span>
+        <span aria-hidden className="shrink-0">·</span>
+        <span className="min-w-0 truncate">
+          {metaLabel}
+        </span>
+      </div>
+      <button
+        type="button"
+        aria-label={t('agentDetail.configure.publishBar.versionHistory')}
+        className="flex size-8 shrink-0 items-center justify-center rounded-lg text-text-tertiary group-data-open/publish-bar:hidden hover:bg-state-base-hover hover:text-text-secondary focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+        onClick={onOpenVersions}
+      >
+        <span aria-hidden className="i-ri-history-line size-4" />
+      </button>
+      <Button
+        type="button"
+        variant="secondary"
+        className="hidden h-8 min-w-18 rounded-lg px-3 group-data-open/publish-bar:inline-flex"
+        onClick={onCancelImpact}
+      >
+        {t('agentDetail.configure.publishImpact.cancel')}
+      </Button>
+      <Button
+        type="button"
+        variant="primary"
+        disabled={!canPublish}
+        loading={isPublishing}
+        className="h-8 gap-1 rounded-lg px-3"
+        onClick={() => {
+          void onPublishRequest()
+        }}
+      >
+        {actionIcon && (
+          <span aria-hidden className={`${actionIcon} size-4 shrink-0`} />
+        )}
+        <span className="shrink-0">{actionLabel}</span>
+        {showShortcut && <PublishShortcut />}
+      </Button>
+    </div>
+  )
+}
+
+function AgentVersionRestoreBar({
+  version,
+  isRestoring = false,
+  onExitVersions,
+  onRestoreVersion,
+}: {
+  version: AgentConfigSnapshotSummaryResponse
+  isRestoring?: boolean
+  onExitVersions?: () => void
+  onRestoreVersion?: (versionId: string) => void
+}) {
+  const { t } = useTranslation('agentV2')
+  const { formatTime } = useTimestamp()
+  const versionLabel = version.version_note || t('agentDetail.versionHistory.versionName', { version: version.version })
+  const createdAt = version.created_at == null
+    ? null
+    : formatTime(version.created_at, t('roster.dateTimeFormat'))
+
+  return (
+    <PublishBarBottomActions>
+      <div className="pointer-events-auto flex max-w-full min-w-0 items-center gap-2 rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-bg-blur py-2 pr-2.5 pl-2 shadow-lg shadow-shadow-shadow-5 backdrop-blur-[5px]">
+        <div className="flex min-w-0 flex-col justify-center gap-0.5 pr-4 pl-2">
+          <div className="flex min-w-0 items-center gap-1">
+            <p className="min-w-0 truncate system-sm-semibold text-text-primary">
+              {versionLabel}
+            </p>
+            <span className="shrink-0 rounded-[5px] border border-text-accent-secondary bg-components-badge-bg-dimm px-1 py-0.5 system-2xs-medium-uppercase text-text-accent-secondary">
+              {t('agentDetail.versionHistory.viewOnly')}
+            </span>
+          </div>
+          {(createdAt || version.created_by) && (
+            <p className="min-w-0 truncate system-xs-regular text-text-tertiary">
+              {createdAt}
+              {createdAt && version.created_by && ' · '}
+              {version.created_by}
+            </p>
+          )}
+        </div>
+        <Button
+          type="button"
+          variant="primary"
+          disabled={!onRestoreVersion}
+          loading={isRestoring}
+          className="h-8 rounded-lg px-3"
+          onClick={() => onRestoreVersion?.(version.id)}
+        >
+          {t('agentDetail.versionHistory.restore')}
+        </Button>
+        <Button
+          type="button"
+          variant="secondary"
+          className="h-8 gap-1 rounded-lg px-3 text-text-accent"
+          onClick={onExitVersions}
+        >
+          <span aria-hidden className="i-ri-arrow-go-back-line size-4 shrink-0" />
+          <span className="shrink-0">{t('agentDetail.versionHistory.exitVersions')}</span>
+        </Button>
+      </div>
+    </PublishBarBottomActions>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/publish-bar/publish-impact-details.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/publish-bar/publish-impact-details.tsx
new file mode 100644
index 00000000000..2cb966e0537
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/publish-bar/publish-impact-details.tsx
@@ -0,0 +1,97 @@
+'use client'
+
+import type { AgentIconType, AgentReferencingWorkflowResponse } from '@dify/contracts/api/console/agent/types.gen'
+import { useId } from 'react'
+import { useTranslation } from 'react-i18next'
+import AppIcon from '@/app/components/base/app-icon'
+import { useFormatTimeFromNow } from '@/hooks/use-format-time-from-now'
+import Link from '@/next/link'
+
+type AgentPublishImpactDetailsProps = {
+  publishActionLabel: string
+  agentName?: string | null
+  references: AgentReferencingWorkflowResponse[]
+}
+
+const getWorkflowReferenceHref = (reference: AgentReferencingWorkflowResponse) => `/app/${reference.app_id}/workflow`
+
+export function AgentPublishImpactDetails({
+  publishActionLabel,
+  agentName,
+  references,
+}: AgentPublishImpactDetailsProps) {
+  const { t } = useTranslation('agentV2')
+  const titleId = useId()
+
+  return (
+    <section
+      aria-labelledby={titleId}
+      className="flex w-full max-w-full flex-col"
+    >
+      <div className="flex flex-col gap-0.5 px-3 pt-3.5 pb-1">
+        <h2 id={titleId} className="w-full px-1 pr-8 system-xl-semibold wrap-break-word text-text-primary">
+          {t('agentDetail.configure.publishImpact.title', {
+            action: publishActionLabel,
+            name: agentName || t('agentDetail.configure.publishImpact.fallbackAgentName'),
+          })}
+        </h2>
+        <p className="px-1 system-xs-regular wrap-break-word text-text-warning">
+          {t('agentDetail.configure.publishImpact.descriptionPrefix')}
+          {' '}
+          <span className="system-xs-medium">
+            {t('agentDetail.configure.publishImpact.workflowCount', { count: references.length })}
+          </span>
+          {t('agentDetail.configure.publishImpact.descriptionSuffix')}
+        </p>
+      </div>
+
+      <div className="flex w-full flex-col gap-1 px-4 py-2">
+        <div className="flex min-h-6 items-center system-sm-medium text-text-secondary">
+          {t('agentDetail.configure.publishImpact.affectedWorkflows')}
+        </div>
+        <div className="flex max-h-[123px] flex-col gap-px overflow-y-auto rounded-xl border border-components-panel-border p-1">
+          {references.map(reference => (
+            <ReferenceLink key={`${reference.app_id}-${reference.workflow_id}`} reference={reference} />
+          ))}
+        </div>
+      </div>
+    </section>
+  )
+}
+
+function ReferenceLink({
+  reference,
+}: {
+  reference: AgentReferencingWorkflowResponse
+}) {
+  const { formatTimeFromNow } = useFormatTimeFromNow()
+  const imageUrl = (reference.app_icon_type === 'image' || reference.app_icon_type === 'link') ? reference.app_icon : undefined
+  const iconType = (imageUrl ? 'image' : reference.app_icon_type) as AgentIconType | null | undefined
+  const updatedAt = reference.app_updated_at == null
+    ? null
+    : formatTimeFromNow(reference.app_updated_at * 1000)
+
+  return (
+    <Link
+      href={getWorkflowReferenceHref(reference)}
+      target="_blank"
+      rel="noopener noreferrer"
+      className="flex min-w-0 items-center gap-2 rounded-lg py-1 pr-2.5 pl-2 system-sm-regular text-text-secondary hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+    >
+      <span aria-hidden className="shrink-0">
+        <AppIcon
+          size="tiny"
+          iconType={iconType}
+          icon={reference.app_icon ?? undefined}
+          background={reference.app_icon_background}
+          imageUrl={imageUrl}
+        />
+      </span>
+      <span className="min-w-0 flex-1 truncate">{reference.app_name}</span>
+      {updatedAt && (
+        <span className="shrink-0 system-xs-regular text-text-tertiary">{updatedAt}</span>
+      )}
+      <span aria-hidden className="i-ri-external-link-line size-3 shrink-0 text-text-tertiary" />
+    </Link>
+  )
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/publish-bar/publish-impact-popover.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/publish-bar/publish-impact-popover.tsx
deleted file mode 100644
index b4fa0896adf..00000000000
--- a/web/features/agent-v2/agent-detail/configure/components/orchestrate/publish-bar/publish-impact-popover.tsx
+++ /dev/null
@@ -1,203 +0,0 @@
-'use client'
-
-import type { AgentIconType, AgentReferencingWorkflowResponse } from '@dify/contracts/api/console/agent/types.gen'
-import type { RegisterableHotkey } from '@tanstack/react-hotkeys'
-import type { MouseEvent, ReactElement, ReactNode } from 'react'
-import { Button } from '@langgenius/dify-ui/button'
-import { Popover, PopoverContent, PopoverTrigger } from '@langgenius/dify-ui/popover'
-import { useHotkey } from '@tanstack/react-hotkeys'
-import { useQuery } from '@tanstack/react-query'
-import { cloneElement, useState } from 'react'
-import { useTranslation } from 'react-i18next'
-import AppIcon from '@/app/components/base/app-icon'
-import Link from '@/next/link'
-import { consoleQuery } from '@/service/client'
-
-type AgentPublishImpactPopoverProps = {
-  actionLabel: string
-  actionShortcut?: ReactNode
-  hotkey: RegisterableHotkey
-  agentId: string
-  agentName?: string | null
-  disabled?: boolean
-  trigger: ReactElement<{
-    onClick?: (event: MouseEvent<HTMLElement>) => void
-  }>
-  onOpenChange?: (open: boolean) => void
-  onPublish: () => void
-}
-
-const getWorkflowReferenceHref = (reference: AgentReferencingWorkflowResponse) => `/app/${reference.app_id}/workflow`
-
-export function AgentPublishImpactPopover({
-  actionLabel,
-  actionShortcut,
-  hotkey,
-  agentId,
-  agentName,
-  disabled = false,
-  trigger,
-  onOpenChange,
-  onPublish,
-}: AgentPublishImpactPopoverProps) {
-  const { t } = useTranslation('agentV2')
-  const [open, setOpen] = useState(false)
-  const [isCheckingReferences, setIsCheckingReferences] = useState(false)
-  const workflowReferencesQuery = useQuery({
-    ...consoleQuery.agent.byAgentId.referencingWorkflows.get.queryOptions({
-      input: {
-        params: {
-          agent_id: agentId,
-        },
-      },
-    }),
-    enabled: false,
-  })
-  const publishedReferences = workflowReferencesQuery.data?.data ?? []
-
-  const updateOpen = (nextOpen: boolean) => {
-    setOpen(nextOpen)
-    onOpenChange?.(nextOpen)
-  }
-
-  const handlePublish = () => {
-    updateOpen(false)
-    onPublish()
-  }
-
-  const handlePublishRequest = async () => {
-    if (disabled || isCheckingReferences)
-      return
-
-    if (open) {
-      handlePublish()
-      return
-    }
-
-    setIsCheckingReferences(true)
-    try {
-      const result = await workflowReferencesQuery.refetch()
-      const references = result.data?.data ?? []
-      if (references.length > 0) {
-        updateOpen(true)
-        return
-      }
-
-      onPublish()
-    }
-    finally {
-      setIsCheckingReferences(false)
-    }
-  }
-
-  useHotkey(hotkey, (event) => {
-    event.preventDefault()
-    void handlePublishRequest()
-  }, {
-    enabled: !disabled,
-    ignoreInputs: false,
-  })
-
-  if (disabled)
-    return trigger
-
-  const triggerWithImpact = cloneElement(trigger, {
-    onClick: async (event: MouseEvent<HTMLElement>) => {
-      event.preventDefault()
-      await handlePublishRequest()
-    },
-  })
-
-  return (
-    <Popover open={open} onOpenChange={updateOpen}>
-      <PopoverTrigger
-        render={triggerWithImpact}
-      />
-      <PopoverContent
-        placement="top-end"
-        sideOffset={-32}
-        popupClassName="w-96 overflow-hidden rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-bg-blur p-0 shadow-lg shadow-shadow-shadow-5 backdrop-blur-[5px] transition-[transform,scale,opacity] duration-150 ease-out data-starting-style:translate-y-5 data-ending-style:translate-y-5 motion-reduce:transition-none motion-reduce:data-starting-style:translate-y-0 motion-reduce:data-ending-style:translate-y-0"
-      >
-        <div className="flex flex-col gap-0">
-          <div className="flex flex-col gap-0.5 px-3 pt-3.5 pb-1">
-            <h2 className="px-1 system-xl-semibold text-text-primary">
-              {t('agentDetail.configure.publishImpact.title', {
-                action: actionLabel,
-                name: agentName || t('agentDetail.configure.publishImpact.fallbackAgentName'),
-              })}
-            </h2>
-            <p className="px-1 system-xs-regular text-text-warning">
-              {t('agentDetail.configure.publishImpact.descriptionPrefix')}
-              {' '}
-              <span className="system-xs-medium">
-                {t('agentDetail.configure.publishImpact.workflowCount', { count: publishedReferences.length })}
-              </span>
-              {t('agentDetail.configure.publishImpact.descriptionSuffix')}
-            </p>
-          </div>
-
-          <div className="flex w-full flex-col gap-1 px-4 py-2">
-            <div className="flex min-h-6 items-center system-sm-medium text-text-secondary">
-              {t('agentDetail.configure.publishImpact.affectedWorkflows')}
-            </div>
-            <div className="flex max-h-44 flex-col gap-px overflow-y-auto rounded-xl border border-components-panel-border p-1">
-              {publishedReferences.map(reference => (
-                <ReferenceLink key={`${reference.app_id}-${reference.workflow_id}`} reference={reference} />
-              ))}
-            </div>
-          </div>
-
-          <div className="flex justify-end gap-2 px-4 pt-2 pb-4">
-            <Button
-              type="button"
-              variant="secondary"
-              className="h-8 min-w-18 rounded-lg px-3"
-              onClick={() => updateOpen(false)}
-            >
-              {t('agentDetail.configure.publishImpact.cancel')}
-            </Button>
-            <Button
-              type="button"
-              variant="primary"
-              className="h-8 min-w-18 gap-1 rounded-lg px-3"
-              onClick={handlePublish}
-            >
-              <span className="shrink-0">{actionLabel}</span>
-              {actionShortcut}
-            </Button>
-          </div>
-        </div>
-      </PopoverContent>
-    </Popover>
-  )
-}
-
-function ReferenceLink({
-  reference,
-}: {
-  reference: AgentReferencingWorkflowResponse
-}) {
-  const imageUrl = (reference.app_icon_type === 'image' || reference.app_icon_type === 'link') ? reference.app_icon : undefined
-  const iconType = (imageUrl ? 'image' : reference.app_icon_type) as AgentIconType | null | undefined
-
-  return (
-    <Link
-      href={getWorkflowReferenceHref(reference)}
-      target="_blank"
-      rel="noopener noreferrer"
-      className="flex min-w-0 items-center gap-2 rounded-lg py-1 pr-2.5 pl-2 system-sm-regular text-text-secondary hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
-    >
-      <span aria-hidden className="shrink-0">
-        <AppIcon
-          size="tiny"
-          iconType={iconType}
-          icon={reference.app_icon ?? undefined}
-          background={reference.app_icon_background}
-          imageUrl={imageUrl}
-        />
-      </span>
-      <span className="min-w-0 flex-1 truncate">{reference.app_name}</span>
-      <span aria-hidden className="i-ri-external-link-line size-3 shrink-0 text-text-tertiary" />
-    </Link>
-  )
-}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/__tests__/index.spec.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/__tests__/index.spec.tsx
index c54d4c86d0f..7b08b75080e 100644
--- a/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/__tests__/index.spec.tsx
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/__tests__/index.spec.tsx
@@ -6,13 +6,17 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { defaultAgentSoulConfigFormState } from '@/features/agent-v2/agent-composer/form-state'
 import { AgentComposerProvider } from '@/features/agent-v2/agent-composer/provider'
 import { useAgentComposerConfigSnapshot } from '@/features/agent-v2/agent-composer/store'
+import { AgentDriveApiContextProvider } from '../../drive-context'
 import { AgentOrchestrateReadOnlyContext } from '../../read-only-context'
 import { AgentSkills } from '../index'
 
 const mocks = vi.hoisted(() => ({
+  driveSkillsQueryOptions: vi.fn(),
+  driveSkillInspectQueryOptions: vi.fn(),
   driveFilesQueryOptions: vi.fn(),
   driveFileDownloadQueryOptions: vi.fn(),
   driveFilePreviewQueryOptions: vi.fn(),
+  deleteSkillMutationOptions: vi.fn(),
   uploadSkillMutationOptions: vi.fn(),
 }))
 
@@ -28,6 +32,18 @@ vi.mock('@/service/client', () => ({
     agent: {
       byAgentId: {
         drive: {
+          skills: {
+            get: {
+              queryOptions: mocks.driveSkillsQueryOptions,
+            },
+            bySkillPath: {
+              inspect: {
+                get: {
+                  queryOptions: mocks.driveSkillInspectQueryOptions,
+                },
+              },
+            },
+          },
           files: {
             get: {
               queryOptions: mocks.driveFilesQueryOptions,
@@ -45,6 +61,11 @@ vi.mock('@/service/client', () => ({
           },
         },
         skills: {
+          bySlug: {
+            delete: {
+              mutationOptions: mocks.deleteSkillMutationOptions,
+            },
+          },
           upload: {
             post: {
               mutationOptions: mocks.uploadSkillMutationOptions,
@@ -53,26 +74,58 @@ vi.mock('@/service/client', () => ({
         },
       },
     },
+    apps: {
+      byAppId: {
+        agent: {
+          drive: {
+            skills: {
+              get: {
+                queryOptions: mocks.driveSkillsQueryOptions,
+              },
+              bySkillPath: {
+                inspect: {
+                  get: {
+                    queryOptions: mocks.driveSkillInspectQueryOptions,
+                  },
+                },
+              },
+            },
+            files: {
+              get: {
+                queryOptions: mocks.driveFilesQueryOptions,
+              },
+              download: {
+                get: {
+                  queryOptions: mocks.driveFileDownloadQueryOptions,
+                },
+              },
+              preview: {
+                get: {
+                  queryOptions: mocks.driveFilePreviewQueryOptions,
+                },
+              },
+            },
+          },
+          skills: {
+            bySlug: {
+              delete: {
+                mutationOptions: mocks.deleteSkillMutationOptions,
+              },
+            },
+            upload: {
+              post: {
+                mutationOptions: mocks.uploadSkillMutationOptions,
+              },
+            },
+          },
+        },
+      },
+    },
   },
 }))
 
 const agentSkillsDraft = {
   ...defaultAgentSoulConfigFormState,
-  skills: [
-    {
-      id: 'tender-analyzer',
-      name: 'Tender Analyzer',
-      description: 'Extracts tender requirements and scoring criteria.',
-      files: ['__MACOSX/._hatch-pet', 'SKILL.md', 'schema.json'],
-      path: 'tender-analyzer',
-      skillMdKey: 'tender-analyzer/SKILL.md',
-    },
-    {
-      id: 'meeting-brief',
-      name: 'Meeting Brief',
-      path: 'meeting-brief',
-    },
-  ],
 } satisfies typeof defaultAgentSoulConfigFormState
 
 function renderAgentSkills() {
@@ -86,9 +139,31 @@ function renderAgentSkills() {
 
   return render(
     <QueryClientProvider client={queryClient}>
-      <AgentComposerProvider initialDraft={agentSkillsDraft}>
-        <AgentSkills agentId="agent-1" />
-      </AgentComposerProvider>
+      <AgentDriveApiContextProvider value={{ agentId: 'agent-1' }}>
+        <AgentComposerProvider initialDraft={agentSkillsDraft}>
+          <AgentSkills />
+        </AgentComposerProvider>
+      </AgentDriveApiContextProvider>
+    </QueryClientProvider>,
+  )
+}
+
+function renderWorkflowAgentSkills() {
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: {
+        retry: false,
+      },
+    },
+  })
+
+  return render(
+    <QueryClientProvider client={queryClient}>
+      <AgentDriveApiContextProvider value={{ agentId: 'agent-1', workflow: { appId: 'app-1', nodeId: 'node-1' } }}>
+        <AgentComposerProvider initialDraft={agentSkillsDraft}>
+          <AgentSkills />
+        </AgentComposerProvider>
+      </AgentDriveApiContextProvider>
     </QueryClientProvider>,
   )
 }
@@ -104,11 +179,13 @@ function renderReadonlyAgentSkills() {
 
   return render(
     <QueryClientProvider client={queryClient}>
-      <AgentComposerProvider initialDraft={agentSkillsDraft}>
-        <AgentOrchestrateReadOnlyContext value>
-          <AgentSkills agentId="agent-1" />
-        </AgentOrchestrateReadOnlyContext>
-      </AgentComposerProvider>
+      <AgentDriveApiContextProvider value={{ agentId: 'agent-1' }}>
+        <AgentComposerProvider initialDraft={agentSkillsDraft}>
+          <AgentOrchestrateReadOnlyContext value>
+            <AgentSkills />
+          </AgentOrchestrateReadOnlyContext>
+        </AgentComposerProvider>
+      </AgentDriveApiContextProvider>
     </QueryClientProvider>,
   )
 }
@@ -118,7 +195,7 @@ function ConfigSnapshotProbe() {
 
   return (
     <pre data-testid="config-snapshot-probe">
-      {JSON.stringify(configSnapshot.skills_files?.skills ?? [])}
+      {JSON.stringify(configSnapshot)}
     </pre>
   )
 }
@@ -126,6 +203,76 @@ function ConfigSnapshotProbe() {
 describe('AgentSkills', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    const skillItems = [
+      {
+        archive_key: 'tender-analyzer/.DIFY-SKILL-FULL.zip',
+        description: 'Extracts tender requirements and scoring criteria.',
+        name: 'Tender Analyzer',
+        path: 'tender-analyzer',
+        skill_md_key: 'tender-analyzer/SKILL.md',
+      },
+      {
+        description: '',
+        name: 'Meeting Brief',
+        path: 'meeting-brief',
+        skill_md_key: 'meeting-brief/SKILL.md',
+      },
+    ]
+    mocks.driveSkillsQueryOptions.mockImplementation(({ input }) => ({
+      queryKey: ['agent-drive-skills', input],
+      initialData: { items: skillItems },
+      queryFn: async () => ({
+        items: skillItems,
+      }),
+    }))
+    mocks.driveSkillInspectQueryOptions.mockImplementation(({ input }) => ({
+      queryKey: ['agent-drive-skill-inspect', input],
+      queryFn: async () => ({
+        archive_key: 'tender-analyzer/.DIFY-SKILL-FULL.zip',
+        description: 'Extracts tender requirements and scoring criteria.',
+        files: [
+          {
+            available_in_drive: true,
+            drive_key: 'tender-analyzer/SKILL.md',
+            name: 'SKILL.md',
+            path: 'SKILL.md',
+            type: 'file',
+          },
+          {
+            available_in_drive: true,
+            drive_key: 'tender-analyzer/references/guide.md',
+            name: 'guide.md',
+            path: 'references/guide.md',
+            type: 'file',
+          },
+          {
+            available_in_drive: true,
+            drive_key: 'tender-analyzer/scripts/extract.py',
+            name: 'extract.py',
+            path: 'scripts/extract.py',
+            type: 'file',
+          },
+          {
+            available_in_drive: true,
+            drive_key: 'tender-analyzer/.DIFY-SKILL-FULL.zip',
+            name: '.DIFY-SKILL-FULL.zip',
+            path: '.DIFY-SKILL-FULL.zip',
+            type: 'file',
+          },
+        ],
+        name: 'Tender Analyzer',
+        path: 'tender-analyzer',
+        skill_md: {
+          binary: false,
+          key: 'tender-analyzer/SKILL.md',
+          text: 'Skill markdown content',
+          truncated: false,
+        },
+        skill_md_key: 'tender-analyzer/SKILL.md',
+        source: 'drive',
+        warnings: [],
+      }),
+    }))
     mocks.driveFilesQueryOptions.mockImplementation(({ input }) => ({
       queryKey: ['agent-drive-files', input],
       queryFn: async () => ({
@@ -157,9 +304,12 @@ describe('AgentSkills', () => {
       mutationFn: vi.fn(),
       mutationKey: ['upload-skill'],
     })
+    mocks.deleteSkillMutationOptions.mockReturnValue({
+      mutationFn: vi.fn(),
+      mutationKey: ['delete-skill'],
+    })
   })
 
-  // Skill rows load their preview from the agent drive and render the shared detail dialog.
   it('should fetch drive files and open the skill detail dialog when the skill row is clicked', async () => {
     renderAgentSkills()
 
@@ -170,81 +320,281 @@ describe('AgentSkills', () => {
     const dialog = screen.getByRole('dialog')
 
     expect(dialog).toBeInTheDocument()
-    expect(mocks.driveFilesQueryOptions).toHaveBeenCalledWith({
-      input: {
-        params: {
-          agent_id: 'agent-1',
+    await waitFor(() => {
+      expect(mocks.driveSkillInspectQueryOptions).toHaveBeenCalledWith({
+        input: {
+          params: {
+            agent_id: 'agent-1',
+            skill_path: 'tender-analyzer',
+          },
         },
-        query: {
-          prefix: 'tender-analyzer/',
-        },
-      },
+      })
     })
+    expect(mocks.driveFilesQueryOptions).not.toHaveBeenCalled()
     expect(within(dialog).getByText('Tender Analyzer')).toBeInTheDocument()
     expect(within(dialog).getByText('Extracts tender requirements and scoring criteria.')).toBeInTheDocument()
-    expect(within(dialog).queryByText('__MACOSX/._hatch-pet')).not.toBeInTheDocument()
-    expect(await within(dialog).findByText('scripts/extract.py')).toBeInTheDocument()
-    expect(within(dialog).getByText('SKILL.md')).toBeInTheDocument()
-    expect(await within(dialog).findByText('Preview content for tender-analyzer/SKILL.md')).toBeInTheDocument()
-    expect(mocks.driveFilePreviewQueryOptions).toHaveBeenCalledWith({
-      input: {
-        params: {
-          agent_id: 'agent-1',
-        },
-        query: {
-          key: 'tender-analyzer/SKILL.md',
-        },
-      },
-    })
-    expect(mocks.driveFilePreviewQueryOptions).not.toHaveBeenCalledWith({
-      input: {
-        params: {
-          agent_id: 'agent-1',
-        },
-        query: {
-          key: 'tender-analyzer/__MACOSX/._hatch-pet',
-        },
-      },
-    })
+    expect(await within(dialog).findByText('references')).toBeInTheDocument()
+    expect(within(dialog).getByText('guide.md')).toBeInTheDocument()
+    expect(within(dialog).getByText('scripts')).toBeInTheDocument()
+    expect(within(dialog).getByText('extract.py')).toBeInTheDocument()
+    expect(within(dialog).queryByText('.DIFY-SKILL-FULL.zip')).not.toBeInTheDocument()
   })
 
-  it('should preview the selected skill file from the detail file tree', async () => {
+  it('should keep the detail dialog open after selecting a skill', async () => {
     renderAgentSkills()
 
     fireEvent.click(screen.getByRole('button', {
       name: 'Tender Analyzer',
     }))
 
-    const dialog = screen.getByRole('dialog')
-    const scriptFile = await within(dialog).findByRole('button', { name: 'scripts/extract.py' })
-    fireEvent.click(scriptFile)
+    expect(screen.getByRole('dialog')).toBeInTheDocument()
+  })
 
-    expect(await within(dialog).findByText('Preview content for tender-analyzer/scripts/extract.py')).toBeInTheDocument()
+  it('should preview selected package file content in the skill detail dialog', async () => {
+    const user = userEvent.setup()
+    renderAgentSkills()
+
+    await user.click(screen.getByRole('button', {
+      name: 'Tender Analyzer',
+    }))
+
+    const dialog = screen.getByRole('dialog')
+    await user.click(await within(dialog).findByText('guide.md'))
+
+    expect(await within(dialog).findByText('Preview content for tender-analyzer/references/guide.md')).toBeInTheDocument()
     expect(mocks.driveFilePreviewQueryOptions).toHaveBeenCalledWith({
       input: {
         params: {
           agent_id: 'agent-1',
         },
         query: {
-          key: 'tender-analyzer/scripts/extract.py',
+          key: 'tender-analyzer/references/guide.md',
         },
       },
     })
   })
 
-  // The hover/focus remove action updates the composer draft without opening preview.
-  it('should remove the skill without opening the detail dialog when the remove action is clicked', () => {
+  it('should not request preview for package files without a drive entry', async () => {
+    const user = userEvent.setup()
+    mocks.driveSkillInspectQueryOptions.mockImplementation(({ input }) => ({
+      queryKey: ['agent-drive-skill-inspect', input],
+      queryFn: async () => ({
+        archive_key: 'tender-analyzer/.DIFY-SKILL-FULL.zip',
+        description: 'Extracts tender requirements and scoring criteria.',
+        files: [
+          {
+            available_in_drive: true,
+            drive_key: 'tender-analyzer/SKILL.md',
+            name: 'SKILL.md',
+            path: 'SKILL.md',
+            type: 'file',
+          },
+          {
+            available_in_drive: false,
+            drive_key: null,
+            name: 'animation-rows.md',
+            path: 'references/animation-rows.md',
+            type: 'file',
+          },
+        ],
+        name: 'Tender Analyzer',
+        path: 'tender-analyzer',
+        skill_md: {
+          binary: false,
+          key: 'tender-analyzer/SKILL.md',
+          text: 'Skill markdown content',
+          truncated: false,
+        },
+        skill_md_key: 'tender-analyzer/SKILL.md',
+        source: 'drive',
+        warnings: [],
+      }),
+    }))
+
+    renderAgentSkills()
+
+    await user.click(screen.getByRole('button', {
+      name: 'Tender Analyzer',
+    }))
+
+    const dialog = screen.getByRole('dialog')
+    await user.click(await within(dialog).findByText('animation-rows.md'))
+
+    expect(mocks.driveFilePreviewQueryOptions).not.toHaveBeenCalledWith({
+      input: {
+        params: {
+          agent_id: 'agent-1',
+        },
+        query: {
+          key: 'tender-analyzer/references/animation-rows.md',
+        },
+      },
+    })
+    expect(within(dialog).getByText('agentV2.agentDetail.configure.files.preview.empty')).toBeInTheDocument()
+  })
+
+  it('should deduplicate package files by path in the skill detail dialog', async () => {
+    const user = userEvent.setup()
+    mocks.driveSkillInspectQueryOptions.mockImplementation(({ input }) => ({
+      queryKey: ['agent-drive-skill-inspect', input],
+      queryFn: async () => ({
+        archive_key: 'tender-analyzer/.DIFY-SKILL-FULL.zip',
+        description: 'Extracts tender requirements and scoring criteria.',
+        files: [
+          {
+            available_in_drive: true,
+            drive_key: 'tender-analyzer/SKILL.md',
+            name: 'SKILL.md',
+            path: 'SKILL.md',
+            type: 'file',
+          },
+          {
+            available_in_drive: false,
+            drive_key: null,
+            name: 'SKILL.md',
+            path: 'tender-analyzer/SKILL.md',
+            type: 'file',
+          },
+          {
+            available_in_drive: true,
+            drive_key: 'tender-analyzer/scripts/extract.py',
+            name: 'extract.py',
+            path: 'scripts/extract.py',
+            type: 'file',
+          },
+        ],
+        name: 'Tender Analyzer',
+        path: 'tender-analyzer',
+        skill_md: {
+          binary: false,
+          key: 'tender-analyzer/SKILL.md',
+          text: 'Skill markdown content',
+          truncated: false,
+        },
+        skill_md_key: 'tender-analyzer/SKILL.md',
+        source: 'drive',
+        warnings: [],
+      }),
+    }))
+
+    renderAgentSkills()
+
+    await user.click(screen.getByRole('button', {
+      name: 'Tender Analyzer',
+    }))
+
+    const dialog = screen.getByRole('dialog')
+
+    expect(await within(dialog).findByText('SKILL.md')).toBeInTheDocument()
+    expect(within(dialog).getAllByText('SKILL.md')).toHaveLength(1)
+    expect(within(dialog).getByText('agentV2.agentDetail.configure.skills.detail.fileCount:{"count":2}')).toBeInTheDocument()
+  })
+
+  it('should use workflow node drive routes for skill list and preview in inline workflow mode', async () => {
+    renderWorkflowAgentSkills()
+
+    expect(mocks.driveSkillsQueryOptions).toHaveBeenCalledWith({
+      input: {
+        params: {
+          app_id: 'app-1',
+        },
+        query: {
+          node_id: 'node-1',
+        },
+      },
+    })
+
+    fireEvent.click(screen.getByRole('button', {
+      name: 'Tender Analyzer',
+    }))
+
+    await waitFor(() => {
+      expect(mocks.driveSkillInspectQueryOptions).toHaveBeenCalledWith({
+        input: {
+          params: {
+            app_id: 'app-1',
+            skill_path: 'tender-analyzer',
+          },
+          query: {
+            node_id: 'node-1',
+          },
+        },
+      })
+    })
+    fireEvent.click(await screen.findByText('guide.md'))
+
+    await waitFor(() => {
+      expect(mocks.driveFilePreviewQueryOptions).toHaveBeenCalledWith({
+        input: {
+          params: {
+            app_id: 'app-1',
+          },
+          query: {
+            node_id: 'node-1',
+            key: 'tender-analyzer/references/guide.md',
+          },
+        },
+      })
+    })
+  })
+
+  it('should delete the skill without opening the detail dialog when the remove action is clicked', () => {
     renderAgentSkills()
 
     fireEvent.click(screen.getByRole('button', {
       name: /agentV2\.agentDetail\.configure\.skills\.remove.*Tender Analyzer/,
     }))
 
-    expect(screen.queryByText('Tender Analyzer')).not.toBeInTheDocument()
-    expect(screen.getByText('Meeting Brief')).toBeInTheDocument()
     expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
   })
 
+  it('should route Agent App skill delete through agent and slug identifiers', async () => {
+    const deleteSkill = vi.fn().mockResolvedValue({ result: 'success', removed_keys: ['tender-analyzer/SKILL.md'] })
+    mocks.deleteSkillMutationOptions.mockReturnValue({
+      mutationFn: deleteSkill,
+      mutationKey: ['delete-skill'],
+    })
+    renderAgentSkills()
+
+    fireEvent.click(screen.getByRole('button', {
+      name: /agentV2\.agentDetail\.configure\.skills\.remove.*Tender Analyzer/,
+    }))
+
+    await waitFor(() => {
+      expect(deleteSkill.mock.calls[0]?.[0]).toEqual({
+        params: {
+          agent_id: 'agent-1',
+          slug: 'tender-analyzer',
+        },
+      })
+    })
+  })
+
+  it('should route workflow skill delete through app and node identifiers', async () => {
+    const deleteSkill = vi.fn().mockResolvedValue({ result: 'success', removed_keys: ['tender-analyzer/SKILL.md'] })
+    mocks.deleteSkillMutationOptions.mockReturnValue({
+      mutationFn: deleteSkill,
+      mutationKey: ['delete-skill'],
+    })
+    renderWorkflowAgentSkills()
+
+    fireEvent.click(screen.getByRole('button', {
+      name: /agentV2\.agentDetail\.configure\.skills\.remove.*Tender Analyzer/,
+    }))
+
+    await waitFor(() => {
+      expect(deleteSkill.mock.calls[0]?.[0]).toEqual({
+        params: {
+          app_id: 'app-1',
+          slug: 'tender-analyzer',
+        },
+        query: {
+          node_id: 'node-1',
+        },
+      })
+    })
+  })
+
   it('should hide add and remove actions when readonly', () => {
     renderReadonlyAgentSkills()
 
@@ -255,21 +605,49 @@ describe('AgentSkills', () => {
     })).not.toBeInTheDocument()
   })
 
-  // Upload uses the drive-backed response so the added skill can be reloaded from agent drive paths.
-  it('should add an uploaded skill with drive-backed keys when the upload succeeds', async () => {
+  it('should upload a skill through the drive-backed endpoint', async () => {
     const user = userEvent.setup()
-    const uploadSkill = vi.fn().mockResolvedValue({
-      manifest: {
-        files: ['SKILL.md', 'scripts/run.py'],
-        name: 'Invoice Helper',
+    const driveSkills = [
+      {
+        archive_key: 'tender-analyzer/.DIFY-SKILL-FULL.zip',
+        description: 'Extracts tender requirements and scoring criteria.',
+        name: 'Tender Analyzer',
+        path: 'tender-analyzer',
+        skill_md_key: 'tender-analyzer/SKILL.md',
       },
-      skill: {
-        id: 'skill-hash',
-        manifest_files: ['SKILL.md', 'scripts/run.py'],
+      {
+        description: '',
+        name: 'Meeting Brief',
+        path: 'meeting-brief',
+        skill_md_key: 'meeting-brief/SKILL.md',
+      },
+    ]
+    mocks.driveSkillsQueryOptions.mockImplementation(({ input }) => ({
+      queryKey: ['agent-drive-skills', input],
+      initialData: { items: [...driveSkills] },
+      queryFn: async () => ({ items: [...driveSkills] }),
+    }))
+    const uploadSkill = vi.fn().mockImplementation(async () => {
+      driveSkills.push({
+        archive_key: 'invoice-helper/.DIFY-SKILL-FULL.zip',
+        description: '',
         name: 'Invoice Helper',
         path: 'invoice-helper',
         skill_md_key: 'invoice-helper/SKILL.md',
-      },
+      })
+      return {
+        manifest: {
+          files: ['SKILL.md', 'scripts/run.py'],
+          name: 'Invoice Helper',
+        },
+        skill: {
+          manifest_files: ['SKILL.md', 'scripts/run.py'],
+          name: 'Invoice Helper',
+          path: 'invoice-helper',
+          skill_md_key: 'invoice-helper/SKILL.md',
+          archive_key: 'invoice-helper/.DIFY-SKILL-FULL.zip',
+        },
+      }
     })
     mocks.uploadSkillMutationOptions.mockReturnValue({
       mutationFn: uploadSkill,
@@ -296,24 +674,94 @@ describe('AgentSkills', () => {
       })
     })
     expect(await screen.findByRole('button', { name: 'Invoice Helper' })).toBeInTheDocument()
-
-    await user.click(screen.getByRole('button', { name: 'Invoice Helper' }))
-
-    expect(mocks.driveFilesQueryOptions).toHaveBeenCalledWith({
-      input: {
-        params: {
-          agent_id: 'agent-1',
-        },
-        query: {
-          prefix: 'invoice-helper/',
-        },
-      },
-    })
     expect(vi.mocked(toast.success)).toHaveBeenCalledWith('agentV2.agentDetail.configure.skills.upload.success')
   })
 
-  // Uploaded drive-backed refs must survive insertion into draft and serialization back to config.
-  it('should preserve archive and skill file ids from the upload response in the serialized draft', async () => {
+  it('should refresh the rendered skill list after delete succeeds', async () => {
+    const driveSkills = [
+      {
+        archive_key: 'tender-analyzer/.DIFY-SKILL-FULL.zip',
+        description: 'Extracts tender requirements and scoring criteria.',
+        name: 'Tender Analyzer',
+        path: 'tender-analyzer',
+        skill_md_key: 'tender-analyzer/SKILL.md',
+      },
+      {
+        description: '',
+        name: 'Meeting Brief',
+        path: 'meeting-brief',
+        skill_md_key: 'meeting-brief/SKILL.md',
+      },
+    ]
+    mocks.driveSkillsQueryOptions.mockImplementation(({ input }) => ({
+      queryKey: ['agent-drive-skills', input],
+      initialData: { items: [...driveSkills] },
+      queryFn: async () => ({ items: [...driveSkills] }),
+    }))
+    const deleteSkill = vi.fn().mockImplementation(async () => {
+      driveSkills.splice(0, 1)
+      return { result: 'success', removed_keys: ['tender-analyzer/SKILL.md'] }
+    })
+    mocks.deleteSkillMutationOptions.mockReturnValue({
+      mutationFn: deleteSkill,
+      mutationKey: ['delete-skill'],
+    })
+
+    renderAgentSkills()
+
+    fireEvent.click(screen.getByRole('button', {
+      name: /agentV2\.agentDetail\.configure\.skills\.remove.*Tender Analyzer/,
+    }))
+
+    await waitFor(() => {
+      expect(screen.queryByRole('button', { name: 'Tender Analyzer' })).not.toBeInTheDocument()
+    })
+    expect(screen.getByRole('button', { name: 'Meeting Brief' })).toBeInTheDocument()
+  })
+
+  it('should route workflow skill uploads through app and node identifiers', async () => {
+    const user = userEvent.setup()
+    const uploadSkill = vi.fn().mockResolvedValue({
+      manifest: {
+        files: ['SKILL.md'],
+        name: 'Invoice Helper',
+      },
+      skill: {
+        name: 'Invoice Helper',
+        path: 'invoice-helper',
+        skill_md_key: 'invoice-helper/SKILL.md',
+      },
+    })
+    mocks.uploadSkillMutationOptions.mockReturnValue({
+      mutationFn: uploadSkill,
+      mutationKey: ['upload-skill'],
+    })
+
+    renderWorkflowAgentSkills()
+
+    await user.click(screen.getByRole('button', { name: 'agentV2.agentDetail.configure.skills.add' }))
+
+    const fileInput = document.querySelector('input[type="file"]') as HTMLInputElement
+    const file = new File(['skill'], 'invoice-helper.skill', { type: 'application/zip' })
+    await user.upload(fileInput, file)
+    await user.click(screen.getByRole('button', { name: 'agentV2.agentDetail.configure.skills.upload.action' }))
+
+    await waitFor(() => {
+      expect(uploadSkill.mock.calls[0]?.[0]).toEqual({
+        params: {
+          app_id: 'app-1',
+        },
+        query: {
+          node_id: 'node-1',
+        },
+        body: {
+          file,
+        },
+      })
+    })
+  })
+
+  it('should not persist skills_files when the draft is serialized', async () => {
     const user = userEvent.setup()
     const uploadSkill = vi.fn().mockResolvedValue({
       manifest: {
@@ -321,14 +769,9 @@ describe('AgentSkills', () => {
         name: 'Invoice Helper',
       },
       skill: {
-        file_id: 'archive-upload-file-id',
-        full_archive_file_id: 'archive-tool-file-id',
-        full_archive_key: 'invoice-helper/.DIFY-SKILL-FULL.zip',
-        id: 'skill-hash',
-        manifest_files: ['SKILL.md', 'scripts/run.py'],
+        archive_key: 'invoice-helper/.DIFY-SKILL-FULL.zip',
         name: 'Invoice Helper',
         path: 'invoice-helper',
-        skill_md_file_id: 'skill-md-tool-file-id',
         skill_md_key: 'invoice-helper/SKILL.md',
       },
     })
@@ -347,10 +790,12 @@ describe('AgentSkills', () => {
 
     render(
       <QueryClientProvider client={queryClient}>
-        <AgentComposerProvider initialDraft={agentSkillsDraft}>
-          <AgentSkills agentId="agent-1" />
-          <ConfigSnapshotProbe />
-        </AgentComposerProvider>
+        <AgentDriveApiContextProvider value={{ agentId: 'agent-1' }}>
+          <AgentComposerProvider initialDraft={agentSkillsDraft}>
+            <AgentSkills />
+            <ConfigSnapshotProbe />
+          </AgentComposerProvider>
+        </AgentDriveApiContextProvider>
       </QueryClientProvider>,
     )
 
@@ -362,18 +807,8 @@ describe('AgentSkills', () => {
     await user.click(screen.getByRole('button', { name: 'agentV2.agentDetail.configure.skills.upload.action' }))
 
     await waitFor(() => {
-      const serializedSkills = JSON.parse(screen.getByTestId('config-snapshot-probe').textContent ?? '[]')
-      expect(serializedSkills).toEqual(expect.arrayContaining([
-        expect.objectContaining({
-          file_id: 'archive-upload-file-id',
-          full_archive_file_id: 'archive-tool-file-id',
-          full_archive_key: 'invoice-helper/.DIFY-SKILL-FULL.zip',
-          name: 'Invoice Helper',
-          path: 'invoice-helper',
-          skill_md_file_id: 'skill-md-tool-file-id',
-          skill_md_key: 'invoice-helper/SKILL.md',
-        }),
-      ]))
+      const serializedConfig = JSON.parse(screen.getByTestId('config-snapshot-probe').textContent ?? '{}')
+      expect(serializedConfig).not.toHaveProperty('skills_files')
     })
   })
 })
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/detail-dialog.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/detail-dialog.tsx
index c7fd8c3f6ff..409adff5d79 100644
--- a/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/detail-dialog.tsx
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/detail-dialog.tsx
@@ -200,7 +200,7 @@ function AgentFilePreviewContent({
   }
 
   return (
-    <pre className="m-0 font-mono text-xs leading-5 break-words whitespace-pre-wrap text-text-secondary">
+    <pre className="m-0 pb-4 font-mono text-xs leading-5 break-words whitespace-pre-wrap text-text-secondary">
       {content}
     </pre>
   )
@@ -217,7 +217,7 @@ export function AgentSkillDetailDialog({
   const fileCount = detail.fileCount ?? countAgentFileNodes(detail.files)
 
   return (
-    <DialogContent className="flex h-[min(720px,calc(100dvh-2rem))] max-h-none w-[min(960px,calc(100vw-2rem))] flex-col overflow-hidden rounded-2xl p-0">
+    <DialogContent backdropProps={{ forceRender: true }} backdropClassName="fixed" className="flex h-[min(720px,calc(100dvh-2rem))] max-h-none w-[min(960px,calc(100vw-2rem))] flex-col overflow-hidden rounded-2xl p-0">
       <DialogCloseButton className="top-5 right-5" />
       <div className="shrink-0 border-b-[0.5px] border-components-panel-border-subtle pt-6 pr-14 pb-3 pl-6">
         <DialogTitle className="title-xl-semi-bold text-text-primary">
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/index.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/index.tsx
index 5ecf687020a..0d4e49eda33 100644
--- a/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/index.tsx
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/index.tsx
@@ -2,47 +2,77 @@
 
 import type { AgentOrchestrateAddActionOptions } from '../add-actions-context'
 import type { AgentSkill } from '@/features/agent-v2/agent-composer/form-state'
-import { useAtom } from 'jotai'
+import { useMutation } from '@tanstack/react-query'
 import { useCallback, useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
-import { agentComposerSkillsAtom, useRemoveSkill } from '@/features/agent-v2/agent-composer/store-modules/skills'
+import { consoleQuery } from '@/service/client'
 import { useRegisterAgentOrchestrateAddAction } from '../add-actions-context'
 import { ConfigureSectionAddButton } from '../common/add-button'
 import { ConfigureSectionEmpty } from '../common/empty'
 import { ConfigureSection } from '../common/section'
+import { useAgentDriveApiContext, useAgentDriveSkills } from '../drive-context'
 import { AgentSkillItem } from './item'
 import { AgentSkillUploadDialog } from './upload-dialog'
 
-export function AgentSkills({
-  agentId,
-}: {
-  agentId: string
-}) {
+export function AgentSkills() {
   const { t } = useTranslation('agentV2')
-  const [skills, setSkills] = useAtom(agentComposerSkillsAtom)
-  const removeSkill = useRemoveSkill()
   const skillsTip = t('agentDetail.configure.skills.tip')
   const skillsListId = 'agent-configure-skills-list'
   const [isUploadOpen, setIsUploadOpen] = useState(false)
   const promptAddCallbackRef = useRef<AgentOrchestrateAddActionOptions['onAdded']>(undefined)
+  const apiContext = useAgentDriveApiContext()
+  const { query: skillsQuery, skills } = useAgentDriveSkills()
+  const { mutate: deleteAgentSkill } = useMutation(consoleQuery.agent.byAgentId.skills.bySlug.delete.mutationOptions())
+  const { mutate: deleteAppSkill } = useMutation(consoleQuery.apps.byAppId.agent.skills.bySlug.delete.mutationOptions())
+
   const handleOpenUpload = useCallback((options?: AgentOrchestrateAddActionOptions) => {
     promptAddCallbackRef.current = options?.onAdded
     setIsUploadOpen(true)
   }, [])
   useRegisterAgentOrchestrateAddAction('skills', handleOpenUpload)
+
   const handleUploaded = useCallback((skill: AgentSkill) => {
-    setSkills(skills.some(currentSkill => currentSkill.id === skill.id)
-      ? skills
-      : [...skills, skill])
+    void skillsQuery.refetch()
     promptAddCallbackRef.current?.(skill)
     promptAddCallbackRef.current = undefined
-  }, [setSkills, skills])
+  }, [skillsQuery])
+
   const handleUploadOpenChange = useCallback((open: boolean) => {
     if (!open)
       promptAddCallbackRef.current = undefined
     setIsUploadOpen(open)
   }, [])
 
+  const handleRemoveSkill = useCallback((skillId: string) => {
+    const skill = skills.find(item => item.id === skillId)
+    const skillSlug = skill?.path ?? skill?.skillMdKey?.split('/', 1)[0]
+    if (!skillSlug)
+      return
+
+    const onSuccess = () => {
+      void skillsQuery.refetch()
+    }
+    if (apiContext.workflow) {
+      deleteAppSkill({
+        params: {
+          app_id: apiContext.workflow.appId,
+          slug: skillSlug,
+        },
+        query: {
+          node_id: apiContext.workflow.nodeId,
+        },
+      }, { onSuccess })
+      return
+    }
+
+    deleteAgentSkill({
+      params: {
+        agent_id: apiContext.agentId,
+        slug: skillSlug,
+      },
+    }, { onSuccess })
+  }, [apiContext, deleteAgentSkill, deleteAppSkill, skills, skillsQuery])
+
   return (
     <>
       <ConfigureSection
@@ -68,11 +98,11 @@ export function AgentSkills({
               />
             )
           : skills.map(skill => (
-              <AgentSkillItem key={skill.id} agentId={agentId} skill={skill} onRemove={removeSkill} />
+              <AgentSkillItem key={skill.id} apiContext={apiContext} skill={skill} onRemove={handleRemoveSkill} />
             ))}
       </ConfigureSection>
       <AgentSkillUploadDialog
-        agentId={agentId}
+        apiContext={apiContext}
         open={isUploadOpen}
         onOpenChange={handleUploadOpenChange}
         onUploaded={handleUploaded}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/item.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/item.tsx
index d3160a470c6..c4126124793 100644
--- a/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/item.tsx
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/item.tsx
@@ -1,126 +1,39 @@
 'use client'
 
-import type { AgentDriveItemResponse } from '@dify/contracts/api/console/agent/types.gen'
-import type { AgentFileNode, AgentSkill } from '@/features/agent-v2/agent-composer/form-state'
+import type { AgentDriveApiContext } from '../drive-context'
+import type { AgentSkill } from '@/features/agent-v2/agent-composer/form-state'
 import {
   Dialog,
 } from '@langgenius/dify-ui/dialog'
-import { useQuery } from '@tanstack/react-query'
 import { useCallback, useState } from 'react'
 import { useTranslation } from 'react-i18next'
-import { consoleQuery } from '@/service/client'
-import { getDriveFileIconType } from '../files/file-icon'
 import { useAgentOrchestrateReadOnly } from '../read-only-context'
 import { AgentSkillDetailDialog } from './detail-dialog'
-
-const getSkillDrivePath = (skill: AgentSkill) => {
-  const skillMdKeySlug = skill.skillMdKey?.split('/', 1)[0]
-  return skill.path ?? skillMdKeySlug ?? skill.id
-}
-
-const getSkillFileName = (key: string, skillDrivePath: string) => key.startsWith(`${skillDrivePath}/`)
-  ? key.slice(skillDrivePath.length + 1)
-  : key
-
-const toSkillFileNode = (item: AgentDriveItemResponse, skillDrivePath: string) => ({
-  icon: getDriveFileIconType({
-    fileKind: item.file_kind,
-    fileName: getSkillFileName(item.key, skillDrivePath),
-    mimeType: item.mime_type,
-  }),
-  id: item.key,
-  name: getSkillFileName(item.key, skillDrivePath),
-})
-
-const getSkillMdFileId = (files: AgentFileNode[]): string | undefined => {
-  for (const file of files) {
-    if (file.icon !== 'folder' && file.name === 'SKILL.md')
-      return file.id
-
-    const childFileId = file.children ? getSkillMdFileId(file.children) : undefined
-    if (childFileId)
-      return childFileId
-  }
-}
-
-const getFirstSkillFileId = (files: AgentFileNode[]): string | undefined => {
-  for (const file of files) {
-    if (file.icon !== 'folder')
-      return file.id
-
-    const childFileId = file.children ? getFirstSkillFileId(file.children) : undefined
-    if (childFileId)
-      return childFileId
-  }
-}
+import { useAgentSkillDetail } from './use-skill-detail'
 
 export function AgentSkillItem({
-  agentId,
+  apiContext,
   skill,
   onRemove,
 }: {
-  agentId: string
+  apiContext: AgentDriveApiContext
   skill: AgentSkill
   onRemove: (skillId: string) => void
 }) {
   const { t } = useTranslation('agentV2')
   const readOnly = useAgentOrchestrateReadOnly()
   const [isPreviewOpen, setIsPreviewOpen] = useState(false)
-  const [selectedFileId, setSelectedFileId] = useState<string>()
   const handleRemove = useCallback(() => {
     onRemove(skill.id)
   }, [onRemove, skill.id])
   const handleOpenPreview = useCallback(() => {
-    setSelectedFileId(undefined)
     setIsPreviewOpen(true)
   }, [])
-  const skillDrivePath = getSkillDrivePath(skill)
-  const driveFilesQuery = useQuery({
-    ...consoleQuery.agent.byAgentId.drive.files.get.queryOptions({
-      input: {
-        params: {
-          agent_id: agentId,
-        },
-        query: {
-          prefix: `${skillDrivePath}/`,
-        },
-      },
-    }),
-    enabled: isPreviewOpen,
-  })
-  const detailFiles = driveFilesQuery.isSuccess
-    ? (driveFilesQuery.data.items ?? []).map(item => toSkillFileNode(item, skillDrivePath))
-    : []
-  const previewFileId = selectedFileId
-    ?? skill.skillMdKey
-    ?? (driveFilesQuery.isSuccess ? getSkillMdFileId(detailFiles) ?? getFirstSkillFileId(detailFiles) : undefined)
-  const previewQuery = useQuery({
-    ...consoleQuery.agent.byAgentId.drive.files.preview.get.queryOptions({
-      input: {
-        params: {
-          agent_id: agentId,
-        },
-        query: {
-          key: previewFileId ?? '',
-        },
-      },
-    }),
-    enabled: isPreviewOpen && !!previewFileId,
-  })
-  const selectedFile = detailFiles.find(file => file.id === previewFileId)
-  const isImagePreviewFile = selectedFile?.icon === 'image'
-  const downloadQuery = useQuery({
-    ...consoleQuery.agent.byAgentId.drive.files.download.get.queryOptions({
-      input: {
-        params: {
-          agent_id: agentId,
-        },
-        query: {
-          key: previewFileId ?? '',
-        },
-      },
-    }),
-    enabled: isPreviewOpen && !!previewFileId && (isImagePreviewFile || !!previewQuery.data?.binary),
+  const detail = useAgentSkillDetail({
+    apiContext,
+    description: skill.description ?? t('agentDetail.configure.skills.tip'),
+    isOpen: isPreviewOpen,
+    skill,
   })
 
   return (
@@ -158,24 +71,7 @@ export function AgentSkillItem({
       {isPreviewOpen && (
         <AgentSkillDetailDialog
           skillName={skill.name}
-          detail={{
-            description: skill.description ?? t('agentDetail.configure.skills.tip'),
-            files: detailFiles,
-            filePreview: {
-              binary: previewQuery.data?.binary,
-              content: previewQuery.data?.text ?? undefined,
-              downloadUrl: downloadQuery.data?.url,
-              fileName: selectedFile?.name,
-              isDownloadError: downloadQuery.isError,
-              isDownloadLoading: (isImagePreviewFile || !!previewQuery.data?.binary) && downloadQuery.isPending,
-              isError: previewQuery.isError,
-              isImage: isImagePreviewFile,
-              isLoading: previewQuery.isPending,
-            },
-            onSelectFile: file => setSelectedFileId(file.id),
-            selectedFileId: previewFileId,
-            sections: [],
-          }}
+          detail={detail}
         />
       )}
     </Dialog>
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/upload-dialog.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/upload-dialog.tsx
index d95bb162b3e..94c66e4b951 100644
--- a/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/upload-dialog.tsx
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/upload-dialog.tsx
@@ -1,6 +1,8 @@
 'use client'
 
 import type { PostAgentByAgentIdSkillsUploadResponse } from '@dify/contracts/api/console/agent/types.gen'
+import type { PostAppsByAppIdAgentSkillsUploadResponse } from '@dify/contracts/api/console/apps/types.gen'
+import type { AgentDriveApiContext } from '../drive-context'
 import type { AgentSkill } from '@/features/agent-v2/agent-composer/form-state'
 import { Button } from '@langgenius/dify-ui/button'
 import { cn } from '@langgenius/dify-ui/cn'
@@ -18,25 +20,23 @@ const skillPackageExtensions = ['.zip', '.skill']
 
 const getSkillNameFromFile = (file: File) => file.name.replace(/\.(?:skill|zip)$/iu, '') || file.name
 
-const toUploadedSkill = (response: PostAgentByAgentIdSkillsUploadResponse, file: File): AgentSkill => {
+const toUploadedSkill = (
+  response: PostAgentByAgentIdSkillsUploadResponse | PostAppsByAppIdAgentSkillsUploadResponse,
+  file: File,
+): AgentSkill => {
   const name = response.skill?.name
     ?? response.manifest?.name
     ?? getSkillNameFromFile(file)
-  const id = response.skill?.id
-    ?? response.skill?.skill_md_key
+  const id = response.skill?.skill_md_key
     ?? response.skill?.path
     ?? name
 
   return {
-    description: response.skill?.description ?? response.manifest?.description,
-    files: response.skill?.manifest_files ?? response.manifest?.files,
-    fileId: response.skill?.file_id ?? undefined,
-    fullArchiveFileId: response.skill?.full_archive_file_id ?? undefined,
-    fullArchiveKey: response.skill?.full_archive_key ?? undefined,
+    description: response.skill?.description ?? response.manifest?.description ?? undefined,
+    archiveKey: response.skill?.archive_key ?? undefined,
     id,
     name,
     path: response.skill?.path ?? undefined,
-    skillMdFileId: response.skill?.skill_md_file_id ?? undefined,
     skillMdKey: response.skill?.skill_md_key ?? undefined,
   }
 }
@@ -146,12 +146,12 @@ function AgentSkillPackageUploader({
 }
 
 export function AgentSkillUploadDialog({
-  agentId,
+  apiContext,
   onUploaded,
   open,
   onOpenChange,
 }: {
-  agentId: string
+  apiContext: AgentDriveApiContext
   onUploaded?: (skill: AgentSkill) => void
   open: boolean
   onOpenChange: (open: boolean) => void
@@ -159,21 +159,16 @@ export function AgentSkillUploadDialog({
   const { t } = useTranslation('agentV2')
   const { t: tCommon } = useTranslation('common')
   const [file, setFile] = useState<File>()
-  const uploadSkillMutation = useMutation(consoleQuery.agent.byAgentId.skills.upload.post.mutationOptions())
+  const uploadAgentSkillMutation = useMutation(consoleQuery.agent.byAgentId.skills.upload.post.mutationOptions())
+  const uploadWorkflowSkillMutation = useMutation(consoleQuery.apps.byAppId.agent.skills.upload.post.mutationOptions())
+  const uploadSkillMutation = apiContext.workflow ? uploadWorkflowSkillMutation : uploadAgentSkillMutation
 
   const handleUpload = () => {
     if (!file || uploadSkillMutation.isPending)
       return
 
-    uploadSkillMutation.mutate({
-      params: {
-        agent_id: agentId,
-      },
-      body: {
-        file,
-      },
-    }, {
-      onSuccess: (response) => {
+    const options = {
+      onSuccess: (response: PostAgentByAgentIdSkillsUploadResponse | PostAppsByAppIdAgentSkillsUploadResponse) => {
         toast.success(t('agentDetail.configure.skills.upload.success'))
         onUploaded?.(toUploadedSkill(response, file))
         setFile(undefined)
@@ -182,20 +177,45 @@ export function AgentSkillUploadDialog({
       onError: () => {
         toast.error(t('agentDetail.configure.skills.upload.failed'))
       },
-    })
+    }
+
+    if (apiContext.workflow) {
+      uploadWorkflowSkillMutation.mutate({
+        params: {
+          app_id: apiContext.workflow.appId,
+        },
+        query: {
+          node_id: apiContext.workflow.nodeId,
+        },
+        body: {
+          file,
+        },
+      }, options)
+      return
+    }
+
+    uploadAgentSkillMutation.mutate({
+      params: {
+        agent_id: apiContext.agentId,
+      },
+      body: {
+        file,
+      },
+    }, options)
   }
 
   const handleOpenChange = (nextOpen: boolean) => {
     if (!nextOpen) {
-      uploadSkillMutation.reset()
+      uploadAgentSkillMutation.reset()
+      uploadWorkflowSkillMutation.reset()
       setFile(undefined)
     }
     onOpenChange(nextOpen)
   }
 
   return (
-    <Dialog open={open} onOpenChange={handleOpenChange}>
-      <DialogContent>
+    <Dialog open={open} onOpenChange={handleOpenChange} disablePointerDismissal>
+      <DialogContent backdropProps={{ forceRender: true }} backdropClassName="fixed">
         <DialogCloseButton />
         <DialogTitle className="title-2xl-semi-bold text-text-primary">
           {t('agentDetail.configure.skills.upload.title')}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/use-skill-detail.ts b/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/use-skill-detail.ts
new file mode 100644
index 00000000000..e254923b9b4
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/skills/use-skill-detail.ts
@@ -0,0 +1,308 @@
+'use client'
+
+import type { AgentDriveSkillFileResponse } from '@dify/contracts/api/console/agent/types.gen'
+import type { AgentDriveApiContext } from '../drive-context'
+import type { AgentSkillDetail } from './detail-dialog'
+import type { AgentFileNode, AgentSkill } from '@/features/agent-v2/agent-composer/form-state'
+import { useQuery } from '@tanstack/react-query'
+import { useMemo, useState } from 'react'
+import { consoleQuery } from '@/service/client'
+import { getDriveFileIconType } from '../files/file-icon'
+
+const DIFY_SKILL_FULL_ARCHIVE_NAME = '.DIFY-SKILL-FULL.zip'
+
+const getSkillDrivePath = (skill: AgentSkill) => {
+  const skillMdKeySlug = skill.skillMdKey?.split('/', 1)[0]
+  return skill.path ?? skillMdKeySlug ?? skill.id
+}
+
+const getSkillFileName = (key: string, skillDrivePath: string) => key.startsWith(`${skillDrivePath}/`)
+  ? key.slice(skillDrivePath.length + 1)
+  : key
+
+const getSkillRelativePath = (path: string, skillDrivePath: string) =>
+  getSkillFileName(path, skillDrivePath).split('/').filter(Boolean).join('/')
+
+const isSkillArchiveFile = (path: string) =>
+  path === DIFY_SKILL_FULL_ARCHIVE_NAME || path.endsWith(`/${DIFY_SKILL_FULL_ARCHIVE_NAME}`)
+
+const isSkillFolder = (file: AgentDriveSkillFileResponse) =>
+  file.type === 'directory' || file.type === 'folder'
+
+const toSkillFileNode = (item: AgentDriveSkillFileResponse, skillDrivePath: string): AgentFileNode => {
+  const filePath = getSkillFileName(item.path, skillDrivePath)
+  const fileName = item.name || filePath.split('/').pop() || filePath
+  const id = item.drive_key
+    ?? (item.path.startsWith(`${skillDrivePath}/`) ? item.path : `${skillDrivePath}/${item.path}`)
+
+  return {
+    driveKey: item.available_in_drive ? item.drive_key ?? undefined : undefined,
+    icon: isSkillFolder(item)
+      ? 'folder'
+      : getDriveFileIconType({
+          fileKind: item.type,
+          fileName,
+          mimeType: undefined,
+        }),
+    id,
+    name: fileName,
+  }
+}
+
+const sortSkillFileNodes = (files: AgentFileNode[]): AgentFileNode[] => [...files].sort((first, second) => {
+  const firstIsFolder = first.icon === 'folder'
+  const secondIsFolder = second.icon === 'folder'
+
+  if (firstIsFolder !== secondIsFolder)
+    return firstIsFolder ? -1 : 1
+
+  return first.name.localeCompare(second.name)
+}).map(file => file.children ? { ...file, children: sortSkillFileNodes(file.children) } : file)
+
+const toSkillFileTree = (files: AgentDriveSkillFileResponse[], skillDrivePath: string): AgentFileNode[] => {
+  const root: AgentFileNode[] = []
+  const folders = new Map<string, AgentFileNode>()
+  const seenFilePaths = new Set<string>()
+
+  for (const file of files) {
+    const relativePath = getSkillRelativePath(file.path, skillDrivePath)
+    if (!relativePath || isSkillArchiveFile(relativePath))
+      continue
+    if (!isSkillFolder(file)) {
+      if (seenFilePaths.has(relativePath))
+        continue
+
+      seenFilePaths.add(relativePath)
+    }
+
+    const segments = relativePath.split('/').filter(Boolean)
+    let siblings = root
+    let currentPath = ''
+
+    segments.forEach((segment, index) => {
+      currentPath = currentPath ? `${currentPath}/${segment}` : segment
+      const isLeaf = index === segments.length - 1
+      const isFolder = !isLeaf || isSkillFolder(file)
+
+      if (isFolder) {
+        const existingFolder = folders.get(currentPath)
+        if (existingFolder) {
+          siblings = existingFolder.children ?? []
+          return
+        }
+
+        const folder: AgentFileNode = {
+          icon: 'folder',
+          id: currentPath,
+          name: segment,
+          children: [],
+        }
+        folders.set(currentPath, folder)
+        siblings.push(folder)
+        siblings = folder.children ?? []
+        return
+      }
+
+      siblings.push({
+        ...toSkillFileNode(file, skillDrivePath),
+        name: segment,
+      })
+    })
+  }
+
+  return sortSkillFileNodes(root)
+}
+
+const countSkillPackageFiles = (files: AgentDriveSkillFileResponse[] | undefined, skillDrivePath: string) => {
+  const filePaths = new Set<string>()
+
+  for (const file of files ?? []) {
+    if (isSkillFolder(file))
+      continue
+
+    const relativePath = getSkillRelativePath(file.path, skillDrivePath)
+    if (!relativePath || isSkillArchiveFile(relativePath))
+      continue
+
+    filePaths.add(relativePath)
+  }
+
+  return filePaths.size
+}
+
+const getSkillMdFileId = (files: AgentFileNode[]): string | undefined => {
+  for (const file of files) {
+    if (file.icon !== 'folder' && file.name === 'SKILL.md')
+      return file.id
+
+    const childFileId = file.children ? getSkillMdFileId(file.children) : undefined
+    if (childFileId)
+      return childFileId
+  }
+}
+
+const getFirstSkillFileId = (files: AgentFileNode[]): string | undefined => {
+  for (const file of files) {
+    if (file.icon !== 'folder')
+      return file.id
+
+    const childFileId = file.children ? getFirstSkillFileId(file.children) : undefined
+    if (childFileId)
+      return childFileId
+  }
+}
+
+const findSkillFileById = (files: AgentFileNode[], fileId?: string): AgentFileNode | undefined => {
+  if (!fileId)
+    return undefined
+
+  for (const file of files) {
+    if (file.id === fileId)
+      return file
+
+    const childFile = file.children ? findSkillFileById(file.children, fileId) : undefined
+    if (childFile)
+      return childFile
+  }
+}
+
+export function useAgentSkillDetail({
+  apiContext,
+  description,
+  isOpen,
+  skill,
+}: {
+  apiContext: AgentDriveApiContext
+  description: string
+  isOpen: boolean
+  skill: AgentSkill
+}): AgentSkillDetail {
+  const [selectedFileId, setSelectedFileId] = useState<string>()
+  const skillDrivePath = getSkillDrivePath(skill)
+  const agentSkillInspectQuery = useQuery({
+    ...consoleQuery.agent.byAgentId.drive.skills.bySkillPath.inspect.get.queryOptions({
+      input: {
+        params: {
+          agent_id: apiContext.agentId,
+          skill_path: skillDrivePath,
+        },
+      },
+    }),
+    enabled: isOpen && !apiContext.workflow,
+  })
+  const workflowSkillInspectQuery = useQuery({
+    ...consoleQuery.apps.byAppId.agent.drive.skills.bySkillPath.inspect.get.queryOptions({
+      input: {
+        params: {
+          app_id: apiContext.workflow?.appId ?? '',
+          skill_path: skillDrivePath,
+        },
+        query: {
+          node_id: apiContext.workflow?.nodeId,
+        },
+      },
+    }),
+    enabled: isOpen && !!apiContext.workflow,
+  })
+  const inspectQuery = apiContext.workflow ? workflowSkillInspectQuery : agentSkillInspectQuery
+  const detailFiles = useMemo(
+    () => toSkillFileTree(inspectQuery.data?.files ?? [], skillDrivePath),
+    [inspectQuery.data?.files, skillDrivePath],
+  )
+  const previewFileId = selectedFileId
+    ?? skill.skillMdKey
+    ?? inspectQuery.data?.skill_md.key
+    ?? (inspectQuery.isSuccess ? getSkillMdFileId(detailFiles) ?? getFirstSkillFileId(detailFiles) : undefined)
+  const selectedFile = findSkillFileById(detailFiles, previewFileId)
+  const isSkillMdSelected = previewFileId === inspectQuery.data?.skill_md.key
+    || previewFileId === skill.skillMdKey
+    || selectedFile?.name === 'SKILL.md'
+  const selectedPreviewKey = isSkillMdSelected
+    ? undefined
+    : selectedFile?.driveKey
+  const agentPreviewQuery = useQuery({
+    ...consoleQuery.agent.byAgentId.drive.files.preview.get.queryOptions({
+      input: {
+        params: {
+          agent_id: apiContext.agentId,
+        },
+        query: {
+          key: selectedPreviewKey ?? '',
+        },
+      },
+    }),
+    enabled: isOpen && !!selectedPreviewKey && !apiContext.workflow,
+  })
+  const workflowPreviewQuery = useQuery({
+    ...consoleQuery.apps.byAppId.agent.drive.files.preview.get.queryOptions({
+      input: {
+        params: {
+          app_id: apiContext.workflow?.appId ?? '',
+        },
+        query: {
+          node_id: apiContext.workflow?.nodeId,
+          key: selectedPreviewKey ?? '',
+        },
+      },
+    }),
+    enabled: isOpen && !!selectedPreviewKey && !!apiContext.workflow,
+  })
+  const previewQuery = apiContext.workflow ? workflowPreviewQuery : agentPreviewQuery
+  const isImagePreviewFile = selectedFile?.icon === 'image'
+  const agentDownloadQuery = useQuery({
+    ...consoleQuery.agent.byAgentId.drive.files.download.get.queryOptions({
+      input: {
+        params: {
+          agent_id: apiContext.agentId,
+        },
+        query: {
+          key: selectedPreviewKey ?? '',
+        },
+      },
+    }),
+    enabled:
+      isOpen
+      && !!selectedPreviewKey
+      && (isImagePreviewFile || !!previewQuery.data?.binary)
+      && !apiContext.workflow,
+  })
+  const workflowDownloadQuery = useQuery({
+    ...consoleQuery.apps.byAppId.agent.drive.files.download.get.queryOptions({
+      input: {
+        params: {
+          app_id: apiContext.workflow?.appId ?? '',
+        },
+        query: {
+          node_id: apiContext.workflow?.nodeId,
+          key: selectedPreviewKey ?? '',
+        },
+      },
+    }),
+    enabled:
+      isOpen
+      && !!selectedPreviewKey
+      && (isImagePreviewFile || !!previewQuery.data?.binary)
+      && !!apiContext.workflow,
+  })
+  const downloadQuery = apiContext.workflow ? workflowDownloadQuery : agentDownloadQuery
+
+  return {
+    description,
+    fileCount: countSkillPackageFiles(inspectQuery.data?.files, skillDrivePath),
+    files: detailFiles,
+    filePreview: {
+      binary: isSkillMdSelected ? inspectQuery.data?.skill_md.binary : previewQuery.data?.binary,
+      content: isSkillMdSelected ? inspectQuery.data?.skill_md.text ?? undefined : previewQuery.data?.text ?? undefined,
+      downloadUrl: downloadQuery.data?.url,
+      fileName: selectedFile?.name,
+      isDownloadError: downloadQuery.isError,
+      isDownloadLoading: !!selectedPreviewKey && (isImagePreviewFile || !!previewQuery.data?.binary) && downloadQuery.isPending,
+      isError: isSkillMdSelected ? inspectQuery.isError : !!selectedPreviewKey && previewQuery.isError,
+      isImage: isImagePreviewFile,
+      isLoading: isSkillMdSelected ? inspectQuery.isPending : !!selectedPreviewKey && previewQuery.isPending,
+    },
+    onSelectFile: file => setSelectedFileId(file.id),
+    selectedFileId: previewFileId,
+    sections: [],
+  }
+}
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/__tests__/index.spec.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/__tests__/index.spec.tsx
index 0c14cb78117..801033033cc 100644
--- a/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/__tests__/index.spec.tsx
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/__tests__/index.spec.tsx
@@ -339,6 +339,32 @@ describe('AgentTools', () => {
         name: 'agentV2.agentDetail.configure.tools.removeAction:{"name":"Lark CLI"}',
       })).not.toBeInTheDocument()
     })
+
+    it('should keep CLI tool row actions out of layout until hover or focus', () => {
+      renderAgentTools()
+
+      const editButton = screen.getByRole('button', {
+        name: 'agentV2.agentDetail.configure.tools.editAction:{"name":"Lark CLI"}',
+      })
+      const removeButton = screen.getByRole('button', {
+        name: 'agentV2.agentDetail.configure.tools.removeAction:{"name":"Lark CLI"}',
+      })
+      const actionGroup = editButton.parentElement
+
+      expect(actionGroup).toHaveClass('hidden')
+      expect(actionGroup).toHaveClass(
+        'group-focus-within:flex',
+        'group-hover:flex',
+      )
+      expect(removeButton).toHaveClass(
+        'hover:bg-state-destructive-hover',
+        'hover:text-text-destructive',
+      )
+      expect(screen.getByText('agentV2.agentDetail.configure.tools.cliTool')).toHaveClass(
+        'group-focus-within:hidden',
+        'group-hover:hidden',
+      )
+    })
   })
 
   describe('Display Metadata', () => {
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/cli-tool/__tests__/dialog.spec.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/cli-tool/__tests__/dialog.spec.tsx
index 77910c149b7..763bd30e31b 100644
--- a/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/cli-tool/__tests__/dialog.spec.tsx
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/cli-tool/__tests__/dialog.spec.tsx
@@ -114,6 +114,25 @@ describe('CliToolDialog', () => {
   })
 
   describe('Actions', () => {
+    it('should keep the form open when the backdrop is clicked', async () => {
+      const user = userEvent.setup()
+      const { onOpenChange } = renderCliToolDialog()
+
+      const dialog = screen.getByRole('dialog', {
+        name: 'agentV2.agentDetail.configure.tools.cliDialog.title',
+      })
+      const backdrop = document.body.querySelector('.bg-background-overlay') as HTMLElement
+      await user.click(backdrop)
+
+      expect(onOpenChange).not.toHaveBeenCalledWith(false)
+      expect(dialog).toBeInTheDocument()
+
+      await user.click(screen.getByRole('button', {
+        name: 'common.operation.cancel',
+      }))
+      expect(onOpenChange).toHaveBeenCalledWith(false)
+    })
+
     it('should show save action when editing a CLI tool', () => {
       renderCliToolDialog({
         mode: 'edit',
diff --git a/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/cli-tool/dialog.tsx b/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/cli-tool/dialog.tsx
index 0d3cecb68dd..0e60a0ea9f2 100644
--- a/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/cli-tool/dialog.tsx
+++ b/web/features/agent-v2/agent-detail/configure/components/orchestrate/tools/cli-tool/dialog.tsx
@@ -127,10 +127,10 @@ export function CliToolDialog({
   }, [onDeleteCliTool, onOpenChange, tool])
 
   return (
-    <Dialog open={open} onOpenChange={handleOpenChange}>
+    <Dialog open={open} onOpenChange={handleOpenChange} disablePointerDismissal>
       <DialogContent className="flex max-h-[calc(100dvh-2rem)] w-[640px] flex-col overflow-hidden p-0">
         <div className="relative px-6 pt-6 pb-3">
-          <DialogCloseButton className="top-5 right-5" />
+          <DialogCloseButton />
           <DialogTitle className="title-2xl-semi-bold text-text-primary">
             {t(mode === 'edit' ? 'agentDetail.configure.tools.cliDialog.editTitle' : 'agentDetail.configure.tools.cliDialog.title')}
           </DialogTitle>
diff --git a/web/features/agent-v2/agent-detail/configure/components/preview/__tests__/chat.spec.tsx b/web/features/agent-v2/agent-detail/configure/components/preview/__tests__/chat.spec.tsx
index c95ce1c635e..a2c46b70026 100644
--- a/web/features/agent-v2/agent-detail/configure/components/preview/__tests__/chat.spec.tsx
+++ b/web/features/agent-v2/agent-detail/configure/components/preview/__tests__/chat.spec.tsx
@@ -1,10 +1,12 @@
 import type { ComponentProps } from 'react'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
 import { fireEvent, render, screen, waitFor } from '@testing-library/react'
 import { createStore, Provider as JotaiProvider } from 'jotai'
 import { agentComposerModelAtom } from '@/features/agent-v2/agent-composer/store-modules/model'
 import { agentComposerPromptAtom } from '@/features/agent-v2/agent-composer/store-modules/prompt'
 import { AgentPreviewChat } from '../chat'
 
+const useChatMock = vi.hoisted(() => vi.fn())
 const handleSendMock = vi.hoisted(() => vi.fn())
 const stopCallbackRef = vi.hoisted(() => ({
   current: undefined as undefined | ((taskId: string) => void),
@@ -32,16 +34,16 @@ vi.mock('@/next/dynamic', () => ({
 }))
 
 vi.mock('@/app/components/base/chat/chat/hooks', () => ({
-  useChat: (
+  useChat: useChatMock.mockImplementation((
     _config: unknown,
     _formSettings: unknown,
-    _chatList: unknown[],
+    chatList: unknown[],
     stopCallback: (taskId: string) => void,
   ) => {
     stopCallbackRef.current = stopCallback
 
     return {
-      chatList: [],
+      chatList,
       setTargetMessageId: vi.fn(),
       isResponding: false,
       handleSend: handleSendMock,
@@ -51,7 +53,7 @@ vi.mock('@/app/components/base/chat/chat/hooks', () => ({
       handleAnnotationEdited: vi.fn(),
       handleAnnotationRemoved: vi.fn(),
     }
-  },
+  }),
 }))
 
 vi.mock('@/context/app-context', () => ({
@@ -103,6 +105,13 @@ vi.mock('@/service/client', () => ({
 
 function renderPreviewChat(props?: Partial<ComponentProps<typeof AgentPreviewChat>>) {
   const store = createStore()
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: {
+        retry: false,
+      },
+    },
+  })
   store.set(agentComposerModelAtom, {
     provider: 'openai',
     model: 'gpt-4',
@@ -110,19 +119,22 @@ function renderPreviewChat(props?: Partial<ComponentProps<typeof AgentPreviewCha
   store.set(agentComposerPromptAtom, 'You are helpful.')
 
   return render(
-    <JotaiProvider store={store}>
-      <AgentPreviewChat
-        agentId="agent-1"
-        clearChatList={false}
-        onClearChatListChange={vi.fn()}
-        {...props}
-      />
-    </JotaiProvider>,
+    <QueryClientProvider client={queryClient}>
+      <JotaiProvider store={store}>
+        <AgentPreviewChat
+          agentId="agent-1"
+          clearChatList={false}
+          onClearChatListChange={vi.fn()}
+          {...props}
+        />
+      </JotaiProvider>
+    </QueryClientProvider>,
   )
 }
 
 describe('AgentPreviewChat', () => {
   beforeEach(() => {
+    useChatMock.mockClear()
     handleSendMock.mockClear()
     chatMessagesGetMock.mockResolvedValue({ data: [] })
     suggestedQuestionsGetMock.mockResolvedValue({ data: [] })
@@ -130,6 +142,64 @@ describe('AgentPreviewChat', () => {
     stopCallbackRef.current = undefined
   })
 
+  it('should initialize preview chat with the stable debug conversation history', async () => {
+    chatMessagesGetMock.mockResolvedValue({
+      data: [
+        {
+          id: 'message-1',
+          conversation_id: 'debug-conversation-1',
+          query: 'previous question',
+          answer: 'previous answer',
+          inputs: {},
+          message: [],
+          message_files: [],
+          agent_thoughts: [],
+          feedbacks: [],
+          answer_tokens: 3,
+          message_tokens: 2,
+          provider_response_latency: 1,
+          status: 'success',
+          from_source: 'console',
+        },
+      ],
+    })
+
+    renderPreviewChat({
+      debugConversationId: 'debug-conversation-1',
+    })
+
+    await waitFor(() => expect(useChatMock).toHaveBeenCalled())
+
+    expect(chatMessagesGetMock).toHaveBeenCalledWith({
+      params: {
+        agent_id: 'agent-1',
+      },
+      query: {
+        conversation_id: 'debug-conversation-1',
+      },
+    })
+    expect(useChatMock).toHaveBeenLastCalledWith(
+      expect.any(Object),
+      expect.any(Object),
+      expect.arrayContaining([
+        expect.objectContaining({
+          id: 'question-message-1',
+          content: 'previous question',
+          children: expect.arrayContaining([
+            expect.objectContaining({
+              id: 'message-1',
+              content: 'previous answer',
+            }),
+          ]),
+        }),
+      ]),
+      expect.any(Function),
+      false,
+      expect.any(Function),
+      'debug-conversation-1',
+    )
+  })
+
   it('should save draft before sending preview chat through the agent chat endpoints', async () => {
     const saveDraftBeforeRun = vi.fn().mockResolvedValue(undefined)
     renderPreviewChat({
diff --git a/web/features/agent-v2/agent-detail/configure/components/preview/__tests__/versions-panel.spec.tsx b/web/features/agent-v2/agent-detail/configure/components/preview/__tests__/versions-panel.spec.tsx
new file mode 100644
index 00000000000..206c46732f7
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/configure/components/preview/__tests__/versions-panel.spec.tsx
@@ -0,0 +1,94 @@
+import type { AgentConfigSnapshotSummaryResponse } from '@dify/contracts/api/console/agent/types.gen'
+import { fireEvent, render, screen } from '@testing-library/react'
+import { AgentPreviewVersionsPanel } from '../versions-panel'
+
+const versions: AgentConfigSnapshotSummaryResponse[] = [
+  {
+    id: 'version-2',
+    version: 2,
+    version_note: 'Published update',
+    created_at: 1710000100,
+    created_by: 'Alice',
+  },
+  {
+    id: 'version-1',
+    version: 1,
+    version_note: 'Initial release',
+    created_at: 1710000000,
+    created_by: 'Bob',
+  },
+]
+
+vi.mock('@tanstack/react-query', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@tanstack/react-query')>()
+
+  return {
+    ...actual,
+    useQuery: () => ({
+      data: { data: versions },
+      isPending: false,
+    }),
+  }
+})
+
+vi.mock('@/hooks/use-timestamp', () => ({
+  default: () => ({
+    formatTime: (timestamp: number) => `formatted-${timestamp}`,
+  }),
+}))
+
+vi.mock('@/service/client', () => ({
+  consoleQuery: {
+    agent: {
+      byAgentId: {
+        versions: {
+          get: {
+            queryOptions: () => ({ queryKey: ['agent-versions'] }),
+          },
+        },
+      },
+    },
+  },
+}))
+
+describe('AgentPreviewVersionsPanel', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  describe('Version selection', () => {
+    it('should notify the selected version when a version row is clicked', () => {
+      const handleSelectVersion = vi.fn()
+
+      render(
+        <AgentPreviewVersionsPanel
+          agentId="agent-1"
+          activeVersionId="version-2"
+          onSelectVersion={handleSelectVersion}
+          onClose={vi.fn()}
+        />,
+      )
+
+      fireEvent.click(screen.getByRole('button', { name: /Initial release/i }))
+
+      expect(handleSelectVersion).toHaveBeenCalledWith('version-1')
+    })
+
+    it('should notify null when the current draft row is clicked', () => {
+      const handleSelectVersion = vi.fn()
+
+      render(
+        <AgentPreviewVersionsPanel
+          agentId="agent-1"
+          activeVersionId="version-2"
+          onSelectVersion={handleSelectVersion}
+          onClose={vi.fn()}
+        />,
+      )
+
+      fireEvent.click(screen.getByRole('button', { name: /currentDraft/i }))
+
+      expect(handleSelectVersion).toHaveBeenCalledWith(null)
+    })
+  })
+})
diff --git a/web/features/agent-v2/agent-detail/configure/components/preview/chat.tsx b/web/features/agent-v2/agent-detail/configure/components/preview/chat.tsx
index 764ba65f498..a3127b4bd49 100644
--- a/web/features/agent-v2/agent-detail/configure/components/preview/chat.tsx
+++ b/web/features/agent-v2/agent-detail/configure/components/preview/chat.tsx
@@ -5,21 +5,30 @@ import type {
   AgentIconType,
   AgentSoulConfig,
   AgentSoulDifyToolConfig,
+  AgentThought,
+  MessageDetailResponse,
 } from '@dify/contracts/api/console/agent/types.gen'
-import type { ChatConfig, ChatItem, OnSend } from '@/app/components/base/chat/types'
+import type { FeedbackType, IChatItem, ThoughtItem } from '@/app/components/base/chat/chat/type'
+import type { ChatConfig, ChatItem, ChatItemInTree, OnSend } from '@/app/components/base/chat/types'
 import type { FileEntity } from '@/app/components/base/file-uploader/types'
 import type { DefaultModel } from '@/app/components/header/account-setting/model-provider-page/declarations'
 import type { Inputs } from '@/models/debug'
+import type { MessageRating } from '@/models/log'
+import type { FileResponse } from '@/types/workflow'
 import { Avatar } from '@langgenius/dify-ui/avatar'
 import { cn } from '@langgenius/dify-ui/cn'
+import { useQuery } from '@tanstack/react-query'
 import { useAtomValue } from 'jotai'
 import { useCallback, useMemo } from 'react'
 import { useTranslation } from 'react-i18next'
 import AppIcon from '@/app/components/base/app-icon'
 import { useChat } from '@/app/components/base/chat/chat/hooks'
-import { getLastAnswer, isValidGeneratedAnswer } from '@/app/components/base/chat/utils'
+import { buildChatItemTree, getLastAnswer, isValidGeneratedAnswer } from '@/app/components/base/chat/utils'
+import { getProcessedFilesFromResponse } from '@/app/components/base/file-uploader/utils'
+import Loading from '@/app/components/base/loading'
 import { ModelFeatureEnum } from '@/app/components/header/account-setting/model-provider-page/declarations'
 import { useTextGenerationCurrentProviderAndModelAndModelList } from '@/app/components/header/account-setting/model-provider-page/hooks'
+import { addFileInfos, sortAgentSorts } from '@/app/components/tools/utils'
 import { InputVarType } from '@/app/components/workflow/types'
 import { DEFAULT_CHAT_PROMPT_CONFIG, DEFAULT_COMPLETION_PROMPT_CONFIG } from '@/config'
 import { useAppContext } from '@/context/app-context'
@@ -151,6 +160,121 @@ const fetchAgentConversationMessages = (agentId: string, conversationId: string)
   })
 }
 
+const toFileResponse = (file: NonNullable<MessageDetailResponse['message_files']>[number]): FileResponse => ({
+  related_id: file.id ?? file.upload_file_id,
+  extension: '',
+  filename: file.filename,
+  size: file.size ?? 0,
+  mime_type: file.mime_type ?? '',
+  transfer_method: file.transfer_method as TransferMethod,
+  type: file.type,
+  url: file.url ?? '',
+  upload_file_id: file.upload_file_id ?? '',
+  remote_url: file.url ?? '',
+})
+
+const toLogMessages = (message: MessageDetailResponse['message'], answer: string, files: MessageDetailResponse['message_files']) => {
+  if (!Array.isArray(message))
+    return []
+
+  const logMessages = message as IChatItem['log']
+  if (logMessages?.at(-1)?.role === 'assistant')
+    return logMessages
+
+  return [
+    ...(logMessages ?? []),
+    {
+      role: 'assistant',
+      text: answer,
+      files: getProcessedFilesFromResponse((files?.filter(file => file.belongs_to === 'assistant') || []).map(toFileResponse)),
+    },
+  ]
+}
+
+const toAgentThoughtItem = (thought: AgentThought, conversationId: string): ThoughtItem => ({
+  id: thought.id,
+  tool: thought.tool ?? '',
+  thought: thought.thought ?? '',
+  tool_input: thought.tool_input ?? '',
+  message_id: thought.message_id,
+  conversation_id: conversationId,
+  observation: thought.observation ?? '',
+  position: thought.position,
+  files: thought.files,
+})
+
+const toFeedback = (feedback: NonNullable<MessageDetailResponse['feedbacks']>[number] | undefined): FeedbackType | undefined => {
+  if (!feedback)
+    return undefined
+
+  const rating = feedback.rating as MessageRating
+  if (rating !== 'like' && rating !== 'dislike' && rating !== null)
+    return undefined
+
+  return {
+    rating,
+    content: feedback.content,
+  }
+}
+
+type AgentDebugMessageWithLegacyAnswer = MessageDetailResponse & {
+  answer?: string | null
+}
+
+const getAgentDebugMessageAnswer = (message: MessageDetailResponse) => {
+  const legacyAnswer = (message as AgentDebugMessageWithLegacyAnswer).answer
+
+  return message.re_sign_file_url_answer ?? legacyAnswer ?? ''
+}
+
+function getFormattedAgentDebugChatTree(messages: MessageDetailResponse[]): ChatItemInTree[] {
+  const chatList: IChatItem[] = []
+
+  messages.forEach((item) => {
+    const answer = getAgentDebugMessageAnswer(item)
+    const questionFiles = item.message_files?.filter(file => file.belongs_to === 'user') || []
+    const answerFiles = item.message_files?.filter(file => file.belongs_to === 'assistant') || []
+    const answerTokens = item.answer_tokens ?? 0
+    const messageTokens = item.message_tokens ?? 0
+    const latency = item.provider_response_latency ?? 0
+
+    chatList.push({
+      id: `question-${item.id}`,
+      content: item.query,
+      isAnswer: false,
+      message_files: getProcessedFilesFromResponse(questionFiles.map(toFileResponse)),
+      parentMessageId: item.parent_message_id || undefined,
+    })
+    chatList.push({
+      id: item.id,
+      content: answer,
+      agent_thoughts: addFileInfos(
+        sortAgentSorts((item.agent_thoughts ?? []).map(thought => toAgentThoughtItem(thought, item.conversation_id))),
+        item.message_files as unknown as FileEntity[],
+      ),
+      feedback: toFeedback(item.feedbacks?.find(feedback => feedback.from_source === 'user')),
+      isAnswer: true,
+      log: toLogMessages(item.message, answer, item.message_files),
+      message_files: getProcessedFilesFromResponse(answerFiles.map(toFileResponse)),
+      parentMessageId: `question-${item.id}`,
+      workflow_run_id: item.workflow_run_id ?? undefined,
+      conversationId: item.conversation_id,
+      input: {
+        inputs: item.inputs,
+        query: item.query,
+      },
+      more: {
+        time: '',
+        tokens: answerTokens + messageTokens,
+        latency: latency.toFixed(2),
+        tokens_per_second: latency > 0 ? (answerTokens / latency).toFixed(2) : undefined,
+      },
+    })
+  })
+
+  return buildChatItemTree(chatList)
+}
+
 const fetchAgentSuggestedQuestions = (agentId: string, messageId: string) => {
   return consoleClient.agent.byAgentId.chatMessages.byMessageId.suggestedQuestions.get({
     params: {
@@ -302,6 +426,7 @@ export function AgentPreviewChat({
   agentName,
   agentSoulConfig,
   clearChatList,
+  debugConversationId,
   onClearChatListChange,
   onSaveDraftBeforeRun,
 }: {
@@ -312,6 +437,68 @@ export function AgentPreviewChat({
   agentName?: string
   agentSoulConfig?: AgentSoulConfig
   clearChatList: boolean
+  debugConversationId?: string | null
+  onClearChatListChange: (clearChatList: boolean) => void
+  onSaveDraftBeforeRun?: () => Promise<void>
+}) {
+  const historyQuery = useQuery({
+    queryKey: ['agent-preview-debug-conversation', agentId, debugConversationId],
+    queryFn: () => fetchAgentConversationMessages(agentId, debugConversationId!),
+    enabled: !!debugConversationId,
+  })
+  const initialChatTree = useMemo(
+    () => getFormattedAgentDebugChatTree(historyQuery.data?.data ?? []),
+    [historyQuery.data?.data],
+  )
+
+  if (debugConversationId && historyQuery.isPending) {
+    return (
+      <div className="flex h-full items-center justify-center">
+        <Loading type="app" />
+      </div>
+    )
+  }
+
+  return (
+    <AgentPreviewChatSession
+      key={`${debugConversationId ?? 'new'}-${historyQuery.dataUpdatedAt}`}
+      agentId={agentId}
+      agentIcon={agentIcon}
+      agentIconBackground={agentIconBackground}
+      agentIconType={agentIconType}
+      agentName={agentName}
+      agentSoulConfig={agentSoulConfig}
+      clearChatList={clearChatList}
+      debugConversationId={debugConversationId}
+      initialChatTree={initialChatTree}
+      onClearChatListChange={onClearChatListChange}
+      onSaveDraftBeforeRun={onSaveDraftBeforeRun}
+    />
+  )
+}
+
+function AgentPreviewChatSession({
+  agentId,
+  agentIcon,
+  agentIconBackground,
+  agentIconType,
+  agentName,
+  agentSoulConfig,
+  clearChatList,
+  debugConversationId,
+  initialChatTree,
+  onClearChatListChange,
+  onSaveDraftBeforeRun,
+}: {
+  agentId: string
+  agentIcon?: string | null
+  agentIconBackground?: string | null
+  agentIconType?: AgentIconType | null
+  agentName?: string
+  agentSoulConfig?: AgentSoulConfig
+  clearChatList: boolean
+  debugConversationId?: string | null
+  initialChatTree: ChatItemInTree[]
   onClearChatListChange: (clearChatList: boolean) => void
   onSaveDraftBeforeRun?: () => Promise<void>
 }) {
@@ -349,12 +536,13 @@ export function AgentPreviewChat({
       inputs,
       inputsForm,
     },
-    [],
+    initialChatTree,
     (taskId) => {
       void stopAgentChatMessageResponding(agentId, taskId)
     },
     clearChatList,
     onClearChatListChange,
+    debugConversationId ?? undefined,
   )
 
   const doSend: OnSend = useCallback(async (message, files, isRegenerate = false, parentAnswer: ChatItem | null = null) => {
diff --git a/web/features/agent-v2/agent-detail/configure/components/preview/versions-panel.tsx b/web/features/agent-v2/agent-detail/configure/components/preview/versions-panel.tsx
index 45a54f14394..329b6e6d2de 100644
--- a/web/features/agent-v2/agent-detail/configure/components/preview/versions-panel.tsx
+++ b/web/features/agent-v2/agent-detail/configure/components/preview/versions-panel.tsx
@@ -10,6 +10,7 @@ import { consoleQuery } from '@/service/client'
 type AgentPreviewVersionsPanelProps = {
   agentId: string
   activeVersionId?: string | null
+  onSelectVersion: (versionId: string | null) => void
   onClose: () => void
 }
 
@@ -63,12 +64,14 @@ function VersionItem({
   isLatest,
   isFirst,
   isLast,
+  onSelect,
 }: {
   version: AgentConfigSnapshotSummaryResponse
   activeVersionId?: string | null
   isLatest: boolean
   isFirst: boolean
   isLast: boolean
+  onSelect: (versionId: string) => void
 }) {
   const { t } = useTranslation('agentV2')
   const { t: tWorkflow } = useTranslation('workflow')
@@ -78,6 +81,8 @@ function VersionItem({
   return (
     <button
       type="button"
+      aria-current={isActive ? 'true' : undefined}
+      onClick={() => onSelect(version.id)}
       className={cn(
         'group relative flex w-full items-start gap-1 rounded-lg py-1 pr-1.5 pl-2 text-left focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden',
         isActive ? 'bg-state-accent-active' : 'hover:bg-state-base-hover',
@@ -107,27 +112,40 @@ function VersionItem({
 }
 
 function CurrentDraftItem({
+  isActive,
   isLast,
+  onSelect,
 }: {
+  isActive: boolean
   isLast: boolean
+  onSelect: () => void
 }) {
   const { t: tWorkflow } = useTranslation('workflow')
 
   return (
-    <div className="flex w-full items-start gap-1 rounded-lg py-1 pr-1.5 pl-2">
-      <VersionTimelineDot isActive={false} isFirst isLast={isLast} />
+    <button
+      type="button"
+      aria-current={isActive ? 'true' : undefined}
+      onClick={onSelect}
+      className={cn(
+        'flex w-full items-start gap-1 rounded-lg py-1 pr-1.5 pl-2 text-left focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden',
+        isActive ? 'bg-state-accent-active' : 'hover:bg-state-base-hover',
+      )}
+    >
+      <VersionTimelineDot isActive={isActive} isFirst isLast={isLast} />
       <div className="min-w-0 flex-1 py-1">
-        <p className="truncate system-sm-semibold text-text-secondary">
+        <p className={cn('truncate system-sm-semibold', isActive ? 'text-text-accent' : 'text-text-secondary')}>
           {tWorkflow('versionHistory.currentDraft')}
         </p>
       </div>
-    </div>
+    </button>
   )
 }
 
 export function AgentPreviewVersionsPanel({
   agentId,
   activeVersionId,
+  onSelectVersion,
   onClose,
 }: AgentPreviewVersionsPanelProps) {
   const { t } = useTranslation('agentV2')
@@ -182,7 +200,11 @@ export function AgentPreviewVersionsPanel({
         )}
         {!versionsQuery.isPending && versions.length > 0 && (
           <div className="flex flex-col gap-px">
-            <CurrentDraftItem isLast={versions.length === 0} />
+            <CurrentDraftItem
+              isActive={!activeVersionId}
+              isLast={versions.length === 0}
+              onSelect={() => onSelectVersion(null)}
+            />
             {versions.map((version, index) => (
               <VersionItem
                 key={version.id}
@@ -191,6 +213,7 @@ export function AgentPreviewVersionsPanel({
                 isLatest={version.id === latestVersionId}
                 isFirst={false}
                 isLast={index === versions.length - 1}
+                onSelect={onSelectVersion}
               />
             ))}
           </div>
diff --git a/web/features/agent-v2/agent-detail/configure/page.tsx b/web/features/agent-v2/agent-detail/configure/page.tsx
index ee2f2f05d62..c242a28061f 100644
--- a/web/features/agent-v2/agent-detail/configure/page.tsx
+++ b/web/features/agent-v2/agent-detail/configure/page.tsx
@@ -38,10 +38,11 @@ function AgentConfigurePageContent({
   agentId,
 }: AgentConfigurePageProps) {
   const { t } = useTranslation('agentV2')
-  const configureData = useAgentConfigureData(agentId)
+  const [selectedVersionId, setSelectedVersionId] = useState<string | null>(null)
+  const configureData = useAgentConfigureData(agentId, selectedVersionId)
   const isConfigureDataPending = configureData.agentQuery.isPending
     || configureData.composerQuery.isPending
-    || (configureData.shouldLoadPublishedVersion && configureData.versionQuery.isPending)
+    || (configureData.shouldLoadVersion && configureData.versionQuery.isPending)
 
   if (isConfigureDataPending) {
     return (
@@ -59,6 +60,7 @@ function AgentConfigurePageContent({
     <AgentConfigurePageLoadedContent
       agentId={agentId}
       configureData={configureData}
+      onSelectVersion={setSelectedVersionId}
     />
   )
 }
@@ -66,8 +68,10 @@ function AgentConfigurePageContent({
 function AgentConfigurePageLoadedContent({
   agentId,
   configureData,
+  onSelectVersion,
 }: AgentConfigurePageProps & {
   configureData: ReturnType<typeof useAgentConfigureData>
+  onSelectVersion: (versionId: string | null) => void
 }) {
   const { t } = useTranslation('agentV2')
   const [showChatFeatures, setShowChatFeatures] = useState(false)
@@ -77,11 +81,13 @@ function AgentConfigurePageLoadedContent({
     agentQuery,
     composerQuery,
     versionQuery,
+    selectedVersionId,
     activeVersionId,
     activeConfigSnapshot,
     agentSoulConfig,
   } = configureData
   const agentIconType = agentQuery.data?.icon_type as AgentIconType | null | undefined
+  const isViewingVersion = !!selectedVersionId
 
   useHydrateAgentSoulConfigDraft({
     agentId,
@@ -102,7 +108,7 @@ function AgentConfigurePageLoadedContent({
     agentId,
     baseConfig: agentSoulConfig,
     currentModel,
-    enabled: composerQuery.isSuccess,
+    enabled: composerQuery.isSuccess && !selectedVersionId,
   })
 
   return (
@@ -121,9 +127,12 @@ function AgentConfigurePageLoadedContent({
         textGenerationModelList={textGenerationModelList}
         draftSavedAt={draftSavedAt}
         isPublishing={isPublishing}
+        readOnly={isViewingVersion}
+        selectedVersionSnapshot={isViewingVersion ? activeConfigSnapshot : undefined}
         onSelectModel={setConfigureModel}
         onPublish={publishDraft}
         onOpenVersions={() => setShowPreviewVersions(true)}
+        onExitVersions={() => onSelectVersion(null)}
       />
 
       {/* Preview area */}
@@ -144,6 +153,7 @@ function AgentConfigurePageLoadedContent({
               agentName={agentQuery.data?.name}
               agentSoulConfig={agentSoulConfig}
               clearChatList={clearPreviewChat}
+              debugConversationId={agentQuery.data?.debug_conversation_id}
               onClearChatListChange={setClearPreviewChat}
               onSaveDraftBeforeRun={saveDraft}
             />
@@ -154,6 +164,7 @@ function AgentConfigurePageLoadedContent({
           <AgentPreviewVersionsPanel
             agentId={agentId}
             activeVersionId={activeVersionId}
+            onSelectVersion={onSelectVersion}
             onClose={() => setShowPreviewVersions(false)}
           />
         )}
@@ -185,7 +196,7 @@ function AgentPreviewChatWithDraftConfig({
   )
 }
 
-function useAgentConfigureData(agentId: string) {
+function useAgentConfigureData(agentId: string, selectedVersionId: string | null) {
   const agentQuery = useQuery(consoleQuery.agent.byAgentId.get.queryOptions({
     input: {
       params: {
@@ -200,27 +211,31 @@ function useAgentConfigureData(agentId: string) {
       },
     },
   }))
-  const activeVersionId = composerQuery.data?.active_config_snapshot?.id
-  const shouldLoadPublishedVersion = !composerQuery.data?.agent_soul
+  const publishedVersionId = composerQuery.data?.active_config_snapshot?.id
+  const shouldLoadPublishedVersion = !selectedVersionId && !composerQuery.data?.agent_soul
+  const versionIdToLoad = selectedVersionId ?? (shouldLoadPublishedVersion ? publishedVersionId : undefined)
+  const shouldLoadVersion = !!versionIdToLoad
   const versionQuery = useQuery(consoleQuery.agent.byAgentId.versions.byVersionId.get.queryOptions({
-    input: activeVersionId && shouldLoadPublishedVersion
+    input: versionIdToLoad
       ? {
           params: {
             agent_id: agentId,
-            version_id: activeVersionId,
+            version_id: versionIdToLoad,
           },
         }
       : skipToken,
   }))
   const versionDetail = versionQuery.data as AgentConfigSnapshotDetailResponse | undefined
-  const activeConfigSnapshot = composerQuery.data?.active_config_snapshot ?? versionDetail
-  const agentSoulConfig = composerQuery.data?.agent_soul ?? versionDetail?.config_snapshot
+  const activeVersionId = selectedVersionId ?? (shouldLoadPublishedVersion ? publishedVersionId : null)
+  const activeConfigSnapshot = selectedVersionId ? versionDetail : (composerQuery.data?.active_config_snapshot ?? versionDetail)
+  const agentSoulConfig = selectedVersionId ? versionDetail?.config_snapshot : (composerQuery.data?.agent_soul ?? versionDetail?.config_snapshot)
 
   return {
     agentQuery,
     composerQuery,
     versionQuery,
-    shouldLoadPublishedVersion,
+    shouldLoadVersion,
+    selectedVersionId,
     activeVersionId,
     activeConfigSnapshot,
     agentSoulConfig,
diff --git a/web/features/agent-v2/agent-detail/configure/use-agent-configure-sync.ts b/web/features/agent-v2/agent-detail/configure/use-agent-configure-sync.ts
index f4410b20eb8..3987df0e16b 100644
--- a/web/features/agent-v2/agent-detail/configure/use-agent-configure-sync.ts
+++ b/web/features/agent-v2/agent-detail/configure/use-agent-configure-sync.ts
@@ -40,7 +40,6 @@ export function useAgentConfigureSync({
   const setOriginalConfig = useSetAtom(agentComposerOriginalConfigAtom)
   const setOriginalDraft = useSetAtom(agentComposerOriginalDraftAtom)
   const setPublishedDraft = useSetAtom(agentComposerPublishedDraftAtom)
-  const [isPublishing, setIsPublishing] = useState(false)
   const [draftSavedAt, setDraftSavedAt] = useState<number | undefined>(undefined)
   const baseConfigRef = useRef(baseConfig)
   const currentModelRef = useRef(currentModel)
@@ -60,13 +59,19 @@ export function useAgentConfigureSync({
   const saveComposerMutation = useMutation(
     consoleQuery.agent.byAgentId.composer.put.mutationOptions(),
   )
+  const publishComposerMutation = useMutation(
+    consoleQuery.agent.byAgentId.composer.put.mutationOptions(),
+  )
 
   const saveComposer = useSerialAsyncCallback(async (
     saveStrategy: ComposerSaveStrategy,
     configSnapshot: AgentSoulConfig,
   ) => {
     const savedDraftKey = JSON.stringify(configSnapshot)
-    const composerState = await saveComposerMutation.mutateAsync({
+    const composerMutation = saveStrategy === 'save_as_new_version'
+      ? publishComposerMutation
+      : saveComposerMutation
+    const composerState = await composerMutation.mutateAsync({
       params: {
         agent_id: agentId,
       },
@@ -152,21 +157,17 @@ export function useAgentConfigureSync({
 
   const publishDraft = useCallback(async (payload: AgentConfigurePublishPayload) => {
     debouncedSaveDraft.cancel?.()
-    setIsPublishing(true)
     try {
       await saveComposer('save_as_new_version', payload.config_snapshot)
     }
     catch {
       // Draft sync follows workflow autosave behavior: save failures are silent and keep the local draft intact.
     }
-    finally {
-      setIsPublishing(false)
-    }
   }, [debouncedSaveDraft, saveComposer])
 
   return {
     draftSavedAt,
-    isPublishing,
+    isPublishing: publishComposerMutation.isPending,
     publishDraft,
     saveDraft,
   }
diff --git a/web/features/agent-v2/agent-detail/layout.tsx b/web/features/agent-v2/agent-detail/layout.tsx
index 863a30e24fb..7088732d9b0 100644
--- a/web/features/agent-v2/agent-detail/layout.tsx
+++ b/web/features/agent-v2/agent-detail/layout.tsx
@@ -27,10 +27,10 @@ export function AgentDetailLayout({
   useDocumentTitle(agentQuery.data?.name ?? t('agentDetail.documentTitle'))
 
   return (
-    <main className="relative flex h-full min-w-0 flex-col overflow-hidden">
+    <div className="relative flex h-full min-w-0 flex-col overflow-hidden">
       <div className="min-h-0 min-w-0 flex-1 overflow-auto">
         {children}
       </div>
-    </main>
+    </div>
   )
 }
diff --git a/web/features/agent-v2/agent-detail/logs/__tests__/page.spec.tsx b/web/features/agent-v2/agent-detail/logs/__tests__/page.spec.tsx
new file mode 100644
index 00000000000..0f625075699
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/logs/__tests__/page.spec.tsx
@@ -0,0 +1,270 @@
+import type { AgentLogListResponse, AgentLogSourceListResponse } from '@dify/contracts/api/console/agent/types.gen'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { render, screen, waitFor } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { AgentLogsPage } from '../page'
+
+type AgentLogsQueryInput = {
+  input: {
+    params: {
+      agent_id: string
+    }
+    query?: Record<string, unknown>
+  }
+}
+
+const mocks = vi.hoisted(() => ({
+  logsQueryFn: vi.fn(),
+  logSourcesQueryFn: vi.fn(),
+  logsQueryOptions: vi.fn((input: AgentLogsQueryInput) => ({
+    queryKey: ['agent-logs', input],
+    queryFn: () => mocks.logsQueryFn(input),
+  })),
+  logSourcesQueryOptions: vi.fn((input: AgentLogsQueryInput) => ({
+    queryKey: ['agent-log-sources', input],
+    queryFn: () => mocks.logSourcesQueryFn(input),
+  })),
+}))
+
+vi.mock('@/context/i18n', () => ({
+  useDocLink: () => (path: string) => `https://docs.example.com${path}`,
+}))
+
+vi.mock('@/hooks/use-timestamp', () => ({
+  default: () => ({
+    formatTime: (value: number) => `formatted-${value}`,
+  }),
+}))
+
+vi.mock('@/service/client', () => ({
+  consoleQuery: {
+    agent: {
+      byAgentId: {
+        logSources: {
+          get: {
+            queryOptions: mocks.logSourcesQueryOptions,
+          },
+        },
+        logs: {
+          get: {
+            queryOptions: mocks.logsQueryOptions,
+          },
+        },
+      },
+    },
+  },
+}))
+
+const emptyLogsResponse: AgentLogListResponse = {
+  data: [],
+  has_more: false,
+  limit: 25,
+  page: 1,
+  total: 0,
+}
+
+const populatedLogsResponse: AgentLogListResponse = {
+  data: [
+    {
+      conversation_id: 'conversation-1',
+      created_at: 1781660000,
+      end_user_id: 'end-user-1',
+      id: 'log-1',
+      message_count: 3,
+      operation_rate: null,
+      source: {
+        app_icon: '📙',
+        app_icon_background: '#FFF4ED',
+        app_icon_type: 'emoji',
+        app_id: 'webapp-app-id',
+        app_name: 'Book Translation',
+        id: 'webapp:webapp-app-id',
+        type: 'webapp',
+      },
+      status: 'success',
+      title: 'Previous conversation',
+      unread: false,
+      updated_at: 1781661000,
+      user_rate: null,
+    },
+  ],
+  has_more: false,
+  limit: 25,
+  page: 1,
+  total: 1,
+}
+
+const logSourcesResponse: AgentLogSourceListResponse = {
+  data: [],
+  groups: [
+    {
+      label: 'Webapp',
+      type: 'webapp',
+      sources: [
+        {
+          app_icon: '📙',
+          app_icon_background: '#FFF4ED',
+          app_icon_type: 'emoji',
+          app_id: 'webapp-app-id',
+          app_name: 'Book Translation',
+          id: 'webapp:webapp-app-id',
+          type: 'webapp',
+        },
+      ],
+    },
+    {
+      label: 'Workflow',
+      type: 'workflow',
+      sources: [
+        {
+          app_icon: '🖌',
+          app_icon_background: '#EEF4FF',
+          app_icon_type: 'emoji',
+          app_id: 'workflow-app-id',
+          app_name: 'SVG Logo Design',
+          id: 'workflow:workflow-app-id:workflow-id:v3:agent-node-id',
+          node_id: 'agent-node-id',
+          type: 'workflow',
+          workflow_id: 'workflow-id',
+          workflow_version: 'v3',
+        },
+      ],
+    },
+  ],
+}
+
+const renderPage = () => {
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: {
+        retry: false,
+      },
+    },
+  })
+
+  render(
+    <QueryClientProvider client={queryClient}>
+      <AgentLogsPage agentId="agent-1" />
+    </QueryClientProvider>,
+  )
+
+  return queryClient
+}
+
+const getLatestLogsQueryInput = () => {
+  const latestCall = mocks.logsQueryOptions.mock.calls.at(-1)
+
+  if (!latestCall)
+    throw new Error('Expected logs query options to be called')
+
+  return latestCall[0]
+}
+
+describe('AgentLogsPage', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.logsQueryFn.mockResolvedValue(emptyLogsResponse)
+    mocks.logSourcesQueryFn.mockResolvedValue(logSourcesResponse)
+  })
+
+  describe('Query contract', () => {
+    it('should request logs with generated contract filters by default', async () => {
+      renderPage()
+
+      await waitFor(() => {
+        expect(mocks.logsQueryOptions).toHaveBeenCalled()
+      })
+
+      expect(getLatestLogsQueryInput()).toEqual({
+        input: {
+          params: {
+            agent_id: 'agent-1',
+          },
+          query: expect.objectContaining({
+            keyword: undefined,
+            limit: 25,
+            page: 1,
+            sort_by: 'created_at',
+            sort_order: 'desc',
+          }),
+        },
+      })
+      expect(getLatestLogsQueryInput().input.query).not.toHaveProperty('source')
+      expect(getLatestLogsQueryInput().input.query).not.toHaveProperty('sources')
+    })
+
+    it('should send multiple source ids through the sources array filter', async () => {
+      const user = userEvent.setup()
+
+      renderPage()
+
+      await user.click(await screen.findByRole('combobox', { name: 'agentV2.agentDetail.logs.filters.source.label' }))
+      await user.click(await screen.findByRole('option', { name: /Book Translation/ }))
+      await user.click(await screen.findByRole('option', { name: /SVG Logo Design/ }))
+
+      await waitFor(() => {
+        expect(getLatestLogsQueryInput().input.query).toEqual(expect.objectContaining({
+          sources: [
+            'webapp:webapp-app-id',
+            'workflow:workflow-app-id:workflow-id:v3:agent-node-id',
+          ],
+        }))
+      })
+
+      expect(getLatestLogsQueryInput().input.query).not.toHaveProperty('source')
+    })
+
+    it('should translate Sort selection into sort_by and sort_order query params', async () => {
+      const user = userEvent.setup()
+
+      renderPage()
+
+      await user.click(screen.getByRole('button', { name: /appLog\.filter\.sortBy/ }))
+      await user.click(await screen.findByRole('menuitemradio', { name: 'agentV2.agentDetail.logs.filters.sort.lastUpdatedTime' }))
+
+      await waitFor(() => {
+        expect(getLatestLogsQueryInput().input.query).toEqual(expect.objectContaining({
+          sort_by: 'updated_at',
+          sort_order: 'desc',
+        }))
+      })
+
+      await user.click(screen.getByRole('button', { name: 'appLog.filter.ascending' }))
+
+      await waitFor(() => {
+        expect(getLatestLogsQueryInput().input.query).toEqual(expect.objectContaining({
+          sort_by: 'updated_at',
+          sort_order: 'asc',
+        }))
+      })
+    })
+
+    it('should keep existing log rows visible while filter changes refetch', async () => {
+      const user = userEvent.setup()
+      let resolveNextLogs: (value: AgentLogListResponse) => void = () => undefined
+      const nextLogsPromise = new Promise<AgentLogListResponse>((resolve) => {
+        resolveNextLogs = resolve
+      })
+      mocks.logsQueryFn
+        .mockResolvedValueOnce(populatedLogsResponse)
+        .mockReturnValueOnce(nextLogsPromise)
+
+      renderPage()
+
+      expect(await screen.findByText('Previous conversation')).toBeInTheDocument()
+
+      await user.click(await screen.findByRole('combobox', { name: 'agentV2.agentDetail.logs.filters.source.label' }))
+      await user.click(await screen.findByRole('option', { name: /Book Translation/ }))
+
+      await waitFor(() => {
+        expect(getLatestLogsQueryInput().input.query).toEqual(expect.objectContaining({
+          sources: ['webapp:webapp-app-id'],
+        }))
+      })
+
+      expect(screen.getByText('Previous conversation')).toBeInTheDocument()
+
+      resolveNextLogs(emptyLogsResponse)
+    })
+  })
+})
diff --git a/web/features/agent-v2/agent-detail/logs/components/source-picker.tsx b/web/features/agent-v2/agent-detail/logs/components/source-picker.tsx
index 6d04799ec87..8dd980ebb61 100644
--- a/web/features/agent-v2/agent-detail/logs/components/source-picker.tsx
+++ b/web/features/agent-v2/agent-detail/logs/components/source-picker.tsx
@@ -5,7 +5,6 @@ import { Button } from '@langgenius/dify-ui/button'
 import { cn } from '@langgenius/dify-ui/cn'
 import {
   Combobox,
-  ComboboxClear,
   ComboboxCollection,
   ComboboxContent,
   ComboboxEmpty,
@@ -95,7 +94,6 @@ export function AgentLogSourcePicker({
               placeholder={t('agentDetail.logs.filters.source.searchPlaceholder')}
               className="block h-4.5 grow px-1 py-0 system-sm-regular text-components-input-text-filled"
             />
-            <ComboboxClear className="mr-0" />
           </ComboboxInputGroup>
         </div>
         {isLoading && (
diff --git a/web/features/agent-v2/agent-detail/logs/page.tsx b/web/features/agent-v2/agent-detail/logs/page.tsx
index bd3a31bfe96..311acb05912 100644
--- a/web/features/agent-v2/agent-detail/logs/page.tsx
+++ b/web/features/agent-v2/agent-detail/logs/page.tsx
@@ -2,7 +2,7 @@
 
 import type { SourceFilterValue } from './components/source-picker'
 import { Pagination } from '@langgenius/dify-ui/pagination'
-import { useQuery } from '@tanstack/react-query'
+import { keepPreviousData, useQuery } from '@tanstack/react-query'
 import dayjs from 'dayjs'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
@@ -15,6 +15,8 @@ import { AgentLogsTable } from './components/logs-table'
 import { AgentLogSourcePicker } from './components/source-picker'
 
 type PeriodKey = 'last7days' | 'last30days' | 'allTime'
+type LogsSortField = 'created_at' | 'updated_at'
+type LogsSortOrder = 'asc' | 'desc'
 
 type AgentLogsPageProps = {
   agentId: string
@@ -42,6 +44,19 @@ const getPeriodQuery = (period: PeriodKey) => {
   }
 }
 
+const parseSortValue = (value: string): {
+  field: LogsSortField
+  order: LogsSortOrder
+} => {
+  const isDescending = value.startsWith('-')
+  const field = isDescending ? value.slice(1) : value
+
+  return {
+    field: field === 'updated_at' ? 'updated_at' : 'created_at',
+    order: isDescending ? 'desc' : 'asc',
+  }
+}
+
 export function AgentLogsPage({
   agentId,
 }: AgentLogsPageProps) {
@@ -51,6 +66,10 @@ export function AgentLogsPage({
   const [period, setPeriod] = useState<PeriodKey>('last7days')
   const [source, setSource] = useState<SourceFilterValue>([])
   const [keyword, setKeyword] = useState('')
+  const [sort, setSort] = useState<{ field: LogsSortField, order: LogsSortOrder }>({
+    field: 'created_at',
+    order: 'desc',
+  })
   const [page, setPage] = useState(1)
   const [limit, setLimit] = useState(25)
   const periodItems = periodOptions.map(option => ({
@@ -64,21 +83,25 @@ export function AgentLogsPage({
       },
     },
   }))
-  const logsQuery = useQuery(consoleQuery.agent.byAgentId.logs.get.queryOptions({
-    input: {
-      params: {
-        agent_id: agentId,
+  const logsQuery = useQuery({
+    ...consoleQuery.agent.byAgentId.logs.get.queryOptions({
+      input: {
+        params: {
+          agent_id: agentId,
+        },
+        query: {
+          ...getPeriodQuery(period),
+          page,
+          limit,
+          keyword: keyword.trim() || undefined,
+          ...(source.length > 0 ? { sources: source } : {}),
+          sort_by: sort.field,
+          sort_order: sort.order,
+        },
       },
-      query: {
-        ...getPeriodQuery(period),
-        page,
-        limit,
-        keyword: keyword.trim() || undefined,
-        // TODO: Send multiple source ids after the backend contract supports multi-source filtering.
-        source: source.length === 1 ? source[0] : undefined,
-      },
-    },
-  }))
+    }),
+    placeholderData: keepPreviousData,
+  })
   const logs = logsQuery.data?.data ?? []
   const totalPages = Math.max(Math.ceil((logsQuery.data?.total ?? 0) / limit), 1)
   const currentPage = logsQuery.data?.page ?? page
@@ -151,13 +174,16 @@ export function AgentLogsPage({
           </div>
 
           <Sort
-            order="desc"
-            value="updated_at"
+            order={sort.order === 'desc' ? '-' : ''}
+            value={sort.field}
             items={[
               { value: 'created_at', name: t('agentDetail.logs.filters.sort.lastCreatedTime') },
               { value: 'updated_at', name: t('agentDetail.logs.filters.sort.lastUpdatedTime') },
             ]}
-            onSelect={() => {}}
+            onSelect={(nextSortValue) => {
+              setPage(1)
+              setSort(parseSortValue(nextSortValue))
+            }}
           />
         </div>
       </header>
diff --git a/web/features/agent-v2/agent-detail/monitoring/__tests__/metrics.spec.ts b/web/features/agent-v2/agent-detail/monitoring/__tests__/metrics.spec.ts
new file mode 100644
index 00000000000..695a1d643bf
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/monitoring/__tests__/metrics.spec.ts
@@ -0,0 +1,110 @@
+import type { AgentStatisticSummaryEnvelopeResponse } from '@dify/contracts/api/console/agent/types.gen'
+import { getAgentMonitoringMetrics } from '../metrics'
+
+const statisticsSummary: AgentStatisticSummaryEnvelopeResponse = {
+  source: 'all',
+  summary: {
+    average_response_time: 1250,
+    average_session_interactions: 1.5,
+    currency: 'USD',
+    tokens_per_second: 4,
+    total_conversations: 2,
+    total_end_users: 3,
+    total_messages: 1250,
+    total_price: '0.005',
+    total_tokens: 2500,
+    user_satisfaction_rate: 66.67,
+  },
+  charts: {
+    average_response_time: [
+      { date: '2026-06-16', latency: 1250 },
+    ],
+    average_session_interactions: [
+      { date: '2026-06-16', interactions: 1.5 },
+    ],
+    daily_conversations: [
+      { date: '2026-06-16', conversation_count: 2 },
+    ],
+    daily_end_users: [
+      { date: '2026-06-16', terminal_count: 3 },
+    ],
+    daily_messages: [
+      { date: '2026-06-16', message_count: 1250 },
+    ],
+    token_usage: [
+      { date: '2026-06-16', token_count: 2500, total_price: '0.005', currency: 'USD' },
+    ],
+    tokens_per_second: [
+      { date: '2026-06-16', tps: 4 },
+    ],
+    user_satisfaction_rate: [
+      { date: '2026-06-16', rate: 66.67 },
+    ],
+  },
+}
+
+describe('getAgentMonitoringMetrics', () => {
+  it('should map statistics summary response into monitoring chart metrics', () => {
+    const metrics = getAgentMonitoringMetrics(statisticsSummary)
+
+    expect(metrics).toHaveLength(6)
+    expect(metrics.map(metric => metric.id)).toEqual([
+      'total-messages',
+      'active-users',
+      'avg-session-interactions',
+      'token-output-speed',
+      'user-satisfaction-rate',
+      'token-usage',
+    ])
+    expect(metrics[0]).toEqual(expect.objectContaining({
+      summaryValue: '1.3k',
+      valueKey: 'message_count',
+      rows: statisticsSummary.charts.daily_messages,
+    }))
+    expect(metrics[2]).toEqual(expect.objectContaining({
+      summaryValue: '1.5',
+      valueKey: 'interactions',
+    }))
+    expect(metrics[4]).toEqual(expect.objectContaining({
+      summaryValue: '66.67%',
+      valueKey: 'rate',
+      yMaxWhenEmpty: 1000,
+    }))
+    expect(metrics[5]).toEqual(expect.objectContaining({
+      summaryValue: '2.5k',
+      valueKey: 'token_count',
+      rows: statisticsSummary.charts.token_usage,
+    }))
+  })
+
+  it('should return zero-valued metrics when statistics data is not loaded yet', () => {
+    const metrics = getAgentMonitoringMetrics()
+
+    expect(metrics).toHaveLength(6)
+    expect(metrics.every(metric => metric.rows.length === 0)).toBe(true)
+    expect(metrics.map(metric => metric.summaryValue)).toEqual(['0', '0', '0', '0', '0%', '0'])
+  })
+
+  it('should fill missing daily chart buckets within the selected period', () => {
+    const metrics = getAgentMonitoringMetrics(statisticsSummary, {
+      start: '2026-06-15 00:00',
+      end: '2026-06-17 23:59',
+    })
+    const totalMessagesMetric = metrics[0]
+    const tokenUsageMetric = metrics[5]
+
+    expect(totalMessagesMetric).toBeDefined()
+    expect(tokenUsageMetric).toBeDefined()
+
+    expect(totalMessagesMetric?.rows).toEqual([
+      { date: '2026-06-15', message_count: 0, total_price: '0' },
+      { date: '2026-06-16', message_count: 1250, total_price: '0' },
+      { date: '2026-06-17', message_count: 0, total_price: '0' },
+    ])
+    expect(tokenUsageMetric?.rows).toEqual([
+      { date: '2026-06-15', token_count: 0, total_price: '0' },
+      { date: '2026-06-16', token_count: 2500, total_price: '0.005', currency: 'USD' },
+      { date: '2026-06-17', token_count: 0, total_price: '0' },
+    ])
+  })
+})
diff --git a/web/features/agent-v2/agent-detail/monitoring/__tests__/page.spec.tsx b/web/features/agent-v2/agent-detail/monitoring/__tests__/page.spec.tsx
new file mode 100644
index 00000000000..d0bff983dee
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/monitoring/__tests__/page.spec.tsx
@@ -0,0 +1,294 @@
+import type { AgentLogSourceListResponse, AgentStatisticSummaryEnvelopeResponse } from '@dify/contracts/api/console/agent/types.gen'
+import type { EChartsOption } from 'echarts'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { render, screen, waitFor, within } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { AgentMonitoringPage } from '../page'
+
+type AgentMonitoringQueryInput = {
+  input: {
+    params: {
+      agent_id: string
+    }
+    query?: Record<string, unknown>
+  }
+}
+
+const mocks = vi.hoisted(() => ({
+  chartOptions: [] as EChartsOption[],
+  statisticsQueryFn: vi.fn(),
+  logSourcesQueryFn: vi.fn(),
+  statisticsQueryOptions: vi.fn((input: AgentMonitoringQueryInput) => ({
+    queryKey: ['agent-monitoring-statistics', input],
+    queryFn: () => mocks.statisticsQueryFn(input),
+  })),
+  logSourcesQueryOptions: vi.fn((input: AgentMonitoringQueryInput) => ({
+    queryKey: ['agent-log-sources', input],
+    queryFn: () => mocks.logSourcesQueryFn(input),
+  })),
+}))
+
+vi.mock('echarts-for-react', () => ({
+  default: ({ option, style }: { option: EChartsOption, style?: React.CSSProperties }) => {
+    mocks.chartOptions.push(option)
+
+    return <div data-testid="agent-monitoring-chart" style={style} />
+  },
+}))
+
+vi.mock('@/context/i18n', () => ({
+  useDocLink: () => (path: string) => `https://docs.example.com${path}`,
+  useLocale: () => 'en-US',
+}))
+
+vi.mock('@/service/client', () => ({
+  consoleQuery: {
+    agent: {
+      byAgentId: {
+        logSources: {
+          get: {
+            queryOptions: mocks.logSourcesQueryOptions,
+          },
+        },
+        statistics: {
+          summary: {
+            get: {
+              queryOptions: mocks.statisticsQueryOptions,
+            },
+          },
+        },
+      },
+    },
+  },
+}))
+
+const logSourcesResponse: AgentLogSourceListResponse = {
+  data: [],
+  groups: [
+    {
+      label: 'Webapp',
+      type: 'webapp',
+      sources: [
+        {
+          app_icon: '📙',
+          app_icon_background: '#FFF4ED',
+          app_icon_type: 'emoji',
+          app_id: 'webapp-app-id',
+          app_name: 'Book Translation',
+          id: 'webapp:webapp-app-id',
+          type: 'webapp',
+        },
+      ],
+    },
+  ],
+}
+
+const statisticsResponse: AgentStatisticSummaryEnvelopeResponse = {
+  source: 'all',
+  summary: {
+    average_response_time: 1250,
+    average_session_interactions: 1.5,
+    currency: 'USD',
+    tokens_per_second: 4,
+    total_conversations: 2,
+    total_end_users: 3,
+    total_messages: 1250,
+    total_price: '0.005',
+    total_tokens: 2500,
+    user_satisfaction_rate: 66.67,
+  },
+  charts: {
+    average_response_time: [
+      { date: '2026-06-22', latency: 1250 },
+    ],
+    average_session_interactions: [
+      { date: '2026-06-22', interactions: 1.5 },
+    ],
+    daily_conversations: [
+      { date: '2026-06-22', conversation_count: 2 },
+    ],
+    daily_end_users: [
+      { date: '2026-06-22', terminal_count: 3 },
+    ],
+    daily_messages: [
+      { date: '2026-06-22', message_count: 1250 },
+    ],
+    token_usage: [
+      { date: '2026-06-22', token_count: 2500, total_price: '0.005', currency: 'USD' },
+    ],
+    tokens_per_second: [
+      { date: '2026-06-22', tps: 4 },
+    ],
+    user_satisfaction_rate: [
+      { date: '2026-06-22', rate: 66.67 },
+    ],
+  },
+}
+
+const emptyStatisticsResponse: AgentStatisticSummaryEnvelopeResponse = {
+  source: 'webapp:webapp-app-id',
+  summary: {
+    average_response_time: 0,
+    average_session_interactions: 0,
+    currency: 'USD',
+    tokens_per_second: 0,
+    total_conversations: 0,
+    total_end_users: 0,
+    total_messages: 0,
+    total_price: '0',
+    total_tokens: 0,
+    user_satisfaction_rate: 0,
+  },
+  charts: {
+    average_response_time: [],
+    average_session_interactions: [],
+    daily_conversations: [],
+    daily_end_users: [],
+    daily_messages: [],
+    token_usage: [],
+    tokens_per_second: [],
+    user_satisfaction_rate: [],
+  },
+}
+
+const renderPage = () => {
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: {
+        retry: false,
+      },
+    },
+  })
+
+  render(
+    <QueryClientProvider client={queryClient}>
+      <AgentMonitoringPage agentId="agent-1" />
+    </QueryClientProvider>,
+  )
+
+  return queryClient
+}
+
+const getLatestStatisticsQueryInput = () => {
+  const latestCall = mocks.statisticsQueryOptions.mock.calls.at(-1)
+
+  if (!latestCall)
+    throw new Error('Expected statistics query options to be called')
+
+  return latestCall[0]
+}
+
+describe('AgentMonitoringPage', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.chartOptions = []
+    mocks.statisticsQueryFn.mockResolvedValue(statisticsResponse)
+    mocks.logSourcesQueryFn.mockResolvedValue(logSourcesResponse)
+  })
+
+  it('should request statistics through the generated contract without a source filter by default', async () => {
+    renderPage()
+
+    await waitFor(() => {
+      expect(mocks.statisticsQueryOptions).toHaveBeenCalled()
+    })
+
+    expect(getLatestStatisticsQueryInput()).toEqual({
+      input: {
+        params: {
+          agent_id: 'agent-1',
+        },
+        query: expect.objectContaining({
+          start: expect.any(String),
+          end: expect.any(String),
+        }),
+      },
+    })
+    expect(getLatestStatisticsQueryInput().input.query).not.toHaveProperty('source')
+  })
+
+  it('should render statistics summary values and chart options from backend data', async () => {
+    renderPage()
+
+    expect(await screen.findByText('1.3k')).toBeInTheDocument()
+    expect(screen.getByText('3')).toBeInTheDocument()
+    expect(screen.getByText('1.5')).toBeInTheDocument()
+    expect(screen.getByText('4')).toBeInTheDocument()
+    expect(screen.getByText('66.67%')).toBeInTheDocument()
+    expect(screen.getByText('2.5k')).toBeInTheDocument()
+
+    await waitFor(() => {
+      expect(mocks.chartOptions).toHaveLength(6)
+    })
+    const firstChartOption = mocks.chartOptions[0]
+
+    expect(firstChartOption).toBeDefined()
+    expect(firstChartOption).toEqual(expect.objectContaining({
+      grid: { top: 8, right: 36, bottom: 10, left: 25, containLabel: true },
+    }))
+    expect(firstChartOption?.xAxis).toEqual(expect.any(Array))
+  })
+
+  it('should use overview empty y-axis fallbacks when backend charts are empty', async () => {
+    mocks.statisticsQueryFn.mockResolvedValue(emptyStatisticsResponse)
+
+    renderPage()
+
+    expect(await screen.findByText('0%')).toBeInTheDocument()
+
+    await waitFor(() => {
+      expect(mocks.chartOptions).toHaveLength(6)
+    })
+
+    expect((mocks.chartOptions[0]?.yAxis as { max?: number }).max).toBe(500)
+    expect((mocks.chartOptions[3]?.yAxis as { max?: number }).max).toBe(100)
+    expect((mocks.chartOptions[4]?.yAxis as { max?: number }).max).toBe(1000)
+  })
+
+  it('should send the selected backend source id through the source query param', async () => {
+    const user = userEvent.setup()
+
+    renderPage()
+
+    await user.click(await screen.findByRole('combobox', { name: /metadata.sourceLabel/ }))
+    await user.click(await screen.findByRole('option', { name: /Book Translation/ }))
+
+    await waitFor(() => {
+      expect(getLatestStatisticsQueryInput().input.query).toEqual(expect.objectContaining({
+        source: 'webapp:webapp-app-id',
+      }))
+    })
+
+    const sourceTrigger = screen.getByRole('combobox', { name: /Book Translation/ })
+
+    expect(within(sourceTrigger).getByText(/metadata.sourceLabel/)).toHaveClass('system-sm-regular', 'text-text-tertiary')
+    expect(within(sourceTrigger).getByText('Book Translation')).toHaveClass('system-sm-medium', 'text-text-secondary')
+  })
+
+  it('should keep previous statistics visible while a source filter refetches', async () => {
+    const user = userEvent.setup()
+    let resolveNextStatistics: (value: AgentStatisticSummaryEnvelopeResponse) => void = () => undefined
+    const nextStatisticsPromise = new Promise<AgentStatisticSummaryEnvelopeResponse>((resolve) => {
+      resolveNextStatistics = resolve
+    })
+    mocks.statisticsQueryFn
+      .mockResolvedValueOnce(statisticsResponse)
+      .mockReturnValueOnce(nextStatisticsPromise)
+
+    renderPage()
+
+    expect(await screen.findByText('1.3k')).toBeInTheDocument()
+
+    await user.click(await screen.findByRole('combobox', { name: /metadata.sourceLabel/ }))
+    await user.click(await screen.findByRole('option', { name: /Book Translation/ }))
+
+    await waitFor(() => {
+      expect(getLatestStatisticsQueryInput().input.query).toEqual(expect.objectContaining({
+        source: 'webapp:webapp-app-id',
+      }))
+    })
+    expect(screen.getByText('1.3k')).toBeInTheDocument()
+
+    resolveNextStatistics(emptyStatisticsResponse)
+  })
+})
diff --git a/web/features/agent-v2/agent-detail/monitoring/chart-utils.ts b/web/features/agent-v2/agent-detail/monitoring/chart-utils.ts
index 2e34d74dd80..2a96a44becc 100644
--- a/web/features/agent-v2/agent-detail/monitoring/chart-utils.ts
+++ b/web/features/agent-v2/agent-detail/monitoring/chart-utils.ts
@@ -1,6 +1,5 @@
 import type { EChartsOption } from 'echarts'
 import dayjs from 'dayjs'
-import { formatNumber } from '@/utils/format'
 
 export type AgentMonitoringChartType = 'conversations' | 'endUsers' | 'tokenUsage'
 
@@ -11,6 +10,10 @@ export type AgentMonitoringChartRow = {
 
 type ColorType = 'green' | 'orange' | 'blue'
 
+type AgentMonitoringChartConfig = {
+  colorType: ColorType
+}
+
 const colorTypeMap: Record<ColorType, { lineColor: string, bgColor: [string, string] }> = {
   green: {
     lineColor: 'rgba(6, 148, 162, 1)',
@@ -26,23 +29,31 @@ const colorTypeMap: Record<ColorType, { lineColor: string, bgColor: [string, str
   },
 }
 
-const chartTypeColorMap: Record<AgentMonitoringChartType, ColorType> = {
-  conversations: 'blue',
-  endUsers: 'blue',
-  tokenUsage: 'blue',
+const chartTypeConfig: Record<AgentMonitoringChartType, AgentMonitoringChartConfig> = {
+  conversations: {
+    colorType: 'green',
+  },
+  endUsers: {
+    colorType: 'orange',
+  },
+  tokenUsage: {
+    colorType: 'blue',
+  },
+}
+
+const commonColorMap = {
+  label: '#9CA3AF',
+  splitLineLight: '#F3F4F6',
+  splitLineDark: '#E5E7EB',
 }
 
-const commonDateFormat = 'MMM D, YYYY'
 const axisDateFormat = 'MMM'
 
-const sumValues = (rows: AgentMonitoringChartRow[], field: string) => {
-  return rows.reduce((sum, row) => sum + Number(row[field] ?? 0), 0)
-}
-
-const getChartColors = (chartType: AgentMonitoringChartType) => colorTypeMap[chartTypeColorMap[chartType]]
+const getChartColors = (chartType: AgentMonitoringChartType) => colorTypeMap[chartTypeConfig[chartType].colorType]
 
 const getMarkLineSeedData = (statisticsLength: number) => {
   const markLineLength = statisticsLength >= 2 ? statisticsLength - 2 : statisticsLength
+
   return ['', ...Array.from({ length: markLineLength }, () => '1'), '']
 }
 
@@ -67,22 +78,6 @@ const getTooltipContent = (
     </div>`
 }
 
-export const getDefaultChartData = ({
-  key = 'count',
-}: {
-  start: string
-  end: string
-  key?: string
-}) => {
-  const values = [180, 198, 188, 286, 423, 345]
-
-  return values.map((value, index) => ({
-    date: dayjs('2024-01-01').add(index, 'month').format(commonDateFormat),
-    [key]: value,
-    total_price: '0.0000',
-  }))
-}
-
 export const getChartValueField = (
   rows: AgentMonitoringChartRow[],
   valueKey?: string,
@@ -93,37 +88,6 @@ export const getChartValueField = (
   return Object.keys(rows[0] ?? {}).find(name => name.includes('count')) ?? 'count'
 }
 
-/**
- * @public
- */
-// TODO: Remove this marker after summary values are wired to monitoring cards.
-export const getSummaryValue = ({
-  chartType,
-  rows,
-  valueKey,
-  isAvg,
-  unit = '',
-}: {
-  chartType: AgentMonitoringChartType
-  rows: AgentMonitoringChartRow[]
-  valueKey: string
-  isAvg?: boolean
-  unit?: string
-}) => {
-  const value = sumValues(rows, valueKey)
-  const summary = isAvg ? value / (rows.length || 1) : value
-
-  if (chartType === 'tokenUsage') {
-    const formattedUsage = summary < 1000
-      ? summary
-      : `${formatNumber(Math.round(summary / 1000))}k`
-
-    return `${formattedUsage}`
-  }
-
-  return `${summary.toLocaleString()} ${unit}`.trim()
-}
-
 export const getTokenSummary = (rows: AgentMonitoringChartRow[]) => {
   const totalPrice = rows.reduce((sum, row) => sum + Number.parseFloat(String(row.total_price ?? '0')), 0)
 
@@ -164,7 +128,7 @@ export const buildChartOptions = ({
       type: 'category',
       boundaryGap: false,
       axisLabel: {
-        color: '#9CA3AF',
+        color: commonColorMap.label,
         hideOverlap: true,
         overflow: 'break',
         formatter(value) {
@@ -176,7 +140,7 @@ export const buildChartOptions = ({
       splitLine: {
         show: true,
         lineStyle: {
-          color: '#F3F4F6',
+          color: commonColorMap.splitLineLight,
           width: 1,
           type: [10, 10],
         },
@@ -194,7 +158,7 @@ export const buildChartOptions = ({
       splitLine: {
         show: true,
         lineStyle: {
-          color: '#E5E7EB',
+          color: commonColorMap.splitLineDark,
         },
         interval(_index, value) {
           return !!value
@@ -204,10 +168,10 @@ export const buildChartOptions = ({
     yAxis: {
       max: yMax ?? 'dataMax',
       type: 'value',
-      axisLabel: { color: '#9CA3AF', hideOverlap: true },
+      axisLabel: { color: commonColorMap.label, hideOverlap: true },
       splitLine: {
         lineStyle: {
-          color: '#F3F4F6',
+          color: commonColorMap.splitLineLight,
         },
       },
     },
diff --git a/web/features/agent-v2/agent-detail/monitoring/chart.tsx b/web/features/agent-v2/agent-detail/monitoring/chart.tsx
index a7ca45bae91..68c356a9933 100644
--- a/web/features/agent-v2/agent-detail/monitoring/chart.tsx
+++ b/web/features/agent-v2/agent-detail/monitoring/chart.tsx
@@ -19,7 +19,11 @@ type AgentMonitoringChartProps = {
   chartType: AgentMonitoringChartType
   valueKey?: string
   unitKey?: I18nKeysWithPrefix<'agentV2', 'agentDetail.monitoring.'>
-  yMax?: number
+  yMaxWhenEmpty: number
+}
+
+const hasChartData = (rows: AgentMonitoringChartRow[], valueKey: string) => {
+  return rows.some(row => Number(row[valueKey] ?? 0) !== 0)
 }
 
 export function AgentMonitoringChart({
@@ -30,24 +34,25 @@ export function AgentMonitoringChart({
   chartType,
   valueKey,
   unitKey,
-  yMax,
+  yMaxWhenEmpty,
 }: AgentMonitoringChartProps) {
   const { t } = useTranslation('agentV2')
   const yField = getChartValueField(rows, valueKey)
   const tokenSummary = getTokenSummary(rows)
+  const shouldUseEmptyYAxis = !hasChartData(rows, yField)
   const options = buildChartOptions({
     rows,
     chartType,
     valueKey: yField,
-    yMax,
+    yMax: shouldUseEmptyYAxis ? yMaxWhenEmpty : undefined,
   })
-  const isEmptySummary = summaryValue === '0' || summaryValue.startsWith('0 ')
+  const isEmptySummary = Number.parseFloat(summaryValue.replace(/,/g, '')) === 0
 
   return (
-    <article className="flex min-h-79 w-full min-w-0 flex-col rounded-xl border border-components-panel-border bg-components-chart-bg px-6 pt-6 pb-4 shadow-xs">
-      <div className="min-w-0">
+    <article className="flex h-[316px] w-full min-w-0 flex-col overflow-hidden rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-on-panel-item-bg">
+      <div className="flex h-11 shrink-0 items-center px-6 pt-6 pb-1">
         <div className="flex min-w-0 items-center gap-1">
-          <h3 className="truncate system-xs-semibold-uppercase text-text-secondary">
+          <h3 className="truncate system-md-semibold text-text-secondary">
             {t(titleKey)}
           </h3>
           <Infotip aria-label={t(explanationKey)}>
@@ -56,17 +61,17 @@ export function AgentMonitoringChart({
         </div>
       </div>
 
-      <div className="mt-2 mb-4 flex min-w-0 items-baseline gap-1">
-        <div className={`truncate text-2xl leading-8 font-semibold ${isEmptySummary ? 'text-text-quaternary' : 'text-text-primary'}`}>
+      <div className="flex h-8 shrink-0 items-start gap-1 px-6 py-1">
+        <div className={`truncate text-3xl leading-7 font-normal ${isEmptySummary ? 'text-text-quaternary' : 'text-text-primary'}`}>
           {summaryValue}
         </div>
         {chartType !== 'tokenUsage' && unitKey && (
-          <div className="truncate system-sm-regular text-text-secondary">
+          <div className="mt-0.5 truncate system-sm-regular text-text-secondary">
             {t(unitKey)}
           </div>
         )}
         {chartType === 'tokenUsage' && (
-          <div className="truncate system-sm-regular text-text-secondary">
+          <div className="mt-0.5 truncate system-sm-regular text-text-secondary">
             {t('agentDetail.monitoring.tokenUsageConsumed')}
             {' '}
             <span className="text-util-colors-orange-orange-600">
@@ -78,7 +83,9 @@ export function AgentMonitoringChart({
         )}
       </div>
 
-      <ReactECharts option={options} style={{ height: 240 }} />
+      <div className="h-60 px-6">
+        <ReactECharts option={options} style={{ height: 240, width: '100%' }} />
+      </div>
     </article>
   )
 }
diff --git a/web/features/agent-v2/agent-detail/monitoring/metrics.ts b/web/features/agent-v2/agent-detail/monitoring/metrics.ts
new file mode 100644
index 00000000000..818ab8dd936
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/monitoring/metrics.ts
@@ -0,0 +1,145 @@
+import type { AgentStatisticSummaryEnvelopeResponse } from '@dify/contracts/api/console/agent/types.gen'
+import type { AgentMonitoringChartRow, AgentMonitoringChartType } from './chart-utils'
+import type { I18nKeysWithPrefix } from '@/types/i18n'
+import dayjs from 'dayjs'
+import { formatNumberAbbreviated } from '@/utils/format'
+
+export type AgentMonitoringMetric = {
+  id: string
+  titleKey: I18nKeysWithPrefix<'agentV2', 'agentDetail.monitoring.'>
+  explanationKey: I18nKeysWithPrefix<'agentV2', 'agentDetail.monitoring.'>
+  chartType: AgentMonitoringChartType
+  rows: AgentMonitoringChartRow[]
+  summaryValue: string
+  valueKey: string
+  unitKey?: I18nKeysWithPrefix<'agentV2', 'agentDetail.monitoring.'>
+  yMaxWhenEmpty: number
+}
+
+type AgentMonitoringPeriodQuery = {
+  start: string
+  end: string
+}
+
+type ChartRowValue = number | string | undefined
+
+const chartDateFormat = 'YYYY-MM-DD'
+
+const toMetricNumber = (value: number) => {
+  if (Number.isInteger(value))
+    return value.toLocaleString()
+
+  return value.toLocaleString(undefined, {
+    maximumFractionDigits: 2,
+  })
+}
+
+const getChartRowValue = (row: AgentMonitoringChartRow | undefined, key: string): ChartRowValue => {
+  if (!row)
+    return 0
+
+  return row[key] ?? 0
+}
+
+const fillChartRows = <T extends { date: string }>(
+  rows: T[] | undefined,
+  periodQuery: AgentMonitoringPeriodQuery,
+  valueKey: string,
+) => {
+  const rowsByDate = new Map(
+    (rows ?? []).map(row => [dayjs(row.date).format(chartDateFormat), row as AgentMonitoringChartRow]),
+  )
+  const start = dayjs(periodQuery.start).startOf('day')
+  const end = dayjs(periodQuery.end).startOf('day')
+  const days = Math.max(end.diff(start, 'day'), 0)
+
+  return Array.from({ length: days + 1 }, (_, index) => {
+    const date = start.add(index, 'day').format(chartDateFormat)
+    const row = rowsByDate.get(date)
+
+    return {
+      ...row,
+      date,
+      [valueKey]: getChartRowValue(row, valueKey),
+      total_price: row?.total_price ?? '0',
+    }
+  }) as AgentMonitoringChartRow[]
+}
+
+export const getAgentMonitoringMetrics = (
+  data?: AgentStatisticSummaryEnvelopeResponse,
+  periodQuery?: AgentMonitoringPeriodQuery,
+): AgentMonitoringMetric[] => {
+  const summary = data?.summary
+  const charts = data?.charts
+  const toChartRows = <T extends { date: string }>(rows: T[] | undefined, valueKey: string) => {
+    if (!periodQuery)
+      return (rows ?? []) as AgentMonitoringChartRow[]
+
+    return fillChartRows(rows, periodQuery, valueKey)
+  }
+
+  return [
+    {
+      id: 'total-messages',
+      titleKey: 'agentDetail.monitoring.metrics.totalMessages.title',
+      explanationKey: 'agentDetail.monitoring.metrics.totalMessages.explanation',
+      chartType: 'conversations',
+      rows: toChartRows(charts?.daily_messages, 'message_count'),
+      summaryValue: formatNumberAbbreviated(summary?.total_messages ?? 0),
+      valueKey: 'message_count',
+      yMaxWhenEmpty: 500,
+    },
+    {
+      id: 'active-users',
+      titleKey: 'agentDetail.monitoring.metrics.activeUsers.title',
+      explanationKey: 'agentDetail.monitoring.metrics.activeUsers.explanation',
+      chartType: 'endUsers',
+      rows: toChartRows(charts?.daily_end_users, 'terminal_count'),
+      summaryValue: formatNumberAbbreviated(summary?.total_end_users ?? 0),
+      valueKey: 'terminal_count',
+      yMaxWhenEmpty: 500,
+    },
+    {
+      id: 'avg-session-interactions',
+      titleKey: 'agentDetail.monitoring.metrics.avgSessionInteractions.title',
+      explanationKey: 'agentDetail.monitoring.metrics.avgSessionInteractions.explanation',
+      chartType: 'conversations',
+      rows: toChartRows(charts?.average_session_interactions, 'interactions'),
+      summaryValue: toMetricNumber(summary?.average_session_interactions ?? 0),
+      valueKey: 'interactions',
+      yMaxWhenEmpty: 500,
+    },
+    {
+      id: 'token-output-speed',
+      titleKey: 'agentDetail.monitoring.metrics.tokenOutputSpeed.title',
+      explanationKey: 'agentDetail.monitoring.metrics.tokenOutputSpeed.explanation',
+      chartType: 'conversations',
+      rows: toChartRows(charts?.tokens_per_second, 'tps'),
+      summaryValue: toMetricNumber(summary?.tokens_per_second ?? 0),
+      valueKey: 'tps',
+      unitKey: 'agentDetail.monitoring.units.tokenPerSecond',
+      yMaxWhenEmpty: 100,
+    },
+    {
+      id: 'user-satisfaction-rate',
+      titleKey: 'agentDetail.monitoring.metrics.userSatisfactionRate.title',
+      explanationKey: 'agentDetail.monitoring.metrics.userSatisfactionRate.explanation',
+      chartType: 'endUsers',
+      rows: toChartRows(charts?.user_satisfaction_rate, 'rate'),
+      summaryValue: `${toMetricNumber(summary?.user_satisfaction_rate ?? 0)}%`,
+      valueKey: 'rate',
+      yMaxWhenEmpty: 1000,
+    },
+    {
+      id: 'token-usage',
+      titleKey: 'agentDetail.monitoring.metrics.tokenUsage.title',
+      explanationKey: 'agentDetail.monitoring.metrics.tokenUsage.explanation',
+      chartType: 'tokenUsage',
+      rows: toChartRows(charts?.token_usage, 'token_count'),
+      summaryValue: formatNumberAbbreviated(summary?.total_tokens ?? 0),
+      valueKey: 'token_count',
+      yMaxWhenEmpty: 100,
+    },
+  ]
+}
diff --git a/web/features/agent-v2/agent-detail/monitoring/mock-data.ts b/web/features/agent-v2/agent-detail/monitoring/mock-data.ts
deleted file mode 100644
index 78a566fd6bf..00000000000
--- a/web/features/agent-v2/agent-detail/monitoring/mock-data.ts
+++ /dev/null
@@ -1,85 +0,0 @@
-import type { AgentMonitoringChartRow } from './chart-utils'
-import type { I18nKeysWithPrefix } from '@/types/i18n'
-import { getDefaultChartData } from './chart-utils'
-
-type AgentMonitoringMetric = {
-  id: string
-  titleKey: I18nKeysWithPrefix<'agentV2', 'agentDetail.monitoring.'>
-  explanationKey: I18nKeysWithPrefix<'agentV2', 'agentDetail.monitoring.'>
-  chartType: 'conversations' | 'endUsers' | 'tokenUsage'
-  rows: AgentMonitoringChartRow[]
-  summaryValue: string
-  valueKey?: string
-  unitKey?: I18nKeysWithPrefix<'agentV2', 'agentDetail.monitoring.'>
-  yMax: number
-}
-
-export const getAgentMonitoringMetrics = ({
-  start,
-  end,
-}: {
-  start: string
-  end: string
-}): AgentMonitoringMetric[] => [
-  {
-    id: 'total-messages',
-    titleKey: 'agentDetail.monitoring.metrics.totalMessages.title',
-    explanationKey: 'agentDetail.monitoring.metrics.totalMessages.explanation',
-    chartType: 'conversations',
-    rows: getDefaultChartData({ start, end, key: 'messages' }),
-    summaryValue: '250k',
-    valueKey: 'messages',
-    yMax: 500,
-  },
-  {
-    id: 'active-users',
-    titleKey: 'agentDetail.monitoring.metrics.activeUsers.title',
-    explanationKey: 'agentDetail.monitoring.metrics.activeUsers.explanation',
-    chartType: 'endUsers',
-    rows: getDefaultChartData({ start, end, key: 'users' }),
-    summaryValue: '20k',
-    valueKey: 'users',
-    yMax: 500,
-  },
-  {
-    id: 'avg-session-interactions',
-    titleKey: 'agentDetail.monitoring.metrics.avgSessionInteractions.title',
-    explanationKey: 'agentDetail.monitoring.metrics.avgSessionInteractions.explanation',
-    chartType: 'conversations',
-    rows: getDefaultChartData({ start, end, key: 'interactions' }),
-    summaryValue: '20k',
-    valueKey: 'interactions',
-    yMax: 500,
-  },
-  {
-    id: 'token-output-speed',
-    titleKey: 'agentDetail.monitoring.metrics.tokenOutputSpeed.title',
-    explanationKey: 'agentDetail.monitoring.metrics.tokenOutputSpeed.explanation',
-    chartType: 'conversations',
-    rows: getDefaultChartData({ start, end, key: 'tps' }),
-    summaryValue: '1087',
-    valueKey: 'tps',
-    unitKey: 'agentDetail.monitoring.units.tokenPerSecond',
-    yMax: 100,
-  },
-  {
-    id: 'user-satisfaction-rate',
-    titleKey: 'agentDetail.monitoring.metrics.userSatisfactionRate.title',
-    explanationKey: 'agentDetail.monitoring.metrics.userSatisfactionRate.explanation',
-    chartType: 'endUsers',
-    rows: getDefaultChartData({ start, end, key: 'rate' }),
-    summaryValue: '0',
-    valueKey: 'rate',
-    yMax: 1000,
-  },
-  {
-    id: 'token-usage',
-    titleKey: 'agentDetail.monitoring.metrics.tokenUsage.title',
-    explanationKey: 'agentDetail.monitoring.metrics.tokenUsage.explanation',
-    chartType: 'tokenUsage',
-    rows: getDefaultChartData({ start, end, key: 'tokens' }),
-    summaryValue: '1087',
-    valueKey: 'tokens',
-    yMax: 100,
-  },
-]
diff --git a/web/features/agent-v2/agent-detail/monitoring/page.tsx b/web/features/agent-v2/agent-detail/monitoring/page.tsx
index 6dedc0de4bc..2bac7ae6191 100644
--- a/web/features/agent-v2/agent-detail/monitoring/page.tsx
+++ b/web/features/agent-v2/agent-detail/monitoring/page.tsx
@@ -1,20 +1,32 @@
 'use client'
 
-import type { AgentAccessSource } from '../access/access-sources'
+import type { AgentLogSourceResponse } from '@dify/contracts/api/console/agent/types.gen'
+import type { ReactNode } from 'react'
+import { Button } from '@langgenius/dify-ui/button'
 import { ScrollArea } from '@langgenius/dify-ui/scroll-area'
-import { useQuery } from '@tanstack/react-query'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectItemIndicator,
+  SelectItemText,
+  SelectTrigger,
+} from '@langgenius/dify-ui/select'
+import { keepPreviousData, useQuery } from '@tanstack/react-query'
 import dayjs from 'dayjs'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
-import Chip from '@/app/components/base/chip'
 import { useDocLink } from '@/context/i18n'
 import { consoleQuery } from '@/service/client'
-import { getAgentAccessSources } from '../access/access-sources'
 import { AgentMonitoringChart } from './chart'
-import { getAgentMonitoringMetrics } from './mock-data'
+import { getAgentMonitoringMetrics } from './metrics'
 import { AgentMonitoringTimeRangePicker } from './time-range-picker'
 
-type SourceFilterValue = 'all' | AgentAccessSource['id']
+type SourceFilterValue = 'all' | AgentLogSourceResponse['id']
+type SourceFilterItem = {
+  value: SourceFilterValue
+  name: string
+}
 type AgentMonitoringPageProps = {
   agentId: string
 }
@@ -31,43 +43,52 @@ const getDefaultPeriodQuery = () => {
   }
 }
 
-const getSourceValue = (source: AgentAccessSource): SourceFilterValue => source.id
-
 export function AgentMonitoringPage({
   agentId,
 }: AgentMonitoringPageProps) {
   const { t } = useTranslation('agentV2')
+  const { t: tCommon } = useTranslation('common')
   const docLink = useDocLink()
   const [period, setPeriod] = useState(() => ({
     name: t('agentDetail.monitoring.timeRanges.today'),
     query: getDefaultPeriodQuery(),
   }))
   const [sourceFilter, setSourceFilter] = useState<SourceFilterValue>('all')
-  const agentQuery = useQuery(consoleQuery.agent.byAgentId.get.queryOptions({
+  const logSourcesQuery = useQuery(consoleQuery.agent.byAgentId.logSources.get.queryOptions({
     input: {
       params: {
         agent_id: agentId,
       },
     },
   }))
-  const accessSources = getAgentAccessSources(agentQuery.data)
-  const sourceItems = [
+  const statisticsQuery = useQuery({
+    ...consoleQuery.agent.byAgentId.statistics.summary.get.queryOptions({
+      input: {
+        params: {
+          agent_id: agentId,
+        },
+        query: {
+          ...period.query,
+          ...(sourceFilter !== 'all' ? { source: sourceFilter } : {}),
+        },
+      },
+    }),
+    placeholderData: keepPreviousData,
+  })
+  const sources = (logSourcesQuery.data?.groups ?? []).flatMap(group => group.sources ?? [])
+  const sourceItems: SourceFilterItem[] = [
     {
       value: 'all' as const,
       name: t('agentDetail.monitoring.sources.all'),
-      triggerName: t('agentDetail.monitoring.sourceTrigger', {
-        name: t('agentDetail.monitoring.sources.all'),
-      }),
     },
-    ...accessSources.map(source => ({
-      value: getSourceValue(source),
-      name: t(source.nameKey),
-      triggerName: t('agentDetail.monitoring.sourceTrigger', {
-        name: t(source.nameKey),
-      }),
+    ...sources.map(source => ({
+      value: source.id,
+      name: source.app_name,
     })),
   ]
-  const metrics = getAgentMonitoringMetrics(period.query)
+  const metrics = getAgentMonitoringMetrics(statisticsQuery.data, period.query)
+  const shouldShowInitialSkeleton = statisticsQuery.isPending && !statisticsQuery.data
+  const shouldShowError = statisticsQuery.isError && !statisticsQuery.data
 
   return (
     <section
@@ -99,12 +120,10 @@ export function AgentMonitoringPage({
             onChange={setPeriod}
           />
 
-          <Chip
-            showLeftIcon={false}
-            className="min-w-53"
-            panelClassName="w-61"
+          <AgentMonitoringSourceFilter
             value={sourceFilter}
             items={sourceItems}
+            label={t('agentDetail.metadata.sourceLabel')}
             onSelect={(item) => {
               setSourceFilter(item.value)
             }}
@@ -121,22 +140,156 @@ export function AgentMonitoringPage({
           content: 'px-6 pt-2 pb-3',
         }}
       >
-        <div className="grid w-full grid-cols-1 gap-3 xl:grid-cols-2">
-          {metrics.map(metric => (
-            <AgentMonitoringChart
-              key={metric.id}
-              titleKey={metric.titleKey}
-              explanationKey={metric.explanationKey}
-              summaryValue={metric.summaryValue}
-              rows={metric.rows}
-              chartType={metric.chartType}
-              valueKey={metric.valueKey}
-              unitKey={metric.unitKey}
-              yMax={metric.yMax}
-            />
-          ))}
-        </div>
+        {shouldShowInitialSkeleton && <AgentMonitoringSkeletonGrid />}
+        {shouldShowError && (
+          <AgentMonitoringState>
+            <div className="flex items-center justify-center gap-2">
+              <span>{t('agentDetail.monitoring.loadFailed')}</span>
+              <Button
+                variant="secondary"
+                size="small"
+                onClick={() => {
+                  void statisticsQuery.refetch()
+                }}
+              >
+                {tCommon('operation.retry')}
+              </Button>
+            </div>
+          </AgentMonitoringState>
+        )}
+        {!shouldShowInitialSkeleton && !shouldShowError && (
+          <div className="grid w-full grid-cols-1 gap-3 xl:grid-cols-2">
+            {metrics.map(metric => (
+              <AgentMonitoringChart
+                key={metric.id}
+                titleKey={metric.titleKey}
+                explanationKey={metric.explanationKey}
+                summaryValue={metric.summaryValue}
+                rows={metric.rows}
+                chartType={metric.chartType}
+                valueKey={metric.valueKey}
+                unitKey={metric.unitKey}
+                yMaxWhenEmpty={metric.yMaxWhenEmpty}
+              />
+            ))}
+          </div>
+        )}
       </ScrollArea>
     </section>
   )
 }
+
+function AgentMonitoringSourceFilter({
+  value,
+  items,
+  label,
+  onSelect,
+  onClear,
+}: {
+  value: SourceFilterValue
+  items: SourceFilterItem[]
+  label: string
+  onSelect: (item: SourceFilterItem) => void
+  onClear: () => void
+}) {
+  const { t } = useTranslation('common')
+  const selectedItem = items.find(item => Object.is(item.value, value))
+  const selectedName = selectedItem?.name ?? ''
+  const triggerLabel = selectedName ? `${label} ${selectedName}` : label
+  const clearLabel = selectedName
+    ? `${t('operation.clear')} ${triggerLabel}`
+    : t('operation.clear')
+
+  return (
+    <Select
+      value={selectedItem?.value ?? null}
+      itemToStringLabel={(itemValue: SourceFilterValue) => items.find(item => Object.is(item.value, itemValue))?.name ?? ''}
+      itemToStringValue={itemValue => String(itemValue)}
+      onValueChange={(nextValue) => {
+        if (nextValue === null)
+          return
+        const selected = items.find(item => Object.is(item.value, nextValue))
+        if (selected)
+          onSelect(selected)
+      }}
+    >
+      <div className="relative w-fit max-w-full">
+        <SelectTrigger
+          aria-label={triggerLabel}
+          className="h-auto min-h-8 w-fit max-w-full min-w-53 cursor-pointer items-center rounded-lg border-[0.5px] border-components-button-secondary-border bg-components-button-secondary-bg px-2 py-1 pr-6 shadow-xs hover:border-components-button-secondary-border-hover hover:bg-components-button-secondary-bg-hover! focus-visible:bg-state-base-hover-alt focus-visible:ring-2 focus-visible:ring-state-accent-solid data-popup-open:border-components-button-secondary-border-hover! data-popup-open:bg-components-button-secondary-bg-hover! data-popup-open:hover:border-components-button-secondary-border-hover data-popup-open:hover:bg-components-button-secondary-bg-hover! [&>*:last-child]:hidden"
+        >
+          <span className="flex min-w-0 grow items-center gap-1 text-left">
+            <span className="flex min-w-0 grow items-center gap-1 px-1">
+              <span className="shrink-0 system-sm-regular text-text-tertiary">
+                {label}
+              </span>
+              <span className="truncate system-sm-medium text-text-secondary">
+                {selectedName}
+              </span>
+            </span>
+          </span>
+        </SelectTrigger>
+        <button
+          type="button"
+          aria-label={clearLabel}
+          className="group/clear absolute top-1/2 right-1.5 flex size-5 -translate-y-1/2 cursor-pointer touch-manipulation items-center justify-center rounded-md border-none bg-transparent p-0 outline-hidden focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:ring-inset"
+          onClick={onClear}
+        >
+          <span aria-hidden className="i-ri-close-circle-fill block size-3.5 text-text-quaternary group-hover/clear:text-text-tertiary" />
+        </button>
+        <SelectContent
+          placement="bottom-start"
+          sideOffset={4}
+          popupClassName="relative w-61 rounded-xl border-[0.5px] bg-components-panel-bg-blur p-0 text-sm text-text-secondary shadow-lg outline-hidden backdrop-blur-[5px] focus:outline-hidden focus-visible:outline-hidden"
+          listClassName="max-h-72 p-1"
+        >
+          {items.map(item => (
+            <SelectItem
+              key={item.value}
+              value={item.value}
+            >
+              <SelectItemText title={item.name}>{item.name}</SelectItemText>
+              <SelectItemIndicator />
+            </SelectItem>
+          ))}
+        </SelectContent>
+      </div>
+    </Select>
+  )
+}
+
+function AgentMonitoringState({
+  children,
+}: {
+  children: ReactNode
+}) {
+  return (
+    <div className="flex h-[316px] items-center justify-center rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-on-panel-item-bg px-6 py-8 text-center system-sm-regular text-text-tertiary">
+      {children}
+    </div>
+  )
+}
+
+function AgentMonitoringSkeletonGrid() {
+  return (
+    <div className="grid w-full grid-cols-1 gap-3 xl:grid-cols-2">
+      {Array.from({ length: 6 }, (_, index) => (
+        <article
+          key={index}
+          aria-hidden="true"
+          className="flex h-[316px] w-full min-w-0 flex-col overflow-hidden rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-on-panel-item-bg"
+        >
+          <div className="flex h-11 items-end px-6 pb-1">
+            <div className="h-4 w-40 rounded-sm bg-text-quaternary opacity-20" />
+          </div>
+          <div className="flex h-8 items-start px-6 py-1">
+            <div className="h-6 w-24 rounded-sm bg-text-quaternary opacity-20" />
+          </div>
+          <div className="h-60 px-6 pb-4">
+            <div className="h-full rounded-md bg-text-quaternary opacity-10" />
+          </div>
+        </article>
+      ))}
+    </div>
+  )
+}
diff --git a/web/features/agent-v2/roster/components/__tests__/agent-roster-list.spec.tsx b/web/features/agent-v2/roster/components/__tests__/agent-roster-list.spec.tsx
index 687133f25e7..637e4f3623c 100644
--- a/web/features/agent-v2/roster/components/__tests__/agent-roster-list.spec.tsx
+++ b/web/features/agent-v2/roster/components/__tests__/agent-roster-list.spec.tsx
@@ -2,7 +2,7 @@ import type { ComponentProps } from 'react'
 import type { AgentRosterListItem } from '../agent-roster-list'
 import { toast } from '@langgenius/dify-ui/toast'
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
-import { render, screen, waitFor } from '@testing-library/react'
+import { render, screen, waitFor, within } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import { AgentRosterList } from '../agent-roster-list'
 
@@ -20,6 +20,9 @@ vi.mock('@/service/client', () => ({
   consoleQuery: {
     agent: {
       byAgentId: {
+        get: {
+          queryKey: ({ input }: { input: { params: { agent_id: string } } }) => ['agent-detail', input.params.agent_id],
+        },
         copy: {
           post: {
             mutationOptions: () => ({
@@ -46,6 +49,9 @@ const createAgent = (overrides: Partial<AgentRosterListItem> = {}): AgentRosterL
   active_config_is_published: false,
   description: 'Find and summarize market materials.',
   id: 'agent-1',
+  icon: '🧸',
+  icon_background: '#F5F3FF',
+  icon_type: 'emoji',
   icon_url: null,
   mode: 'agent',
   name: 'Research Agent',
@@ -61,7 +67,7 @@ const renderList = (
 ) => {
   const queryClient = new QueryClient()
 
-  return render(
+  const result = render(
     <QueryClientProvider client={queryClient}>
       <AgentRosterList
         agents={agents}
@@ -77,6 +83,11 @@ const renderList = (
       />
     </QueryClientProvider>,
   )
+
+  return {
+    ...result,
+    queryClient,
+  }
 }
 
 describe('AgentRosterList', () => {
@@ -201,19 +212,108 @@ describe('AgentRosterList', () => {
     expect(screen.getByText(/agentV2\.roster\.references\.label/)).toBeInTheDocument()
   })
 
-  it('duplicates an agent from the card action menu', async () => {
+  it('opens a duplicate dialog from the card action menu', async () => {
     const user = userEvent.setup()
     renderList([createAgent()])
 
     await user.click(screen.getByRole('button', { name: /agentV2\.roster\.moreActions/ }))
     await user.click(screen.getByRole('menuitem', { name: /common\.operation\.duplicate/ }))
 
+    const dialog = await screen.findByRole('dialog', { name: 'agentV2.roster.duplicateDialog.title' })
+    expect(within(dialog).getByRole('textbox', { name: /agentV2\.roster\.createForm\.nameLabel/ })).toHaveValue('')
+    expect(within(dialog).getByRole('textbox', { name: /agentV2\.roster\.createForm\.nameLabel/ })).toHaveAttribute('placeholder', 'Research Agent copy')
+    expect(within(dialog).getByRole('textbox', { name: /agentV2\.roster\.createForm\.roleLabel/ })).toHaveValue('Research Assistant')
+    expect(within(dialog).getByRole('textbox', { name: /agentV2\.roster\.createForm\.descriptionLabel/ })).toHaveValue('Find and summarize market materials.')
+    expect(duplicateAgentMutationFn).not.toHaveBeenCalled()
+  })
+
+  it('uses the latest cached agent detail when opening the duplicate dialog', async () => {
+    const user = userEvent.setup()
+    const { queryClient } = renderList([
+      createAgent({
+        description: null,
+      }),
+    ])
+    queryClient.setQueryData(['agent-detail', 'agent-1'], createAgent({
+      description: 'Summarize new market updates.',
+      role: 'Market Researcher',
+    }))
+
+    await user.click(screen.getByRole('button', { name: /agentV2\.roster\.moreActions/ }))
+    await user.click(screen.getByRole('menuitem', { name: /common\.operation\.duplicate/ }))
+
+    const dialog = await screen.findByRole('dialog', { name: 'agentV2.roster.duplicateDialog.title' })
+    expect(within(dialog).getByRole('textbox', { name: /agentV2\.roster\.createForm\.nameLabel/ })).toHaveValue('')
+    expect(within(dialog).getByRole('textbox', { name: /agentV2\.roster\.createForm\.nameLabel/ })).toHaveAttribute('placeholder', 'Research Agent copy')
+    expect(within(dialog).getByRole('textbox', { name: /agentV2\.roster\.createForm\.descriptionLabel/ })).toHaveValue('Summarize new market updates.')
+    expect(within(dialog).getByRole('textbox', { name: /agentV2\.roster\.createForm\.roleLabel/ })).toHaveValue('Market Researcher')
+  })
+
+  it('duplicates an agent with backend-generated naming when the dialog name is empty', async () => {
+    const user = userEvent.setup()
+    renderList([createAgent()])
+
+    await user.click(screen.getByRole('button', { name: /agentV2\.roster\.moreActions/ }))
+    await user.click(screen.getByRole('menuitem', { name: /common\.operation\.duplicate/ }))
+
+    const dialog = await screen.findByRole('dialog', { name: 'agentV2.roster.duplicateDialog.title' })
+    await user.click(within(dialog).getByRole('button', { name: 'common.operation.duplicate' }))
+
     expect(duplicateAgentMutationFn).toHaveBeenCalledWith(
       {
         params: {
           agent_id: 'agent-1',
         },
-        body: {},
+        body: {
+          description: 'Find and summarize market materials.',
+          role: 'Research Assistant',
+          icon: '🧸',
+          icon_background: '#F5F3FF',
+          icon_type: 'emoji',
+        },
+      },
+      expect.objectContaining({
+        client: expect.any(QueryClient),
+      }),
+    )
+    expect(duplicateAgentMutationFn.mock.calls[0]?.[0].body).not.toHaveProperty('name')
+    await waitFor(() => {
+      expect(toast.success).toHaveBeenCalledWith('agentV2.roster.duplicateSuccess')
+    })
+  })
+
+  it('duplicates an agent with the dialog name, role, and description when provided', async () => {
+    const user = userEvent.setup()
+    renderList([createAgent()])
+
+    await user.click(screen.getByRole('button', { name: /agentV2\.roster\.moreActions/ }))
+    await user.click(screen.getByRole('menuitem', { name: /common\.operation\.duplicate/ }))
+
+    const dialog = await screen.findByRole('dialog', { name: 'agentV2.roster.duplicateDialog.title' })
+    const nameInput = within(dialog).getByRole('textbox', { name: /agentV2\.roster\.createForm\.nameLabel/ })
+    const roleInput = within(dialog).getByRole('textbox', { name: /agentV2\.roster\.createForm\.roleLabel/ })
+    const descriptionInput = within(dialog).getByRole('textbox', { name: /agentV2\.roster\.createForm\.descriptionLabel/ })
+    await user.clear(nameInput)
+    await user.type(nameInput, ' Market Agent ')
+    await user.clear(roleInput)
+    await user.type(roleInput, ' Market Analyst ')
+    await user.clear(descriptionInput)
+    await user.type(descriptionInput, ' Copied for market research ')
+    await user.click(within(dialog).getByRole('button', { name: 'common.operation.duplicate' }))
+
+    expect(duplicateAgentMutationFn).toHaveBeenCalledWith(
+      {
+        params: {
+          agent_id: 'agent-1',
+        },
+        body: {
+          name: 'Market Agent',
+          description: 'Copied for market research',
+          role: 'Market Analyst',
+          icon: '🧸',
+          icon_background: '#F5F3FF',
+          icon_type: 'emoji',
+        },
       },
       expect.objectContaining({
         client: expect.any(QueryClient),
@@ -223,4 +323,45 @@ describe('AgentRosterList', () => {
       expect(toast.success).toHaveBeenCalledWith('agentV2.roster.duplicateSuccess')
     })
   })
+
+  it('shows a field error when duplicating with an empty role', async () => {
+    const user = userEvent.setup()
+    renderList([createAgent()])
+
+    await user.click(screen.getByRole('button', { name: /agentV2\.roster\.moreActions/ }))
+    await user.click(screen.getByRole('menuitem', { name: /common\.operation\.duplicate/ }))
+
+    const dialog = await screen.findByRole('dialog', { name: 'agentV2.roster.duplicateDialog.title' })
+    await user.clear(within(dialog).getByRole('textbox', { name: /agentV2\.roster\.createForm\.roleLabel/ }))
+    await user.click(within(dialog).getByRole('button', { name: 'common.operation.duplicate' }))
+
+    expect(await within(dialog).findByText('agentV2.roster.createForm.roleRequired')).toBeInTheDocument()
+    expect(duplicateAgentMutationFn).not.toHaveBeenCalled()
+  })
+
+  it('resets the edit form draft when reopening after canceling unsaved changes', async () => {
+    const user = userEvent.setup()
+    renderList([createAgent()])
+
+    await user.click(screen.getByRole('button', { name: /agentV2\.roster\.moreActions/ }))
+    await user.click(screen.getByRole('menuitem', { name: /agentV2\.roster\.editInfo/ }))
+
+    const dialog = await screen.findByRole('dialog', { name: 'agentV2.roster.editDialog.title' })
+    const nameInput = within(dialog).getByRole('textbox', { name: 'agentV2.roster.createForm.nameLabel' })
+    await user.clear(nameInput)
+    await user.type(nameInput, 'Draft Name')
+    await user.click(within(dialog).getByRole('button', { name: 'common.operation.cancel' }))
+
+    await waitFor(() => {
+      expect(screen.queryByRole('dialog', { name: 'agentV2.roster.editDialog.title' })).not.toBeInTheDocument()
+    })
+
+    await user.click(screen.getByRole('button', { name: /agentV2\.roster\.moreActions/ }))
+    await user.click(screen.getByRole('menuitem', { name: /agentV2\.roster\.editInfo/ }))
+
+    const reopenedDialog = await screen.findByRole('dialog', { name: 'agentV2.roster.editDialog.title' })
+    expect(within(reopenedDialog).getByRole('textbox', { name: 'agentV2.roster.createForm.nameLabel' })).toHaveValue('Research Agent')
+    expect(within(reopenedDialog).getByRole('textbox', { name: 'agentV2.roster.createForm.roleLabel' })).toHaveValue('Research Assistant')
+    expect(within(reopenedDialog).getByRole('button', { name: 'common.operation.save' })).toBeDisabled()
+  })
 })
diff --git a/web/features/agent-v2/roster/components/__tests__/create-agent-dialog.spec.tsx b/web/features/agent-v2/roster/components/__tests__/create-agent-dialog.spec.tsx
index 57fb616246f..559cfb41f1b 100644
--- a/web/features/agent-v2/roster/components/__tests__/create-agent-dialog.spec.tsx
+++ b/web/features/agent-v2/roster/components/__tests__/create-agent-dialog.spec.tsx
@@ -1,4 +1,4 @@
-import { render, screen, within } from '@testing-library/react'
+import { render, screen, waitFor, within } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import { CreateAgentDialog } from '../create-agent-dialog'
 
@@ -112,4 +112,22 @@ describe('CreateAgentDialog', () => {
     expect(toastMock.error).not.toHaveBeenCalled()
     expect(mutationMock.mutate).not.toHaveBeenCalled()
   })
+
+  it('keeps the form open when the backdrop is clicked', async () => {
+    const user = userEvent.setup()
+    render(<CreateAgentDialog />)
+
+    await user.click(screen.getByRole('button', { name: /agentV2\.roster\.createAgent/ }))
+
+    const dialog = await screen.findByRole('dialog', { name: 'agentV2.roster.createDialog.title' })
+    const backdrop = document.body.querySelector('.bg-background-overlay') as HTMLElement
+    await user.click(backdrop)
+
+    expect(dialog).toBeInTheDocument()
+
+    await user.click(within(dialog).getByRole('button', { name: 'common.operation.cancel' }))
+    await waitFor(() => {
+      expect(screen.queryByRole('dialog', { name: 'agentV2.roster.createDialog.title' })).not.toBeInTheDocument()
+    })
+  })
 })
diff --git a/web/features/agent-v2/roster/components/__tests__/edit-agent-dialog.spec.tsx b/web/features/agent-v2/roster/components/__tests__/edit-agent-dialog.spec.tsx
index be9d113c79f..eca96683382 100644
--- a/web/features/agent-v2/roster/components/__tests__/edit-agent-dialog.spec.tsx
+++ b/web/features/agent-v2/roster/components/__tests__/edit-agent-dialog.spec.tsx
@@ -75,6 +75,7 @@ const renderDialog = (agent = createAgent()) => {
   render(
     <EditAgentDialog
       agent={agent}
+      formKey={0}
       open
       onOpenChange={onOpenChange}
     />,
@@ -221,4 +222,19 @@ describe('EditAgentDialog', () => {
     expect(toastMock.error).not.toHaveBeenCalled()
     expect(mutationMock.mutate).not.toHaveBeenCalled()
   })
+
+  it('keeps the form open when the backdrop is clicked', async () => {
+    const user = userEvent.setup()
+    const { onOpenChange } = renderDialog()
+
+    const dialog = screen.getByRole('dialog', { name: 'agentV2.roster.editDialog.title' })
+    const backdrop = document.body.querySelector('.bg-background-overlay') as HTMLElement
+    await user.click(backdrop)
+
+    expect(onOpenChange).not.toHaveBeenCalledWith(false)
+    expect(dialog).toBeInTheDocument()
+
+    await user.click(within(dialog).getByRole('button', { name: 'common.operation.cancel' }))
+    expect(onOpenChange).toHaveBeenCalledWith(false)
+  })
 })
diff --git a/web/features/agent-v2/roster/components/agent-form-fields.tsx b/web/features/agent-v2/roster/components/agent-form-fields.tsx
new file mode 100644
index 00000000000..c3f1fe7b025
--- /dev/null
+++ b/web/features/agent-v2/roster/components/agent-form-fields.tsx
@@ -0,0 +1,122 @@
+import type { AgentIconSelection } from './agent-form'
+import { FieldControl, FieldError, FieldLabel, FieldRoot } from '@langgenius/dify-ui/field'
+import { Textarea } from '@langgenius/dify-ui/textarea'
+import { useTranslation } from 'react-i18next'
+import AppIcon from '@/app/components/base/app-icon'
+
+type AgentFormFieldsProps = {
+  description: string
+  icon: AgentIconSelection
+  iconAriaLabel: string
+  name: string
+  onDescriptionChange: (description: string) => void
+  onIconClick: () => void
+  onNameChange: (name: string) => void
+  onRoleChange: (role: string) => void
+  role: string
+}
+
+export function AgentFormFields({
+  description,
+  icon,
+  iconAriaLabel,
+  name,
+  onDescriptionChange,
+  onIconClick,
+  onNameChange,
+  onRoleChange,
+  role,
+}: AgentFormFieldsProps) {
+  const { t } = useTranslation('agentV2')
+
+  return (
+    <div className="space-y-5 px-6 py-3">
+      <div className="flex items-end gap-4 pb-2">
+        <button
+          type="button"
+          aria-label={iconAriaLabel}
+          className="shrink-0 rounded-full outline-hidden focus-visible:ring-2 focus-visible:ring-state-accent-solid"
+          onClick={onIconClick}
+        >
+          <AppIcon
+            size="xxl"
+            rounded
+            className="size-16 cursor-pointer"
+            iconType={icon.type === 'link' ? 'image' : icon.type}
+            icon={icon.type === 'emoji' ? icon.icon : undefined}
+            background={icon.type === 'emoji' ? icon.background : undefined}
+            imageUrl={icon.type === 'emoji' ? undefined : icon.url}
+          />
+        </button>
+        <div className="flex min-w-0 flex-1 gap-3 pb-1">
+          <FieldRoot
+            name="name"
+            className="relative min-w-0 flex-1"
+            validate={(value) => {
+              if (typeof value === 'string' && value.length > 0 && !value.trim())
+                return t('roster.createForm.nameRequired')
+
+              return null
+            }}
+          >
+            <FieldLabel>
+              {t('roster.createForm.nameLabel')}
+            </FieldLabel>
+            <FieldControl
+              autoComplete="off"
+              // eslint-disable-next-line jsx-a11y/no-autofocus -- Agent roster dialogs open from explicit commands, and the name field is the primary editable control.
+              autoFocus
+              maxLength={255}
+              onValueChange={onNameChange}
+              placeholder={t('roster.createForm.namePlaceholder')}
+              required
+              value={name}
+            />
+            <div className="absolute top-full left-0 mt-1">
+              <FieldError match="valueMissing">{t('roster.createForm.nameRequired')}</FieldError>
+              <FieldError match="customError" />
+            </div>
+          </FieldRoot>
+          <FieldRoot
+            name="role"
+            className="relative min-w-0 flex-1"
+            validate={(value) => {
+              if (typeof value === 'string' && value.length > 0 && !value.trim())
+                return t('roster.createForm.roleRequired')
+
+              return null
+            }}
+          >
+            <FieldLabel>
+              {t('roster.createForm.roleLabel')}
+            </FieldLabel>
+            <FieldControl
+              autoComplete="off"
+              maxLength={255}
+              onValueChange={onRoleChange}
+              placeholder={t('roster.createForm.rolePlaceholder')}
+              required
+              value={role}
+            />
+            <div className="absolute top-full left-0 mt-1">
+              <FieldError match="valueMissing">{t('roster.createForm.roleRequired')}</FieldError>
+              <FieldError match="customError" />
+            </div>
+          </FieldRoot>
+        </div>
+      </div>
+      <FieldRoot name="description">
+        <FieldLabel>
+          {t('roster.createForm.descriptionLabel')}
+        </FieldLabel>
+        <Textarea
+          autoComplete="off"
+          className="h-20 resize-none"
+          onValueChange={onDescriptionChange}
+          placeholder={t('roster.createForm.descriptionPlaceholder')}
+          value={description}
+        />
+      </FieldRoot>
+    </div>
+  )
+}
diff --git a/web/features/agent-v2/roster/components/agent-form.ts b/web/features/agent-v2/roster/components/agent-form.ts
new file mode 100644
index 00000000000..cf738afbb31
--- /dev/null
+++ b/web/features/agent-v2/roster/components/agent-form.ts
@@ -0,0 +1,54 @@
+import type { AgentAppPartial } from '@dify/contracts/api/console/agent/types.gen'
+import type { AppIconSelection } from '@/app/components/base/app-icon-picker'
+
+export type AgentFormValues = {
+  description?: string
+  name?: string
+  role?: string
+}
+
+export type AgentIconSelection = AppIconSelection | {
+  type: 'link'
+  icon: string
+  url: string
+}
+
+export const defaultAgentIcon = {
+  type: 'emoji',
+  icon: '🧸',
+  background: '#F5F3FF',
+} satisfies AppIconSelection
+
+export const createAgentIconSelection = (agent: AgentAppPartial): AgentIconSelection => {
+  if (agent.icon_type === 'image' && agent.icon) {
+    return {
+      type: 'image',
+      fileId: agent.icon,
+      url: agent.icon,
+    }
+  }
+
+  if (agent.icon_type === 'link' && agent.icon) {
+    return {
+      type: 'link',
+      icon: agent.icon,
+      url: agent.icon,
+    }
+  }
+
+  return {
+    type: 'emoji',
+    icon: agent.icon || defaultAgentIcon.icon,
+    background: agent.icon_background || defaultAgentIcon.background,
+  }
+}
+
+export const getAgentIconKey = (icon: AgentIconSelection) => {
+  if (icon.type === 'emoji')
+    return `${icon.type}:${icon.icon}:${icon.background}`
+
+  if (icon.type === 'image')
+    return `${icon.type}:${icon.fileId}`
+
+  return `${icon.type}:${icon.icon}`
+}
diff --git a/web/features/agent-v2/roster/components/agent-roster-list.tsx b/web/features/agent-v2/roster/components/agent-roster-list.tsx
index f59632791e2..46f36effd9c 100644
--- a/web/features/agent-v2/roster/components/agent-roster-list.tsx
+++ b/web/features/agent-v2/roster/components/agent-roster-list.tsx
@@ -9,17 +9,15 @@ import {
   DropdownMenuSeparator,
   DropdownMenuTrigger,
 } from '@langgenius/dify-ui/dropdown-menu'
-import { toast } from '@langgenius/dify-ui/toast'
-import { useMutation } from '@tanstack/react-query'
 import { useId, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import AppIcon from '@/app/components/base/app-icon'
 import { SkeletonRectangle } from '@/app/components/base/skeleton'
 import useTimestamp from '@/hooks/use-timestamp'
 import Link from '@/next/link'
-import { consoleQuery } from '@/service/client'
 import { AgentWorkflowReferencesDropdown } from './agent-workflow-references-dropdown'
 import { DeleteAgentDialog } from './delete-agent-dialog'
+import { DuplicateAgentDialog } from './duplicate-agent-dialog'
 import { EditAgentDialog } from './edit-agent-dialog'
 
 type AgentRosterListProps = {
@@ -104,8 +102,10 @@ function AgentRosterItem({
   const nameId = useId()
   const descriptionId = useId()
   const [isEditOpen, setIsEditOpen] = useState(false)
+  const [editSessionKey, setEditSessionKey] = useState(0)
+  const [isDuplicateOpen, setIsDuplicateOpen] = useState(false)
+  const [duplicateSessionKey, setDuplicateSessionKey] = useState(0)
   const [isDeleteOpen, setIsDeleteOpen] = useState(false)
-  const duplicateAgentMutation = useMutation(consoleQuery.agent.byAgentId.copy.post.mutationOptions())
   const updatedAt = agent.updated_at != null
     ? formatTime(agent.updated_at, t('roster.dateTimeFormat'))
     : null
@@ -115,23 +115,15 @@ function AgentRosterItem({
   const isDraft = agent.active_config_is_published !== true
   const imageUrl = (agent.icon_type === 'image' || agent.icon_type === 'link') ? agent.icon : undefined
   const iconType = (imageUrl ? 'image' : agent.icon_type) as AgentIconType | null | undefined
-  const handleDuplicate = () => {
-    if (duplicateAgentMutation.isPending)
-      return
 
-    duplicateAgentMutation.mutate({
-      params: {
-        agent_id: agent.id,
-      },
-      body: {},
-    }, {
-      onSuccess: () => {
-        toast.success(t('roster.duplicateSuccess'))
-      },
-      onError: () => {
-        toast.error(t('roster.duplicateFailed'))
-      },
-    })
+  const handleEditOpen = () => {
+    setEditSessionKey(key => key + 1)
+    setIsEditOpen(true)
+  }
+
+  const handleDuplicateOpen = () => {
+    setDuplicateSessionKey(key => key + 1)
+    setIsDuplicateOpen(true)
   }
 
   return (
@@ -214,14 +206,13 @@ function AgentRosterItem({
             <span aria-hidden className="i-ri-more-fill size-4.5 text-text-tertiary" />
           </DropdownMenuTrigger>
           <DropdownMenuContent placement="bottom-end" sideOffset={4} popupClassName="w-40">
-            <DropdownMenuItem className="gap-2" onClick={() => setIsEditOpen(true)}>
+            <DropdownMenuItem className="gap-2" onClick={handleEditOpen}>
               <span aria-hidden className="i-ri-edit-line size-4 shrink-0 text-text-tertiary" />
               <span>{t('roster.editInfo')}</span>
             </DropdownMenuItem>
             <DropdownMenuItem
-              disabled={duplicateAgentMutation.isPending}
               className="gap-2"
-              onClick={handleDuplicate}
+              onClick={handleDuplicateOpen}
             >
               <span aria-hidden className="i-ri-file-copy-line size-4 shrink-0 text-text-tertiary" />
               <span>{tCommon('operation.duplicate')}</span>
@@ -238,7 +229,18 @@ function AgentRosterItem({
           </DropdownMenuContent>
         </DropdownMenu>
       </div>
-      <EditAgentDialog agent={agent} open={isEditOpen} onOpenChange={setIsEditOpen} />
+      <EditAgentDialog
+        agent={agent}
+        formKey={editSessionKey}
+        open={isEditOpen}
+        onOpenChange={setIsEditOpen}
+      />
+      <DuplicateAgentDialog
+        agent={agent}
+        formKey={duplicateSessionKey}
+        open={isDuplicateOpen}
+        onOpenChange={setIsDuplicateOpen}
+      />
       <DeleteAgentDialog agentId={agent.id} agentName={agent.name} open={isDeleteOpen} onOpenChange={setIsDeleteOpen} />
     </article>
   )
diff --git a/web/features/agent-v2/roster/components/create-agent-dialog.tsx b/web/features/agent-v2/roster/components/create-agent-dialog.tsx
index abda2faa6af..8d31016c54c 100644
--- a/web/features/agent-v2/roster/components/create-agent-dialog.tsx
+++ b/web/features/agent-v2/roster/components/create-agent-dialog.tsx
@@ -1,43 +1,36 @@
 'use client'
 
 import type { AgentAppCreatePayload } from '@dify/contracts/api/console/agent/types.gen'
-import type { AppIconSelection } from '@/app/components/base/app-icon-picker'
+import type { AgentFormValues, AgentIconSelection } from './agent-form'
 import { Button } from '@langgenius/dify-ui/button'
 import { Dialog, DialogCloseButton, DialogContent, DialogDescription, DialogTitle, DialogTrigger } from '@langgenius/dify-ui/dialog'
-import { FieldControl, FieldError, FieldLabel, FieldRoot } from '@langgenius/dify-ui/field'
 import { Form } from '@langgenius/dify-ui/form'
-import { Textarea } from '@langgenius/dify-ui/textarea'
 import { toast } from '@langgenius/dify-ui/toast'
 import { useMutation } from '@tanstack/react-query'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
-import AppIcon from '@/app/components/base/app-icon'
 import AppIconPicker from '@/app/components/base/app-icon-picker'
 import { consoleQuery } from '@/service/client'
-
-type AgentFormValues = {
-  description?: string
-  name?: string
-  role?: string
-}
-
-const defaultAgentIcon = {
-  type: 'emoji',
-  icon: '🧸',
-  background: '#F5F3FF',
-} satisfies AppIconSelection
+import { defaultAgentIcon } from './agent-form'
+import { AgentFormFields } from './agent-form-fields'
 
 export function CreateAgentDialog() {
   const { t } = useTranslation('agentV2')
   const { t: tCommon } = useTranslation('common')
   const [open, setOpen] = useState(false)
   const [formKey, setFormKey] = useState(0)
+  const [name, setName] = useState('')
+  const [description, setDescription] = useState('')
+  const [role, setRole] = useState('')
   const [iconPickerOpen, setIconPickerOpen] = useState(false)
-  const [agentIcon, setAgentIcon] = useState<AppIconSelection>(defaultAgentIcon)
+  const [agentIcon, setAgentIcon] = useState<AgentIconSelection>(defaultAgentIcon)
   const createAgentMutation = useMutation(consoleQuery.agent.post.mutationOptions())
 
   const resetForm = () => {
     setFormKey(key => key + 1)
+    setName('')
+    setDescription('')
+    setRole('')
     setAgentIcon(defaultAgentIcon)
     setIconPickerOpen(false)
   }
@@ -75,7 +68,7 @@ export function CreateAgentDialog() {
 
   return (
     <>
-      <Dialog open={open} onOpenChange={handleOpenChange}>
+      <Dialog open={open} onOpenChange={handleOpenChange} disablePointerDismissal>
         <DialogTrigger
           render={(
             <Button
@@ -88,7 +81,7 @@ export function CreateAgentDialog() {
           <span className="px-0.5 system-sm-medium">{t('roster.createAgent')}</span>
         </DialogTrigger>
         <DialogContent className="flex max-h-[calc(100dvh-2rem)] w-[520px] flex-col overflow-hidden! p-0!">
-          <DialogCloseButton className="top-5 right-5 size-8 rounded-lg" />
+          <DialogCloseButton />
           <div className="shrink-0 pt-6 pr-14 pb-3 pl-6">
             <DialogTitle className="title-2xl-semi-bold text-text-primary">
               {t('roster.createDialog.title')}
@@ -102,91 +95,17 @@ export function CreateAgentDialog() {
             className="min-h-0 flex-1"
             onFormSubmit={handleSubmit}
           >
-            <div className="space-y-5 px-6 py-3">
-              <div className="flex items-end gap-4 pb-2">
-                <button
-                  type="button"
-                  aria-label={t('roster.createForm.changeIcon')}
-                  className="shrink-0 rounded-full outline-hidden focus-visible:ring-2 focus-visible:ring-state-accent-solid"
-                  onClick={() => setIconPickerOpen(true)}
-                >
-                  <AppIcon
-                    size="xxl"
-                    rounded
-                    className="size-16 cursor-pointer"
-                    iconType={agentIcon.type}
-                    icon={agentIcon.type === 'image' ? agentIcon.fileId : agentIcon.icon}
-                    background={agentIcon.type === 'emoji' ? agentIcon.background : undefined}
-                    imageUrl={agentIcon.type === 'image' ? agentIcon.url : undefined}
-                  />
-                </button>
-                <div className="flex min-w-0 flex-1 gap-3 pb-1">
-                  <FieldRoot
-                    name="name"
-                    className="relative min-w-0 flex-1"
-                    validate={(value) => {
-                      if (typeof value === 'string' && value.length > 0 && !value.trim())
-                        return t('roster.createForm.nameRequired')
-
-                      return null
-                    }}
-                  >
-                    <FieldLabel>
-                      {t('roster.createForm.nameLabel')}
-                    </FieldLabel>
-                    <FieldControl
-                      autoComplete="off"
-                      // eslint-disable-next-line jsx-a11y/no-autofocus -- The create dialog opens from an explicit command, and the next expected action is naming the agent.
-                      autoFocus
-                      maxLength={255}
-                      placeholder={t('roster.createForm.namePlaceholder')}
-                      required
-                    />
-                    <div className="absolute top-full left-0 mt-1">
-                      <FieldError match="valueMissing">{t('roster.createForm.nameRequired')}</FieldError>
-                      <FieldError match="customError" />
-                    </div>
-                  </FieldRoot>
-                  <FieldRoot
-                    name="role"
-                    className="relative min-w-0 flex-1"
-                    validate={(value) => {
-                      if (typeof value === 'string' && value.length > 0 && !value.trim())
-                        return t('roster.createForm.roleRequired')
-
-                      return null
-                    }}
-                  >
-                    <FieldLabel>
-                      {t('roster.createForm.roleLabel')}
-                    </FieldLabel>
-                    <FieldControl
-                      autoComplete="off"
-                      maxLength={255}
-                      placeholder={t('roster.createForm.rolePlaceholder')}
-                      required
-                    />
-                    <div className="absolute top-full left-0 mt-1">
-                      <FieldError match="valueMissing">{t('roster.createForm.roleRequired')}</FieldError>
-                      <FieldError match="customError" />
-                    </div>
-                  </FieldRoot>
-                </div>
-              </div>
-              <FieldRoot name="description">
-                <FieldLabel>
-                  {t('roster.createForm.descriptionLabel')}
-                  <span className="ml-1 system-xs-regular text-text-tertiary">
-                    {t('roster.createForm.descriptionOptional')}
-                  </span>
-                </FieldLabel>
-                <Textarea
-                  autoComplete="off"
-                  className="h-20 resize-none"
-                  placeholder={t('roster.createForm.descriptionPlaceholder')}
-                />
-              </FieldRoot>
-            </div>
+            <AgentFormFields
+              description={description}
+              icon={agentIcon}
+              iconAriaLabel={t('roster.createForm.changeIcon')}
+              name={name}
+              role={role}
+              onDescriptionChange={setDescription}
+              onIconClick={() => setIconPickerOpen(true)}
+              onNameChange={setName}
+              onRoleChange={setRole}
+            />
             <div className="flex shrink-0 justify-end gap-2 px-6 pt-5 pb-6">
               <Button type="button" className="min-w-18" onClick={() => handleOpenChange(false)} disabled={createAgentMutation.isPending}>
                 {tCommon('operation.cancel')}
diff --git a/web/features/agent-v2/roster/components/duplicate-agent-dialog.tsx b/web/features/agent-v2/roster/components/duplicate-agent-dialog.tsx
new file mode 100644
index 00000000000..4a5efae43a4
--- /dev/null
+++ b/web/features/agent-v2/roster/components/duplicate-agent-dialog.tsx
@@ -0,0 +1,234 @@
+'use client'
+
+import type { AgentAppCopyPayload, AgentAppPartial } from '@dify/contracts/api/console/agent/types.gen'
+import type { AgentFormValues, AgentIconSelection } from './agent-form'
+import { Button } from '@langgenius/dify-ui/button'
+import { Dialog, DialogCloseButton, DialogContent, DialogDescription, DialogTitle } from '@langgenius/dify-ui/dialog'
+import { FieldControl, FieldError, FieldLabel, FieldRoot } from '@langgenius/dify-ui/field'
+import { Form } from '@langgenius/dify-ui/form'
+import { Textarea } from '@langgenius/dify-ui/textarea'
+import { toast } from '@langgenius/dify-ui/toast'
+import { useMutation, useQueryClient } from '@tanstack/react-query'
+import { useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import AppIcon from '@/app/components/base/app-icon'
+import AppIconPicker from '@/app/components/base/app-icon-picker'
+import { consoleQuery } from '@/service/client'
+import { createAgentIconSelection } from './agent-form'
+
+type DuplicateAgentDialogProps = {
+  agent: AgentAppPartial
+  formKey: number
+  open: boolean
+  onOpenChange: (open: boolean) => void
+}
+
+const getDefaultCopyName = (name: string) => {
+  const suffix = ' copy'
+  return `${name.slice(0, 255 - suffix.length)}${suffix}`
+}
+
+export function DuplicateAgentDialog({
+  agent,
+  formKey,
+  open,
+  onOpenChange,
+}: DuplicateAgentDialogProps) {
+  const { t } = useTranslation('agentV2')
+  const { t: tCommon } = useTranslation('common')
+  const queryClient = useQueryClient()
+  const latestAgent = queryClient.getQueryData<AgentAppPartial>(consoleQuery.agent.byAgentId.get.queryKey({
+    input: {
+      params: {
+        agent_id: agent.id,
+      },
+    },
+  })) ?? agent
+  const [renderedFormKey, setRenderedFormKey] = useState(formKey)
+  const [name, setName] = useState('')
+  const [description, setDescription] = useState(latestAgent.description ?? '')
+  const [role, setRole] = useState(latestAgent.role ?? '')
+  const [iconPickerOpen, setIconPickerOpen] = useState(false)
+  const [agentIcon, setAgentIcon] = useState<AgentIconSelection>(() => createAgentIconSelection(latestAgent))
+  const duplicateAgentMutation = useMutation(consoleQuery.agent.byAgentId.copy.post.mutationOptions())
+  const defaultCopyName = getDefaultCopyName(latestAgent.name)
+
+  if (formKey !== renderedFormKey) {
+    setRenderedFormKey(formKey)
+    setName('')
+    setDescription(latestAgent.description ?? '')
+    setRole(latestAgent.role ?? '')
+    setIconPickerOpen(false)
+    setAgentIcon(createAgentIconSelection(latestAgent))
+  }
+
+  const handleOpenChange = (nextOpen: boolean) => {
+    if (nextOpen) {
+      const currentAgent = queryClient.getQueryData<AgentAppPartial>(consoleQuery.agent.byAgentId.get.queryKey({
+        input: {
+          params: {
+            agent_id: agent.id,
+          },
+        },
+      })) ?? agent
+      setName('')
+      setDescription(currentAgent.description ?? '')
+      setRole(currentAgent.role ?? '')
+      setAgentIcon(createAgentIconSelection(currentAgent))
+    }
+    else {
+      setIconPickerOpen(false)
+    }
+    onOpenChange(nextOpen)
+  }
+
+  const handleSubmit = (formValues: AgentFormValues) => {
+    if (duplicateAgentMutation.isPending)
+      return
+
+    const trimmedName = formValues.name?.trim() ?? ''
+    const trimmedRole = formValues.role?.trim() ?? ''
+    const body: AgentAppCopyPayload = {
+      description: formValues.description?.trim() ?? '',
+      role: trimmedRole,
+      icon_type: agentIcon.type,
+      icon: agentIcon.type === 'image' ? agentIcon.fileId : agentIcon.icon,
+      icon_background: agentIcon.type === 'emoji' ? agentIcon.background : undefined,
+      ...(trimmedName ? { name: trimmedName } : {}),
+    }
+
+    duplicateAgentMutation.mutate({
+      params: {
+        agent_id: agent.id,
+      },
+      body,
+    }, {
+      onSuccess: () => {
+        toast.success(t('roster.duplicateSuccess'))
+        handleOpenChange(false)
+      },
+    })
+  }
+
+  return (
+    <>
+      <Dialog open={open} onOpenChange={handleOpenChange} disablePointerDismissal>
+        <DialogContent className="flex max-h-[calc(100dvh-2rem)] w-130 flex-col overflow-hidden! p-0!">
+          <DialogCloseButton />
+          <div className="shrink-0 pt-6 pr-14 pb-3 pl-6">
+            <DialogTitle className="title-2xl-semi-bold text-text-primary">
+              {t('roster.duplicateDialog.title')}
+            </DialogTitle>
+            <DialogDescription className="sr-only">
+              {t('roster.duplicateDialog.description', { name: latestAgent.name })}
+            </DialogDescription>
+          </div>
+          <Form<AgentFormValues>
+            key={formKey}
+            className="min-h-0 flex-1"
+            onFormSubmit={handleSubmit}
+          >
+            <div className="space-y-5 px-6 py-3">
+              <div className="flex items-end gap-4 pb-2">
+                <button
+                  type="button"
+                  aria-label={t('roster.duplicateForm.changeIcon', { name: latestAgent.name })}
+                  className="shrink-0 rounded-full outline-hidden focus-visible:ring-2 focus-visible:ring-state-accent-solid"
+                  onClick={() => setIconPickerOpen(true)}
+                >
+                  <AppIcon
+                    size="xxl"
+                    rounded
+                    className="size-16 cursor-pointer"
+                    iconType={agentIcon.type === 'link' ? 'image' : agentIcon.type}
+                    icon={agentIcon.type === 'emoji' ? agentIcon.icon : undefined}
+                    background={agentIcon.type === 'emoji' ? agentIcon.background : undefined}
+                    imageUrl={agentIcon.type === 'emoji' ? undefined : agentIcon.url}
+                  />
+                </button>
+                <div className="flex min-w-0 flex-1 gap-3 pb-1">
+                  <FieldRoot name="name" className="relative min-w-0 flex-1">
+                    <FieldLabel>
+                      {t('roster.createForm.nameLabel')}
+                      <span className="ml-1 system-xs-regular text-text-tertiary">
+                        {tCommon('label.optional')}
+                      </span>
+                    </FieldLabel>
+                    <FieldControl
+                      autoComplete="off"
+                      // eslint-disable-next-line jsx-a11y/no-autofocus -- The duplicate dialog opens from an explicit command, and naming the copy is the primary editable action.
+                      autoFocus
+                      maxLength={255}
+                      onValueChange={setName}
+                      placeholder={defaultCopyName}
+                      value={name}
+                    />
+                  </FieldRoot>
+                  <FieldRoot
+                    name="role"
+                    className="relative min-w-0 flex-1"
+                    validate={(value) => {
+                      if (typeof value === 'string' && value.length > 0 && !value.trim())
+                        return t('roster.createForm.roleRequired')
+
+                      return null
+                    }}
+                  >
+                    <FieldLabel>
+                      {t('roster.createForm.roleLabel')}
+                    </FieldLabel>
+                    <FieldControl
+                      autoComplete="off"
+                      maxLength={255}
+                      onValueChange={setRole}
+                      placeholder={t('roster.createForm.rolePlaceholder')}
+                      required
+                      value={role}
+                    />
+                    <div className="absolute top-full left-0 mt-1">
+                      <FieldError match="valueMissing">{t('roster.createForm.roleRequired')}</FieldError>
+                      <FieldError match="customError" />
+                    </div>
+                  </FieldRoot>
+                </div>
+              </div>
+              <FieldRoot name="description">
+                <FieldLabel>
+                  {t('roster.createForm.descriptionLabel')}
+                </FieldLabel>
+                <Textarea
+                  autoComplete="off"
+                  className="h-20 resize-none"
+                  onValueChange={setDescription}
+                  placeholder={t('roster.createForm.descriptionPlaceholder')}
+                  value={description}
+                />
+              </FieldRoot>
+            </div>
+            <div className="flex shrink-0 justify-end gap-2 px-6 pt-5 pb-6">
+              <Button type="button" className="min-w-18" onClick={() => handleOpenChange(false)} disabled={duplicateAgentMutation.isPending}>
+                {tCommon('operation.cancel')}
+              </Button>
+              <Button
+                type="submit"
+                variant="primary"
+                className="min-w-18"
+                loading={duplicateAgentMutation.isPending}
+              >
+                {tCommon('operation.duplicate')}
+              </Button>
+            </div>
+          </Form>
+        </DialogContent>
+      </Dialog>
+      <AppIconPicker
+        open={iconPickerOpen}
+        initialEmoji={agentIcon.type === 'emoji'
+          ? { icon: agentIcon.icon, background: agentIcon.background }
+          : undefined}
+        onOpenChange={setIconPickerOpen}
+        onSelect={setAgentIcon}
+      />
+    </>
+  )
+}
diff --git a/web/features/agent-v2/roster/components/edit-agent-dialog.tsx b/web/features/agent-v2/roster/components/edit-agent-dialog.tsx
index 3688476972a..222761dc386 100644
--- a/web/features/agent-v2/roster/components/edit-agent-dialog.tsx
+++ b/web/features/agent-v2/roster/components/edit-agent-dialog.tsx
@@ -1,78 +1,26 @@
 'use client'
 
 import type { AgentAppPartial, AgentAppUpdatePayload } from '@dify/contracts/api/console/agent/types.gen'
-import type { AppIconSelection } from '@/app/components/base/app-icon-picker'
+import type { AgentFormValues, AgentIconSelection } from './agent-form'
 import { Button } from '@langgenius/dify-ui/button'
 import { Dialog, DialogCloseButton, DialogContent, DialogDescription, DialogTitle } from '@langgenius/dify-ui/dialog'
-import { FieldControl, FieldError, FieldLabel, FieldRoot } from '@langgenius/dify-ui/field'
 import { Form } from '@langgenius/dify-ui/form'
-import { Textarea } from '@langgenius/dify-ui/textarea'
 import { toast } from '@langgenius/dify-ui/toast'
 import { useMutation } from '@tanstack/react-query'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
-import AppIcon from '@/app/components/base/app-icon'
 import AppIconPicker from '@/app/components/base/app-icon-picker'
 import { consoleQuery } from '@/service/client'
+import { createAgentIconSelection, getAgentIconKey } from './agent-form'
+import { AgentFormFields } from './agent-form-fields'
 
 type EditAgentDialogProps = {
   agent: AgentAppPartial
+  formKey: number
   open: boolean
   onOpenChange: (open: boolean) => void
 }
 
-type AgentFormValues = {
-  description?: string
-  name?: string
-  role?: string
-}
-
-type AgentIconSelection = AppIconSelection | {
-  type: 'link'
-  icon: string
-  url: string
-}
-
-const defaultAgentIcon = {
-  type: 'emoji',
-  icon: '🧸',
-  background: '#F5F3FF',
-} satisfies AppIconSelection
-
-const createAgentIconSelection = (agent: AgentAppPartial): AgentIconSelection => {
-  if (agent.icon_type === 'image' && agent.icon) {
-    return {
-      type: 'image',
-      fileId: agent.icon,
-      url: agent.icon,
-    }
-  }
-
-  if (agent.icon_type === 'link' && agent.icon) {
-    return {
-      type: 'link',
-      icon: agent.icon,
-      url: agent.icon,
-    }
-  }
-
-  return {
-    type: 'emoji',
-    icon: agent.icon || defaultAgentIcon.icon,
-    background: agent.icon_background || defaultAgentIcon.background,
-  }
-}
-
-const getAgentIconKey = (icon: AgentIconSelection) => {
-  if (icon.type === 'emoji')
-    return `${icon.type}:${icon.icon}:${icon.background}`
-
-  if (icon.type === 'image')
-    return `${icon.type}:${icon.fileId}`
-
-  return `${icon.type}:${icon.icon}`
-}
-
 const applyIconPayload = (body: AgentAppUpdatePayload, icon: AgentIconSelection) => {
   if (icon.type === 'emoji') {
     body.icon_type = icon.type
@@ -88,11 +36,13 @@ const applyIconPayload = (body: AgentAppUpdatePayload, icon: AgentIconSelection)
 
 export function EditAgentDialog({
   agent,
+  formKey,
   open,
   onOpenChange,
 }: EditAgentDialogProps) {
   const { t } = useTranslation('agentV2')
   const { t: tCommon } = useTranslation('common')
+  const [renderedFormKey, setRenderedFormKey] = useState(formKey)
   const [name, setName] = useState(agent.name)
   const [description, setDescription] = useState(agent.description ?? '')
   const [role, setRole] = useState(agent.role ?? '')
@@ -100,6 +50,28 @@ export function EditAgentDialog({
   const [agentIcon, setAgentIcon] = useState<AgentIconSelection>(() => createAgentIconSelection(agent))
   const updateAgentMutation = useMutation(consoleQuery.agent.byAgentId.put.mutationOptions())
 
+  if (formKey !== renderedFormKey) {
+    setRenderedFormKey(formKey)
+    setName(agent.name)
+    setDescription(agent.description ?? '')
+    setRole(agent.role ?? '')
+    setIconPickerOpen(false)
+    setAgentIcon(createAgentIconSelection(agent))
+  }
+
+  const handleOpenChange = (nextOpen: boolean) => {
+    if (nextOpen) {
+      setName(agent.name)
+      setDescription(agent.description ?? '')
+      setRole(agent.role ?? '')
+      setAgentIcon(createAgentIconSelection(agent))
+    }
+    else {
+      setIconPickerOpen(false)
+    }
+    onOpenChange(nextOpen)
+  }
+
   const handleSubmit = (formValues: AgentFormValues) => {
     const trimmedName = formValues.name?.trim() ?? ''
     const trimmedDescription = formValues.description?.trim() ?? ''
@@ -134,24 +106,11 @@ export function EditAgentDialog({
     }, {
       onSuccess: () => {
         toast.success(t('roster.updateSuccess'))
-        onOpenChange(false)
+        handleOpenChange(false)
       },
     })
   }
 
-  const handleOpenChange = (nextOpen: boolean) => {
-    if (nextOpen) {
-      setName(agent.name)
-      setDescription(agent.description ?? '')
-      setRole(agent.role ?? '')
-      setAgentIcon(createAgentIconSelection(agent))
-    }
-    else {
-      setIconPickerOpen(false)
-    }
-    onOpenChange(nextOpen)
-  }
-
   const trimmedName = name.trim()
   const trimmedDescription = description.trim()
   const trimmedRole = role.trim()
@@ -163,9 +122,9 @@ export function EditAgentDialog({
 
   return (
     <>
-      <Dialog open={open} onOpenChange={handleOpenChange}>
-        <DialogContent className="flex max-h-[calc(100dvh-2rem)] w-[520px] flex-col overflow-hidden! p-0!">
-          <DialogCloseButton className="top-5 right-5 size-8 rounded-lg" />
+      <Dialog open={open} onOpenChange={handleOpenChange} disablePointerDismissal>
+        <DialogContent className="flex max-h-[calc(100dvh-2rem)] w-130 flex-col overflow-hidden! p-0!">
+          <DialogCloseButton />
           <div className="shrink-0 pt-6 pr-14 pb-3 pl-6">
             <DialogTitle className="title-2xl-semi-bold text-text-primary">
               {t('roster.editDialog.title')}
@@ -175,102 +134,23 @@ export function EditAgentDialog({
             </DialogDescription>
           </div>
           <Form<AgentFormValues>
+            key={formKey}
             className="min-h-0 flex-1"
             onFormSubmit={handleSubmit}
           >
-            <div className="space-y-5 px-6 py-3">
-              <div className="flex items-end gap-4 pb-2">
-                <button
-                  type="button"
-                  aria-label={t('roster.editAgent', { name: agent.name })}
-                  className="shrink-0 rounded-full outline-hidden focus-visible:ring-2 focus-visible:ring-state-accent-solid"
-                  onClick={() => setIconPickerOpen(true)}
-                >
-                  <AppIcon
-                    size="xxl"
-                    rounded
-                    className="size-16 cursor-pointer"
-                    iconType={agentIcon.type === 'link' ? 'image' : agentIcon.type}
-                    icon={agentIcon.type === 'emoji' ? agentIcon.icon : undefined}
-                    background={agentIcon.type === 'emoji' ? agentIcon.background : undefined}
-                    imageUrl={agentIcon.type === 'emoji' ? undefined : agentIcon.url}
-                  />
-                </button>
-                <div className="flex min-w-0 flex-1 gap-3 pb-1">
-                  <FieldRoot
-                    name="name"
-                    className="relative min-w-0 flex-1"
-                    validate={(value) => {
-                      if (typeof value === 'string' && value.length > 0 && !value.trim())
-                        return t('roster.createForm.nameRequired')
-
-                      return null
-                    }}
-                  >
-                    <FieldLabel>
-                      {t('roster.createForm.nameLabel')}
-                    </FieldLabel>
-                    <FieldControl
-                      autoComplete="off"
-                      // eslint-disable-next-line jsx-a11y/no-autofocus -- The edit dialog opens from an explicit command, and the name field is the primary editable control.
-                      autoFocus
-                      maxLength={255}
-                      onValueChange={setName}
-                      placeholder={t('roster.createForm.namePlaceholder')}
-                      required
-                      value={name}
-                    />
-                    <div className="absolute top-full left-0 mt-1">
-                      <FieldError match="valueMissing">{t('roster.createForm.nameRequired')}</FieldError>
-                      <FieldError match="customError" />
-                    </div>
-                  </FieldRoot>
-                  <FieldRoot
-                    name="role"
-                    className="relative min-w-0 flex-1"
-                    validate={(value) => {
-                      if (typeof value === 'string' && value.length > 0 && !value.trim())
-                        return t('roster.createForm.roleRequired')
-
-                      return null
-                    }}
-                  >
-                    <FieldLabel>
-                      {t('roster.createForm.roleLabel')}
-                    </FieldLabel>
-                    <FieldControl
-                      autoComplete="off"
-                      maxLength={255}
-                      onValueChange={setRole}
-                      placeholder={t('roster.createForm.rolePlaceholder')}
-                      required
-                      value={role}
-                    />
-                    <div className="absolute top-full left-0 mt-1">
-                      <FieldError match="valueMissing">{t('roster.createForm.roleRequired')}</FieldError>
-                      <FieldError match="customError" />
-                    </div>
-                  </FieldRoot>
-                </div>
-              </div>
-              <FieldRoot name="description">
-                <FieldLabel>
-                  {t('roster.createForm.descriptionLabel')}
-                  <span className="ml-1 system-xs-regular text-text-tertiary">
-                    {t('roster.createForm.descriptionOptional')}
-                  </span>
-                </FieldLabel>
-                <Textarea
-                  autoComplete="off"
-                  className="h-20 resize-none"
-                  onValueChange={setDescription}
-                  placeholder={t('roster.createForm.descriptionPlaceholder')}
-                  value={description}
-                />
-              </FieldRoot>
-            </div>
+            <AgentFormFields
+              description={description}
+              icon={agentIcon}
+              iconAriaLabel={t('roster.editAgent', { name: agent.name })}
+              name={name}
+              role={role}
+              onDescriptionChange={setDescription}
+              onIconClick={() => setIconPickerOpen(true)}
+              onNameChange={setName}
+              onRoleChange={setRole}
+            />
             <div className="flex shrink-0 justify-end gap-2 px-6 pt-5 pb-6">
-              <Button type="button" className="min-w-18" onClick={() => onOpenChange(false)} disabled={updateAgentMutation.isPending}>
+              <Button type="button" className="min-w-18" onClick={() => handleOpenChange(false)} disabled={updateAgentMutation.isPending}>
                 {tCommon('operation.cancel')}
               </Button>
               <Button
diff --git a/web/features/agent-v2/roster/page.tsx b/web/features/agent-v2/roster/page.tsx
index c4f75470df6..2527c0875b5 100644
--- a/web/features/agent-v2/roster/page.tsx
+++ b/web/features/agent-v2/roster/page.tsx
@@ -84,7 +84,7 @@ export default function RosterPage() {
   useDocumentTitle(tCommon('menus.roster'))
 
   return (
-    <main className="flex h-0 min-w-0 grow flex-col overflow-hidden bg-background-body">
+    <div className="flex h-0 min-w-0 grow flex-col overflow-hidden bg-background-body">
       <Tabs defaultValue="agent" className="flex min-h-0 flex-1 flex-col">
         <div className="h-25.5 shrink-0 bg-background-body px-8 pt-4 pb-4">
           <div className="flex min-w-0 items-center justify-between gap-4">
@@ -145,6 +145,6 @@ export default function RosterPage() {
           </ScrollAreaRoot>
         </TabsPanel>
       </Tabs>
-    </main>
+    </div>
   )
 }
diff --git a/web/features/deployments/components/deployment-actions/__tests__/state.spec.ts b/web/features/deployments/components/deployment-actions/__tests__/state.spec.ts
new file mode 100644
index 00000000000..0137a339d1a
--- /dev/null
+++ b/web/features/deployments/components/deployment-actions/__tests__/state.spec.ts
@@ -0,0 +1,222 @@
+import type { Getter } from 'jotai/vanilla'
+import { skipToken } from '@tanstack/react-query'
+import { atom, createStore } from 'jotai'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+type QueryOptions = {
+  enabled?: boolean
+  input?: unknown
+  queryKey?: readonly unknown[]
+}
+
+type QueryResult = {
+  data?: unknown
+}
+
+type MutationOptions = {
+  mutationKey?: readonly string[]
+}
+
+type MutationResult = {
+  isPending: boolean
+  mutate: ReturnType<typeof vi.fn>
+  mutateAsync: ReturnType<typeof vi.fn>
+}
+
+const mockQueryResults = vi.hoisted(() => ({
+  current: new Map<string, QueryResult>(),
+}))
+
+const mockUpdateMutation = vi.hoisted<{ current: MutationResult }>(() => ({
+  current: {
+    isPending: false,
+    mutate: vi.fn(),
+    mutateAsync: vi.fn(),
+  },
+}))
+
+const mockDeleteMutation = vi.hoisted<{ current: MutationResult }>(() => ({
+  current: {
+    isPending: false,
+    mutate: vi.fn(),
+    mutateAsync: vi.fn(),
+  },
+}))
+
+vi.mock('jotai-tanstack-query', () => ({
+  atomWithQuery: (createOptions: (get: Getter) => QueryOptions) => atom((get) => {
+    const options = createOptions(get)
+    const queryName = String(options.queryKey?.[0] ?? 'unknown')
+    const queryResult = options.enabled === false
+      ? undefined
+      : mockQueryResults.current.get(queryName)
+
+    return {
+      ...options,
+      data: queryResult?.data,
+      isError: false,
+      isFetching: false,
+      isLoading: false,
+      isSuccess: Boolean(queryResult?.data),
+    }
+  }),
+  atomWithMutation: (createOptions: () => MutationOptions) => atom(() => {
+    const options = createOptions()
+    return options.mutationKey?.[0] === 'deleteAppInstance'
+      ? mockDeleteMutation.current
+      : mockUpdateMutation.current
+  }),
+}))
+
+vi.mock('@/service/client', () => ({
+  consoleQuery: {
+    enterprise: {
+      appInstanceService: {
+        getAppInstance: {
+          queryOptions: (options: QueryOptions) => ({
+            ...options,
+            queryKey: ['getAppInstance', options.input],
+          }),
+        },
+        updateAppInstance: {
+          mutationOptions: () => ({ mutationKey: ['updateAppInstance'] }),
+        },
+        deleteAppInstance: {
+          mutationOptions: () => ({ mutationKey: ['deleteAppInstance'] }),
+        },
+      },
+    },
+  },
+}))
+
+async function loadState() {
+  return await import('../state')
+}
+
+async function mountedStore() {
+  const state = await loadState()
+  const store = createStore()
+  const unsubscribe = store.sub(state.editDeploymentFormCanSaveAtom, () => undefined)
+
+  store.set(state.deploymentActionAppInstanceIdHydrationAtom, 'app-instance-1')
+
+  return {
+    state,
+    store,
+    unsubscribe,
+  }
+}
+
+function setAppInstance(overrides: Record<string, unknown> = {}) {
+  mockQueryResults.current.set('getAppInstance', {
+    data: {
+      appInstance: {
+        id: 'app-instance-1',
+        displayName: 'Deployment 1',
+        description: 'Initial description',
+        ...overrides,
+      },
+    },
+  })
+}
+
+describe('deployment action state', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockQueryResults.current.clear()
+    mockUpdateMutation.current = {
+      isPending: false,
+      mutate: vi.fn(),
+      mutateAsync: vi.fn(),
+    }
+    mockDeleteMutation.current = {
+      isPending: false,
+      mutate: vi.fn(),
+      mutateAsync: vi.fn(),
+    }
+  })
+
+  it('should fetch app instance data only while an action dialog is open', async () => {
+    const { state, store, unsubscribe } = await mountedStore()
+
+    expect(store.get(state.deploymentActionAppInstanceQueryAtom)).toMatchObject({
+      enabled: false,
+      input: skipToken,
+    })
+
+    store.set(state.editDeploymentDialogOpenAtom, true)
+    expect(store.get(state.deploymentActionAppInstanceQueryAtom)).toMatchObject({
+      enabled: true,
+      input: { params: { appInstanceId: 'app-instance-1' } },
+    })
+
+    store.set(state.editDeploymentDialogOpenAtom, false)
+    store.set(state.deleteDeploymentDialogOpenAtom, true)
+    expect(store.get(state.deploymentActionAppInstanceQueryAtom)).toMatchObject({
+      enabled: true,
+      input: { params: { appInstanceId: 'app-instance-1' } },
+    })
+
+    unsubscribe()
+  })
+
+  it('should keep an edit dialog open while update is pending', async () => {
+    const { state, store, unsubscribe } = await mountedStore()
+    mockUpdateMutation.current = {
+      isPending: true,
+      mutate: vi.fn(),
+      mutateAsync: vi.fn(),
+    }
+    store.set(state.editDeploymentDialogOpenAtom, true)
+
+    store.set(state.setEditDeploymentDialogOpenAtom, false)
+
+    expect(store.get(state.editDeploymentDialogOpenAtom)).toBe(true)
+
+    unsubscribe()
+  })
+
+  it('should submit edited deployment metadata with trimmed values', async () => {
+    const { state, store, unsubscribe } = await mountedStore()
+    const response = { appInstance: { id: 'app-instance-1' } }
+    setAppInstance()
+    mockUpdateMutation.current.mutateAsync.mockResolvedValue(response)
+    store.set(state.editDeploymentDialogOpenAtom, true)
+    store.set(state.editDeploymentNameFieldAtom, ' Deployment 2 ')
+    store.set(state.editDeploymentDescriptionFieldAtom, ' Updated description ')
+
+    const result = await store.set(state.submitEditDeploymentFormAtom)
+
+    expect(result).toBe(true)
+    expect(mockUpdateMutation.current.mutateAsync).toHaveBeenCalledWith({
+      params: {
+        appInstanceId: 'app-instance-1',
+      },
+      body: {
+        appInstanceId: 'app-instance-1',
+        displayName: 'Deployment 2',
+        description: 'Updated description',
+      },
+    })
+
+    unsubscribe()
+  })
+
+  it('should submit delete with the hydrated app instance id and caller callbacks', async () => {
+    const { state, store, unsubscribe } = await mountedStore()
+    const onSuccess = vi.fn()
+
+    store.set(state.submitDeleteDeploymentInstanceAtom, { onSuccess })
+
+    expect(mockDeleteMutation.current.mutate).toHaveBeenCalledWith(
+      {
+        params: {
+          appInstanceId: 'app-instance-1',
+        },
+      },
+      { onSuccess },
+    )
+
+    unsubscribe()
+  })
+})
diff --git a/web/features/deployments/components/deployment-actions/delete-dialog.tsx b/web/features/deployments/components/deployment-actions/delete-dialog.tsx
index e2a79e060b6..6af38106365 100644
--- a/web/features/deployments/components/deployment-actions/delete-dialog.tsx
+++ b/web/features/deployments/components/deployment-actions/delete-dialog.tsx
@@ -10,47 +10,37 @@ import {
   AlertDialogTitle,
 } from '@langgenius/dify-ui/alert-dialog'
 import { toast } from '@langgenius/dify-ui/toast'
-import { useMutation } from '@tanstack/react-query'
+import { useAtom, useAtomValue, useSetAtom } from 'jotai'
 import { useTranslation } from 'react-i18next'
 import { useRouter } from '@/next/navigation'
-import { consoleQuery } from '@/service/client'
+import {
+  deleteDeploymentDialogOpenAtom,
+  deleteDeploymentInstanceMutationAtom,
+  deploymentActionDisplayNameAtom,
+  submitDeleteDeploymentInstanceAtom,
+} from './state'
 
-export function DeleteDeploymentDialog({
-  appInstanceId,
-  appName,
-  open,
-  onOpenChange,
-}: {
-  appInstanceId: string
-  appName?: string
-  open: boolean
-  onOpenChange: (open: boolean) => void
-}) {
+export function DeleteDeploymentDialog() {
   const { t } = useTranslation('deployments')
   const router = useRouter()
-  const deleteInstance = useMutation(consoleQuery.enterprise.appInstanceService.deleteAppInstance.mutationOptions())
-  const displayName = appName || appInstanceId
+  const [open, setOpen] = useAtom(deleteDeploymentDialogOpenAtom)
+  const deleteInstance = useAtomValue(deleteDeploymentInstanceMutationAtom)
+  const submitDeleteInstance = useSetAtom(submitDeleteDeploymentInstanceAtom)
+  const displayName = useAtomValue(deploymentActionDisplayNameAtom)
 
   function handleDelete() {
-    deleteInstance.mutate(
-      {
-        params: {
-          appInstanceId,
-        },
+    submitDeleteInstance({
+      onSuccess: () => {
+        toast.success(t('settings.deleted'))
+        router.push('/deployments')
       },
-      {
-        onSuccess: () => {
-          toast.success(t('settings.deleted'))
-          router.push('/deployments')
-        },
-        onError: () => {
-          toast.error(t('settings.deleteFailed'))
-        },
-        onSettled: () => {
-          onOpenChange(false)
-        },
+      onError: () => {
+        toast.error(t('settings.deleteFailed'))
       },
-    )
+      onSettled: () => {
+        setOpen(false)
+      },
+    })
   }
 
   return (
@@ -59,7 +49,7 @@ export function DeleteDeploymentDialog({
       onOpenChange={(nextOpen) => {
         if (!nextOpen && deleteInstance.isPending)
           return
-        onOpenChange(nextOpen)
+        setOpen(nextOpen)
       }}
     >
       <AlertDialogContent className="w-120">
diff --git a/web/features/deployments/components/deployment-actions/edit-dialog.tsx b/web/features/deployments/components/deployment-actions/edit-dialog.tsx
index a1a367022a1..b433771b4e5 100644
--- a/web/features/deployments/components/deployment-actions/edit-dialog.tsx
+++ b/web/features/deployments/components/deployment-actions/edit-dialog.tsx
@@ -1,6 +1,5 @@
 'use client'
 
-import type { AppInstance } from '@dify/contracts/enterprise/types.gen'
 import type { FormEvent } from 'react'
 import { Button } from '@langgenius/dify-ui/button'
 import {
@@ -12,16 +11,22 @@ import {
 import { Input } from '@langgenius/dify-ui/input'
 import { Textarea } from '@langgenius/dify-ui/textarea'
 import { toast } from '@langgenius/dify-ui/toast'
-import { useMutation, useQuery } from '@tanstack/react-query'
-import { useState } from 'react'
+import { useAtom, useAtomValue, useSetAtom } from 'jotai'
+import { ScopeProvider } from 'jotai-scope'
 import { useTranslation } from 'react-i18next'
 import { SkeletonRectangle, SkeletonRow } from '@/app/components/base/skeleton'
-import { consoleQuery } from '@/service/client'
-
-type EditDeploymentFormValues = {
-  name: string
-  description: string
-}
+import {
+  deploymentActionAppInstanceQueryAtom,
+  editDeploymentDescriptionFieldAtom,
+  editDeploymentDialogOpenAtom,
+  editDeploymentFormAtom,
+  editDeploymentFormCanSaveAtom,
+  editDeploymentFormSavePendingAtom,
+  editDeploymentNameFieldAtom,
+  setEditDeploymentDialogOpenAtom,
+  submitEditDeploymentFormAtom,
+  updateDeploymentInstanceMutationAtom,
+} from './state'
 
 function EditDeploymentFormSkeleton() {
   return (
@@ -42,35 +47,34 @@ function EditDeploymentFormSkeleton() {
   )
 }
 
-function EditDeploymentForm({
-  app,
-  isSaving,
-  onClose,
-  onSubmit,
-}: {
-  app: AppInstance
-  isSaving: boolean
-  onClose: () => void
-  onSubmit: (values: EditDeploymentFormValues) => void
-}) {
+function EditDeploymentForm() {
   const { t } = useTranslation('deployments')
-  const initialName = app.displayName
-  const initialDescription = app.description
-  const [name, setName] = useState(initialName)
-  const [description, setDescription] = useState(initialDescription)
-  const normalizedName = name.trim()
-  const normalizedDescription = description.trim()
-  const canSave = Boolean(normalizedName && (normalizedName !== initialName || normalizedDescription !== initialDescription) && !isSaving)
+  const [nameField, setNameField] = useAtom(editDeploymentNameFieldAtom)
+  const [descriptionField, setDescriptionField] = useAtom(editDeploymentDescriptionFieldAtom)
+  const canSave = useAtomValue(editDeploymentFormCanSaveAtom)
+  const savePending = useAtomValue(editDeploymentFormSavePendingAtom)
+  const submitEditDeploymentForm = useSetAtom(submitEditDeploymentFormAtom)
+  const requestOpenChange = useSetAtom(setEditDeploymentDialogOpenAtom)
+  const setOpen = useSetAtom(editDeploymentDialogOpenAtom)
 
-  function handleSubmit(event: FormEvent<HTMLFormElement>) {
+  async function handleSubmit(event: FormEvent<HTMLFormElement>) {
     event.preventDefault()
+    event.stopPropagation()
+
     if (!canSave)
       return
 
-    onSubmit({
-      name: normalizedName,
-      description: normalizedDescription,
-    })
+    try {
+      const didSubmit = await submitEditDeploymentForm()
+      if (!didSubmit)
+        return
+
+      toast.success(t('settings.updated'))
+      setOpen(false)
+    }
+    catch {
+      toast.error(t('settings.updateFailed'))
+    }
   }
 
   return (
@@ -81,9 +85,10 @@ function EditDeploymentForm({
         </label>
         <Input
           id="deployment-edit-name"
+          name="name"
           type="text"
-          value={name}
-          onChange={event => setName(event.target.value)}
+          value={nameField.value}
+          onChange={event => setNameField(event.target.value)}
           className="h-8"
         />
       </div>
@@ -93,8 +98,9 @@ function EditDeploymentForm({
         </label>
         <Textarea
           id="deployment-edit-description"
-          value={description}
-          onValueChange={setDescription}
+          name="description"
+          value={descriptionField.value}
+          onValueChange={value => setDescriptionField(value)}
           className="min-h-24"
         />
       </div>
@@ -102,8 +108,8 @@ function EditDeploymentForm({
         <Button
           type="button"
           variant="secondary"
-          disabled={isSaving}
-          onClick={onClose}
+          disabled={savePending}
+          onClick={() => requestOpenChange(false)}
         >
           {t('createModal.cancel')}
         </Button>
@@ -111,7 +117,7 @@ function EditDeploymentForm({
           type="submit"
           variant="primary"
           disabled={!canSave}
-          loading={isSaving}
+          loading={savePending}
         >
           {t('settings.save')}
         </Button>
@@ -120,62 +126,17 @@ function EditDeploymentForm({
   )
 }
 
-export function EditDeploymentDialog({
-  appInstanceId,
-  open,
-  onOpenChange,
-}: {
-  appInstanceId: string
-  open: boolean
-  onOpenChange: (open: boolean) => void
-}) {
+export function EditDeploymentDialog() {
   const { t } = useTranslation('deployments')
-  const updateInstance = useMutation(consoleQuery.enterprise.appInstanceService.updateAppInstance.mutationOptions())
-  const instanceQuery = useQuery(consoleQuery.enterprise.appInstanceService.getAppInstance.queryOptions({
-    input: {
-      params: { appInstanceId },
-    },
-    enabled: open,
-  }))
+  const open = useAtomValue(editDeploymentDialogOpenAtom)
+  const setOpen = useSetAtom(setEditDeploymentDialogOpenAtom)
+  const updateInstance = useAtomValue(updateDeploymentInstanceMutationAtom)
+  const instanceQuery = useAtomValue(deploymentActionAppInstanceQueryAtom)
   const app = instanceQuery.data?.appInstance
   const formKey = app ? `${app.id}-${app.displayName}-${app.description}` : 'loading'
 
-  function handleOpenChange(nextOpen: boolean) {
-    if (!nextOpen && updateInstance.isPending)
-      return
-    onOpenChange(nextOpen)
-  }
-
-  function handleClose() {
-    handleOpenChange(false)
-  }
-
-  function handleSubmit(values: EditDeploymentFormValues) {
-    updateInstance.mutate(
-      {
-        params: {
-          appInstanceId,
-        },
-        body: {
-          appInstanceId,
-          displayName: values.name,
-          description: values.description || undefined,
-        },
-      },
-      {
-        onSuccess: () => {
-          toast.success(t('settings.updated'))
-          onOpenChange(false)
-        },
-        onError: () => {
-          toast.error(t('settings.updateFailed'))
-        },
-      },
-    )
-  }
-
   return (
-    <Dialog open={open} onOpenChange={handleOpenChange}>
+    <Dialog open={open} onOpenChange={setOpen}>
       <DialogContent className="w-120 max-w-[calc(100vw-32px)] p-0">
         <DialogCloseButton disabled={updateInstance.isPending} />
         <div className="border-b border-divider-subtle px-6 py-5">
@@ -190,13 +151,17 @@ export function EditDeploymentDialog({
               ? <div className="system-sm-regular text-text-tertiary">{t('common.loadFailed')}</div>
               : app
                 ? (
-                    <EditDeploymentForm
+                    <ScopeProvider
                       key={formKey}
-                      app={app}
-                      isSaving={updateInstance.isPending}
-                      onClose={handleClose}
-                      onSubmit={handleSubmit}
-                    />
+                      atoms={[
+                        editDeploymentFormAtom,
+                        [editDeploymentNameFieldAtom, app.displayName],
+                        [editDeploymentDescriptionFieldAtom, app.description],
+                      ]}
+                      name="EditDeploymentForm"
+                    >
+                      <EditDeploymentForm />
+                    </ScopeProvider>
                   )
                 : <div className="system-sm-regular text-text-tertiary">{t('detail.notFound')}</div>}
         </div>
diff --git a/web/features/deployments/components/deployment-actions/index.spec.tsx b/web/features/deployments/components/deployment-actions/index.spec.tsx
index 42229edd338..39098c77e08 100644
--- a/web/features/deployments/components/deployment-actions/index.spec.tsx
+++ b/web/features/deployments/components/deployment-actions/index.spec.tsx
@@ -4,13 +4,31 @@ import { DeploymentActionsMenu } from './index'
 
 vi.mock('@langgenius/dify-ui/dropdown-menu', () => import('@/__mocks__/base-ui-dropdown-menu'))
 
-vi.mock('./edit-dialog', () => ({
-  EditDeploymentDialog: () => null,
-}))
+vi.mock('./edit-dialog', async () => {
+  const { useAtomValue } = await import('jotai')
+  const { editDeploymentDialogOpenAtom } = await import('./state')
 
-vi.mock('./delete-dialog', () => ({
-  DeleteDeploymentDialog: () => null,
-}))
+  return {
+    EditDeploymentDialog: () => {
+      const open = useAtomValue(editDeploymentDialogOpenAtom)
+
+      return <div data-testid="edit-dialog" data-open={String(open)} />
+    },
+  }
+})
+
+vi.mock('./delete-dialog', async () => {
+  const { useAtomValue } = await import('jotai')
+  const { deleteDeploymentDialogOpenAtom } = await import('./state')
+
+  return {
+    DeleteDeploymentDialog: () => {
+      const open = useAtomValue(deleteDeploymentDialogOpenAtom)
+
+      return <div data-testid="delete-dialog" data-open={String(open)} />
+    },
+  }
+})
 
 describe('DeploymentActionsMenu', () => {
   it('keeps the trigger wrapper visible while the menu is open', () => {
@@ -31,4 +49,52 @@ describe('DeploymentActionsMenu', () => {
     expect(wrapper).toHaveClass('pointer-events-auto', 'opacity-100')
     expect(wrapper).not.toHaveClass('pointer-events-none', 'opacity-0')
   })
+
+  it('keeps edit and delete dialog open state independent', () => {
+    render(
+      <DeploymentActionsMenu
+        appInstanceId="app-instance-1"
+        placement="bottom-end"
+      />,
+    )
+
+    fireEvent.click(screen.getByTestId('dropdown-menu-trigger'))
+    fireEvent.click(screen.getByText('deployments.card.menu.editInfo'))
+    expect(screen.getByTestId('edit-dialog')).toHaveAttribute('data-open', 'true')
+    expect(screen.getByTestId('delete-dialog')).toHaveAttribute('data-open', 'false')
+
+    fireEvent.click(screen.getByTestId('dropdown-menu-trigger'))
+    fireEvent.click(screen.getByText('deployments.card.menu.delete'))
+    expect(screen.getByTestId('edit-dialog')).toHaveAttribute('data-open', 'true')
+    expect(screen.getByTestId('delete-dialog')).toHaveAttribute('data-open', 'true')
+  })
+
+  it('resets dialog state when the menu app instance changes', () => {
+    const { rerender } = render(
+      <DeploymentActionsMenu
+        appInstanceId="app-instance-1"
+        placement="bottom-end"
+      />,
+    )
+
+    fireEvent.click(screen.getByTestId('dropdown-menu-trigger'))
+    fireEvent.click(screen.getByText('deployments.card.menu.editInfo'))
+    expect(screen.getByTestId('edit-dialog')).toHaveAttribute('data-open', 'true')
+
+    rerender(
+      <DeploymentActionsMenu
+        appInstanceId="app-instance-2"
+        placement="bottom-end"
+      />,
+    )
+    expect(screen.getByTestId('edit-dialog')).toHaveAttribute('data-open', 'false')
+
+    rerender(
+      <DeploymentActionsMenu
+        appInstanceId="app-instance-1"
+        placement="bottom-end"
+      />,
+    )
+    expect(screen.getByTestId('edit-dialog')).toHaveAttribute('data-open', 'false')
+  })
 })
diff --git a/web/features/deployments/components/deployment-actions/index.tsx b/web/features/deployments/components/deployment-actions/index.tsx
index 7db4e6c9db3..dd06be7c07f 100644
--- a/web/features/deployments/components/deployment-actions/index.tsx
+++ b/web/features/deployments/components/deployment-actions/index.tsx
@@ -9,10 +9,18 @@ import {
   DropdownMenuSeparator,
   DropdownMenuTrigger,
 } from '@langgenius/dify-ui/dropdown-menu'
+import { useSetAtom } from 'jotai'
+import { ScopeProvider } from 'jotai-scope'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import { DeleteDeploymentDialog } from './delete-dialog'
 import { EditDeploymentDialog } from './edit-dialog'
+import {
+  deleteDeploymentDialogOpenAtom,
+  deploymentActionAppInstanceIdHydrationAtom,
+  deploymentActionsLocalAtoms,
+  editDeploymentDialogOpenAtom,
+} from './state'
 
 const ACTION_TRIGGER_CLASS_NAME = cn(
   'inline-flex size-8 items-center justify-center rounded-lg bg-components-panel-bg text-text-tertiary shadow-xs outline-hidden',
@@ -22,25 +30,24 @@ const ACTION_TRIGGER_CLASS_NAME = cn(
 
 type DeploymentActionsMenuProps = {
   appInstanceId: string
-  appName?: string
   className?: string
   triggerClassName?: string
   placement: ComponentProps<typeof DropdownMenuContent>['placement']
   sideOffset?: ComponentProps<typeof DropdownMenuContent>['sideOffset']
 }
 
-export function DeploymentActionsMenu({
-  appInstanceId,
-  appName,
+type DeploymentActionsMenuContentProps = Omit<DeploymentActionsMenuProps, 'appInstanceId'>
+
+function DeploymentActionsMenuContent({
   className,
   triggerClassName,
   placement,
   sideOffset,
-}: DeploymentActionsMenuProps) {
+}: DeploymentActionsMenuContentProps) {
   const { t } = useTranslation('deployments')
+  const setEditOpen = useSetAtom(editDeploymentDialogOpenAtom)
+  const setDeleteOpen = useSetAtom(deleteDeploymentDialogOpenAtom)
   const [menuOpen, setMenuOpen] = useState(false)
-  const [editOpen, setEditOpen] = useState(false)
-  const [deleteOpen, setDeleteOpen] = useState(false)
 
   function openEditDialog() {
     setMenuOpen(false)
@@ -66,36 +73,43 @@ export function DeploymentActionsMenu({
         >
           <span aria-hidden className="i-ri-more-fill size-4" />
         </DropdownMenuTrigger>
-        {menuOpen && (
-          <DropdownMenuContent placement={placement} sideOffset={sideOffset} popupClassName="min-w-44">
-            <DropdownMenuItem className="gap-2 px-3" onClick={openEditDialog}>
-              <span aria-hidden className="i-ri-edit-line size-4 shrink-0 text-text-tertiary" />
-              <span className="system-sm-regular text-text-secondary">{t('card.menu.editInfo')}</span>
-            </DropdownMenuItem>
-            <DropdownMenuSeparator />
-            <DropdownMenuItem
-              variant="destructive"
-              className="gap-2 px-3"
-              onClick={openDeleteDialog}
-            >
-              <span aria-hidden className="i-ri-delete-bin-line size-4 shrink-0" />
-              <span className="system-sm-regular">{t('card.menu.delete')}</span>
-            </DropdownMenuItem>
-          </DropdownMenuContent>
-        )}
+        <DropdownMenuContent placement={placement} sideOffset={sideOffset} popupClassName="min-w-44">
+          <DropdownMenuItem className="gap-2 px-3" onClick={openEditDialog}>
+            <span aria-hidden className="i-ri-edit-line size-4 shrink-0 text-text-tertiary" />
+            <span className="system-sm-regular text-text-secondary">{t('card.menu.editInfo')}</span>
+          </DropdownMenuItem>
+          <DropdownMenuSeparator />
+          <DropdownMenuItem
+            variant="destructive"
+            className="gap-2 px-3"
+            onClick={openDeleteDialog}
+          >
+            <span aria-hidden className="i-ri-delete-bin-line size-4 shrink-0" />
+            <span className="system-sm-regular">{t('card.menu.delete')}</span>
+          </DropdownMenuItem>
+        </DropdownMenuContent>
       </DropdownMenu>
 
-      <EditDeploymentDialog
-        appInstanceId={appInstanceId}
-        open={editOpen}
-        onOpenChange={setEditOpen}
-      />
-      <DeleteDeploymentDialog
-        appInstanceId={appInstanceId}
-        appName={appName}
-        open={deleteOpen}
-        onOpenChange={setDeleteOpen}
-      />
+      <EditDeploymentDialog />
+      <DeleteDeploymentDialog />
     </div>
   )
 }
+
+export function DeploymentActionsMenu({
+  appInstanceId,
+  ...props
+}: DeploymentActionsMenuProps) {
+  return (
+    <ScopeProvider
+      key={appInstanceId}
+      atoms={[
+        [deploymentActionAppInstanceIdHydrationAtom, appInstanceId],
+        ...deploymentActionsLocalAtoms,
+      ]}
+      name="DeploymentActionsMenu"
+    >
+      <DeploymentActionsMenuContent {...props} />
+    </ScopeProvider>
+  )
+}
diff --git a/web/features/deployments/components/deployment-actions/state.ts b/web/features/deployments/components/deployment-actions/state.ts
new file mode 100644
index 00000000000..217b4f6aebc
--- /dev/null
+++ b/web/features/deployments/components/deployment-actions/state.ts
@@ -0,0 +1,168 @@
+'use client'
+
+import type { ExtractAtomValue } from 'jotai'
+import type { Getter } from 'jotai/vanilla'
+import { skipToken } from '@tanstack/react-query'
+import { atom } from 'jotai'
+import {
+  atomWithForm,
+  createFormAtoms,
+} from 'jotai-tanstack-form'
+import { atomWithMutation, atomWithQuery } from 'jotai-tanstack-query'
+import { consoleQuery } from '@/service/client'
+
+export type EditDeploymentFormValues = {
+  name: string
+  description: string
+}
+
+const DEFAULT_EDIT_DEPLOYMENT_FORM_VALUES: EditDeploymentFormValues = {
+  name: '',
+  description: '',
+}
+
+export const deploymentActionAppInstanceIdHydrationAtom = atom<string | undefined>(undefined)
+
+export const editDeploymentDialogOpenAtom = atom(false)
+export const deleteDeploymentDialogOpenAtom = atom(false)
+
+export const editDeploymentFormAtom = atomWithForm({
+  defaultValues: DEFAULT_EDIT_DEPLOYMENT_FORM_VALUES,
+})
+
+const editDeploymentFormAtoms = createFormAtoms(editDeploymentFormAtom)
+
+const editDeploymentFormValuesAtom = editDeploymentFormAtoms.valuesAtom
+export const editDeploymentNameFieldAtom = editDeploymentFormAtoms.fieldAtom('name')
+export const editDeploymentDescriptionFieldAtom = editDeploymentFormAtoms.fieldAtom('description')
+
+const deploymentActionAppInstanceIdAtom = atom((get): string => {
+  const appInstanceId = get(deploymentActionAppInstanceIdHydrationAtom)
+  if (!appInstanceId)
+    throw new Error('Missing deployment action app instance id.')
+
+  return appInstanceId
+})
+
+function normalizedEditDeploymentFormValues(value: EditDeploymentFormValues) {
+  return {
+    name: value.name.trim(),
+    description: value.description.trim(),
+  }
+}
+
+export const deploymentActionAppInstanceQueryAtom = atomWithQuery((get) => {
+  const appInstanceId = get(deploymentActionAppInstanceIdAtom)
+  const editOpen = get(editDeploymentDialogOpenAtom)
+  const deleteOpen = get(deleteDeploymentDialogOpenAtom)
+  const enabled = editOpen || deleteOpen
+
+  return consoleQuery.enterprise.appInstanceService.getAppInstance.queryOptions({
+    input: enabled
+      ? {
+          params: { appInstanceId },
+        }
+      : skipToken,
+    enabled,
+  })
+})
+
+export const deploymentActionDisplayNameAtom = atom((get): string => {
+  return get(deploymentActionAppInstanceQueryAtom).data?.appInstance.displayName || get(deploymentActionAppInstanceIdAtom)
+})
+
+function editDeploymentInitialFormValues(get: Getter): EditDeploymentFormValues | undefined {
+  const app = get(deploymentActionAppInstanceQueryAtom).data?.appInstance
+  if (!app)
+    return undefined
+
+  return {
+    name: app.displayName,
+    description: app.description,
+  }
+}
+
+function canSubmitEditDeploymentForm(get: Getter, value: EditDeploymentFormValues) {
+  const initialValues = editDeploymentInitialFormValues(get)
+  if (!initialValues)
+    return false
+
+  const normalizedValues = normalizedEditDeploymentFormValues(value)
+  return Boolean(
+    normalizedValues.name
+    && (
+      normalizedValues.name !== initialValues.name
+      || normalizedValues.description !== initialValues.description
+    ),
+  )
+}
+
+export const updateDeploymentInstanceMutationAtom = atomWithMutation(() =>
+  consoleQuery.enterprise.appInstanceService.updateAppInstance.mutationOptions(),
+)
+
+export const deleteDeploymentInstanceMutationAtom = atomWithMutation(() =>
+  consoleQuery.enterprise.appInstanceService.deleteAppInstance.mutationOptions(),
+)
+
+export const setEditDeploymentDialogOpenAtom = atom(null, (get, set, open: boolean) => {
+  if (!open && get(updateDeploymentInstanceMutationAtom).isPending)
+    return
+
+  set(editDeploymentDialogOpenAtom, open)
+})
+
+export const editDeploymentFormSavePendingAtom = atom((get) => {
+  return get(updateDeploymentInstanceMutationAtom).isPending
+})
+
+export const editDeploymentFormCanSaveAtom = atom((get) => {
+  return canSubmitEditDeploymentForm(get, get(editDeploymentFormValuesAtom))
+    && !get(editDeploymentFormSavePendingAtom)
+})
+
+const submitEditDeploymentInstanceAtom = atom(null, async (get, _set, value: EditDeploymentFormValues) => {
+  if (!canSubmitEditDeploymentForm(get, value))
+    return undefined
+
+  const appInstanceId = get(deploymentActionAppInstanceIdAtom)
+  const updateInstance = get(updateDeploymentInstanceMutationAtom)
+  const normalizedValues = normalizedEditDeploymentFormValues(value)
+
+  return await updateInstance.mutateAsync({
+    params: {
+      appInstanceId,
+    },
+    body: {
+      appInstanceId,
+      displayName: normalizedValues.name,
+      description: normalizedValues.description,
+    },
+  })
+})
+
+export const submitEditDeploymentFormAtom = atom(null, async (get, set) => {
+  const response = await set(submitEditDeploymentInstanceAtom, get(editDeploymentFormValuesAtom))
+  return Boolean(response)
+})
+
+type DeleteDeploymentInstanceMutationCallbacks = Parameters<ExtractAtomValue<typeof deleteDeploymentInstanceMutationAtom>['mutate']>[1]
+
+export const submitDeleteDeploymentInstanceAtom = atom(null, (get, _set, callbacks?: DeleteDeploymentInstanceMutationCallbacks) => {
+  const appInstanceId = get(deploymentActionAppInstanceIdAtom)
+  const deleteInstance = get(deleteDeploymentInstanceMutationAtom)
+
+  deleteInstance.mutate(
+    {
+      params: {
+        appInstanceId,
+      },
+    },
+    callbacks,
+  )
+})
+
+export const deploymentActionsLocalAtoms = [
+  editDeploymentDialogOpenAtom,
+  deleteDeploymentDialogOpenAtom,
+] as const
diff --git a/web/features/deployments/create-guide/index.tsx b/web/features/deployments/create-guide/index.tsx
index 462b869e7e5..a1f71716c91 100644
--- a/web/features/deployments/create-guide/index.tsx
+++ b/web/features/deployments/create-guide/index.tsx
@@ -17,7 +17,7 @@ export function CreateDeploymentGuide() {
         backdropClassName="bg-background-overlay-backdrop backdrop-blur-[6px]"
         className="top-4 bottom-4 h-auto max-h-none w-[min(calc(100vw-2rem),1120px)] max-w-none translate-y-0 overflow-hidden border-effects-highlight bg-background-default-subtle p-0"
       >
-        <main className="relative flex h-full min-w-0 grow flex-col overflow-hidden">
+        <div className="relative flex h-full min-w-0 grow flex-col overflow-hidden">
           <Link
             href="/deployments"
             aria-label={t('createGuide.nav.back')}
@@ -28,7 +28,7 @@ export function CreateDeploymentGuide() {
           <CreateDeploymentGuideProvider>
             <CreateDeploymentGuideShell />
           </CreateDeploymentGuideProvider>
-        </main>
+        </div>
       </DialogContent>
     </Dialog>
   )
diff --git a/web/features/deployments/create-guide/state/__tests__/index.spec.ts b/web/features/deployments/create-guide/state/__tests__/index.spec.ts
new file mode 100644
index 00000000000..f06773b2367
--- /dev/null
+++ b/web/features/deployments/create-guide/state/__tests__/index.spec.ts
@@ -0,0 +1,218 @@
+import type { Getter } from 'jotai'
+import { atom, createStore } from 'jotai'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+type QueryOptions = {
+  enabled?: boolean
+  input?: unknown
+  queryKey?: readonly unknown[]
+  retry?: boolean
+}
+
+type InfiniteQueryOptions = QueryOptions & {
+  input?: (pageParam: number) => unknown
+}
+
+type QueryResult = {
+  data?: unknown
+  hasNextPage?: boolean
+  isError?: boolean
+  isFetching?: boolean
+  isFetchingNextPage?: boolean
+  isLoading?: boolean
+  isPlaceholderData?: boolean
+  isSuccess?: boolean
+}
+
+const mockQueryResults = vi.hoisted(() => ({
+  current: new Map<string, QueryResult>(),
+}))
+
+vi.mock('jotai-tanstack-query', () => ({
+  atomWithInfiniteQuery: (createOptions: (get: Getter) => InfiniteQueryOptions) => atom((get) => {
+    const options = createOptions(get)
+    const queryName = String(options.queryKey?.[0] ?? 'unknown')
+    const queryResult = mockQueryResults.current.get(queryName)
+
+    return {
+      ...options,
+      data: { pages: [{ data: [] }] },
+      hasNextPage: false,
+      isFetching: false,
+      isFetchingNextPage: false,
+      isLoading: false,
+      isPlaceholderData: false,
+      isSuccess: Boolean(queryResult?.data),
+      fetchNextPage: vi.fn(),
+      ...queryResult,
+    }
+  }),
+  atomWithMutation: () => atom(() => ({
+    isPending: false,
+    mutateAsync: vi.fn(),
+  })),
+  atomWithQuery: (createOptions: (get: Getter) => QueryOptions) => atom((get) => {
+    const options = createOptions(get)
+    const queryName = String(options.queryKey?.[0] ?? 'unknown')
+    const queryResult = options.enabled === false
+      ? undefined
+      : mockQueryResults.current.get(queryName)
+
+    return {
+      ...options,
+      data: undefined,
+      isError: false,
+      isFetching: false,
+      isLoading: false,
+      isSuccess: false,
+      ...queryResult,
+    }
+  }),
+}))
+
+vi.mock('@/service/client', () => ({
+  consoleQuery: {
+    apps: {
+      list: {
+        infiniteOptions: (options: InfiniteQueryOptions) => ({
+          ...options,
+          queryKey: ['sourceApps'],
+        }),
+      },
+    },
+    enterprise: {
+      appInstanceService: {
+        listAppInstances: {
+          infiniteOptions: (options: InfiniteQueryOptions) => ({
+            ...options,
+            queryKey: ['existingInstanceNames'],
+          }),
+          queryOptions: (options: QueryOptions) => ({
+            ...options,
+            queryKey: ['instanceNameConflict'],
+          }),
+        },
+      },
+      environmentService: {
+        listEnvironments: {
+          queryOptions: (options: QueryOptions) => ({
+            ...options,
+            queryKey: ['environments'],
+          }),
+        },
+      },
+      releaseService: {
+        computeDeploymentOptions: {
+          queryOptions: (options: QueryOptions) => ({
+            ...options,
+            queryKey: ['deploymentOptions'],
+          }),
+        },
+        precheckRelease: {
+          queryOptions: (options: QueryOptions) => ({
+            ...options,
+            queryKey: ['precheckRelease'],
+          }),
+        },
+      },
+    },
+  },
+}))
+
+async function loadState() {
+  return await import('../index')
+}
+
+describe('create deployment guide state', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockQueryResults.current.clear()
+  })
+
+  it('should keep the guide on source app mode when DSL import is disabled', async () => {
+    const state = await loadState()
+    const store = createStore()
+
+    store.set(state.selectMethodAtom, 'importDsl')
+
+    expect(store.get(state.methodAtom)).toBe('bindApp')
+    expect(store.get(state.effectiveMethodAtom)).toBe('bindApp')
+  })
+
+  it('should keep source app loading enabled if stale state points to DSL import', async () => {
+    const state = await loadState()
+    const store = createStore()
+
+    store.set(state.methodAtom, 'importDsl')
+
+    const sourceAppsQuery = store.get(state.sourceAppsQueryAtom) as unknown as { enabled?: boolean }
+
+    expect(store.get(state.effectiveMethodAtom)).toBe('bindApp')
+    expect(sourceAppsQuery.enabled).toBe(true)
+  })
+
+  it('should continue from source app mode and auto-fill unique release metadata', async () => {
+    const state = await loadState()
+    const store = createStore()
+    mockQueryResults.current.set('sourceApps', {
+      data: {
+        pages: [
+          {
+            data: [
+              {
+                id: 'source-app-1',
+                name: 'Customer Service',
+                mode: 'workflow',
+              },
+            ],
+          },
+        ],
+      },
+      isSuccess: true,
+    })
+    mockQueryResults.current.set('precheckRelease', {
+      data: {
+        canCreate: true,
+        unsupportedNodes: [],
+      },
+      isSuccess: true,
+    })
+    mockQueryResults.current.set('deploymentOptions', {
+      data: {
+        options: {
+          credentialSlots: [],
+          envVarSlots: [],
+        },
+      },
+      isSuccess: true,
+    })
+    mockQueryResults.current.set('existingInstanceNames', {
+      data: {
+        pages: [
+          {
+            appInstances: [
+              { displayName: 'Customer Service' },
+              { displayName: 'Customer Service 1' },
+            ],
+          },
+        ],
+      },
+      isSuccess: true,
+    })
+
+    expect(store.get(state.sourceCanGoNextAtom)).toBe(true)
+
+    store.set(state.continueFromSourceAtom, {
+      defaultDslAppName: 'Imported DSL',
+      defaultReleaseName: 'Initial Release',
+    })
+
+    expect(store.get(state.selectedAppAtom)).toMatchObject({
+      id: 'source-app-1',
+      name: 'Customer Service',
+    })
+    expect(store.get(state.instanceNameAtom)).toMatch(/^Customer Service-[a-z]{4}$/)
+    expect(store.get(state.releaseNameAtom)).toBe('Initial Release')
+    expect(store.get(state.stepAtom)).toBe('release')
+  })
+})
diff --git a/web/features/deployments/create-guide/state/index.ts b/web/features/deployments/create-guide/state/index.ts
index 06dab290172..1db093e9486 100644
--- a/web/features/deployments/create-guide/state/index.ts
+++ b/web/features/deployments/create-guide/state/index.ts
@@ -10,7 +10,7 @@ import type { RuntimeCredentialBindingSelections } from '@/features/deployments/
 import type { UnsupportedDslNode } from '@/features/deployments/shared/domain/error'
 import type { App } from '@/types/app'
 import { EnvVarValueSource as ApiEnvVarValueSource } from '@dify/contracts/enterprise/types.gen'
-import { keepPreviousData } from '@tanstack/react-query'
+import { keepPreviousData, skipToken } from '@tanstack/react-query'
 import { atom } from 'jotai'
 import { atomWithInfiniteQuery, atomWithMutation, atomWithQuery } from 'jotai-tanstack-query'
 import { envVarBindingSlotFromContract, envVarBindingValueType } from '@/features/deployments/components/env-var-bindings-utils'
@@ -27,6 +27,7 @@ import {
   isWorkflowDsl,
 } from '@/features/deployments/shared/domain/dsl'
 import { unsupportedDslNodeError } from '@/features/deployments/shared/domain/error'
+import { isDeploymentDslImportEnabled } from '@/features/deployments/shared/domain/feature-flags'
 import { createDeploymentIdempotencyKey } from '@/features/deployments/shared/domain/idempotency'
 import {
   DEPLOYMENT_PAGE_SIZE,
@@ -41,6 +42,12 @@ export type GuideMethod = 'bindApp' | 'importDsl'
 export type GuideStep = 'source' | 'release' | 'target'
 export type WorkflowSourceApp = App & { mode: Extract<AppModeEnum, 'workflow'> }
 
+function deploymentGuideMethod(method: GuideMethod): GuideMethod {
+  return method === 'importDsl' && !isDeploymentDslImportEnabled
+    ? 'bindApp'
+    : method
+}
+
 const RANDOM_SUFFIX_ALPHABET = 'abcdefghijklmnopqrstuvwxyz'
 const RANDOM_SUFFIX_LENGTH = 4
 const RANDOM_SUFFIX_FALLBACK_LENGTH = 6
@@ -124,6 +131,7 @@ function envVarInput(slot: EnvVarBindingSlot, selection: EnvVarValueSelection |
 // Workflow primitives
 export const stepAtom = atom<GuideStep>('source')
 export const methodAtom = atom<GuideMethod>('bindApp')
+export const effectiveMethodAtom = atom(get => deploymentGuideMethod(get(methodAtom)))
 
 // Source primitives
 export const sourceSearchTextAtom = atom('')
@@ -145,7 +153,7 @@ export const dslDefaultAppNameAtom = atom((get) => {
 export const dslUnsupportedModeAtom = atom((get) => {
   const dslContent = get(dslContentAtom)
 
-  return get(methodAtom) === 'importDsl'
+  return get(effectiveMethodAtom) === 'importDsl'
     && Boolean(dslContent.trim())
     && !get(isReadingDslAtom)
     && !get(dslReadErrorAtom)
@@ -185,22 +193,20 @@ export const isSubmittingDeploymentGuideAtom = atom(get => (
 export const sourceAppsQueryAtom = atomWithInfiniteQuery((get) => {
   const sourceSearchText = get(sourceSearchTextAtom)
 
-  return {
-    ...consoleQuery.apps.list.infiniteOptions({
-      input: pageParam => ({
-        query: {
-          page: Number(pageParam),
-          limit: SOURCE_APPS_PAGE_SIZE,
-          name: sourceSearchText,
-          mode: AppModeEnum.WORKFLOW,
-        },
-      }),
-      getNextPageParam: lastPage => lastPage.has_more ? lastPage.page + 1 : undefined,
-      initialPageParam: 1,
-      placeholderData: keepPreviousData,
+  return consoleQuery.apps.list.infiniteOptions({
+    input: pageParam => ({
+      query: {
+        page: Number(pageParam),
+        limit: SOURCE_APPS_PAGE_SIZE,
+        name: sourceSearchText,
+        mode: AppModeEnum.WORKFLOW,
+      },
     }),
-    enabled: get(methodAtom) === 'bindApp',
-  }
+    getNextPageParam: lastPage => lastPage.has_more ? lastPage.page + 1 : undefined,
+    initialPageParam: 1,
+    placeholderData: keepPreviousData,
+    enabled: get(effectiveMethodAtom) === 'bindApp',
+  })
 })
 
 export const effectiveSelectedAppAtom = atom((get) => {
@@ -218,15 +224,15 @@ export const effectiveSelectedAppAtom = atom((get) => {
 })
 
 function sourceReady(get: Getter) {
-  const method = get(methodAtom)
+  const method = get(effectiveMethodAtom)
 
   return method === 'importDsl'
     ? get(importDslReadyAtom)
     : Boolean(get(effectiveSelectedAppAtom)?.id)
 }
 
-const existingInstanceNamesQueryAtom = atomWithInfiniteQuery(() => ({
-  ...consoleQuery.enterprise.appInstanceService.listAppInstances.infiniteOptions({
+const existingInstanceNamesQueryAtom = atomWithInfiniteQuery(() =>
+  consoleQuery.enterprise.appInstanceService.listAppInstances.infiniteOptions({
     input: pageParam => ({
       query: {
         pageNumber: Number(pageParam),
@@ -235,9 +241,9 @@ const existingInstanceNamesQueryAtom = atomWithInfiniteQuery(() => ({
     }),
     getNextPageParam: lastPage => getNextPageParamFromPagination(lastPage.pagination),
     initialPageParam: 1,
+    placeholderData: keepPreviousData,
   }),
-  placeholderData: keepPreviousData,
-}))
+)
 
 const instanceNameConflictQueryAtom = atomWithQuery((get) => {
   const submittedInstanceName = get(instanceNameAtom).trim()
@@ -269,34 +275,38 @@ export const deployableEnvironmentsQueryAtom = atomWithQuery((get) => {
 })
 
 const precheckReleaseQueryAtom = atomWithQuery((get) => {
-  const method = get(methodAtom)
+  const method = get(effectiveMethodAtom)
   const effectiveSelectedApp = get(effectiveSelectedAppAtom)
   const dslContent = get(dslContentAtom)
+  const encodedDslContent = dslContent.trim() ? encodeDslContent(dslContent) : undefined
   const enabled = sourceReady(get)
 
   // PrecheckRelease takes exactly one source arm (dsl | sourceAppId).
   const precheckReleaseQueryOptions = method === 'importDsl'
     ? consoleQuery.enterprise.releaseService.precheckRelease.queryOptions({
-        input: {
-          body: {
-            dsl: dslContent.trim() ? encodeDslContent(dslContent) : '',
-          },
-        },
+        input: encodedDslContent
+          ? {
+              body: {
+                dsl: encodedDslContent,
+              },
+            }
+          : skipToken,
         enabled,
+        retry: false,
       })
     : consoleQuery.enterprise.releaseService.precheckRelease.queryOptions({
-        input: {
-          body: {
-            sourceAppId: effectiveSelectedApp?.id ?? '',
-          },
-        },
+        input: effectiveSelectedApp?.id
+          ? {
+              body: {
+                sourceAppId: effectiveSelectedApp.id,
+              },
+            }
+          : skipToken,
         enabled: enabled && Boolean(effectiveSelectedApp?.id),
+        retry: false,
       })
 
-  return {
-    ...precheckReleaseQueryOptions,
-    retry: false,
-  }
+  return precheckReleaseQueryOptions
 })
 
 function precheckReleaseReady(get: Getter) {
@@ -310,35 +320,38 @@ function precheckReleaseReady(get: Getter) {
 }
 
 export const deploymentOptionsQueryAtom = atomWithQuery((get) => {
-  const method = get(methodAtom)
+  const method = get(effectiveMethodAtom)
   const effectiveSelectedApp = get(effectiveSelectedAppAtom)
   const dslContent = get(dslContentAtom)
+  const encodedDslContent = dslContent.trim() ? encodeDslContent(dslContent) : undefined
   const enabled = precheckReleaseReady(get)
 
   // ComputeDeploymentOptions takes exactly one source arm (dsl | sourceAppId | releaseId).
   const deploymentOptionsQueryOptions = method === 'importDsl'
     ? consoleQuery.enterprise.releaseService.computeDeploymentOptions.queryOptions({
-        input: {
-          body: {
-            dsl: dslContent.trim() ? encodeDslContent(dslContent) : '',
-          },
-        },
+        input: encodedDslContent
+          ? {
+              body: {
+                dsl: encodedDslContent,
+              },
+            }
+          : skipToken,
         enabled,
+        retry: false,
       })
     : consoleQuery.enterprise.releaseService.computeDeploymentOptions.queryOptions({
-        input: {
-          body: {
-            sourceAppId: effectiveSelectedApp?.id ?? '',
-          },
-        },
+        input: effectiveSelectedApp?.id
+          ? {
+              body: {
+                sourceAppId: effectiveSelectedApp.id,
+              },
+            }
+          : skipToken,
         enabled: enabled && Boolean(effectiveSelectedApp?.id),
+        retry: false,
       })
 
-  // oRPC encodes input before TanStack can skip work, so keep a valid input shape and gate requests with enabled.
-  return {
-    ...deploymentOptionsQueryOptions,
-    retry: false,
-  }
+  return deploymentOptionsQueryOptions
 })
 
 // Unsupported DSL state
@@ -378,7 +391,7 @@ const deploymentOptionsContentCheckedAtom = atom((get) => {
 })
 
 export const sourceCanGoNextAtom = atom((get) => {
-  const method = get(methodAtom)
+  const method = get(effectiveMethodAtom)
   const effectiveSelectedApp = get(effectiveSelectedAppAtom)
   const importDslReady = method === 'importDsl' && get(importDslReadyAtom)
   const bindAppReady = method === 'bindApp' && Boolean(effectiveSelectedApp?.id)
@@ -416,7 +429,7 @@ export const continueFromSourceAtom = atom(null, (get, set, {
   if (!get(sourceCanGoNextAtom))
     return
 
-  const method = get(methodAtom)
+  const method = get(effectiveMethodAtom)
   const effectiveSelectedApp = get(effectiveSelectedAppAtom)
   if (method === 'bindApp' && effectiveSelectedApp)
     set(selectSourceAppAtom, effectiveSelectedApp)
@@ -606,7 +619,7 @@ const requiredBindingsReadyAtom = atom((get) => {
 })
 
 export const deploymentTargetEnvVarSlotsAtom = atom((get) => {
-  const method = get(methodAtom)
+  const method = get(effectiveMethodAtom)
   const deploymentOptionsQuery = get(deploymentOptionsQueryAtom)
   const slots = sourceReady(get) ? deploymentOptionsQuery.data?.options?.envVarSlots : undefined
   const dslContent = get(dslContentAtom)
@@ -702,7 +715,7 @@ export const setEnvVarAtom = atom(null, (get, set, key: string, value: EnvVarVal
 
 // Workflow actions
 export const selectMethodAtom = atom(null, (_get, set, method: GuideMethod) => {
-  set(methodAtom, method)
+  set(methodAtom, deploymentGuideMethod(method))
   set(selectedEnvironmentIdAtom, '')
   set(manualBindingSelectionsAtom, {})
   set(envVarValuesAtom, {})
@@ -738,7 +751,7 @@ export const createDeploymentGuideSubmissionAtom = atom(null, async (get, set, {
 }: {
   deployToEnvironment: boolean
 }) => {
-  const method = get(methodAtom)
+  const method = get(effectiveMethodAtom)
   const dslContent = get(dslContentAtom)
   const submittedInstanceName = get(instanceNameAtom).trim()
   const submittedReleaseName = get(releaseNameAtom).trim()
diff --git a/web/features/deployments/create-guide/ui/__tests__/source-step.spec.tsx b/web/features/deployments/create-guide/ui/__tests__/source-step.spec.tsx
new file mode 100644
index 00000000000..3a99e1418a7
--- /dev/null
+++ b/web/features/deployments/create-guide/ui/__tests__/source-step.spec.tsx
@@ -0,0 +1,49 @@
+import { render, screen } from '@testing-library/react'
+import { describe, expect, it, vi } from 'vitest'
+import { SourceStepContent } from '../source-step'
+
+vi.mock('@/features/deployments/create-guide/state', async () => {
+  const { atom } = await import('jotai')
+  const methodAtom = atom<'bindApp' | 'importDsl'>('bindApp')
+  const emptyActionAtom = atom(null, () => undefined)
+
+  return {
+    continueFromSourceAtom: emptyActionAtom,
+    dslFileAtom: atom<File | undefined>(undefined),
+    dslReadErrorAtom: atom(false),
+    dslUnsupportedModeAtom: atom(false),
+    effectiveMethodAtom: atom(get => get(methodAtom)),
+    effectiveSelectedAppAtom: atom(undefined),
+    isReadingDslAtom: atom(false),
+    methodAtom,
+    selectDslFileAtom: emptyActionAtom,
+    selectMethodAtom: atom(null, (_get, set, value: 'bindApp' | 'importDsl') => {
+      set(methodAtom, value)
+    }),
+    selectSourceAppAtom: emptyActionAtom,
+    setSourceSearchTextAtom: emptyActionAtom,
+    sourceAppsQueryAtom: atom({
+      data: { pages: [{ data: [] }] },
+      hasNextPage: false,
+      isFetching: false,
+      isFetchingNextPage: false,
+      isLoading: false,
+      isPlaceholderData: false,
+      fetchNextPage: vi.fn(),
+    }),
+    sourceCanGoNextAtom: atom(false),
+    sourceSearchTextAtom: atom(''),
+    unsupportedDslNodesAtom: atom([]),
+  }
+})
+
+describe('SourceStepContent', () => {
+  it('should hide the import DSL option when deployment DSL import is disabled', () => {
+    render(<SourceStepContent />)
+
+    expect(screen.getByText(/createGuide\.methods\.bindApp\.title/)).toBeInTheDocument()
+    expect(screen.queryByText(/createGuide\.methods\.importDsl\.title/)).not.toBeInTheDocument()
+    expect(screen.queryByText(/createGuide\.methods\.importDsl\.description/)).not.toBeInTheDocument()
+    expect(screen.getByRole('textbox', { name: /createGuide\.source\.sourceApp/ })).toBeInTheDocument()
+  })
+})
diff --git a/web/features/deployments/create-guide/ui/release-step.tsx b/web/features/deployments/create-guide/ui/release-step.tsx
index 192351003ab..19494772935 100644
--- a/web/features/deployments/create-guide/ui/release-step.tsx
+++ b/web/features/deployments/create-guide/ui/release-step.tsx
@@ -7,10 +7,10 @@ import { useTranslation } from 'react-i18next'
 import {
   continueFromReleaseAtom,
   dslDefaultAppNameAtom,
+  effectiveMethodAtom,
   hasInstanceNameConflictAtom,
   instanceDescriptionAtom,
   instanceNameAtom,
-  methodAtom,
   releaseCanGoNextAtom,
   releaseDescriptionAtom,
   releaseNameAtom,
@@ -74,7 +74,7 @@ function InstanceNameField() {
   const { t } = useTranslation('deployments')
   const instanceName = useAtomValue(instanceNameAtom)
   const setInstanceName = useSetAtom(setInstanceNameAtom)
-  const method = useAtomValue(methodAtom)
+  const method = useAtomValue(effectiveMethodAtom)
   const selectedApp = useAtomValue(selectedAppAtom)
   const dslDefaultAppName = useAtomValue(dslDefaultAppNameAtom)
   const instanceNamePlaceholder = method === 'importDsl'
diff --git a/web/features/deployments/create-guide/ui/source-step.tsx b/web/features/deployments/create-guide/ui/source-step.tsx
index 832219f1b18..d75b9965773 100644
--- a/web/features/deployments/create-guide/ui/source-step.tsx
+++ b/web/features/deployments/create-guide/ui/source-step.tsx
@@ -19,9 +19,9 @@ import {
   dslFileAtom,
   dslReadErrorAtom,
   dslUnsupportedModeAtom,
+  effectiveMethodAtom,
   effectiveSelectedAppAtom,
   isReadingDslAtom,
-  methodAtom,
   selectDslFileAtom,
   selectMethodAtom,
   selectSourceAppAtom,
@@ -31,12 +31,13 @@ import {
   sourceSearchTextAtom,
   unsupportedDslNodesAtom,
 } from '@/features/deployments/create-guide/state'
+import { isDeploymentDslImportEnabled } from '@/features/deployments/shared/domain/feature-flags'
 import { StepShell } from './layout'
 
 const sourceAppSkeletonKeys = ['first-source-app', 'second-source-app', 'third-source-app']
 
 export function SourceStepContent() {
-  const method = useAtomValue(methodAtom)
+  const method = useAtomValue(effectiveMethodAtom)
   const unsupportedDslNodes = useAtomValue(unsupportedDslNodesAtom)
 
   return (
@@ -55,7 +56,7 @@ export function SourceStepContent() {
 
 function SourceMethodSection() {
   const { t } = useTranslation('deployments')
-  const method = useAtomValue(methodAtom)
+  const method = useAtomValue(effectiveMethodAtom)
   const selectMethod = useSetAtom(selectMethodAtom)
 
   return (
@@ -76,12 +77,14 @@ function SourceMethodSection() {
           title={t('createGuide.methods.bindApp.title')}
           description={t('createGuide.methods.bindApp.description')}
         />
-        <SourceMethodCard
-          value="importDsl"
-          icon="i-ri-file-code-line"
-          title={t('createGuide.methods.importDsl.title')}
-          description={t('createGuide.methods.importDsl.description')}
-        />
+        {isDeploymentDslImportEnabled && (
+          <SourceMethodCard
+            value="importDsl"
+            icon="i-ri-file-code-line"
+            title={t('createGuide.methods.importDsl.title')}
+            description={t('createGuide.methods.importDsl.description')}
+          />
+        )}
       </RadioGroup>
     </StepShell>
   )
diff --git a/web/features/deployments/create-release/index.tsx b/web/features/deployments/create-release/index.tsx
index 3bfdde51bcd..4f5fd6f2680 100644
--- a/web/features/deployments/create-release/index.tsx
+++ b/web/features/deployments/create-release/index.tsx
@@ -2,17 +2,21 @@
 
 import type { ButtonProps } from '@langgenius/dify-ui/button'
 import { Button } from '@langgenius/dify-ui/button'
-import { useSetAtom } from 'jotai'
+import { Dialog, DialogTrigger } from '@langgenius/dify-ui/dialog'
+import { useAtomValue, useSetAtom } from 'jotai'
 import { ScopeProvider } from 'jotai-scope'
 import { useTranslation } from 'react-i18next'
 import {
-  createReleaseConfigAtom,
+  createReleaseAppInstanceIdAtom,
+  createReleaseDialogOpenAtom,
   createReleaseLocalAtoms,
+  isCreatingReleaseAtom,
   openCreateReleaseDialogAtom,
+  requestCloseCreateReleaseDialogAtom,
 } from './state'
-import { CreateReleaseDialog } from './ui/dialog'
+import { CreateReleaseDialogContent } from './ui/dialog'
 
-function CreateReleaseTrigger({
+function CreateReleaseScopedControl({
   variant,
   size,
   label,
@@ -24,17 +28,39 @@ function CreateReleaseTrigger({
   className?: string
 }) {
   const { t } = useTranslation('deployments')
+  const open = useAtomValue(createReleaseDialogOpenAtom)
+  const isCreatingRelease = useAtomValue(isCreatingReleaseAtom)
   const openDialog = useSetAtom(openCreateReleaseDialogAtom)
+  const requestCloseDialog = useSetAtom(requestCloseCreateReleaseDialogAtom)
+
+  function handleDialogOpenChange(nextOpen: boolean) {
+    if (nextOpen) {
+      openDialog()
+      return
+    }
+
+    if (!isCreatingRelease)
+      requestCloseDialog()
+  }
 
   return (
-    <Button
-      size={size}
-      variant={variant}
-      className={className}
-      onClick={openDialog}
+    <Dialog
+      open={open}
+      onOpenChange={handleDialogOpenChange}
     >
-      {label ?? t('versions.createRelease')}
-    </Button>
+      <DialogTrigger
+        render={(
+          <Button
+            size={size}
+            variant={variant}
+            className={className}
+          />
+        )}
+      >
+        {label ?? t('versions.createRelease')}
+      </DialogTrigger>
+      <CreateReleaseDialogContent />
+    </Dialog>
   )
 }
 
@@ -55,18 +81,17 @@ export function CreateReleaseControl({
     <ScopeProvider
       key={appInstanceId}
       atoms={[
-        [createReleaseConfigAtom, { appInstanceId }],
+        [createReleaseAppInstanceIdAtom, appInstanceId],
         ...createReleaseLocalAtoms,
       ]}
       name="CreateRelease"
     >
-      <CreateReleaseTrigger
+      <CreateReleaseScopedControl
         variant={variant}
         size={size}
         label={label}
         className={className}
       />
-      <CreateReleaseDialog />
     </ScopeProvider>
   )
 }
diff --git a/web/features/deployments/create-release/state/__tests__/dsl-enabled.spec.ts b/web/features/deployments/create-release/state/__tests__/dsl-enabled.spec.ts
new file mode 100644
index 00000000000..bacafb08696
--- /dev/null
+++ b/web/features/deployments/create-release/state/__tests__/dsl-enabled.spec.ts
@@ -0,0 +1,245 @@
+import type { Getter } from 'jotai'
+import { QueryClient } from '@tanstack/react-query'
+import { atom, createStore } from 'jotai'
+import { queryClientAtom } from 'jotai-tanstack-query'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+type QueryResult = {
+  data?: unknown
+  isError?: boolean
+  isFetching?: boolean
+  isLoading?: boolean
+  isSuccess?: boolean
+}
+
+type QueryOptions = {
+  enabled?: boolean
+  input?: unknown
+  queryFn?: () => unknown
+  queryKey?: readonly unknown[]
+  retry?: boolean
+}
+
+type InfiniteQueryOptions = QueryOptions & {
+  input?: (pageParam: number) => unknown
+}
+
+type MutationResult = {
+  isPending: boolean
+  mutateAsync: ReturnType<typeof vi.fn>
+}
+
+const mockQueryResults = vi.hoisted(() => ({
+  current: new Map<string, QueryResult>(),
+}))
+
+const mockCreateReleaseMutation = vi.hoisted<{ current: MutationResult }>(() => ({
+  current: {
+    isPending: false,
+    mutateAsync: vi.fn(),
+  },
+}))
+
+vi.mock('../../../shared/domain/feature-flags', () => ({
+  isDeploymentDslImportEnabled: true,
+}))
+
+vi.mock('jotai-tanstack-query', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('jotai-tanstack-query')>()
+
+  return {
+    ...actual,
+    atomWithQuery: (createOptions: (get: Getter) => QueryOptions) => atom((get) => {
+      const options = createOptions(get)
+      const queryKey = Array.isArray(options.queryKey) ? options.queryKey[0] : undefined
+      const queryName = typeof queryKey === 'string' ? queryKey : 'unknown'
+      const queryResult = options.enabled === false
+        ? undefined
+        : mockQueryResults.current.get(queryName)
+
+      return {
+        ...options,
+        data: undefined,
+        isError: false,
+        isFetching: false,
+        isLoading: false,
+        isSuccess: false,
+        ...queryResult,
+      }
+    }),
+    atomWithInfiniteQuery: (createOptions: (get: Getter) => InfiniteQueryOptions) => atom((get) => {
+      const options = createOptions(get)
+      const queryKey = Array.isArray(options.queryKey) ? options.queryKey[0] : undefined
+      const queryName = typeof queryKey === 'string' ? queryKey : 'unknown'
+      const queryResult = options.enabled === false
+        ? undefined
+        : mockQueryResults.current.get(queryName)
+
+      return {
+        ...options,
+        data: undefined,
+        hasNextPage: false,
+        isError: false,
+        isFetching: false,
+        isFetchingNextPage: false,
+        isLoading: false,
+        isPlaceholderData: false,
+        isSuccess: false,
+        ...queryResult,
+      }
+    }),
+    atomWithMutation: () => atom(() => mockCreateReleaseMutation.current),
+  }
+})
+
+vi.mock('@/service/client', () => ({
+  consoleQuery: {
+    apps: {
+      list: {
+        infiniteOptions: (options: InfiniteQueryOptions) => ({
+          ...options,
+          queryKey: ['sourceApps', options.input],
+        }),
+      },
+    },
+    enterprise: {
+      releaseService: {
+        listReleaseSummaries: {
+          key: ({ input }: { input?: unknown } = {}) => input === undefined ? ['listReleaseSummaries'] : ['listReleaseSummaries', input],
+        },
+        listReleases: {
+          key: ({ input }: { input?: unknown } = {}) => input === undefined ? ['listReleases'] : ['listReleases', input],
+        },
+        precheckRelease: {
+          queryOptions: (options: QueryOptions) => ({
+            ...options,
+            queryKey: ['precheckRelease', options.input],
+          }),
+        },
+        createRelease: {
+          mutationOptions: () => ({ mutationKey: ['createRelease'] }),
+        },
+      },
+    },
+  },
+}))
+
+async function loadState() {
+  return await import('../index')
+}
+
+async function mountedStore() {
+  const state = await loadState()
+  const store = createStore()
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: {
+        retry: false,
+      },
+    },
+  })
+  store.set(queryClientAtom, queryClient)
+  const unsubscribe = store.sub(state.createReleaseFormValuesAtom, () => undefined)
+
+  return {
+    state,
+    store,
+    unsubscribe,
+  }
+}
+
+function workflowDsl() {
+  return [
+    'app:',
+    '  mode: workflow',
+    '  name: Release source',
+  ].join('\n')
+}
+
+function setDslFileContentResult(overrides: QueryResult = {}) {
+  mockQueryResults.current.set('createReleaseDslFileContent', {
+    data: workflowDsl(),
+    isSuccess: true,
+    ...overrides,
+  })
+}
+
+function setPrecheckReleaseResult(overrides: QueryResult = {}) {
+  mockQueryResults.current.set('precheckRelease', {
+    data: {
+      gateCommitId: 'gate-commit-1',
+      canCreate: true,
+      unsupportedNodes: [],
+    },
+    isSuccess: true,
+    ...overrides,
+  })
+}
+
+describe('create release state with DSL import enabled', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockQueryResults.current.clear()
+    mockCreateReleaseMutation.current = {
+      isPending: false,
+      mutateAsync: vi.fn(),
+    }
+  })
+
+  it('should enable source app search with the current search text while creating from an app', async () => {
+    const { state, store, unsubscribe } = await mountedStore()
+    store.set(state.createReleaseAppInstanceIdAtom, 'app-instance-1')
+    store.set(state.openCreateReleaseDialogAtom)
+    store.set(state.createReleaseSourceAppSearchTextAtom, 'customer')
+
+    const sourceAppsQuery = store.get(state.createReleaseSourceAppsQueryAtom) as unknown as InfiniteQueryOptions
+
+    expect(sourceAppsQuery.enabled).toBe(true)
+    expect(sourceAppsQuery.input?.(2)).toEqual({
+      query: {
+        page: 2,
+        limit: 20,
+        name: 'customer',
+        mode: 'workflow',
+      },
+    })
+
+    unsubscribe()
+  })
+
+  it('should submit a DSL release with encoded workflow content', async () => {
+    const { state, store, unsubscribe } = await mountedStore()
+    const response = {
+      release: {
+        displayName: 'Release from DSL',
+      },
+    }
+    const file = new File([workflowDsl()], 'workflow.yml', { type: 'text/yaml' })
+    mockCreateReleaseMutation.current.mutateAsync.mockResolvedValue(response)
+    store.set(state.createReleaseAppInstanceIdAtom, 'app-instance-1')
+    store.set(state.openCreateReleaseDialogAtom)
+    store.set(state.selectCreateReleaseSourceModeAtom, 'dsl')
+    store.set(state.updateCreateReleaseDslFileAtom, file)
+    setDslFileContentResult()
+    setPrecheckReleaseResult()
+    store.set(state.createReleaseNameFieldAtom, ' Release from DSL ')
+    store.set(state.createReleaseDescriptionFieldAtom, ' Imported workflow ')
+
+    const result = await store.set(state.submitCreateReleaseFormAtom)
+    const encodedDslContent = store.get(state.createReleaseEncodedDslContentAtom)
+
+    expect(result).toBe(response)
+    expect(encodedDslContent).not.toBe('')
+    expect(mockCreateReleaseMutation.current.mutateAsync).toHaveBeenCalledWith({
+      body: {
+        appInstanceId: 'app-instance-1',
+        displayName: 'Release from DSL',
+        description: 'Imported workflow',
+        createAppInstance: false,
+        dsl: encodedDslContent,
+      },
+    })
+
+    unsubscribe()
+  })
+})
diff --git a/web/features/deployments/create-release/state/__tests__/index.spec.ts b/web/features/deployments/create-release/state/__tests__/index.spec.ts
new file mode 100644
index 00000000000..dfb1bb12264
--- /dev/null
+++ b/web/features/deployments/create-release/state/__tests__/index.spec.ts
@@ -0,0 +1,490 @@
+import type { Getter } from 'jotai'
+import type { CreateReleaseFormValues } from '../index'
+import { QueryClient } from '@tanstack/react-query'
+import { atom, createStore } from 'jotai'
+import { queryClientAtom } from 'jotai-tanstack-query'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { consoleQuery } from '@/service/client'
+
+type QueryResult = {
+  data?: unknown
+  isError?: boolean
+  isFetching?: boolean
+  isLoading?: boolean
+  isSuccess?: boolean
+}
+
+type QueryOptions = {
+  enabled?: boolean
+  input?: unknown
+  queryFn?: () => unknown
+  queryKey?: readonly unknown[]
+  retry?: boolean
+}
+
+type MutationResult = {
+  isPending: boolean
+  mutateAsync: ReturnType<typeof vi.fn>
+}
+
+const mockQueryResults = vi.hoisted(() => ({
+  current: new Map<string, QueryResult>(),
+}))
+
+const mockCreateReleaseMutation = vi.hoisted<{ current: MutationResult }>(() => ({
+  current: {
+    isPending: false,
+    mutateAsync: vi.fn(),
+  },
+}))
+
+vi.mock('jotai-tanstack-query', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('jotai-tanstack-query')>()
+
+  return {
+    ...actual,
+    atomWithQuery: (createOptions: (get: Getter) => QueryOptions) => atom((get) => {
+      const options = createOptions(get)
+      const queryKey = Array.isArray(options.queryKey) ? options.queryKey[0] : undefined
+      const queryName = typeof queryKey === 'string' ? queryKey : 'unknown'
+      const queryResult = options.enabled === false
+        ? undefined
+        : mockQueryResults.current.get(queryName)
+
+      return {
+        ...options,
+        data: undefined,
+        isError: false,
+        isFetching: false,
+        isLoading: false,
+        isSuccess: false,
+        ...queryResult,
+      }
+    }),
+    atomWithMutation: () => atom(() => mockCreateReleaseMutation.current),
+  }
+})
+
+vi.mock('@/service/client', () => ({
+  consoleQuery: {
+    apps: {
+      byAppId: {
+        get: {
+          queryOptions: ({ enabled, input }: QueryOptions) => ({
+            enabled,
+            input,
+            queryKey: ['appById', input],
+          }),
+        },
+      },
+    },
+    enterprise: {
+      releaseService: {
+        listReleaseSummaries: {
+          key: ({ input }: { input?: unknown } = {}) => input === undefined ? ['listReleaseSummaries'] : ['listReleaseSummaries', input],
+          queryOptions: ({ enabled, input }: QueryOptions) => ({
+            enabled,
+            input,
+            queryKey: ['listReleaseSummaries', input],
+          }),
+        },
+        listReleases: {
+          key: ({ input }: { input?: unknown } = {}) => input === undefined ? ['listReleases'] : ['listReleases', input],
+          queryOptions: ({ enabled, input }: QueryOptions) => ({
+            enabled,
+            input,
+            queryKey: ['listReleases', input],
+          }),
+        },
+        precheckRelease: {
+          queryOptions: ({ enabled, input }: QueryOptions) => ({
+            enabled,
+            input,
+            queryKey: ['precheckRelease', input],
+          }),
+        },
+        createRelease: {
+          mutationOptions: () => ({ mutationKey: ['createRelease'] }),
+        },
+      },
+    },
+  },
+}))
+
+async function loadState() {
+  return await import('../index')
+}
+
+async function mountedStore() {
+  const state = await loadState()
+  const store = createStore()
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: {
+        retry: false,
+      },
+    },
+  })
+  store.set(queryClientAtom, queryClient)
+  const unsubscribe = store.sub(state.createReleaseFormValuesAtom, () => undefined)
+
+  return {
+    queryClient,
+    state,
+    store,
+    unsubscribe,
+  }
+}
+
+function sourceApp(overrides: Partial<NonNullable<CreateReleaseFormValues['sourceApp']>> = {}): NonNullable<CreateReleaseFormValues['sourceApp']> {
+  return {
+    id: 'source-app-1',
+    name: 'Source App',
+    mode: 'workflow',
+    ...overrides,
+  }
+}
+
+function validationIssueMessage(error: unknown) {
+  if (!error || typeof error !== 'object' || !('message' in error))
+    return undefined
+
+  return typeof error.message === 'string' ? error.message : undefined
+}
+
+function hasValidationIssue(errors: unknown[], message: string) {
+  return errors.some(error => validationIssueMessage(error) === message)
+}
+
+function workflowDsl() {
+  return [
+    'app:',
+    '  mode: workflow',
+    '  name: Release source',
+  ].join('\n')
+}
+
+function setDefaultSourceApp(defaultSourceApp = sourceApp({ id: 'default-source-app', name: 'Default Source App' })) {
+  mockQueryResults.current.set('listReleases', {
+    data: {
+      releases: [
+        {
+          sourceAppId: defaultSourceApp.id,
+        },
+      ],
+    },
+    isSuccess: true,
+  })
+  mockQueryResults.current.set('appById', {
+    data: defaultSourceApp,
+    isSuccess: true,
+  })
+}
+
+function setPrecheckReleaseResult(overrides: {
+  canCreate?: boolean
+  matchedRelease?: unknown
+  unsupportedNodes?: Array<{ id?: string, type?: string }>
+} = {}) {
+  mockQueryResults.current.set('precheckRelease', {
+    data: {
+      gateCommitId: 'gate-commit-1',
+      canCreate: true,
+      unsupportedNodes: [],
+      ...overrides,
+    },
+    isSuccess: true,
+  })
+}
+
+function setCachedReleaseSummaries(queryClient: QueryClient, appInstanceId: string, displayNames: string[]) {
+  queryClient.setQueryData(
+    consoleQuery.enterprise.releaseService.listReleaseSummaries.key({
+      type: 'query',
+      input: { params: { appInstanceId } },
+    }),
+    {
+      releaseSummaries: displayNames.map(displayName => ({
+        release: {
+          displayName,
+        },
+      })),
+      pagination: {},
+    },
+  )
+}
+
+function setDslFileContentResult(overrides: QueryResult = {}) {
+  mockQueryResults.current.set('createReleaseDslFileContent', {
+    data: workflowDsl(),
+    isSuccess: true,
+    ...overrides,
+  })
+}
+
+describe('create release state', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockQueryResults.current.clear()
+    mockCreateReleaseMutation.current = {
+      isPending: false,
+      mutateAsync: vi.fn(),
+    }
+  })
+
+  it('should keep default form values before editing', async () => {
+    const { state, store, unsubscribe } = await mountedStore()
+
+    expect(store.get(state.createReleaseFormValuesAtom)).toEqual({
+      dslFile: undefined,
+      releaseDescription: '',
+      releaseName: '',
+      releaseSourceMode: 'sourceApp',
+      sourceApp: undefined,
+    })
+
+    unsubscribe()
+  })
+
+  it('should validate release name only when submitting', async () => {
+    const { state, store, unsubscribe } = await mountedStore()
+
+    await store.set(state.submitCreateReleaseFormAtom)
+
+    expect(mockCreateReleaseMutation.current.mutateAsync).not.toHaveBeenCalled()
+    expect(hasValidationIssue(
+      store.get(state.createReleaseNameFieldAtom).meta?.errors ?? [],
+      state.RELEASE_NAME_REQUIRED_ERROR,
+    )).toBe(true)
+
+    unsubscribe()
+  })
+
+  it('should submit after fixing release name following a submit validation error', async () => {
+    const { state, store, unsubscribe } = await mountedStore()
+    const response = {
+      release: {
+        displayName: 'Release 1',
+      },
+    }
+    mockCreateReleaseMutation.current.mutateAsync.mockResolvedValue(response)
+    store.set(state.createReleaseAppInstanceIdAtom, 'app-instance-1')
+    store.set(state.openCreateReleaseDialogAtom)
+    setDefaultSourceApp()
+    setPrecheckReleaseResult()
+
+    await store.set(state.submitCreateReleaseFormAtom)
+    store.set(state.createReleaseNameFieldAtom, 'Release 1')
+
+    const result = await store.set(state.submitCreateReleaseFormAtom)
+
+    expect(result).toBe(response)
+    expect(mockCreateReleaseMutation.current.mutateAsync).toHaveBeenCalledTimes(1)
+
+    unsubscribe()
+  })
+
+  it('should coerce DSL source mode to source app mode when DSL import is disabled', async () => {
+    const { state, store, unsubscribe } = await mountedStore()
+
+    store.set(state.selectCreateReleaseSourceModeAtom, 'dsl')
+
+    expect(store.get(state.createReleaseSourceModeFieldAtom).value).toBe('sourceApp')
+    expect(store.get(state.createReleaseSourceModeAtom)).toBe('sourceApp')
+
+    unsubscribe()
+  })
+
+  it('should derive default source app selection from the latest release source', async () => {
+    const { state, store, unsubscribe } = await mountedStore()
+    store.set(state.createReleaseAppInstanceIdAtom, 'app-instance-1')
+    store.set(state.openCreateReleaseDialogAtom)
+    setDefaultSourceApp()
+
+    expect(store.get(state.createReleaseSelectedSourceAppAtom)).toEqual({
+      id: 'default-source-app',
+      name: 'Default Source App',
+      mode: 'workflow',
+    })
+    expect(store.get(state.createReleaseSelectedSourceAppAtom)?.id).toBe('default-source-app')
+
+    unsubscribe()
+  })
+
+  it('should derive workflow DSL read state when selecting a DSL file', async () => {
+    const { state, store, unsubscribe } = await mountedStore()
+    const file = new File([workflowDsl()], 'workflow.yml', { type: 'text/yaml' })
+
+    store.set(state.updateCreateReleaseDslFileAtom, file)
+    setDslFileContentResult()
+
+    expect(store.get(state.createReleaseDslFileFieldAtom).value).toBe(file)
+    expect(store.get(state.createReleaseDslContentAtom)).toBe(workflowDsl())
+    expect(store.get(state.createReleaseHasDslContentAtom)).toBe(true)
+    expect(store.get(state.isReadingCreateReleaseDslAtom)).toBe(false)
+    expect(store.get(state.createReleaseIsWorkflowDslContentAtom)).toBe(true)
+    expect(store.get(state.createReleaseEncodedDslContentAtom)).not.toBe('')
+
+    unsubscribe()
+  })
+
+  it('should reset DSL state when switching back to source app mode', async () => {
+    const { state, store, unsubscribe } = await mountedStore()
+    const file = new File([workflowDsl()], 'workflow.yml', { type: 'text/yaml' })
+
+    store.set(state.updateCreateReleaseDslFileAtom, file)
+    setDslFileContentResult()
+    store.set(state.selectCreateReleaseSourceModeAtom, 'sourceApp')
+
+    expect(store.get(state.createReleaseSourceModeFieldAtom).value).toBe('sourceApp')
+    expect(store.get(state.createReleaseDslFileFieldAtom).value).toBeUndefined()
+    expect(store.get(state.createReleaseDslContentAtom)).toBe('')
+    expect(store.get(state.createReleaseDslReadErrorAtom)).toBe(false)
+    expect(store.get(state.createReleaseEncodedDslContentAtom)).toBe('')
+    expect(store.get(state.createReleaseHasDslContentAtom)).toBe(false)
+    expect(store.get(state.isReadingCreateReleaseDslAtom)).toBe(false)
+    expect(store.get(state.createReleaseIsWorkflowDslContentAtom)).toBe(false)
+
+    unsubscribe()
+  })
+
+  it('should capture DSL file read failures and clear them when opening or closing the dialog', async () => {
+    const { state, store, unsubscribe } = await mountedStore()
+    const file = new File(['broken'], 'broken.yml', { type: 'text/yaml' })
+
+    store.set(state.updateCreateReleaseDslFileAtom, file)
+    setDslFileContentResult({
+      data: undefined,
+      isError: true,
+      isSuccess: false,
+    })
+
+    expect(store.get(state.createReleaseDslReadErrorAtom)).toBe(true)
+
+    store.set(state.openCreateReleaseDialogAtom)
+    expect(store.get(state.createReleaseDialogOpenAtom)).toBe(true)
+    expect(store.get(state.createReleaseDslReadErrorAtom)).toBe(false)
+
+    store.set(state.closeCreateReleaseDialogAtom)
+    expect(store.get(state.createReleaseDialogOpenAtom)).toBe(false)
+
+    unsubscribe()
+  })
+
+  it('should derive content readiness from release content precheck', async () => {
+    const { state, store, unsubscribe } = await mountedStore()
+    store.set(state.createReleaseAppInstanceIdAtom, 'app-instance-1')
+    store.set(state.openCreateReleaseDialogAtom)
+    setDefaultSourceApp()
+    setPrecheckReleaseResult()
+
+    expect(store.get(state.createReleaseContentReadyAtom)).toBe(true)
+
+    store.set(state.createReleaseNameFieldAtom, 'Release 1')
+
+    expect(store.get(state.createReleaseContentReadyAtom)).toBe(true)
+
+    unsubscribe()
+  })
+
+  it('should detect existing release name conflicts from cached release summaries', async () => {
+    const { queryClient, state, store, unsubscribe } = await mountedStore()
+    store.set(state.createReleaseAppInstanceIdAtom, 'app-instance-1')
+    store.set(state.openCreateReleaseDialogAtom)
+    store.set(state.createReleaseNameFieldAtom, ' Release 1 ')
+    setCachedReleaseSummaries(queryClient, 'app-instance-1', ['Release 1'])
+
+    expect(store.get(state.createReleaseHasNameConflictAtom)).toBe(true)
+
+    unsubscribe()
+  })
+
+  it('should close the dialog through the close request action', async () => {
+    const { state, store, unsubscribe } = await mountedStore()
+
+    store.set(state.openCreateReleaseDialogAtom)
+    store.set(state.requestCloseCreateReleaseDialogAtom)
+
+    expect(store.get(state.createReleaseDialogOpenAtom)).toBe(false)
+
+    unsubscribe()
+  })
+
+  it('should expose unsupported nodes from release content precheck', async () => {
+    const { state, store, unsubscribe } = await mountedStore()
+    store.set(state.createReleaseAppInstanceIdAtom, 'app-instance-1')
+    store.set(state.openCreateReleaseDialogAtom)
+    setDefaultSourceApp()
+    setPrecheckReleaseResult({
+      canCreate: false,
+      unsupportedNodes: [{ id: 'precheck-node' }],
+    })
+
+    expect(store.get(state.createReleaseUnsupportedDslNodesAtom)).toEqual([{ id: 'precheck-node' }])
+
+    unsubscribe()
+  })
+
+  it('should submit source app release with the checked source and metadata', async () => {
+    const { state, store, unsubscribe } = await mountedStore()
+    const response = {
+      release: {
+        displayName: 'Release 1',
+      },
+    }
+    mockCreateReleaseMutation.current.mutateAsync.mockResolvedValue(response)
+    store.set(state.createReleaseAppInstanceIdAtom, 'app-instance-1')
+    store.set(state.openCreateReleaseDialogAtom)
+    setDefaultSourceApp()
+    setPrecheckReleaseResult()
+    store.set(state.createReleaseNameFieldAtom, ' Release 1 ')
+    store.set(state.createReleaseDescriptionFieldAtom, ' Initial rollout ')
+
+    const result = await store.set(state.submitCreateReleaseFormAtom)
+
+    expect(result).toBe(response)
+    expect(mockCreateReleaseMutation.current.mutateAsync).toHaveBeenCalledWith({
+      body: {
+        appInstanceId: 'app-instance-1',
+        sourceAppId: 'default-source-app',
+        displayName: 'Release 1',
+        description: 'Initial rollout',
+        createAppInstance: false,
+      },
+    })
+
+    unsubscribe()
+  })
+
+  it('should block release submission when release name already exists', async () => {
+    const { queryClient, state, store, unsubscribe } = await mountedStore()
+    store.set(state.createReleaseAppInstanceIdAtom, 'app-instance-1')
+    store.set(state.openCreateReleaseDialogAtom)
+    setDefaultSourceApp()
+    setPrecheckReleaseResult()
+    setCachedReleaseSummaries(queryClient, 'app-instance-1', ['Release 1'])
+    store.set(state.createReleaseNameFieldAtom, 'Release 1')
+
+    const result = await store.set(state.submitCreateReleaseFormAtom)
+
+    expect(result).toBeUndefined()
+    expect(mockCreateReleaseMutation.current.mutateAsync).not.toHaveBeenCalled()
+
+    unsubscribe()
+  })
+
+  it('should propagate create release submission errors', async () => {
+    const { state, store, unsubscribe } = await mountedStore()
+    const submitError = new Error('submit failed')
+    mockCreateReleaseMutation.current.mutateAsync.mockRejectedValue(submitError)
+    store.set(state.createReleaseAppInstanceIdAtom, 'app-instance-1')
+    store.set(state.openCreateReleaseDialogAtom)
+    setDefaultSourceApp()
+    setPrecheckReleaseResult()
+    store.set(state.createReleaseNameFieldAtom, 'Release 1')
+
+    await expect(store.set(state.submitCreateReleaseFormAtom)).rejects.toThrow(submitError)
+
+    unsubscribe()
+  })
+})
diff --git a/web/features/deployments/create-release/state/index.ts b/web/features/deployments/create-release/state/index.ts
index ee6bcf9d28b..ce9daa7b7dc 100644
--- a/web/features/deployments/create-release/state/index.ts
+++ b/web/features/deployments/create-release/state/index.ts
@@ -1,122 +1,550 @@
 'use client'
 
+import type {
+  CreateReleaseResponse,
+  ListReleasesResponse,
+  ListReleaseSummariesResponse,
+} from '@dify/contracts/enterprise/types.gen'
+import type { Getter } from 'jotai/vanilla'
 import type { UnsupportedDslNode } from '../../shared/domain/error'
-import type { CreateReleaseForm } from './use-create-release-form'
-import { atom, useAtomValue } from 'jotai'
+import type { App } from '@/types/app'
+import { keepPreviousData, queryOptions, skipToken } from '@tanstack/react-query'
+import { atom } from 'jotai'
+import {
+  atomWithForm,
+  createFormAtoms,
+} from 'jotai-tanstack-form'
+import {
+  atomWithInfiniteQuery,
+  atomWithMutation,
+  atomWithQuery,
+  queryClientAtom,
+} from 'jotai-tanstack-query'
+import * as z from 'zod'
+import { consoleQuery } from '@/service/client'
+import { AppModeEnum } from '@/types/app'
 import { encodeDslContent, isWorkflowDsl } from '../../shared/domain/dsl'
+import { isDeploymentDslImportEnabled } from '../../shared/domain/feature-flags'
 
-type CreateReleaseConfig = {
-  appInstanceId: string
+export type ReleaseSourceMode = 'sourceApp' | 'dsl'
+
+export type SourceAppPickerValue = Pick<App, 'id' | 'name'> & Partial<Pick<App, 'icon_type' | 'icon' | 'icon_background' | 'icon_url' | 'mode'>>
+
+export type CreateReleaseFormValues = {
+  releaseSourceMode: ReleaseSourceMode
+  sourceApp?: SourceAppPickerValue
+  dslFile?: File
+  releaseName: string
+  releaseDescription: string
 }
 
-export type CreateReleaseDslState = {
-  dslContent: string
-  dslReadError: boolean
-  encodedDslContent: string
-  hasDslContent: boolean
-  isReadingDsl: boolean
-  isWorkflowDslContent: boolean
+const DEFAULT_CREATE_RELEASE_FORM_VALUES: CreateReleaseFormValues = {
+  releaseSourceMode: 'sourceApp',
+  sourceApp: undefined,
+  dslFile: undefined,
+  releaseName: '',
+  releaseDescription: '',
 }
 
-export const createReleaseConfigAtom = atom<CreateReleaseConfig | undefined>(undefined)
-export const createReleaseDialogOpenAtom = atom(false)
-export const createReleaseFormAtom = atom<CreateReleaseForm | undefined>(undefined)
-export const createReleaseSubmitUnsupportedDslNodesAtom = atom<UnsupportedDslNode[]>([])
+export const RELEASE_NAME_REQUIRED_ERROR = 'releaseNameRequired'
 
-const createReleaseDslContentAtom = atom('')
-const createReleaseDslReadErrorAtom = atom(false)
-const createReleaseDslReadingAtom = atom(false)
-const createReleaseDslReadTokenAtom = atom(0)
+const DEFAULT_SOURCE_RELEASE_PAGE_SIZE = 1
+const CREATE_RELEASE_SOURCE_APP_PAGE_SIZE = 20
 
-export const createReleaseLocalAtoms = [
-  createReleaseDialogOpenAtom,
-  createReleaseDslContentAtom,
-  createReleaseDslReadErrorAtom,
-  createReleaseDslReadingAtom,
-  createReleaseDslReadTokenAtom,
-  createReleaseSubmitUnsupportedDslNodesAtom,
-] as const
+function deploymentReleaseSourceMode(mode: ReleaseSourceMode): ReleaseSourceMode {
+  return mode === 'dsl' && !isDeploymentDslImportEnabled
+    ? 'sourceApp'
+    : mode
+}
 
-export const clearCreateReleaseSubmissionErrorAtom = atom(null, (_get, set) => {
-  set(createReleaseSubmitUnsupportedDslNodesAtom, [])
+function workflowSourceAppPickerValue(value: unknown, fallbackId: string): SourceAppPickerValue | undefined {
+  if (!value || typeof value !== 'object')
+    return undefined
+
+  const record = value as Record<string, unknown>
+  const mode = typeof record.mode === 'string' ? record.mode : undefined
+  if (mode !== AppModeEnum.WORKFLOW)
+    return undefined
+
+  const id = typeof record.id === 'string' && record.id ? record.id : fallbackId
+  const name = typeof record.name === 'string' && record.name ? record.name : id
+
+  return {
+    id,
+    name,
+    mode,
+  }
+}
+
+const createReleaseFormSchema = z.object({
+  releaseSourceMode: z.union([z.literal('sourceApp'), z.literal('dsl')]),
+  sourceApp: z.custom<CreateReleaseFormValues['sourceApp']>().optional(),
+  dslFile: z.custom<CreateReleaseFormValues['dslFile']>().optional(),
+  releaseName: z.string().trim().min(1, RELEASE_NAME_REQUIRED_ERROR),
+  releaseDescription: z.string(),
 })
 
-export const resetCreateReleaseDslFileAtom = atom(null, (get, set) => {
-  set(createReleaseDslReadTokenAtom, get(createReleaseDslReadTokenAtom) + 1)
-  set(createReleaseDslContentAtom, '')
-  set(createReleaseDslReadingAtom, false)
-  set(createReleaseDslReadErrorAtom, false)
+type CreateReleaseSubmit = (value: CreateReleaseFormValues) => Promise<CreateReleaseResponse | undefined> | CreateReleaseResponse | undefined
+
+type CreateReleaseSubmitMeta = {
+  createRelease: CreateReleaseSubmit
+}
+
+const noopCreateRelease: CreateReleaseSubmit = () => undefined
+
+// Form state
+export const createReleaseFormAtom = atomWithForm({
+  defaultValues: DEFAULT_CREATE_RELEASE_FORM_VALUES,
+  onSubmitMeta: {
+    createRelease: noopCreateRelease,
+  },
+  validators: {
+    onSubmit: createReleaseFormSchema,
+  },
+  onSubmit: ({ value, meta }) => meta.createRelease(value),
+})
+
+const createReleaseFormAtoms = createFormAtoms(createReleaseFormAtom)
+
+export const createReleaseFormValuesAtom = createReleaseFormAtoms.valuesAtom
+export const createReleaseFormIsSubmittingAtom = createReleaseFormAtoms.isSubmittingAtom
+export const createReleaseSourceModeFieldAtom = createReleaseFormAtoms.fieldAtom('releaseSourceMode')
+export const createReleaseSourceAppFieldAtom = createReleaseFormAtoms.fieldAtom('sourceApp')
+export const createReleaseDslFileFieldAtom = createReleaseFormAtoms.fieldAtom('dslFile')
+export const createReleaseNameFieldAtom = createReleaseFormAtoms.fieldAtom('releaseName')
+export const createReleaseDescriptionFieldAtom = createReleaseFormAtoms.fieldAtom('releaseDescription')
+
+// Dialog and source primitives
+export const createReleaseAppInstanceIdAtom = atom<string | undefined>(undefined)
+export const createReleaseDialogOpenAtom = atom(false)
+const createReleaseDslFileReadVersionAtom = atom(0)
+
+function requiredAppInstanceId(get: Getter) {
+  const appInstanceId = get(createReleaseAppInstanceIdAtom)
+  if (!appInstanceId)
+    throw new Error('Missing create release app instance id.')
+
+  return appInstanceId
+}
+
+// Query and remote data
+const latestSourceReleaseQueryAtom = atomWithQuery((get) => {
+  const appInstanceId = get(createReleaseAppInstanceIdAtom)
+
+  return consoleQuery.enterprise.releaseService.listReleases.queryOptions({
+    input: appInstanceId
+      ? {
+          params: { appInstanceId },
+          query: {
+            pageNumber: 1,
+            resultsPerPage: DEFAULT_SOURCE_RELEASE_PAGE_SIZE,
+          },
+        }
+      : skipToken,
+    enabled: Boolean(appInstanceId && get(createReleaseDialogOpenAtom)),
+  })
+})
+
+function latestReleaseSourceAppId(get: Getter) {
+  const latestReleaseQuery = get(latestSourceReleaseQueryAtom)
+
+  return latestReleaseQuery.data?.releases[0]?.sourceAppId
+}
+
+const defaultSourceAppQueryAtom = atomWithQuery((get) => {
+  const latestSourceAppId = latestReleaseSourceAppId(get)
+
+  return consoleQuery.apps.byAppId.get.queryOptions({
+    input: latestSourceAppId
+      ? {
+          params: { app_id: latestSourceAppId },
+        }
+      : skipToken,
+    enabled: Boolean(get(createReleaseDialogOpenAtom) && latestSourceAppId),
+  })
+})
+
+function defaultSourceApp(get: Getter) {
+  const latestSourceAppId = latestReleaseSourceAppId(get)
+  if (!latestSourceAppId)
+    return undefined
+
+  return workflowSourceAppPickerValue(get(defaultSourceAppQueryAtom).data, latestSourceAppId)
+}
+
+function submittedReleaseName(get: Getter) {
+  return get(createReleaseNameFieldAtom).value.trim()
+}
+
+function cachedReleaseDisplayNames(get: Getter) {
+  const appInstanceId = get(createReleaseAppInstanceIdAtom)
+  if (!appInstanceId)
+    return []
+
+  const queryClient = get(queryClientAtom)
+  const releaseSummaryQueries = queryClient.getQueriesData<ListReleaseSummariesResponse>({
+    queryKey: consoleQuery.enterprise.releaseService.listReleaseSummaries.key({
+      type: 'query',
+      input: { params: { appInstanceId } },
+    }),
+  })
+  const releaseQueries = queryClient.getQueriesData<ListReleasesResponse>({
+    queryKey: consoleQuery.enterprise.releaseService.listReleases.key({
+      type: 'query',
+      input: { params: { appInstanceId } },
+    }),
+  })
+
+  return [
+    ...releaseSummaryQueries.flatMap(([, data]) => {
+      return data?.releaseSummaries.map(summary => summary.release.displayName) ?? []
+    }),
+    ...releaseQueries.flatMap(([, data]) => {
+      return data?.releases.map(release => release.displayName) ?? []
+    }),
+  ]
+}
+
+export const createReleaseHasNameConflictAtom = atom((get) => {
+  const releaseName = submittedReleaseName(get)
+  if (!releaseName)
+    return false
+
+  return cachedReleaseDisplayNames(get).some(displayName => displayName.trim() === releaseName)
+})
+
+const createReleaseDslFileContentQueryAtom = atomWithQuery((get) => {
+  const file = get(createReleaseDslFileFieldAtom).value
+  const fileReadVersion = get(createReleaseDslFileReadVersionAtom)
+
+  return queryOptions({
+    queryKey: [
+      'createReleaseDslFileContent',
+      fileReadVersion,
+      file,
+      file?.name ?? '',
+      file?.size ?? 0,
+      file?.lastModified ?? 0,
+    ],
+    queryFn: async () => file ? await file.text() : '',
+    enabled: Boolean(file),
+    retry: false,
+  })
+})
+
+// Source derived state
+function effectiveCreateReleaseSourceMode(get: Getter) {
+  return deploymentReleaseSourceMode(get(createReleaseSourceModeFieldAtom).value)
+}
+
+export const createReleaseSourceModeAtom = atom((get) => {
+  return effectiveCreateReleaseSourceMode(get)
+})
+
+export const createReleaseSourceAppSearchTextAtom = atom('')
+
+export const createReleaseSourceAppsQueryAtom = atomWithInfiniteQuery((get) => {
+  const searchText = get(createReleaseSourceAppSearchTextAtom)
+
+  return consoleQuery.apps.list.infiniteOptions({
+    input: pageParam => ({
+      query: {
+        page: Number(pageParam),
+        limit: CREATE_RELEASE_SOURCE_APP_PAGE_SIZE,
+        name: searchText,
+        mode: AppModeEnum.WORKFLOW,
+      },
+    }),
+    getNextPageParam: lastPage => lastPage.has_more ? lastPage.page + 1 : undefined,
+    initialPageParam: 1,
+    placeholderData: keepPreviousData,
+    enabled: Boolean(
+      get(createReleaseDialogOpenAtom)
+      && effectiveCreateReleaseSourceMode(get) === 'sourceApp'
+      && isDeploymentDslImportEnabled,
+    ),
+  })
+})
+
+export const createReleaseDslContentAtom = atom((get) => {
+  return get(createReleaseDslFileContentQueryAtom).data ?? ''
+})
+
+export const createReleaseDslReadErrorAtom = atom((get) => {
+  return Boolean(get(createReleaseDslFileFieldAtom).value && get(createReleaseDslFileContentQueryAtom).isError)
+})
+
+export const isReadingCreateReleaseDslAtom = atom((get) => {
+  const file = get(createReleaseDslFileFieldAtom).value
+  const dslFileContentQuery = get(createReleaseDslFileContentQueryAtom)
+
+  return Boolean(file && (dslFileContentQuery.isLoading || dslFileContentQuery.isFetching))
+})
+
+export const createReleaseHasDslContentAtom = atom((get) => {
+  return Boolean(get(createReleaseDslContentAtom).trim())
+})
+
+export const createReleaseIsWorkflowDslContentAtom = atom((get) => {
+  const dslContent = get(createReleaseDslContentAtom)
+
+  return get(createReleaseHasDslContentAtom) ? isWorkflowDsl(dslContent) : false
+})
+
+export const createReleaseEncodedDslContentAtom = atom((get) => {
+  const dslContent = get(createReleaseDslContentAtom)
+
+  return get(createReleaseHasDslContentAtom) && get(createReleaseIsWorkflowDslContentAtom)
+    ? encodeDslContent(dslContent)
+    : ''
+})
+
+export const createReleaseSelectedSourceAppAtom = atom((get) => {
+  if (effectiveCreateReleaseSourceMode(get) !== 'sourceApp')
+    return undefined
+
+  const fieldSourceApp = get(createReleaseSourceAppFieldAtom).value
+  const fallbackSourceApp = defaultSourceApp(get)
+
+  if (!isDeploymentDslImportEnabled)
+    return fallbackSourceApp
+
+  return fieldSourceApp ?? fallbackSourceApp
+})
+
+function selectedSourceAppId(get: Getter) {
+  return effectiveCreateReleaseSourceMode(get) === 'sourceApp'
+    ? get(createReleaseSelectedSourceAppAtom)?.id
+    : undefined
+}
+
+function hasUnsupportedDslMode(get: Getter) {
+  if (effectiveCreateReleaseSourceMode(get) !== 'dsl')
+    return false
+
+  return get(createReleaseHasDslContentAtom)
+    && !get(isReadingCreateReleaseDslAtom)
+    && !get(createReleaseDslReadErrorAtom)
+    && !get(createReleaseIsWorkflowDslContentAtom)
+}
+
+export const createReleaseHasUnsupportedDslModeAtom = atom((get) => {
+  return hasUnsupportedDslMode(get)
+})
+
+function canCheckReleaseSourceContent(get: Getter) {
+  if (effectiveCreateReleaseSourceMode(get) === 'sourceApp')
+    return Boolean(selectedSourceAppId(get))
+  if (!isDeploymentDslImportEnabled)
+    return false
+
+  return Boolean(
+    get(createReleaseHasDslContentAtom)
+    && !get(isReadingCreateReleaseDslAtom)
+    && !get(createReleaseDslReadErrorAtom)
+    && !hasUnsupportedDslMode(get),
+  )
+}
+
+function canCheckReleaseContent(get: Getter) {
+  return Boolean(
+    get(createReleaseAppInstanceIdAtom)
+    && get(createReleaseDialogOpenAtom)
+    && canCheckReleaseSourceContent(get),
+  )
+}
+
+// Release content check
+const precheckReleaseQueryAtom = atomWithQuery((get) => {
+  const appInstanceId = get(createReleaseAppInstanceIdAtom)
+  const releaseSourceMode = effectiveCreateReleaseSourceMode(get)
+  const sourceAppId = selectedSourceAppId(get)
+  const canCheck = canCheckReleaseContent(get)
+
+  return consoleQuery.enterprise.releaseService.precheckRelease.queryOptions({
+    input: appInstanceId
+      ? releaseSourceMode === 'dsl'
+        ? {
+            body: {
+              appInstanceId,
+              dsl: get(createReleaseEncodedDslContentAtom),
+            },
+          }
+        : sourceAppId
+          ? {
+              body: {
+                appInstanceId,
+                sourceAppId,
+              },
+            }
+          : skipToken
+      : skipToken,
+    enabled: canCheck,
+    retry: false,
+  })
+})
+
+export const isCheckingCreateReleaseContentAtom = atom((get) => {
+  const canCheck = canCheckReleaseContent(get)
+  const precheckReleaseQuery = get(precheckReleaseQueryAtom)
+
+  return canCheck && (precheckReleaseQuery.isLoading || precheckReleaseQuery.isFetching)
+})
+
+export const createReleaseMatchedReleaseAtom = atom((get) => {
+  return canCheckReleaseContent(get)
+    ? get(precheckReleaseQueryAtom).data?.matchedRelease
+    : undefined
+})
+
+export const createReleaseContentCheckFailedAtom = atom((get) => {
+  return canCheckReleaseContent(get) && get(precheckReleaseQueryAtom).isError
+})
+
+export const createReleaseUnsupportedDslNodesAtom = atom((get): UnsupportedDslNode[] => {
+  return canCheckReleaseContent(get)
+    ? get(precheckReleaseQueryAtom).data?.unsupportedNodes ?? []
+    : []
+})
+
+export const createReleaseContentReadyAtom = atom((get) => {
+  const canCheck = canCheckReleaseContent(get)
+  const precheckReleaseQuery = get(precheckReleaseQueryAtom)
+
+  return canCheck
+    && precheckReleaseQuery.isSuccess
+    && !get(isCheckingCreateReleaseContentAtom)
+    && !get(createReleaseContentCheckFailedAtom)
+    && Boolean(precheckReleaseQuery.data?.canCreate)
+    && get(createReleaseUnsupportedDslNodesAtom).length === 0
+})
+
+// Actions
+const resetCreateReleaseDslFileAtom = atom(null, (get, set) => {
+  set(createReleaseDslFileFieldAtom, undefined)
+  set(createReleaseDslFileReadVersionAtom, get(createReleaseDslFileReadVersionAtom) + 1)
 })
 
 export const openCreateReleaseDialogAtom = atom(null, (_get, set) => {
-  set(clearCreateReleaseSubmissionErrorAtom)
   set(resetCreateReleaseDslFileAtom)
   set(createReleaseDialogOpenAtom, true)
 })
 
 export const closeCreateReleaseDialogAtom = atom(null, (_get, set) => {
   set(createReleaseDialogOpenAtom, false)
-  set(clearCreateReleaseSubmissionErrorAtom)
   set(resetCreateReleaseDslFileAtom)
 })
 
-export const selectCreateReleaseDslFileAtom = atom(null, async (get, set, file?: File) => {
-  const readToken = get(createReleaseDslReadTokenAtom) + 1
-  set(createReleaseDslReadTokenAtom, readToken)
-  set(createReleaseDslContentAtom, '')
-  set(createReleaseDslReadingAtom, false)
-  set(createReleaseDslReadErrorAtom, false)
-
-  if (!file)
+export const requestCloseCreateReleaseDialogAtom = atom(null, (get, set) => {
+  if (get(createReleaseFormIsSubmittingAtom))
     return
 
-  set(createReleaseDslReadingAtom, true)
-  try {
-    const content = await file.text()
-    if (get(createReleaseDslReadTokenAtom) !== readToken)
-      return
-
-    set(createReleaseDslContentAtom, content)
-  }
-  catch {
-    if (get(createReleaseDslReadTokenAtom) !== readToken)
-      return
-
-    set(createReleaseDslReadErrorAtom, true)
-  }
-  finally {
-    if (get(createReleaseDslReadTokenAtom) === readToken)
-      set(createReleaseDslReadingAtom, false)
-  }
+  set(closeCreateReleaseDialogAtom)
 })
 
-export const createReleaseDslStateAtom = atom((get): CreateReleaseDslState => {
-  const dslContent = get(createReleaseDslContentAtom)
-  const hasDslContent = Boolean(dslContent.trim())
-  const isWorkflowDslContent = hasDslContent ? isWorkflowDsl(dslContent) : false
+export const selectCreateReleaseSourceModeAtom = atom(null, (_get, set, releaseSourceMode: ReleaseSourceMode) => {
+  const effectiveReleaseSourceMode = deploymentReleaseSourceMode(releaseSourceMode)
+  set(createReleaseSourceModeFieldAtom, effectiveReleaseSourceMode)
 
-  return {
-    dslContent,
-    dslReadError: get(createReleaseDslReadErrorAtom),
-    encodedDslContent: hasDslContent && isWorkflowDslContent ? encodeDslContent(dslContent) : '',
-    hasDslContent,
-    isReadingDsl: get(createReleaseDslReadingAtom),
-    isWorkflowDslContent,
+  if (effectiveReleaseSourceMode === 'sourceApp') {
+    set(resetCreateReleaseDslFileAtom)
+    return
   }
+
+  set(createReleaseSourceAppFieldAtom, undefined)
 })
 
-export function useCreateReleaseConfig() {
-  const config = useAtomValue(createReleaseConfigAtom)
-  if (!config)
-    throw new Error('Missing create release config.')
+export const updateCreateReleaseSourceAppAtom = atom(null, (_get, set, sourceApp: CreateReleaseFormValues['sourceApp']) => {
+  set(createReleaseSourceAppFieldAtom, sourceApp)
+})
 
-  return config
+export const updateCreateReleaseDslFileAtom = atom(null, (get, set, dslFile: CreateReleaseFormValues['dslFile']) => {
+  set(createReleaseDslFileFieldAtom, dslFile)
+  set(createReleaseDslFileReadVersionAtom, get(createReleaseDslFileReadVersionAtom) + 1)
+})
+
+// Submission
+const createReleaseMutationAtom = atomWithMutation(() =>
+  consoleQuery.enterprise.releaseService.createRelease.mutationOptions(),
+)
+
+export const isCreatingReleaseAtom = atom((get) => {
+  return get(createReleaseMutationAtom).isPending
+})
+
+export class CreateReleaseSubmissionBlockedError extends Error {
+  reason: 'unsupportedDslMode'
+
+  constructor(reason: 'unsupportedDslMode') {
+    super(reason)
+    this.reason = reason
+    this.name = 'CreateReleaseSubmissionBlockedError'
+  }
 }
 
-export function useCreateReleaseFormApi() {
-  const form = useAtomValue(createReleaseFormAtom)
-  if (!form)
-    throw new Error('Missing create release form.')
+const createReleaseSubmissionAtom = atom(null, async (get, set, value: CreateReleaseFormValues) => {
+  const releaseSourceMode = effectiveCreateReleaseSourceMode(get)
+  const sourceAppId = selectedSourceAppId(get)
+  const submittedReleaseName = value.releaseName.trim()
 
-  return form
-}
+  if (get(isCheckingCreateReleaseContentAtom) || !submittedReleaseName)
+    return undefined
+
+  if (get(createReleaseHasNameConflictAtom))
+    return undefined
+
+  if (!canCheckReleaseSourceContent(get) || !get(createReleaseContentReadyAtom))
+    return undefined
+
+  const appInstanceId = requiredAppInstanceId(get)
+  const commonCreateReleaseRequest = {
+    appInstanceId,
+    displayName: submittedReleaseName,
+    description: value.releaseDescription.trim() || undefined,
+    createAppInstance: false,
+  }
+
+  if (releaseSourceMode === 'dsl') {
+    if (!get(createReleaseIsWorkflowDslContentAtom))
+      throw new CreateReleaseSubmissionBlockedError('unsupportedDslMode')
+
+    return await get(createReleaseMutationAtom).mutateAsync({
+      body: {
+        ...commonCreateReleaseRequest,
+        dsl: get(createReleaseEncodedDslContentAtom),
+      },
+    })
+  }
+
+  if (!sourceAppId)
+    return undefined
+
+  return await get(createReleaseMutationAtom).mutateAsync({
+    body: {
+      ...commonCreateReleaseRequest,
+      sourceAppId,
+    },
+  })
+})
+
+export const submitCreateReleaseFormAtom = atom(null, (get, set) => {
+  const form = get(createReleaseFormAtom)
+  let submitResponse: CreateReleaseResponse | undefined
+
+  return form.api.handleSubmit({
+    createRelease: async (value) => {
+      const response = await set(createReleaseSubmissionAtom, value)
+      submitResponse = response
+
+      return response
+    },
+  } satisfies CreateReleaseSubmitMeta)
+    .then(() => submitResponse)
+})
+
+// Scoped atoms
+export const createReleaseLocalAtoms = [
+  createReleaseDialogOpenAtom,
+  createReleaseDslFileReadVersionAtom,
+  createReleaseSourceAppSearchTextAtom,
+] as const
diff --git a/web/features/deployments/create-release/state/types.ts b/web/features/deployments/create-release/state/types.ts
deleted file mode 100644
index 0ebb291ed7c..00000000000
--- a/web/features/deployments/create-release/state/types.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-import type { SourceAppPickerValue } from '../ui/source-app-picker-value'
-
-export type ReleaseSourceMode = 'sourceApp' | 'dsl'
-
-export type CreateReleaseFormValues = {
-  releaseSourceMode: ReleaseSourceMode
-  sourceApp?: SourceAppPickerValue
-  dslFile?: File
-  releaseName: string
-  releaseDescription: string
-}
-
-export const DEFAULT_CREATE_RELEASE_FORM_VALUES: CreateReleaseFormValues = {
-  releaseSourceMode: 'sourceApp',
-  sourceApp: undefined,
-  dslFile: undefined,
-  releaseName: '',
-  releaseDescription: '',
-}
diff --git a/web/features/deployments/create-release/state/use-create-release-form.ts b/web/features/deployments/create-release/state/use-create-release-form.ts
deleted file mode 100644
index 9e7c3b6e911..00000000000
--- a/web/features/deployments/create-release/state/use-create-release-form.ts
+++ /dev/null
@@ -1,24 +0,0 @@
-'use client'
-
-import type { CreateReleaseFormValues } from './types'
-import { useForm } from '@tanstack/react-form'
-import { DEFAULT_CREATE_RELEASE_FORM_VALUES } from './types'
-
-export const RELEASE_NAME_REQUIRED_ERROR = 'releaseNameRequired'
-
-export function validateReleaseName({ value }: {
-  value: string
-}) {
-  return value.trim() ? undefined : RELEASE_NAME_REQUIRED_ERROR
-}
-
-export function useCreateReleaseForm({ onSubmit }: {
-  onSubmit: (value: CreateReleaseFormValues) => Promise<void> | void
-}) {
-  return useForm({
-    defaultValues: DEFAULT_CREATE_RELEASE_FORM_VALUES,
-    onSubmit: ({ value }) => onSubmit(value),
-  })
-}
-
-export type CreateReleaseForm = ReturnType<typeof useCreateReleaseForm>
diff --git a/web/features/deployments/create-release/ui/__tests__/source-app-picker.spec.tsx b/web/features/deployments/create-release/ui/__tests__/source-app-picker.spec.tsx
new file mode 100644
index 00000000000..dbf553b8d1f
--- /dev/null
+++ b/web/features/deployments/create-release/ui/__tests__/source-app-picker.spec.tsx
@@ -0,0 +1,33 @@
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { render, screen } from '@testing-library/react'
+import { describe, expect, it } from 'vitest'
+import { SourceAppPicker } from '../source-app-picker'
+
+function renderSourceAppPicker(disabled: boolean) {
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: {
+        retry: false,
+      },
+    },
+  })
+
+  return render(
+    <QueryClientProvider client={queryClient}>
+      <SourceAppPicker
+        value={{ id: 'app-1', name: 'Workflow 1' }}
+        onChange={() => undefined}
+        disabled={disabled}
+      />
+    </QueryClientProvider>,
+  )
+}
+
+describe('SourceAppPicker', () => {
+  it('should disable the switch control when disabled', () => {
+    renderSourceAppPicker(true)
+
+    expect(screen.getByText('Workflow 1')).toBeInTheDocument()
+    expect(screen.getByRole('combobox', { name: 'deployments.versions.sourceAppOption' })).toBeDisabled()
+  })
+})
diff --git a/web/features/deployments/create-release/ui/actions.tsx b/web/features/deployments/create-release/ui/actions.tsx
index cd2eee506ef..40558eedefe 100644
--- a/web/features/deployments/create-release/ui/actions.tsx
+++ b/web/features/deployments/create-release/ui/actions.tsx
@@ -1,61 +1,26 @@
 'use client'
 
-import type { CreateReleaseFormValues } from '../state/types'
 import { Button } from '@langgenius/dify-ui/button'
-import { useSetAtom } from 'jotai'
+import { useAtomValue, useSetAtom } from 'jotai'
 import { useTranslation } from 'react-i18next'
 import {
-  closeCreateReleaseDialogAtom,
-  useCreateReleaseFormApi,
+  createReleaseContentReadyAtom,
+  createReleaseFormIsSubmittingAtom,
+  createReleaseHasNameConflictAtom,
+  createReleaseNameFieldAtom,
+  isCheckingCreateReleaseContentAtom,
+  requestCloseCreateReleaseDialogAtom,
 } from '../state'
-import {
-  createReleaseReadiness,
-  useCreateReleaseSourceSelection,
-  useReleaseContentCheck,
-} from './use-release-content-check'
 
 export function CreateReleaseActions() {
-  const form = useCreateReleaseFormApi()
-
-  return (
-    <form.Subscribe selector={state => ({
-      isSubmitting: state.isSubmitting,
-      values: state.values,
-    })}
-    >
-      {({ isSubmitting, values }) => (
-        <CreateReleaseActionsContent
-          formValues={values}
-          isSubmitting={isSubmitting}
-        />
-      )}
-    </form.Subscribe>
-  )
-}
-
-function CreateReleaseActionsContent({
-  formValues,
-  isSubmitting,
-}: {
-  formValues: CreateReleaseFormValues
-  isSubmitting: boolean
-}) {
   const { t } = useTranslation('deployments')
-  const closeDialog = useSetAtom(closeCreateReleaseDialogAtom)
-  const sourceSelection = useCreateReleaseSourceSelection(formValues)
-  const releaseContent = useReleaseContentCheck(sourceSelection)
-  const { canCreate, isCheckingReleaseContent } = createReleaseReadiness({
-    formValues,
-    isSubmitting,
-    releaseContent,
-  })
-
-  function requestClose() {
-    if (isSubmitting)
-      return
-
-    closeDialog()
-  }
+  const requestCloseDialog = useSetAtom(requestCloseCreateReleaseDialogAtom)
+  const isSubmitting = useAtomValue(createReleaseFormIsSubmittingAtom)
+  const releaseContentReady = useAtomValue(createReleaseContentReadyAtom)
+  const isCheckingReleaseContent = useAtomValue(isCheckingCreateReleaseContentAtom)
+  const hasReleaseNameConflict = useAtomValue(createReleaseHasNameConflictAtom)
+  const releaseNameField = useAtomValue(createReleaseNameFieldAtom)
+  const hasReleaseName = Boolean(releaseNameField.value.trim())
 
   return (
     <div className="flex items-center justify-end gap-4 border-t border-divider-subtle bg-background-default-subtle px-6 py-4">
@@ -67,12 +32,12 @@ function CreateReleaseActionsContent({
           onPointerDown={(event) => {
             event.preventDefault()
             event.stopPropagation()
-            requestClose()
+            requestCloseDialog()
           }}
           onClick={(event) => {
             event.preventDefault()
             event.stopPropagation()
-            requestClose()
+            requestCloseDialog()
           }}
         >
           {t('versions.cancelCreate')}
@@ -81,7 +46,8 @@ function CreateReleaseActionsContent({
           type="submit"
           variant="primary"
           className="min-w-22"
-          disabled={!canCreate}
+          disabled={!hasReleaseName || !releaseContentReady || hasReleaseNameConflict}
+          loading={isSubmitting}
         >
           {isSubmitting ? t('versions.creating') : isCheckingReleaseContent ? t('versions.checkingReleaseContent') : t('versions.create')}
         </Button>
diff --git a/web/features/deployments/create-release/ui/content-feedback.tsx b/web/features/deployments/create-release/ui/content-feedback.tsx
index 24e4a573744..8e7b2e323f4 100644
--- a/web/features/deployments/create-release/ui/content-feedback.tsx
+++ b/web/features/deployments/create-release/ui/content-feedback.tsx
@@ -1,59 +1,31 @@
 'use client'
 
-import type { CreateReleaseFormValues } from '../state/types'
 import { useAtomValue } from 'jotai'
 import { useTranslation } from 'react-i18next'
 import { UnsupportedDslNodesAlert } from '../../components/unsupported-dsl-nodes-alert'
 import {
-  createReleaseSubmitUnsupportedDslNodesAtom,
-  useCreateReleaseFormApi,
+  createReleaseContentCheckFailedAtom,
+  createReleaseMatchedReleaseAtom,
+  createReleaseUnsupportedDslNodesAtom,
 } from '../state'
-import {
-  useCreateReleaseSourceSelection,
-  useReleaseContentCheck,
-} from './use-release-content-check'
 
 export function ReleaseContentFeedback() {
-  const form = useCreateReleaseFormApi()
-
-  return (
-    <form.Subscribe selector={state => state.values}>
-      {formValues => <ReleaseContentFeedbackContent formValues={formValues} />}
-    </form.Subscribe>
-  )
-}
-
-function ReleaseContentFeedbackContent({ formValues }: {
-  formValues: CreateReleaseFormValues
-}) {
   const { t } = useTranslation('deployments')
-  const sourceSelection = useCreateReleaseSourceSelection(formValues)
-  const releaseContent = useReleaseContentCheck(sourceSelection)
-  const submitUnsupportedDslNodes = useAtomValue(createReleaseSubmitUnsupportedDslNodesAtom)
-  // Precheck reports unsupported nodes at pick time; the post-submit atom stays
-  // as the TOCTOU fallback when the content changes server-side between
-  // precheck and create.
-  const unsupportedDslNodes = releaseContent.unsupportedNodes.length > 0
-    ? releaseContent.unsupportedNodes
-    : submitUnsupportedDslNodes
+  const unsupportedDslNodes = useAtomValue(createReleaseUnsupportedDslNodesAtom)
+  const matchedRelease = useAtomValue(createReleaseMatchedReleaseAtom)
+  const releaseContentCheckFailed = useAtomValue(createReleaseContentCheckFailedAtom)
 
   return (
     <>
       <UnsupportedDslNodesAlert nodes={unsupportedDslNodes} />
 
-      {releaseContent.isCheckingReleaseContent && (
-        <div className="rounded-lg border border-divider-subtle bg-background-default-subtle px-3 py-2 system-sm-regular text-text-tertiary">
-          {t('versions.checkingReleaseContent')}
-        </div>
-      )}
-
-      {releaseContent.matchedRelease && (
+      {matchedRelease && (
         <div role="alert" className="rounded-lg border border-util-colors-warning-warning-200 bg-util-colors-warning-warning-50 px-3 py-2 system-sm-regular text-util-colors-warning-warning-700">
-          {t('versions.releaseAlreadyExists', { name: releaseContent.matchedRelease.displayName })}
+          {t('versions.releaseAlreadyExists', { name: matchedRelease.displayName })}
         </div>
       )}
 
-      {releaseContent.releaseContentCheckFailed && (
+      {releaseContentCheckFailed && (
         <div role="alert" className="rounded-lg border border-util-colors-red-red-200 bg-util-colors-red-red-50 px-3 py-2 system-sm-regular text-util-colors-red-red-700">
           {t('versions.releaseContentCheckFailed')}
         </div>
diff --git a/web/features/deployments/create-release/ui/dialog.tsx b/web/features/deployments/create-release/ui/dialog.tsx
index 501600e73ac..a0b6dde2fc6 100644
--- a/web/features/deployments/create-release/ui/dialog.tsx
+++ b/web/features/deployments/create-release/ui/dialog.tsx
@@ -1,42 +1,27 @@
 'use client'
 
-import type { CreateReleaseFormValues } from '../state/types'
-import { Dialog, DialogCloseButton, DialogContent, DialogDescription, DialogTitle } from '@langgenius/dify-ui/dialog'
-import { skipToken, useQuery } from '@tanstack/react-query'
+import { DialogCloseButton, DialogContent, DialogDescription, DialogTitle } from '@langgenius/dify-ui/dialog'
+import { toast } from '@langgenius/dify-ui/toast'
 import { useAtomValue, useSetAtom } from 'jotai'
 import { ScopeProvider } from 'jotai-scope'
-import { useEffect, useRef } from 'react'
 import { useTranslation } from 'react-i18next'
-import { consoleQuery } from '@/service/client'
+import { deploymentErrorMessage } from '../../shared/domain/error'
 import {
   closeCreateReleaseDialogAtom,
-  createReleaseDialogOpenAtom,
   createReleaseFormAtom,
-  openCreateReleaseDialogAtom,
-  useCreateReleaseConfig,
-  useCreateReleaseFormApi,
+  createReleaseFormIsSubmittingAtom,
+  CreateReleaseSubmissionBlockedError,
+  requestCloseCreateReleaseDialogAtom,
+  submitCreateReleaseFormAtom,
 } from '../state'
-import { useCreateReleaseForm } from '../state/use-create-release-form'
 import { CreateReleaseActions } from './actions'
 import { ReleaseContentFeedback } from './content-feedback'
 import { ReleaseMetadataFields } from './metadata-fields'
-import { workflowSourceAppPickerValue } from './source-app-picker-value'
 import { ReleaseSourceSection } from './source-section'
-import { useCreateReleaseSubmission } from './use-create-release-submission'
 
-const DEFAULT_SOURCE_RELEASE_PAGE_SIZE = 1
-
-function CreateReleaseCloseButton({ isSubmitting }: {
-  isSubmitting: boolean
-}) {
-  const closeDialog = useSetAtom(closeCreateReleaseDialogAtom)
-
-  function requestClose() {
-    if (isSubmitting)
-      return
-
-    closeDialog()
-  }
+function CreateReleaseCloseButton() {
+  const isSubmitting = useAtomValue(createReleaseFormIsSubmittingAtom)
+  const requestCloseDialog = useSetAtom(requestCloseCreateReleaseDialogAtom)
 
   return (
     <DialogCloseButton
@@ -45,159 +30,81 @@ function CreateReleaseCloseButton({ isSubmitting }: {
       onPointerDown={(event) => {
         event.preventDefault()
         event.stopPropagation()
-        requestClose()
+        requestCloseDialog()
       }}
       onClick={(event) => {
         event.preventDefault()
         event.stopPropagation()
-        requestClose()
+        requestCloseDialog()
       }}
     />
   )
 }
 
-function CreateReleaseDefaultSourceApp({ formValues }: {
-  formValues: CreateReleaseFormValues
-}) {
-  const { appInstanceId } = useCreateReleaseConfig()
-  const form = useCreateReleaseFormApi()
-  const isDialogOpen = useAtomValue(createReleaseDialogOpenAtom)
-  const latestReleaseQuery = useQuery(consoleQuery.enterprise.releaseService.listReleases.queryOptions({
-    input: {
-      params: { appInstanceId },
-      query: {
-        pageNumber: 1,
-        resultsPerPage: DEFAULT_SOURCE_RELEASE_PAGE_SIZE,
-      },
-    },
-    enabled: isDialogOpen,
-  }))
-  const latestSourceAppId = latestReleaseQuery.data?.releases[0]?.sourceAppId
-  const defaultSourceAppInput = isDialogOpen && latestSourceAppId
-    ? { params: { app_id: latestSourceAppId } }
-    : undefined
-  const defaultSourceAppQuery = useQuery(defaultSourceAppInput
-    ? consoleQuery.apps.byAppId.get.queryOptions({
-        input: defaultSourceAppInput,
-      })
-    : {
-        queryFn: skipToken,
-        queryKey: ['create-release', 'default-source-app'],
-      })
-  const defaultSourceApp = latestSourceAppId
-    ? workflowSourceAppPickerValue(defaultSourceAppQuery.data, latestSourceAppId)
-    : undefined
-
-  useEffect(() => {
-    if (!isDialogOpen || formValues.releaseSourceMode !== 'sourceApp' || formValues.sourceApp || !defaultSourceApp)
-      return
-
-    form.setFieldValue('sourceApp', defaultSourceApp)
-  }, [defaultSourceApp, form, formValues.releaseSourceMode, formValues.sourceApp, isDialogOpen])
-
-  return null
-}
-
-function CreateReleaseDialogForm() {
-  const submitReleaseRef = useRef<(value: CreateReleaseFormValues) => Promise<void> | void>(() => undefined)
-  const form = useCreateReleaseForm({
-    onSubmit: value => submitReleaseRef.current(value),
-  })
-
+export function CreateReleaseDialogContent() {
   return (
-    <ScopeProvider atoms={[[createReleaseFormAtom, form]]}>
-      <form.Subscribe selector={state => ({
-        isSubmitting: state.isSubmitting,
-        values: state.values,
-      })}
-      >
-        {({ isSubmitting, values }) => (
-          <CreateReleaseDialogSurface
-            formValues={values}
-            isSubmitting={isSubmitting}
-            submitReleaseRef={submitReleaseRef}
-          />
-        )}
-      </form.Subscribe>
+    <ScopeProvider atoms={[createReleaseFormAtom]}>
+      <CreateReleaseDialogSurface />
     </ScopeProvider>
   )
 }
 
-function CreateReleaseDialogSurface({
-  formValues,
-  isSubmitting,
-  submitReleaseRef,
-}: {
-  formValues: CreateReleaseFormValues
-  isSubmitting: boolean
-  submitReleaseRef: {
-    current: (value: CreateReleaseFormValues) => Promise<void> | void
-  }
-}) {
-  const open = useAtomValue(createReleaseDialogOpenAtom)
-  const openDialog = useSetAtom(openCreateReleaseDialogAtom)
+function CreateReleaseDialogSurface() {
   const closeDialog = useSetAtom(closeCreateReleaseDialogAtom)
+  const submitCreateReleaseForm = useSetAtom(submitCreateReleaseFormAtom)
   const { t } = useTranslation('deployments')
-  const form = useCreateReleaseFormApi()
-  const submission = useCreateReleaseSubmission(formValues)
-  submitReleaseRef.current = submission.createRelease
 
-  function handleDialogOpenChange(nextOpen: boolean) {
-    if (nextOpen) {
-      openDialog()
-      return
-    }
+  async function handleSubmit() {
+    try {
+      const response = await submitCreateReleaseForm()
+      if (!response)
+        return
 
-    if (!isSubmitting)
+      toast.success(t('versions.createSuccess', { name: response.release.displayName }))
       closeDialog()
+    }
+    catch (error) {
+      if (error instanceof CreateReleaseSubmissionBlockedError) {
+        toast.error(t('versions.dslUnsupportedMode'))
+        return
+      }
+
+      const message = await deploymentErrorMessage(error)
+      toast.error(message || t('versions.createFailed'))
+    }
   }
 
   return (
-    <Dialog
-      open={open}
-      onOpenChange={handleDialogOpenChange}
-    >
-      <DialogContent className="top-[18dvh] w-140 max-w-[calc(100vw-32px)] translate-y-0 overflow-hidden p-0">
-        <CreateReleaseDefaultSourceApp formValues={formValues} />
-        <CreateReleaseCloseButton isSubmitting={isSubmitting} />
-        <form
-          noValidate
-          autoComplete="off"
-          onSubmit={(event) => {
-            event.preventDefault()
-            event.stopPropagation()
-            void form.handleSubmit()
-          }}
-        >
-          <div className="border-b border-divider-subtle px-6 py-5 pr-14">
-            <div className="min-w-0">
-              <DialogTitle className="title-xl-semi-bold text-text-primary">
-                {t('versions.createRelease')}
-              </DialogTitle>
-              <DialogDescription className="mt-1 system-sm-regular text-text-tertiary">
-                {t('versions.createReleaseDescription')}
-              </DialogDescription>
-            </div>
+    <DialogContent className="top-[18dvh] w-140 max-w-[calc(100vw-32px)] translate-y-0 overflow-hidden p-0">
+      <CreateReleaseCloseButton />
+      <form
+        noValidate
+        autoComplete="off"
+        onSubmit={(event) => {
+          event.preventDefault()
+          event.stopPropagation()
+          void handleSubmit()
+        }}
+      >
+        <div className="border-b border-divider-subtle px-6 py-5 pr-14">
+          <div className="min-w-0">
+            <DialogTitle className="title-xl-semi-bold text-text-primary">
+              {t('versions.createRelease')}
+            </DialogTitle>
+            <DialogDescription className="mt-1 system-sm-regular text-text-tertiary">
+              {t('versions.createReleaseDescription')}
+            </DialogDescription>
           </div>
+        </div>
 
-          <div className="flex flex-col gap-5 px-6 py-5">
-            <ReleaseSourceSection />
-            <ReleaseContentFeedback />
-            <ReleaseMetadataFields />
-          </div>
+        <div className="flex flex-col gap-5 px-6 py-5">
+          <ReleaseSourceSection />
+          <ReleaseContentFeedback />
+          <ReleaseMetadataFields />
+        </div>
 
-          <CreateReleaseActions />
-        </form>
-      </DialogContent>
-    </Dialog>
+        <CreateReleaseActions />
+      </form>
+    </DialogContent>
   )
 }
-
-export function CreateReleaseDialog() {
-  const open = useAtomValue(createReleaseDialogOpenAtom)
-
-  if (!open)
-    return null
-
-  return <CreateReleaseDialogForm />
-}
diff --git a/web/features/deployments/create-release/ui/metadata-fields.tsx b/web/features/deployments/create-release/ui/metadata-fields.tsx
index ee82c0bf18f..0144fae1ec3 100644
--- a/web/features/deployments/create-release/ui/metadata-fields.tsx
+++ b/web/features/deployments/create-release/ui/metadata-fields.tsx
@@ -3,25 +3,53 @@
 import { cn } from '@langgenius/dify-ui/cn'
 import { Input } from '@langgenius/dify-ui/input'
 import { Textarea } from '@langgenius/dify-ui/textarea'
+import { useAtom, useAtomValue } from 'jotai'
 import { useEffect, useRef } from 'react'
 import { useTranslation } from 'react-i18next'
-import { useCreateReleaseFormApi } from '../state'
 import {
+  createReleaseDescriptionFieldAtom,
+  createReleaseHasNameConflictAtom,
+  createReleaseNameFieldAtom,
   RELEASE_NAME_REQUIRED_ERROR,
-  validateReleaseName,
-} from '../state/use-create-release-form'
+} from '../state'
 
 const DESCRIPTION_MAX_LENGTH = 512
 const DESCRIPTION_WARN_THRESHOLD = 460
 
+function isValidationIssue(error: unknown): error is { message: string } {
+  return Boolean(
+    error
+    && typeof error === 'object'
+    && 'message' in error
+    && typeof error.message === 'string',
+  )
+}
+
 function hasReleaseNameRequiredError(errors: unknown[]) {
-  return errors.includes(RELEASE_NAME_REQUIRED_ERROR)
+  return errors.some((error) => {
+    if (error === RELEASE_NAME_REQUIRED_ERROR)
+      return true
+
+    if (Array.isArray(error))
+      return error.some(issue => isValidationIssue(issue) && issue.message === RELEASE_NAME_REQUIRED_ERROR)
+
+    return isValidationIssue(error) && error.message === RELEASE_NAME_REQUIRED_ERROR
+  })
 }
 
 export function ReleaseMetadataFields() {
   const { t } = useTranslation('deployments')
-  const form = useCreateReleaseFormApi()
+  const [releaseNameField, setReleaseNameField] = useAtom(createReleaseNameFieldAtom)
+  const [releaseDescriptionField, setReleaseDescriptionField] = useAtom(createReleaseDescriptionFieldAtom)
+  const hasReleaseNameConflict = useAtomValue(createReleaseHasNameConflictAtom)
   const releaseNameInputRef = useRef<HTMLInputElement>(null)
+  const releaseNameErrors = releaseNameField.meta?.errors ?? []
+  const hasReleaseNameRequired = hasReleaseNameRequiredError(releaseNameErrors)
+  const releaseNameError = hasReleaseNameRequired
+    ? t('versions.releaseNameRequired')
+    : hasReleaseNameConflict
+      ? t('versions.releaseNameConflict')
+      : ''
 
   useEffect(() => {
     releaseNameInputRef.current?.focus()
@@ -29,78 +57,66 @@ export function ReleaseMetadataFields() {
 
   return (
     <>
-      <form.Field
-        name="releaseName"
-        validators={{
-          onBlur: validateReleaseName,
-          onChange: validateReleaseName,
-          onSubmit: validateReleaseName,
-        }}
-      >
-        {field => (
-          <div className="flex flex-col gap-2">
-            <label className="system-xs-medium-uppercase text-text-tertiary" htmlFor="release-name">
-              {t('versions.releaseNameLabel')}
-            </label>
-            <Input
-              ref={releaseNameInputRef}
-              id="release-name"
-              name="releaseName"
-              placeholder={t('versions.releaseNamePlaceholder')}
-              maxLength={128}
-              autoComplete="off"
-              value={field.state.value}
-              aria-invalid={hasReleaseNameRequiredError(field.state.meta.errors) || undefined}
-              aria-describedby={hasReleaseNameRequiredError(field.state.meta.errors) ? 'release-name-error' : undefined}
-              onBlur={field.handleBlur}
-              onChange={event => field.handleChange(event.target.value)}
-              className="h-9"
-            />
-            {hasReleaseNameRequiredError(field.state.meta.errors) && (
-              <div id="release-name-error" role="alert" className="system-xs-regular text-text-destructive">
-                {t('versions.releaseNameRequired')}
-              </div>
-            )}
+      <div className="flex flex-col gap-2">
+        <label className="system-xs-medium-uppercase text-text-tertiary" htmlFor="release-name">
+          {t('versions.releaseNameLabel')}
+        </label>
+        <Input
+          ref={releaseNameInputRef}
+          id="release-name"
+          name="releaseName"
+          placeholder={t('versions.releaseNamePlaceholder')}
+          maxLength={128}
+          autoComplete="off"
+          value={releaseNameField.value}
+          aria-invalid={Boolean(releaseNameError) || undefined}
+          aria-describedby={releaseNameError ? 'release-name-error' : undefined}
+          onChange={(event) => {
+            setReleaseNameField(event.target.value)
+          }}
+          className="h-9"
+        />
+        {releaseNameError && (
+          <div id="release-name-error" role="alert" className="system-xs-regular text-text-destructive">
+            {releaseNameError}
           </div>
         )}
-      </form.Field>
+      </div>
 
-      <form.Field name="releaseDescription">
-        {field => (
-          <div className="flex flex-col gap-2">
-            <div className="flex items-center justify-between gap-3">
-              <label className="system-xs-medium-uppercase text-text-tertiary" htmlFor="release-description">
-                {t('versions.releaseDescriptionLabel')}
-              </label>
-              <div className="flex items-center gap-2">
-                <span className="system-xs-regular text-text-quaternary">
-                  {t('versions.optional')}
-                </span>
-                <span
-                  className={cn(
-                    'system-xs-regular tabular-nums',
-                    field.state.value.length >= DESCRIPTION_WARN_THRESHOLD ? 'text-util-colors-warning-warning-700' : 'text-text-quaternary',
-                  )}
-                >
-                  {field.state.value.length}
-                  /
-                  {DESCRIPTION_MAX_LENGTH}
-                </span>
-              </div>
-            </div>
-            <Textarea
-              id="release-description"
-              name="releaseDescription"
-              placeholder={t('versions.releaseDescriptionPlaceholder')}
-              maxLength={DESCRIPTION_MAX_LENGTH}
-              autoComplete="off"
-              value={field.state.value}
-              onValueChange={field.handleChange}
-              className="min-h-24 resize-none"
-            />
+      <div className="flex flex-col gap-2">
+        <div className="flex items-center justify-between gap-3">
+          <label className="system-xs-medium-uppercase text-text-tertiary" htmlFor="release-description">
+            {t('versions.releaseDescriptionLabel')}
+          </label>
+          <div className="flex items-center gap-2">
+            <span className="system-xs-regular text-text-quaternary">
+              {t('versions.optional')}
+            </span>
+            <span
+              className={cn(
+                'system-xs-regular tabular-nums',
+                releaseDescriptionField.value.length >= DESCRIPTION_WARN_THRESHOLD ? 'text-util-colors-warning-warning-700' : 'text-text-quaternary',
+              )}
+            >
+              {releaseDescriptionField.value.length}
+              /
+              {DESCRIPTION_MAX_LENGTH}
+            </span>
           </div>
-        )}
-      </form.Field>
+        </div>
+        <Textarea
+          id="release-description"
+          name="releaseDescription"
+          placeholder={t('versions.releaseDescriptionPlaceholder')}
+          maxLength={DESCRIPTION_MAX_LENGTH}
+          autoComplete="off"
+          value={releaseDescriptionField.value}
+          onValueChange={(value) => {
+            setReleaseDescriptionField(value)
+          }}
+          className="min-h-24 resize-none"
+        />
+      </div>
     </>
   )
 }
diff --git a/web/features/deployments/create-release/ui/source-app-mode.ts b/web/features/deployments/create-release/ui/source-app-mode.ts
deleted file mode 100644
index 478417e92a3..00000000000
--- a/web/features/deployments/create-release/ui/source-app-mode.ts
+++ /dev/null
@@ -1,11 +0,0 @@
-import { AppModeEnum } from '@/types/app'
-
-type WorkflowAppMode = Extract<AppModeEnum, 'workflow'>
-
-export function isWorkflowAppMode(mode?: string | null): mode is WorkflowAppMode {
-  return mode === AppModeEnum.WORKFLOW
-}
-
-export function isWorkflowApp<T extends { mode?: string | null }>(app?: T): app is T & { mode: WorkflowAppMode } {
-  return isWorkflowAppMode(app?.mode)
-}
diff --git a/web/features/deployments/create-release/ui/source-app-picker-value.ts b/web/features/deployments/create-release/ui/source-app-picker-value.ts
deleted file mode 100644
index dee3375d784..00000000000
--- a/web/features/deployments/create-release/ui/source-app-picker-value.ts
+++ /dev/null
@@ -1,23 +0,0 @@
-import type { App } from '@/types/app'
-import { isWorkflowAppMode } from './source-app-mode'
-
-export type SourceAppPickerValue = Pick<App, 'id' | 'name'> & Partial<Pick<App, 'icon_type' | 'icon' | 'icon_background' | 'icon_url' | 'mode'>>
-
-export function workflowSourceAppPickerValue(value: unknown, fallbackId: string): SourceAppPickerValue | undefined {
-  if (!value || typeof value !== 'object')
-    return undefined
-
-  const record = value as Record<string, unknown>
-  const mode = typeof record.mode === 'string' ? record.mode : undefined
-  if (!isWorkflowAppMode(mode))
-    return undefined
-
-  const id = typeof record.id === 'string' && record.id ? record.id : fallbackId
-  const name = typeof record.name === 'string' && record.name ? record.name : id
-
-  return {
-    id,
-    name,
-    mode,
-  }
-}
diff --git a/web/features/deployments/create-release/ui/source-app-picker.tsx b/web/features/deployments/create-release/ui/source-app-picker.tsx
index 93b99e7fac2..633cea433fc 100644
--- a/web/features/deployments/create-release/ui/source-app-picker.tsx
+++ b/web/features/deployments/create-release/ui/source-app-picker.tsx
@@ -1,5 +1,5 @@
 'use client'
-import type { SourceAppPickerValue } from './source-app-picker-value'
+import type { SourceAppPickerValue } from '../state'
 import type { App } from '@/types/app'
 import { Button } from '@langgenius/dify-ui/button'
 import { cn } from '@langgenius/dify-ui/cn'
@@ -14,25 +14,24 @@ import {
   ComboboxList,
   ComboboxTrigger,
 } from '@langgenius/dify-ui/combobox'
-import { keepPreviousData, useInfiniteQuery } from '@tanstack/react-query'
+import { useAtomValue, useSetAtom } from 'jotai'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import AppIcon from '@/app/components/base/app-icon'
 import { SkeletonRectangle, SkeletonRow } from '@/app/components/base/skeleton'
-import { consoleQuery } from '@/service/client'
-import { AppModeEnum } from '@/types/app'
 import { TitleTooltip } from '../../components/title-tooltip'
-import { isWorkflowApp } from './source-app-mode'
+import {
+  createReleaseSourceAppSearchTextAtom,
+  createReleaseSourceAppsQueryAtom,
+} from '../state'
 
-const SOURCE_APP_PAGE_SIZE = 20
 const SOURCE_APP_PICKER_SKELETON_KEYS = ['first-source-app', 'second-source-app', 'third-source-app']
 
 function sourceAppSearchText(app: App) {
   return `${app.name} ${app.id}`.toLowerCase()
 }
 
-function SourceAppTrigger({ open, app }: {
-  open: boolean
+function SourceAppTrigger({ app }: {
   app?: SourceAppPickerValue
 }) {
   const { t } = useTranslation('deployments')
@@ -40,8 +39,10 @@ function SourceAppTrigger({ open, app }: {
   return (
     <span
       className={cn(
-        'group flex h-10 cursor-pointer items-center gap-2 rounded-lg border border-transparent bg-components-input-bg-normal px-3 text-left hover:border-components-input-border-hover hover:bg-components-input-bg-hover',
-        open && 'border-components-input-border-active bg-components-input-bg-active shadow-xs',
+        'flex h-10 items-center gap-2 rounded-lg border border-transparent bg-components-input-bg-normal px-3 text-left',
+        'cursor-pointer hover:border-components-input-border-hover hover:bg-components-input-bg-hover',
+        'group-data-disabled/combobox-trigger:cursor-not-allowed group-data-disabled/combobox-trigger:text-components-input-text-disabled group-data-disabled/combobox-trigger:hover:border-transparent group-data-disabled/combobox-trigger:hover:bg-components-input-bg-normal',
+        'group-data-popup-open/combobox-trigger:border-components-input-border-active group-data-popup-open/combobox-trigger:bg-components-input-bg-active group-data-popup-open/combobox-trigger:shadow-xs',
         app && 'pl-2',
       )}
     >
@@ -69,8 +70,9 @@ function SourceAppTrigger({ open, app }: {
       </TitleTooltip>
       <span
         className={cn(
-          'i-ri-arrow-down-s-line size-4 shrink-0 text-text-quaternary group-hover:text-text-secondary',
-          open && 'text-text-secondary',
+          'i-ri-arrow-down-s-line size-4 shrink-0 text-text-quaternary group-hover/combobox-trigger:text-text-secondary',
+          'group-data-disabled/combobox-trigger:text-text-quaternary group-data-disabled/combobox-trigger:opacity-50',
+          'group-data-popup-open/combobox-trigger:text-text-secondary',
         )}
         aria-hidden="true"
       />
@@ -123,47 +125,40 @@ function SourceAppPickerSkeleton() {
   )
 }
 
-export function SourceAppPicker({ value, onChange, ariaLabel }: {
+export function SourceAppPicker({ value, onChange, disabled = false }: {
   value?: SourceAppPickerValue
   onChange: (app: App) => void
-  ariaLabel?: string
+  disabled?: boolean
 }) {
   const { t } = useTranslation('deployments')
   const [isShow, setIsShow] = useState(false)
-  const [searchText, setSearchText] = useState('')
-
+  const searchText = useAtomValue(createReleaseSourceAppSearchTextAtom)
+  const setSearchText = useSetAtom(createReleaseSourceAppSearchTextAtom)
   const {
     data,
     isLoading,
     isFetchingNextPage,
     fetchNextPage,
     hasNextPage,
-  } = useInfiniteQuery({
-    ...consoleQuery.apps.list.infiniteOptions({
-      input: pageParam => ({
-        query: {
-          page: Number(pageParam),
-          limit: SOURCE_APP_PAGE_SIZE,
-          name: searchText,
-          mode: AppModeEnum.WORKFLOW,
-        },
-      }),
-      getNextPageParam: lastPage => lastPage.has_more ? lastPage.page + 1 : undefined,
-      initialPageParam: 1,
-      placeholderData: keepPreviousData,
-    }),
-  })
+  } = useAtomValue(createReleaseSourceAppsQueryAtom)
 
-  const apps = data?.pages.flatMap(page => page.data).filter(isWorkflowApp) ?? []
+  const apps = data?.pages.flatMap(page => page.data) ?? []
 
   return (
     <Combobox<App>
       items={apps}
-      open={isShow}
+      open={!disabled && isShow}
       inputValue={searchText}
-      onOpenChange={setIsShow}
-      onInputValueChange={setSearchText}
+      onOpenChange={(open) => {
+        setIsShow(disabled ? false : open)
+      }}
+      onInputValueChange={(value) => {
+        if (!disabled)
+          setSearchText(value)
+      }}
       onValueChange={(app) => {
+        if (disabled)
+          return
         if (!app)
           return
         onChange(app)
@@ -182,14 +177,14 @@ export function SourceAppPicker({ value, onChange, ariaLabel }: {
         return app.id
       }}
       filter={(app, query) => sourceAppSearchText(app).includes(query.toLowerCase())}
-      disabled={false}
+      disabled={disabled}
     >
       <ComboboxTrigger
-        aria-label={ariaLabel ?? t('createModal.sourceApp')}
+        aria-label={t('versions.sourceAppOption')}
         icon={false}
         className="block h-auto w-full border-0 bg-transparent p-0 text-left hover:bg-transparent focus-visible:bg-transparent focus-visible:ring-0 data-open:bg-transparent"
       >
-        <SourceAppTrigger open={isShow} app={value} />
+        <SourceAppTrigger app={value} />
       </ComboboxTrigger>
       <ComboboxContent
         placement="bottom-start"
diff --git a/web/features/deployments/create-release/ui/source-section.tsx b/web/features/deployments/create-release/ui/source-section.tsx
index 59d95a2f69e..9b54bff3914 100644
--- a/web/features/deployments/create-release/ui/source-section.tsx
+++ b/web/features/deployments/create-release/ui/source-section.tsx
@@ -1,16 +1,21 @@
 'use client'
 
-import type { ReleaseSourceMode } from '../state/types'
+import type { ReleaseSourceMode } from '../state'
 import { SegmentedControl, SegmentedControlItem } from '@langgenius/dify-ui/segmented-control'
 import { useAtomValue, useSetAtom } from 'jotai'
 import { useTranslation } from 'react-i18next'
 import Uploader from '@/app/components/app/create-from-dsl-modal/uploader'
+import { isDeploymentDslImportEnabled } from '../../shared/domain/feature-flags'
 import {
-  clearCreateReleaseSubmissionErrorAtom,
-  createReleaseDslStateAtom,
-  resetCreateReleaseDslFileAtom,
-  selectCreateReleaseDslFileAtom,
-  useCreateReleaseFormApi,
+  createReleaseDslFileFieldAtom,
+  createReleaseDslReadErrorAtom,
+  createReleaseHasUnsupportedDslModeAtom,
+  createReleaseSelectedSourceAppAtom,
+  createReleaseSourceModeAtom,
+  isReadingCreateReleaseDslAtom,
+  selectCreateReleaseSourceModeAtom,
+  updateCreateReleaseDslFileAtom,
+  updateCreateReleaseSourceAppAtom,
 } from '../state'
 import { SourceAppPicker } from './source-app-picker'
 
@@ -20,127 +25,99 @@ function selectedReleaseSourceMode(value: readonly ReleaseSourceMode[] | undefin
 
 export function ReleaseSourceSection() {
   const { t } = useTranslation('deployments')
-  const form = useCreateReleaseFormApi()
-  const resetDslFile = useSetAtom(resetCreateReleaseDslFileAtom)
-  const clearSubmissionError = useSetAtom(clearCreateReleaseSubmissionErrorAtom)
+  const releaseSourceMode = useAtomValue(createReleaseSourceModeAtom)
+  const selectReleaseSourceMode = useSetAtom(selectCreateReleaseSourceModeAtom)
 
   return (
-    <form.Field name="releaseSourceMode">
-      {modeField => (
-        <div className="flex flex-col gap-2">
-          <div className="flex flex-wrap items-center justify-between gap-3">
-            <label id="release-source-mode-label" className="system-xs-medium-uppercase text-text-tertiary">
-              {t('versions.releaseSourceLabel')}
-            </label>
-            <SegmentedControl<ReleaseSourceMode>
-              aria-labelledby="release-source-mode-label"
-              value={[modeField.state.value]}
-              onValueChange={(value) => {
-                const nextMode = selectedReleaseSourceMode(value)
-                if (!nextMode || nextMode === modeField.state.value)
-                  return
+    <div className="flex flex-col gap-2">
+      <div className="flex flex-wrap items-center justify-between gap-3">
+        <label id="release-source-mode-label" className="system-xs-medium-uppercase text-text-tertiary">
+          {t('versions.releaseSourceLabel')}
+        </label>
+        {isDeploymentDslImportEnabled && (
+          <SegmentedControl<ReleaseSourceMode>
+            aria-labelledby="release-source-mode-label"
+            value={[releaseSourceMode]}
+            onValueChange={(value) => {
+              const nextMode = selectedReleaseSourceMode(value)
+              if (!nextMode || nextMode === releaseSourceMode)
+                return
 
-                clearSubmissionError()
-                modeField.handleChange(nextMode)
-                if (nextMode === 'sourceApp') {
-                  form.setFieldValue('dslFile', undefined)
-                  resetDslFile()
-                }
-                else {
-                  form.setFieldValue('sourceApp', undefined)
-                }
-              }}
-              className="shrink-0"
-            >
-              <SegmentedControlItem value="sourceApp" className="gap-1.5">
-                <span className="i-ri-apps-2-line size-4 shrink-0" aria-hidden="true" />
-                <span>{t('versions.sourceAppOption')}</span>
-              </SegmentedControlItem>
-              <SegmentedControlItem value="dsl" className="gap-1.5">
-                <span className="i-ri-upload-cloud-2-line size-4 shrink-0" aria-hidden="true" />
-                <span>{t('versions.manualDslOption')}</span>
-              </SegmentedControlItem>
-            </SegmentedControl>
-          </div>
+              selectReleaseSourceMode(nextMode)
+            }}
+            className="shrink-0"
+          >
+            <SegmentedControlItem value="sourceApp" className="gap-1.5">
+              <span className="i-ri-apps-2-line size-4 shrink-0" aria-hidden="true" />
+              <span>{t('versions.sourceAppOption')}</span>
+            </SegmentedControlItem>
+            <SegmentedControlItem value="dsl" className="gap-1.5">
+              <span className="i-ri-upload-cloud-2-line size-4 shrink-0" aria-hidden="true" />
+              <span>{t('versions.manualDslOption')}</span>
+            </SegmentedControlItem>
+          </SegmentedControl>
+        )}
+      </div>
 
-          <div className="min-h-12">
-            {modeField.state.value === 'sourceApp'
-              ? <SourceAppField />
-              : <DslFileField />}
-          </div>
-        </div>
-      )}
-    </form.Field>
+      <div className="min-h-12">
+        {releaseSourceMode === 'sourceApp'
+          ? <SourceAppField />
+          : <DslFileField />}
+      </div>
+    </div>
   )
 }
 
 function SourceAppField() {
-  const { t } = useTranslation('deployments')
-  const form = useCreateReleaseFormApi()
-  const clearSubmissionError = useSetAtom(clearCreateReleaseSubmissionErrorAtom)
+  const sourceApp = useAtomValue(createReleaseSelectedSourceAppAtom)
+  const updateSourceApp = useSetAtom(updateCreateReleaseSourceAppAtom)
+  const sourceAppLocked = !isDeploymentDslImportEnabled
 
   return (
-    <form.Field name="sourceApp">
-      {field => (
-        <div className="flex min-h-12 items-center">
-          <SourceAppPicker
-            value={field.state.value}
-            onChange={(app) => {
-              field.handleChange(app)
-              clearSubmissionError()
-            }}
-            ariaLabel={t('versions.sourceAppOption')}
-          />
-        </div>
-      )}
-    </form.Field>
+    <div className="flex min-h-12 items-center">
+      <SourceAppPicker
+        value={sourceApp}
+        onChange={updateSourceApp}
+        disabled={sourceAppLocked}
+      />
+    </div>
   )
 }
 
 function DslFileField() {
   const { t } = useTranslation('deployments')
-  const form = useCreateReleaseFormApi()
-  const dslState = useAtomValue(createReleaseDslStateAtom)
-  const clearSubmissionError = useSetAtom(clearCreateReleaseSubmissionErrorAtom)
-  const selectDslFile = useSetAtom(selectCreateReleaseDslFileAtom)
+  const dslFileField = useAtomValue(createReleaseDslFileFieldAtom)
+  const isReadingDsl = useAtomValue(isReadingCreateReleaseDslAtom)
+  const dslReadError = useAtomValue(createReleaseDslReadErrorAtom)
+  const updateDslFile = useSetAtom(updateCreateReleaseDslFileAtom)
 
   return (
-    <form.Field name="dslFile">
-      {field => (
-        <div className="flex min-h-12 flex-col gap-2">
-          <Uploader
-            file={field.state.value}
-            updateFile={(file) => {
-              field.handleChange(file)
-              clearSubmissionError()
-              void selectDslFile(file)
-            }}
-            className="mt-0"
-          />
-          {dslState.isReadingDsl && (
-            <div className="system-xs-regular text-text-tertiary">
-              {t('versions.dslReading')}
-            </div>
-          )}
-          {dslState.dslReadError && (
-            <div role="alert" className="system-xs-regular text-util-colors-red-red-600">
-              {t('versions.dslReadFailed')}
-            </div>
-          )}
-          <DslUnsupportedModeError />
+    <div className="flex min-h-12 flex-col gap-2">
+      <Uploader
+        file={dslFileField.value}
+        updateFile={(file) => {
+          void updateDslFile(file)
+        }}
+        className="mt-0"
+      />
+      {isReadingDsl && (
+        <div role="status" className="system-xs-regular text-text-tertiary">
+          {t('versions.dslReading')}
         </div>
       )}
-    </form.Field>
+      {dslReadError && (
+        <div role="alert" className="system-xs-regular text-util-colors-red-red-600">
+          {t('versions.dslReadFailed')}
+        </div>
+      )}
+      <DslUnsupportedModeError />
+    </div>
   )
 }
 
 function DslUnsupportedModeError() {
   const { t } = useTranslation('deployments')
-  const dslState = useAtomValue(createReleaseDslStateAtom)
-  const hasUnsupportedDslMode = dslState.hasDslContent
-    && !dslState.isReadingDsl
-    && !dslState.dslReadError
-    && !dslState.isWorkflowDslContent
+  const hasUnsupportedDslMode = useAtomValue(createReleaseHasUnsupportedDslModeAtom)
 
   if (!hasUnsupportedDslMode)
     return null
diff --git a/web/features/deployments/create-release/ui/use-create-release-submission.ts b/web/features/deployments/create-release/ui/use-create-release-submission.ts
deleted file mode 100644
index 7c220255ef2..00000000000
--- a/web/features/deployments/create-release/ui/use-create-release-submission.ts
+++ /dev/null
@@ -1,109 +0,0 @@
-'use client'
-
-import type { CreateReleaseResponse } from '@dify/contracts/enterprise/types.gen'
-import type { CreateReleaseFormValues } from '../state/types'
-import { toast } from '@langgenius/dify-ui/toast'
-import { useMutation } from '@tanstack/react-query'
-import { useSetAtom } from 'jotai'
-import { useTranslation } from 'react-i18next'
-import { consoleQuery } from '@/service/client'
-import { deploymentErrorMessage, unsupportedDslNodeError } from '../../shared/domain/error'
-import {
-  clearCreateReleaseSubmissionErrorAtom,
-  closeCreateReleaseDialogAtom,
-  createReleaseSubmitUnsupportedDslNodesAtom,
-  useCreateReleaseConfig,
-} from '../state'
-import {
-  canCheckReleaseSourceContent,
-  useCreateReleaseSourceSelection,
-  useReleaseContentCheck,
-} from './use-release-content-check'
-
-export function useCreateReleaseSubmission(formValues: CreateReleaseFormValues) {
-  const { t } = useTranslation('deployments')
-  const { appInstanceId } = useCreateReleaseConfig()
-  const sourceSelection = useCreateReleaseSourceSelection(formValues)
-  const releaseContent = useReleaseContentCheck(sourceSelection)
-  const closeDialog = useSetAtom(closeCreateReleaseDialogAtom)
-  const createReleaseMutation = useMutation(consoleQuery.enterprise.releaseService.createRelease.mutationOptions())
-  const clearSubmitError = useSetAtom(clearCreateReleaseSubmissionErrorAtom)
-  const setUnsupportedDslNodes = useSetAtom(createReleaseSubmitUnsupportedDslNodesAtom)
-
-  function clearSubmissionError() {
-    createReleaseMutation.reset()
-    clearSubmitError()
-  }
-
-  function handleSuccess(response: CreateReleaseResponse) {
-    const createdName = response.release.displayName
-    toast.success(t('versions.createSuccess', { name: createdName }))
-    closeDialog()
-  }
-
-  async function handleError(error: unknown) {
-    const unsupportedError = await unsupportedDslNodeError(error)
-    if (unsupportedError?.nodes.length) {
-      setUnsupportedDslNodes(unsupportedError.nodes)
-      return
-    }
-
-    const message = await deploymentErrorMessage(error)
-    toast.error(message || t('versions.createFailed'))
-  }
-
-  async function createRelease(value: CreateReleaseFormValues) {
-    if (releaseContent.isCheckingReleaseContent)
-      return
-
-    const submittedReleaseName = value.releaseName.trim()
-    if (!submittedReleaseName)
-      return
-
-    clearSubmissionError()
-    try {
-      if (!canCheckReleaseSourceContent(sourceSelection) || !releaseContent.releaseContentReady)
-        return
-
-      if (value.releaseSourceMode === 'dsl') {
-        if (!sourceSelection.isWorkflowDslContent) {
-          toast.error(t('versions.dslUnsupportedMode'))
-          return
-        }
-
-        const response = await createReleaseMutation.mutateAsync({
-          body: {
-            appInstanceId,
-            dsl: sourceSelection.encodedDslContent,
-            displayName: submittedReleaseName,
-            description: value.releaseDescription.trim() || undefined,
-            createAppInstance: false,
-          },
-        })
-        handleSuccess(response)
-        return
-      }
-
-      if (!sourceSelection.selectedSourceAppId)
-        return
-
-      const response = await createReleaseMutation.mutateAsync({
-        body: {
-          appInstanceId,
-          sourceAppId: sourceSelection.selectedSourceAppId,
-          displayName: submittedReleaseName,
-          description: value.releaseDescription.trim() || undefined,
-          createAppInstance: false,
-        },
-      })
-      handleSuccess(response)
-    }
-    catch (error) {
-      await handleError(error)
-    }
-  }
-
-  return {
-    createRelease,
-  }
-}
diff --git a/web/features/deployments/create-release/ui/use-release-content-check.ts b/web/features/deployments/create-release/ui/use-release-content-check.ts
deleted file mode 100644
index a903daae143..00000000000
--- a/web/features/deployments/create-release/ui/use-release-content-check.ts
+++ /dev/null
@@ -1,124 +0,0 @@
-'use client'
-
-import type { CreateReleaseDslState } from '../state'
-import type { CreateReleaseFormValues, ReleaseSourceMode } from '../state/types'
-import { skipToken, useQuery } from '@tanstack/react-query'
-import { useAtomValue } from 'jotai'
-import { consoleQuery } from '@/service/client'
-import {
-  createReleaseDialogOpenAtom,
-  createReleaseDslStateAtom,
-  useCreateReleaseConfig,
-} from '../state'
-
-export type CreateReleaseSourceSelection = CreateReleaseDslState & {
-  hasUnsupportedDslMode: boolean
-  releaseSourceMode: ReleaseSourceMode
-  selectedSourceAppId?: string
-}
-
-function createReleaseSourceSelection(
-  formValues: CreateReleaseFormValues,
-  dslState: CreateReleaseDslState,
-): CreateReleaseSourceSelection {
-  const hasUnsupportedDslMode = formValues.releaseSourceMode === 'dsl'
-    && dslState.hasDslContent
-    && !dslState.isReadingDsl
-    && !dslState.dslReadError
-    && !dslState.isWorkflowDslContent
-  const selectedSourceAppId = formValues.releaseSourceMode === 'sourceApp' ? formValues.sourceApp?.id : undefined
-
-  return {
-    ...dslState,
-    hasUnsupportedDslMode,
-    releaseSourceMode: formValues.releaseSourceMode,
-    selectedSourceAppId,
-  }
-}
-
-export function canCheckReleaseSourceContent(releaseSource: CreateReleaseSourceSelection) {
-  if (releaseSource.releaseSourceMode === 'sourceApp')
-    return Boolean(releaseSource.selectedSourceAppId)
-
-  return Boolean(
-    releaseSource.hasDslContent
-    && !releaseSource.isReadingDsl
-    && !releaseSource.dslReadError
-    && !releaseSource.hasUnsupportedDslMode,
-  )
-}
-
-export function useReleaseContentCheck(releaseSource: CreateReleaseSourceSelection) {
-  const { appInstanceId } = useCreateReleaseConfig()
-  const isDialogOpen = useAtomValue(createReleaseDialogOpenAtom)
-  const canCheckReleaseContent = isDialogOpen && canCheckReleaseSourceContent(releaseSource)
-  // PrecheckRelease takes exactly one source arm (dsl | sourceAppId).
-  const precheckSource = releaseSource.releaseSourceMode === 'sourceApp'
-    ? (releaseSource.selectedSourceAppId ? { sourceAppId: releaseSource.selectedSourceAppId } : undefined)
-    : { dsl: releaseSource.encodedDslContent }
-  const precheckInput = canCheckReleaseContent && precheckSource
-    ? {
-        body: {
-          appInstanceId,
-          ...precheckSource,
-        },
-      }
-    : undefined
-  const precheckQuery = useQuery({
-    ...(precheckInput
-      ? consoleQuery.enterprise.releaseService.precheckRelease.queryOptions({
-          input: precheckInput,
-        })
-      : {
-          queryFn: skipToken,
-          queryKey: ['create-release', 'release-precheck'],
-        }),
-    retry: false,
-  })
-  const matchedRelease = canCheckReleaseContent ? precheckQuery.data?.matchedRelease : undefined
-  const unsupportedNodes = (canCheckReleaseContent ? precheckQuery.data?.unsupportedNodes : undefined) ?? []
-  const isCheckingReleaseContent = canCheckReleaseContent && (precheckQuery.isLoading || precheckQuery.isFetching)
-  const releaseContentCheckFailed = canCheckReleaseContent && precheckQuery.isError
-  const releaseContentReady = canCheckReleaseContent
-    && precheckQuery.isSuccess
-    && !isCheckingReleaseContent
-    && !releaseContentCheckFailed
-    && Boolean(precheckQuery.data?.canCreate)
-
-  return {
-    isCheckingReleaseContent,
-    matchedRelease,
-    releaseContentCheckFailed,
-    releaseContentReady,
-    unsupportedNodes,
-  }
-}
-
-export type ReleaseContentCheck = ReturnType<typeof useReleaseContentCheck>
-
-export function useCreateReleaseSourceSelection(formValues: CreateReleaseFormValues) {
-  const dslState = useAtomValue(createReleaseDslStateAtom)
-
-  return createReleaseSourceSelection(formValues, dslState)
-}
-
-export function createReleaseReadiness({
-  formValues,
-  isSubmitting,
-  releaseContent,
-}: {
-  formValues: CreateReleaseFormValues
-  isSubmitting: boolean
-  releaseContent: ReleaseContentCheck
-}) {
-  const canCreate = Boolean(
-    formValues.releaseName.trim()
-    && releaseContent.releaseContentReady
-    && !isSubmitting,
-  )
-
-  return {
-    canCreate,
-    isCheckingReleaseContent: releaseContent.isCheckingReleaseContent,
-  }
-}
diff --git a/web/features/deployments/deploy-drawer/__tests__/index.spec.tsx b/web/features/deployments/deploy-drawer/__tests__/index.spec.tsx
new file mode 100644
index 00000000000..c82e4f0ec0d
--- /dev/null
+++ b/web/features/deployments/deploy-drawer/__tests__/index.spec.tsx
@@ -0,0 +1,36 @@
+import { render, screen } from '@testing-library/react'
+import { createStore, Provider as JotaiProvider } from 'jotai'
+import { describe, expect, it, vi } from 'vitest'
+import { DeployDrawer } from '../index'
+import {
+  deployDrawerAppInstanceIdAtom,
+  deployDrawerOpenAtom,
+} from '../state'
+
+vi.mock('../ui/form', () => ({
+  DeployForm: () => <div data-testid="deploy-form" />,
+}))
+
+describe('DeployDrawer', () => {
+  it('uses the full-height right drawer layout', () => {
+    const store = createStore()
+    store.set(deployDrawerOpenAtom, true)
+    store.set(deployDrawerAppInstanceIdAtom, 'app-instance-1')
+
+    render(
+      <JotaiProvider store={store}>
+        <DeployDrawer />
+      </JotaiProvider>,
+    )
+
+    const drawer = screen.getByRole('dialog')
+
+    expect(screen.getByTestId('deploy-form')).toBeInTheDocument()
+    expect(drawer).toHaveClass('data-[swipe-direction=right]:w-[640px]')
+    expect(drawer).not.toHaveClass('data-[swipe-direction=right]:top-2')
+    expect(drawer).not.toHaveClass('data-[swipe-direction=right]:right-2')
+    expect(drawer).not.toHaveClass('data-[swipe-direction=right]:bottom-2')
+    expect(drawer).not.toHaveClass('data-[swipe-direction=right]:h-auto')
+    expect(drawer).not.toHaveClass('data-[swipe-direction=right]:rounded-xl')
+  })
+})
diff --git a/web/features/deployments/deploy-drawer/index.tsx b/web/features/deployments/deploy-drawer/index.tsx
index 88d2bae02cc..026d35f5b8e 100644
--- a/web/features/deployments/deploy-drawer/index.tsx
+++ b/web/features/deployments/deploy-drawer/index.tsx
@@ -39,7 +39,7 @@ export function DeployDrawer() {
       <DrawerPortal>
         <DrawerBackdrop />
         <DrawerViewport>
-          <DrawerPopup className="data-[swipe-direction=right]:top-16 data-[swipe-direction=right]:right-2 data-[swipe-direction=right]:bottom-2 data-[swipe-direction=right]:h-auto data-[swipe-direction=right]:w-[640px] data-[swipe-direction=right]:max-w-[calc(100vw-1rem)] data-[swipe-direction=right]:rounded-xl data-[swipe-direction=right]:border-[0.5px]">
+          <DrawerPopup className="data-[swipe-direction=right]:w-[640px] data-[swipe-direction=right]:max-w-[calc(100vw-1rem)]">
             <DrawerCloseButton
               aria-label={t('deployDrawer.close')}
               className="absolute top-4 right-5 size-6 rounded-md"
diff --git a/web/features/deployments/deploy-drawer/state/index.ts b/web/features/deployments/deploy-drawer/state/index.ts
index 9d576a23ed9..1be5ce4c102 100644
--- a/web/features/deployments/deploy-drawer/state/index.ts
+++ b/web/features/deployments/deploy-drawer/state/index.ts
@@ -15,6 +15,7 @@ import type {
 import type { RuntimeCredentialBindingSelections } from '../../components/runtime-credential-bindings-utils'
 import { EnvVarValueSource as ApiEnvVarValueSource } from '@dify/contracts/enterprise/types.gen'
 import { toast } from '@langgenius/dify-ui/toast'
+import { skipToken } from '@tanstack/react-query'
 import { atom } from 'jotai'
 import { atomWithMutation, atomWithQuery } from 'jotai-tanstack-query'
 import { consoleQuery } from '@/service/client'
@@ -38,6 +39,7 @@ export const deployDrawerOpenAtom = atom(false)
 export const deployDrawerAppInstanceIdAtom = atom<string | undefined>(undefined)
 export const deployDrawerEnvironmentIdAtom = atom<string | undefined>(undefined)
 export const deployDrawerReleaseIdAtom = atom<string | undefined>(undefined)
+export const deployFormAppInstanceIdAtom = atom('')
 
 export const openDeployDrawerAtom = atom(null, (_get, set, params: OpenDeployDrawerParams) => {
   set(deployDrawerAppInstanceIdAtom, params.appInstanceId)
@@ -66,6 +68,17 @@ export type DeployReadyFormConfig = {
 
 export const deployReadyFormConfigAtom = atom<DeployReadyFormConfig | undefined>(undefined)
 
+export const releaseDeploymentViewQueryAtom = atomWithQuery((get) => {
+  const appInstanceId = get(deployFormAppInstanceIdAtom)
+
+  return consoleQuery.enterprise.releaseService.computeReleaseDeploymentView.queryOptions({
+    input: {
+      params: { appInstanceId },
+    },
+    enabled: Boolean(appInstanceId),
+  })
+})
+
 const selectedEnvIdAtom = atom<string | undefined>(undefined)
 const selectedReleaseIdAtom = atom<string | undefined>(undefined)
 const manualBindingsAtom = atom<RuntimeCredentialBindingSelections>({})
@@ -192,20 +205,20 @@ const releaseDeploymentOptionsQueryAtom = atomWithQuery((get) => {
   const hasSelectedEnvironment = get(deployHasSelectedEnvironmentAtom)
   const releaseId = get(deployTargetReleaseIdAtom)
   const selectedEnvironmentId = get(deploySelectedEnvironmentIdAtom)
-  const enabled = Boolean(releaseId && selectedEnvironmentId && hasSelectedEnvironment)
+  const hasRequiredInput = Boolean(releaseId && selectedEnvironmentId)
 
-  return {
-    ...consoleQuery.enterprise.releaseService.computeDeploymentOptions.queryOptions({
-      input: {
-        body: {
-          releaseId: releaseId ?? '',
-          environmentId: selectedEnvironmentId ?? '',
-        },
-      },
-      enabled,
-    }),
+  return consoleQuery.enterprise.releaseService.computeDeploymentOptions.queryOptions({
+    input: releaseId && selectedEnvironmentId
+      ? {
+          body: {
+            releaseId,
+            environmentId: selectedEnvironmentId,
+          },
+        }
+      : skipToken,
+    enabled: hasRequiredInput && hasSelectedEnvironment,
     retry: false,
-  }
+  })
 })
 
 export const deployBindingSlotsAtom = atom((get) => {
diff --git a/web/features/deployments/deploy-drawer/ui/form.tsx b/web/features/deployments/deploy-drawer/ui/form.tsx
index 354116eb015..b95bc871a56 100644
--- a/web/features/deployments/deploy-drawer/ui/form.tsx
+++ b/web/features/deployments/deploy-drawer/ui/form.tsx
@@ -6,14 +6,12 @@ import type {
   Release,
 } from '@dify/contracts/enterprise/types.gen'
 import { Button } from '@langgenius/dify-ui/button'
-import { useQuery } from '@tanstack/react-query'
 import { useAtomValue, useSetAtom } from 'jotai'
 import { ScopeProvider } from 'jotai-scope'
 import { useTranslation } from 'react-i18next'
-import { consoleQuery } from '@/service/client'
 import { EnvVarBindingsPanel } from '../../components/env-var-bindings'
 import { isAvailableDeploymentTarget } from '../../shared/domain/runtime-status'
-import { canAttemptDeployAtom, canSubmitDeployAtom, closeDeployDrawerAtom, deployBindingSlotsAtom, deployEnvVarSlotsAtom, deployEnvVarValuesAtom, deployHasBindingOptionsErrorAtom, deployHasSelectedEnvironmentAtom, deployIsBindingOptionsLoadingAtom, deployReadyFormConfigAtom, deployReadyFormLocalAtoms, deployReleaseSubmissionAtom, deploySelectedBindingsAtom, deployShowValidationErrorsAtom, deployTargetReleaseIdAtom, isDeployReleaseSubmittingAtom, selectDeployBindingAtom, setDeployEnvVarAtom, showDeployValidationErrorsAtom } from '../state'
+import { canAttemptDeployAtom, canSubmitDeployAtom, closeDeployDrawerAtom, deployBindingSlotsAtom, deployEnvVarSlotsAtom, deployEnvVarValuesAtom, deployFormAppInstanceIdAtom, deployHasBindingOptionsErrorAtom, deployHasSelectedEnvironmentAtom, deployIsBindingOptionsLoadingAtom, deployReadyFormConfigAtom, deployReadyFormLocalAtoms, deployReleaseSubmissionAtom, deploySelectedBindingsAtom, deployShowValidationErrorsAtom, deployTargetReleaseIdAtom, isDeployReleaseSubmittingAtom, releaseDeploymentViewQueryAtom, selectDeployBindingAtom, setDeployEnvVarAtom, showDeployValidationErrorsAtom } from '../state'
 import {
   currentReleaseIdForEnvironment,
   selectableDeployReleases,
@@ -199,17 +197,13 @@ function DeployReadyForm(config: DeployReadyFormProps) {
   )
 }
 
-export function DeployForm({
+function DeployFormContent({
   appInstanceId,
   lockedEnvId,
   presetReleaseId,
 }: DeployFormProps) {
   const { t } = useTranslation('deployments')
-  const releaseDeploymentViewQuery = useQuery(consoleQuery.enterprise.releaseService.computeReleaseDeploymentView.queryOptions({
-    input: {
-      params: { appInstanceId },
-    },
-  }))
+  const releaseDeploymentViewQuery = useAtomValue(releaseDeploymentViewQueryAtom)
 
   if (releaseDeploymentViewQuery.isLoading) {
     return <DeployFormSkeleton />
@@ -267,3 +261,17 @@ export function DeployForm({
     />
   )
 }
+
+export function DeployForm(props: DeployFormProps) {
+  return (
+    <ScopeProvider
+      key={props.appInstanceId}
+      atoms={[
+        [deployFormAppInstanceIdAtom, props.appInstanceId],
+      ]}
+      name="DeployForm"
+    >
+      <DeployFormContent {...props} />
+    </ScopeProvider>
+  )
+}
diff --git a/web/features/deployments/detail/__tests__/state.spec.ts b/web/features/deployments/detail/__tests__/state.spec.ts
new file mode 100644
index 00000000000..5d7b9d47948
--- /dev/null
+++ b/web/features/deployments/detail/__tests__/state.spec.ts
@@ -0,0 +1,119 @@
+import type { Getter } from 'jotai'
+import { skipToken } from '@tanstack/react-query'
+import { atom, createStore } from 'jotai'
+import { describe, expect, it, vi } from 'vitest'
+import { deploymentRouteAppInstanceIdAtom } from '../../route-state'
+
+type QueryOptions = {
+  enabled?: boolean
+  input?: unknown
+  queryKey?: readonly unknown[]
+  refetchInterval?: (query: { state: { data?: unknown } }) => number | false
+}
+
+vi.mock('jotai-tanstack-query', () => ({
+  atomWithQuery: (createOptions: (get: Getter) => QueryOptions) => atom(get => ({
+    ...createOptions(get),
+    data: undefined,
+    isError: false,
+    isFetching: false,
+    isLoading: false,
+    isSuccess: false,
+  })),
+}))
+
+vi.mock('@/service/client', () => ({
+  consoleQuery: {
+    apps: {
+      byAppId: {
+        get: {
+          queryOptions: (options: QueryOptions) => ({
+            ...options,
+            queryKey: ['appById', options.input],
+          }),
+        },
+      },
+    },
+    enterprise: {
+      appInstanceService: {
+        getAppInstance: {
+          queryOptions: (options: QueryOptions) => ({
+            ...options,
+            queryKey: ['getAppInstance', options.input],
+          }),
+        },
+        getAppInstanceOverview: {
+          queryOptions: (options: QueryOptions) => ({
+            ...options,
+            queryKey: ['getAppInstanceOverview', options.input],
+          }),
+        },
+      },
+      deploymentService: {
+        listEnvironmentDeployments: {
+          queryOptions: (options: QueryOptions) => ({
+            ...options,
+            queryKey: ['listEnvironmentDeployments', options.input],
+          }),
+        },
+      },
+    },
+  },
+}))
+
+async function loadState() {
+  return await import('../state')
+}
+
+describe('deployment detail state', () => {
+  it('should disable detail queries with skipToken until a route app instance exists', async () => {
+    const state = await loadState()
+    const store = createStore()
+
+    expect(store.get(state.deploymentDetailAppInstanceQueryAtom)).toMatchObject({
+      enabled: false,
+      input: skipToken,
+    })
+    expect(store.get(state.deploymentDetailOverviewQueryAtom)).toMatchObject({
+      enabled: false,
+      input: skipToken,
+    })
+    expect(store.get(state.deploymentEnvironmentDeploymentsQueryAtom)).toMatchObject({
+      enabled: false,
+      input: skipToken,
+    })
+    expect(store.get(state.deploymentSourceAppQueryAtom)).toMatchObject({
+      enabled: false,
+      input: skipToken,
+    })
+  })
+
+  it('should build detail query inputs from route and source identities', async () => {
+    const state = await loadState()
+    const store = createStore()
+
+    store.set(deploymentRouteAppInstanceIdAtom, 'app-instance-1')
+    store.set(state.deploymentSourceAppIdAtom, 'source-app-1')
+
+    expect(store.get(state.deploymentDetailAppInstanceQueryAtom)).toMatchObject({
+      enabled: true,
+      input: { params: { appInstanceId: 'app-instance-1' } },
+    })
+    expect(store.get(state.deploymentDetailOverviewQueryAtom)).toMatchObject({
+      enabled: true,
+      input: { params: { appInstanceId: 'app-instance-1' } },
+    })
+
+    const environmentDeploymentsQuery = store.get(state.deploymentEnvironmentDeploymentsQueryAtom) as unknown as QueryOptions
+    expect(environmentDeploymentsQuery).toMatchObject({
+      enabled: true,
+      input: { params: { appInstanceId: 'app-instance-1' } },
+    })
+    expect(environmentDeploymentsQuery.refetchInterval).toEqual(expect.any(Function))
+
+    expect(store.get(state.deploymentSourceAppQueryAtom)).toMatchObject({
+      enabled: true,
+      input: { params: { app_id: 'source-app-1' } },
+    })
+  })
+})
diff --git a/web/features/deployments/detail/access-tab.tsx b/web/features/deployments/detail/access-tab.tsx
index fde0499d538..92b463e3970 100644
--- a/web/features/deployments/detail/access-tab.tsx
+++ b/web/features/deployments/detail/access-tab.tsx
@@ -1,18 +1,14 @@
 'use client'
 
-import { useQuery } from '@tanstack/react-query'
-import { consoleQuery } from '@/service/client'
+import { useAtomValue } from 'jotai'
 import { AccessChannelsSection } from './settings-tab/access/channels-section'
 import { AccessPermissionsSection } from './settings-tab/access/permissions-section'
+import { accessSettingsQueryAtom } from './settings-tab/access/state'
 
 export function AccessTab({ appInstanceId }: {
   appInstanceId: string
 }) {
-  const accessSettingsQuery = useQuery(consoleQuery.enterprise.accessService.getAccessSettings.queryOptions({
-    input: {
-      params: { appInstanceId },
-    },
-  }))
+  const accessSettingsQuery = useAtomValue(accessSettingsQueryAtom)
 
   return (
     <div className="flex w-full max-w-[960px] min-w-0 flex-col gap-y-4 px-6 py-6 sm:px-20 sm:py-8">
diff --git a/web/features/deployments/detail/deploy-tab.tsx b/web/features/deployments/detail/deploy-tab.tsx
index 17414e9712a..874881f31f5 100644
--- a/web/features/deployments/detail/deploy-tab.tsx
+++ b/web/features/deployments/detail/deploy-tab.tsx
@@ -1,12 +1,12 @@
 'use client'
-import { useQuery } from '@tanstack/react-query'
+import { useAtomValue } from 'jotai'
 import { useTranslation } from 'react-i18next'
 import { SkeletonRectangle, SkeletonRow } from '@/app/components/base/skeleton'
-import { consoleQuery } from '@/service/client'
 import { DeploymentEmptyState, DeploymentStateMessage } from '../components/empty-state'
-import { deploymentStatusPollingInterval, hasRuntimeInstanceDeployment } from '../shared/domain/runtime-status'
+import { hasRuntimeInstanceDeployment } from '../shared/domain/runtime-status'
 import { DeploymentEnvironmentList } from './deploy-tab/deployment-environment-list'
 import { NewDeploymentButton } from './deploy-tab/new-deployment-button'
+import { deploymentEnvironmentDeploymentsQueryAtom } from './state'
 import {
   DetailTable,
   DetailTableBody,
@@ -91,12 +91,7 @@ export function DeployTab({ appInstanceId }: {
   appInstanceId: string
 }) {
   const { t } = useTranslation('deployments')
-  const environmentDeploymentsQuery = useQuery(consoleQuery.enterprise.deploymentService.listEnvironmentDeployments.queryOptions({
-    input: {
-      params: { appInstanceId },
-    },
-    refetchInterval: query => deploymentStatusPollingInterval(query.state.data?.environmentDeployments),
-  }))
+  const environmentDeploymentsQuery = useAtomValue(deploymentEnvironmentDeploymentsQueryAtom)
   const environmentDeployments = environmentDeploymentsQuery.data
   const rows = environmentDeployments?.environmentDeployments.filter(hasRuntimeInstanceDeployment) ?? []
   const isLoading = environmentDeploymentsQuery.isLoading
diff --git a/web/features/deployments/detail/deploy-tab/deployment-row-actions.tsx b/web/features/deployments/detail/deploy-tab/deployment-row-actions.tsx
index 33af0ae3f2a..8e3fa0c55a3 100644
--- a/web/features/deployments/detail/deploy-tab/deployment-row-actions.tsx
+++ b/web/features/deployments/detail/deploy-tab/deployment-row-actions.tsx
@@ -22,12 +22,12 @@ export function DeploymentRowActions({ appInstanceId, envId, row }: {
   const { t } = useTranslation('deployments')
   const openDeployDrawer = useSetAtom(openDeployDrawerAtom)
   const undeployDeployment = useMutation(consoleQuery.enterprise.deploymentService.undeploy.mutationOptions())
-  const isUndeployed = isUndeployedDeploymentRow(row)
-  const status = row.status
   const [showUndeployConfirm, setShowUndeployConfirm] = useState(false)
   const [showErrorDetail, setShowErrorDetail] = useState(false)
   const [isUndeploying, setIsUndeploying] = useState(false)
   const undeployInFlightRef = useRef(false)
+  const isUndeployed = isUndeployedDeploymentRow(row)
+  const status = row.status
   const isUndeployRequesting = undeployDeployment.isPending || isUndeploying
   const undeployActionDisabled = isUndeployRequesting
   const isDeploymentInProgress = isRuntimeDeploymentInProgress(status)
@@ -45,6 +45,7 @@ export function DeploymentRowActions({ appInstanceId, envId, row }: {
   function handleUndeploy() {
     if (undeployInFlightRef.current)
       return
+
     undeployInFlightRef.current = true
     setIsUndeploying(true)
     undeployDeployment.mutate(
diff --git a/web/features/deployments/detail/deploy-tab/new-deployment-button.tsx b/web/features/deployments/detail/deploy-tab/new-deployment-button.tsx
index 26b231dd6a8..87350ec42e0 100644
--- a/web/features/deployments/detail/deploy-tab/new-deployment-button.tsx
+++ b/web/features/deployments/detail/deploy-tab/new-deployment-button.tsx
@@ -1,12 +1,11 @@
 'use client'
 
 import { Button } from '@langgenius/dify-ui/button'
-import { useQuery } from '@tanstack/react-query'
-import { useSetAtom } from 'jotai'
+import { useAtomValue, useSetAtom } from 'jotai'
 import { useTranslation } from 'react-i18next'
-import { consoleQuery } from '@/service/client'
 import { openDeployDrawerAtom } from '../../deploy-drawer/state'
-import { deploymentStatusPollingInterval, hasRuntimeInstanceDeployment } from '../../shared/domain/runtime-status'
+import { hasRuntimeInstanceDeployment } from '../../shared/domain/runtime-status'
+import { deploymentEnvironmentDeploymentsQueryAtom } from '../state'
 
 export function NewDeploymentButton({ appInstanceId }: {
   appInstanceId: string
@@ -30,12 +29,7 @@ export function NewDeploymentButton({ appInstanceId }: {
 export function NewDeploymentHeaderAction({ appInstanceId }: {
   appInstanceId: string
 }) {
-  const environmentDeploymentsQuery = useQuery(consoleQuery.enterprise.deploymentService.listEnvironmentDeployments.queryOptions({
-    input: {
-      params: { appInstanceId },
-    },
-    refetchInterval: query => deploymentStatusPollingInterval(query.state.data?.environmentDeployments),
-  }))
+  const environmentDeploymentsQuery = useAtomValue(deploymentEnvironmentDeploymentsQueryAtom)
   const rows = environmentDeploymentsQuery.data?.environmentDeployments.filter(hasRuntimeInstanceDeployment) ?? []
 
   if (environmentDeploymentsQuery.isLoading || environmentDeploymentsQuery.isError || rows.length === 0)
diff --git a/web/features/deployments/detail/deployment-sidebar.tsx b/web/features/deployments/detail/deployment-sidebar.tsx
index efe86ba7b3d..3e8a013f34e 100644
--- a/web/features/deployments/detail/deployment-sidebar.tsx
+++ b/web/features/deployments/detail/deployment-sidebar.tsx
@@ -7,7 +7,7 @@ import { cn } from '@langgenius/dify-ui/cn'
 import { Kbd, KbdGroup } from '@langgenius/dify-ui/kbd'
 import { Tooltip, TooltipContent, TooltipTrigger } from '@langgenius/dify-ui/tooltip'
 import { formatForDisplay } from '@tanstack/react-hotkeys'
-import { useQuery } from '@tanstack/react-query'
+import { useAtomValue } from 'jotai'
 import { useTranslation } from 'react-i18next'
 import NavLink from '@/app/components/app-sidebar/nav-link'
 import ToggleButton from '@/app/components/app-sidebar/toggle-button'
@@ -17,9 +17,10 @@ import { SkeletonContainer, SkeletonRectangle } from '@/app/components/base/skel
 import { useSetGotoAnythingOpen } from '@/app/components/goto-anything/atoms'
 import Link from '@/next/link'
 import { usePathname, useRouter } from '@/next/navigation'
-import { consoleQuery } from '@/service/client'
 import { DeploymentActionsMenu } from '../components/deployment-actions'
 import { TitleTooltip } from '../components/title-tooltip'
+import { deploymentRouteAppInstanceIdAtom } from '../route-state'
+import { deploymentDetailAppInstanceQueryAtom } from './state'
 
 type TabDef = {
   key: InstanceDetailTabKey
@@ -73,11 +74,6 @@ const DEPLOYMENT_TABS: TabDef[] = [
 
 const SEARCH_SHORTCUT = ['Mod', 'K']
 
-const getDeploymentIdFromPathname = (pathname: string) => {
-  const [section, appInstanceId] = pathname.split('/').filter(Boolean)
-  return section === 'deployments' ? appInstanceId : undefined
-}
-
 function DeploymentIcon({ expand }: {
   expand: boolean
 }) {
@@ -98,11 +94,7 @@ function DeploymentDetailInstanceInfo({ appInstanceId, expand }: {
   expand: boolean
 }) {
   const { t } = useTranslation('deployments')
-  const overviewQuery = useQuery(consoleQuery.enterprise.appInstanceService.getAppInstance.queryOptions({
-    input: {
-      params: { appInstanceId },
-    },
-  }))
+  const overviewQuery = useAtomValue(deploymentDetailAppInstanceQueryAtom)
   const app = overviewQuery.data?.appInstance
   const isLoading = !app && overviewQuery.isLoading
   const isUnavailable = !app || overviewQuery.isError
@@ -173,7 +165,6 @@ function DeploymentDetailInstanceInfo({ appInstanceId, expand }: {
                     </div>
                     <DeploymentActionsMenu
                       appInstanceId={appInstanceId}
-                      appName={instanceName}
                       placement="bottom-end"
                       sideOffset={4}
                       className="shrink-0"
@@ -284,7 +275,7 @@ export function DeploymentDetailSection({
 }) {
   const { t } = useTranslation('deployments')
   const pathname = usePathname()
-  const appInstanceId = getDeploymentIdFromPathname(pathname)
+  const appInstanceId = useAtomValue(deploymentRouteAppInstanceIdAtom)
 
   if (!appInstanceId)
     return null
diff --git a/web/features/deployments/detail/index.tsx b/web/features/deployments/detail/index.tsx
index 5b1ec7a9f19..5d188ce347e 100644
--- a/web/features/deployments/detail/index.tsx
+++ b/web/features/deployments/detail/index.tsx
@@ -2,6 +2,7 @@
 
 import type { ReactNode } from 'react'
 import type { InstanceDetailTabKey } from './tabs'
+import { ScopeProvider } from 'jotai-scope'
 import { useTranslation } from 'react-i18next'
 import useDocumentTitle from '@/hooks/use-document-title'
 import Link from '@/next/link'
@@ -10,6 +11,7 @@ import { CreateReleaseControl } from '../create-release'
 import { NewDeploymentHeaderAction } from './deploy-tab/new-deployment-button'
 import { DeveloperApiHeaderSwitch } from './settings-tab/access/developer-api-section'
 import { INSTANCE_DETAIL_TAB_KEYS, isInstanceDetailTabKey } from './tabs'
+import { versionsTabLocalAtoms } from './versions-tab/state'
 
 function MobileDetailTabs({ appInstanceId, activeTab }: {
   appInstanceId: string
@@ -53,37 +55,45 @@ export function InstanceDetail({ appInstanceId, children }: {
   useDocumentTitle(t('documentTitle.detail'))
 
   return (
-    <div className="relative m-1 ml-0 flex min-h-0 flex-1 overflow-hidden rounded-lg shadow-xs">
-      <div className="min-w-0 grow overflow-hidden bg-components-panel-bg">
-        <div className="h-full min-w-0 overflow-y-auto">
-          <div className="flex min-h-full w-full flex-col">
-            <div className="flex w-full flex-col gap-y-0.5 px-4 pt-3 pb-2 sm:px-6">
-              <div className="flex min-w-0 flex-col gap-3 sm:flex-row sm:items-start sm:justify-between sm:gap-4">
-                <div className="min-w-0">
-                  <div className="flex min-w-0 flex-wrap items-center gap-x-3 gap-y-2">
-                    <div className="system-xl-semibold text-text-primary">{t(`tabs.${activeTab}.name`)}</div>
-                    {activeTab === 'api-tokens' && (
-                      <div className="shrink-0">
-                        <DeveloperApiHeaderSwitch appInstanceId={appInstanceId} />
-                      </div>
-                    )}
+    <ScopeProvider
+      key={appInstanceId}
+      atoms={[
+        ...versionsTabLocalAtoms,
+      ]}
+      name="DeploymentDetail"
+    >
+      <div className="relative m-1 ml-0 flex min-h-0 flex-1 overflow-hidden rounded-lg shadow-xs">
+        <div className="min-w-0 grow overflow-hidden bg-components-panel-bg">
+          <div className="h-full min-w-0 overflow-y-auto">
+            <div className="flex min-h-full w-full flex-col">
+              <div className="flex w-full flex-col gap-y-0.5 px-4 pt-3 pb-2 sm:px-6">
+                <div className="flex min-w-0 flex-col gap-3 sm:flex-row sm:items-start sm:justify-between sm:gap-4">
+                  <div className="min-w-0">
+                    <div className="flex min-w-0 flex-wrap items-center gap-x-3 gap-y-2">
+                      <div className="system-xl-semibold text-text-primary">{t(`tabs.${activeTab}.name`)}</div>
+                      {activeTab === 'api-tokens' && (
+                        <div className="shrink-0">
+                          <DeveloperApiHeaderSwitch appInstanceId={appInstanceId} />
+                        </div>
+                      )}
+                    </div>
+                    <div className="system-sm-regular text-text-tertiary">{t(`tabs.${activeTab}.description`)}</div>
                   </div>
-                  <div className="system-sm-regular text-text-tertiary">{t(`tabs.${activeTab}.description`)}</div>
+                  {(activeTab === 'instances' || activeTab === 'releases') && (
+                    <div className="w-full shrink-0 pt-1 sm:w-auto sm:pt-1.5 [&_button]:w-full sm:[&_button]:w-auto">
+                      {activeTab === 'instances'
+                        ? <NewDeploymentHeaderAction appInstanceId={appInstanceId} />
+                        : <CreateReleaseControl appInstanceId={appInstanceId} size="medium" />}
+                    </div>
+                  )}
                 </div>
-                {(activeTab === 'instances' || activeTab === 'releases') && (
-                  <div className="w-full shrink-0 pt-1 sm:w-auto sm:pt-1.5 [&_button]:w-full sm:[&_button]:w-auto">
-                    {activeTab === 'instances'
-                      ? <NewDeploymentHeaderAction appInstanceId={appInstanceId} />
-                      : <CreateReleaseControl appInstanceId={appInstanceId} size="medium" />}
-                  </div>
-                )}
               </div>
+              <MobileDetailTabs appInstanceId={appInstanceId} activeTab={activeTab} />
+              {children}
             </div>
-            <MobileDetailTabs appInstanceId={appInstanceId} activeTab={activeTab} />
-            {children}
           </div>
         </div>
       </div>
-    </div>
+    </ScopeProvider>
   )
 }
diff --git a/web/features/deployments/detail/overview-tab.tsx b/web/features/deployments/detail/overview-tab.tsx
index 3c0ffab519b..4a742c1e115 100644
--- a/web/features/deployments/detail/overview-tab.tsx
+++ b/web/features/deployments/detail/overview-tab.tsx
@@ -1,14 +1,14 @@
 'use client'
 
-import { useQuery } from '@tanstack/react-query'
+import { useAtomValue } from 'jotai'
 import { useTranslation } from 'react-i18next'
 import Link from '@/next/link'
-import { consoleQuery } from '@/service/client'
 import { DeploymentStateMessage } from '../components/empty-state'
 import { hasRuntimeInstanceDeployment } from '../shared/domain/runtime-status'
 import { AccessStatusSection, AccessStatusSectionSkeleton, ApiTokenSummarySection, ApiTokenSummarySectionSkeleton } from './overview-tab/access-status-section'
 import { EnvironmentStrip, EnvironmentStripSkeleton } from './overview-tab/environment-strip'
 import { ReleaseHero, ReleaseHeroSkeleton } from './overview-tab/release-hero'
+import { deploymentDetailOverviewQueryAtom } from './state'
 
 function OverviewLayout({ children }: { children: React.ReactNode }) {
   return (
@@ -64,8 +64,7 @@ export function OverviewTab({ appInstanceId }: {
   appInstanceId: string
 }) {
   const { t } = useTranslation('deployments')
-  const input = { params: { appInstanceId } }
-  const overviewQuery = useQuery(consoleQuery.enterprise.appInstanceService.getAppInstanceOverview.queryOptions({ input }))
+  const overviewQuery = useAtomValue(deploymentDetailOverviewQueryAtom)
   const overview = overviewQuery.data
 
   if (overviewQuery.isLoading)
diff --git a/web/features/deployments/detail/overview-tab/release-hero.tsx b/web/features/deployments/detail/overview-tab/release-hero.tsx
index b275b4b48d4..c67ab3b7040 100644
--- a/web/features/deployments/detail/overview-tab/release-hero.tsx
+++ b/web/features/deployments/detail/overview-tab/release-hero.tsx
@@ -4,16 +4,20 @@ import type { Release } from '@dify/contracts/enterprise/types.gen'
 import type { ReactNode } from 'react'
 import { ReleaseSource } from '@dify/contracts/enterprise/types.gen'
 import { cn } from '@langgenius/dify-ui/cn'
-import { useQuery } from '@tanstack/react-query'
+import { useAtomValue } from 'jotai'
+import { ScopeProvider } from 'jotai-scope'
 import { useTranslation } from 'react-i18next'
 import { SkeletonRectangle } from '@/app/components/base/skeleton'
 import { useFormatTimeFromNow } from '@/hooks/use-format-time-from-now'
 import Link from '@/next/link'
-import { consoleQuery } from '@/service/client'
 import { DeploymentEmptyState } from '../../components/empty-state'
 import { TitleTooltip } from '../../components/title-tooltip'
 import { CreateReleaseControl } from '../../create-release'
 import { formatDate, releaseCommit } from '../../shared/domain/release'
+import {
+  deploymentSourceAppIdAtom,
+  deploymentSourceAppQueryAtom,
+} from '../state'
 import { OVERVIEW_CARD_CLASS_NAME, OVERVIEW_ICON_CLASS_NAME } from './card-styles'
 
 type ReleaseHeroProps = {
@@ -116,10 +120,6 @@ function LatestReleaseSource({ release }: {
 }) {
   const { t } = useTranslation('deployments')
   const sourceAppId = release.sourceAppId
-  const sourceAppQuery = useQuery(consoleQuery.apps.byAppId.get.queryOptions({
-    input: { params: { app_id: sourceAppId ?? '' } },
-    enabled: Boolean(sourceAppId),
-  }))
 
   if (!sourceAppId) {
     return (
@@ -129,6 +129,23 @@ function LatestReleaseSource({ release }: {
     )
   }
 
+  return (
+    <ScopeProvider
+      key={sourceAppId}
+      atoms={[
+        [deploymentSourceAppIdAtom, sourceAppId],
+      ]}
+      name="DeploymentLatestReleaseSource"
+    >
+      <LatestReleaseSourceLink sourceAppId={sourceAppId} />
+    </ScopeProvider>
+  )
+}
+
+function LatestReleaseSourceLink({ sourceAppId }: {
+  sourceAppId: string
+}) {
+  const sourceAppQuery = useAtomValue(deploymentSourceAppQueryAtom)
   const sourceAppName = sourceAppQuery.data?.name
   const label = sourceAppName || sourceAppId
   const title = sourceAppName ? `${sourceAppName} (${sourceAppId})` : sourceAppId
diff --git a/web/features/deployments/detail/settings-tab/access/__tests__/api-key-generate-menu.spec.tsx b/web/features/deployments/detail/settings-tab/access/__tests__/api-key-generate-menu.spec.tsx
index 6d7d03bc94c..9dceb9e2aa8 100644
--- a/web/features/deployments/detail/settings-tab/access/__tests__/api-key-generate-menu.spec.tsx
+++ b/web/features/deployments/detail/settings-tab/access/__tests__/api-key-generate-menu.spec.tsx
@@ -48,4 +48,29 @@ describe('ApiKeyGenerateMenu', () => {
     expect(screen.getByText('deployments.access.api.nameRequired')).toBeInTheDocument()
     expect(mockMutate).not.toHaveBeenCalled()
   })
+
+  it('should clear the required name error when typing a valid name', () => {
+    render(
+      <ApiKeyGenerateMenu
+        appInstanceId="app-instance-1"
+        environments={[createEnvironment()]}
+        onCreatedToken={vi.fn()}
+      />,
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: 'deployments.access.api.newKey' }))
+    const nameInput = screen.getByLabelText('deployments.access.api.nameLabel')
+
+    fireEvent.change(nameInput, {
+      target: { value: '   ' },
+    })
+    fireEvent.click(screen.getByRole('button', { name: 'deployments.access.api.createKey' }))
+    expect(screen.getByText('deployments.access.api.nameRequired')).toBeInTheDocument()
+
+    fireEvent.change(nameInput, {
+      target: { value: 'Production key' },
+    })
+
+    expect(screen.queryByText('deployments.access.api.nameRequired')).not.toBeInTheDocument()
+  })
 })
diff --git a/web/features/deployments/detail/settings-tab/access/__tests__/permissions.spec.tsx b/web/features/deployments/detail/settings-tab/access/__tests__/permissions.spec.tsx
index 489550127b1..0f8be629b27 100644
--- a/web/features/deployments/detail/settings-tab/access/__tests__/permissions.spec.tsx
+++ b/web/features/deployments/detail/settings-tab/access/__tests__/permissions.spec.tsx
@@ -1,6 +1,8 @@
 import type { AccessPolicy, Environment, EnvironmentAccessPolicy } from '@dify/contracts/enterprise/types.gen'
+import type { ReactNode } from 'react'
 import { AccessMode, SubjectType } from '@dify/contracts/enterprise/types.gen'
 import { fireEvent, render, screen } from '@testing-library/react'
+import { createStore, Provider as JotaiProvider } from 'jotai'
 import { describe, expect, it, vi } from 'vitest'
 import { EnvironmentPermissionRow } from '../permissions'
 import { AccessPermissionsSection } from '../permissions-section'
@@ -16,6 +18,14 @@ vi.mock('@tanstack/react-query', async (importOriginal) => {
   }
 })
 
+function renderWithAtomStore(children: ReactNode) {
+  return render(
+    <JotaiProvider store={createStore()}>
+      {children}
+    </JotaiProvider>,
+  )
+}
+
 function createEnvironment(overrides: Partial<Environment> = {}): Environment {
   return {
     id: 'environment-1',
@@ -74,7 +84,7 @@ describe('EnvironmentPermissionRow', () => {
   })
 
   it('should keep the previous permission visible when updating the policy fails', () => {
-    render(
+    renderWithAtomStore(
       <EnvironmentPermissionRow
         appInstanceId="app-instance-1"
         environment={createEnvironment()}
@@ -91,7 +101,7 @@ describe('EnvironmentPermissionRow', () => {
   })
 
   it('should show specific subject counts in the access summary', () => {
-    render(
+    renderWithAtomStore(
       <EnvironmentPermissionRow
         appInstanceId="app-instance-1"
         environment={createEnvironment()}
@@ -118,7 +128,7 @@ describe('AccessPermissionsSection', () => {
   })
 
   it('should render permission rows without column headers', () => {
-    render(
+    renderWithAtomStore(
       <AccessPermissionsSection
         appInstanceId="app-instance-1"
         environmentPolicies={[createEnvironmentAccessPolicy()]}
diff --git a/web/features/deployments/detail/settings-tab/access/api-key-generate-menu.tsx b/web/features/deployments/detail/settings-tab/access/api-key-generate-menu.tsx
index e004d36ff13..bde6eb5d667 100644
--- a/web/features/deployments/detail/settings-tab/access/api-key-generate-menu.tsx
+++ b/web/features/deployments/detail/settings-tab/access/api-key-generate-menu.tsx
@@ -64,13 +64,6 @@ export function ApiKeyGenerateMenu({
       nameInputRef.current?.focus()
   }, [createDialogOpen])
 
-  function resetCreateDialog() {
-    setCreateDialogOpen(false)
-    setSelectedEnvironmentId(undefined)
-    setDraftName('')
-    setNameError(false)
-  }
-
   function handleOpenCreateDialog() {
     const firstEnvironment = selectableEnvironments[0]
     if (!firstEnvironment)
@@ -87,6 +80,19 @@ export function ApiKeyGenerateMenu({
     setNameError(false)
   }
 
+  function handleDraftNameChange(nextDraftName: string) {
+    setDraftName(nextDraftName)
+    if (nameError && nextDraftName.trim())
+      setNameError(false)
+  }
+
+  function resetCreateDialog() {
+    setCreateDialogOpen(false)
+    setSelectedEnvironmentId(undefined)
+    setDraftName('')
+    setNameError(false)
+  }
+
   function handleDialogOpenChange(nextOpen: boolean) {
     if (nextOpen || isCreating)
       return
@@ -175,9 +181,7 @@ export function ApiKeyGenerateMenu({
                   aria-describedby={nameError ? `${nameInputId}-error` : undefined}
                   placeholder={t('access.api.namePlaceholder')}
                   onChange={(event) => {
-                    setDraftName(event.target.value)
-                    if (nameError && event.target.value.trim())
-                      setNameError(false)
+                    handleDraftNameChange(event.target.value)
                   }}
                 />
                 {nameError && (
diff --git a/web/features/deployments/detail/settings-tab/access/developer-api-section.tsx b/web/features/deployments/detail/settings-tab/access/developer-api-section.tsx
index 23496dc76ad..3d9ca287cf7 100644
--- a/web/features/deployments/detail/settings-tab/access/developer-api-section.tsx
+++ b/web/features/deployments/detail/settings-tab/access/developer-api-section.tsx
@@ -8,8 +8,8 @@ import type {
 import type { ReactNode } from 'react'
 import { Button } from '@langgenius/dify-ui/button'
 import { Switch, SwitchSkeleton } from '@langgenius/dify-ui/switch'
-import { useMutation, useQuery } from '@tanstack/react-query'
-import { atom, useAtom } from 'jotai'
+import { useMutation } from '@tanstack/react-query'
+import { useAtomValue } from 'jotai'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import { consoleQuery } from '@/service/client'
@@ -20,20 +20,15 @@ import { ApiKeyList } from './api-key-list'
 import { CopyPill } from './common'
 import { CreatedApiTokenDialog } from './developer-api-created-token-dialog'
 import { DeveloperApiSkeleton } from './developer-api-skeleton'
+import { developerApiSettingsQueryAtom } from './state'
 
 type CreatedApiToken = {
   appInstanceId: string
   token: string
 }
 
-const createdApiTokenAtom = atom<CreatedApiToken | undefined>(undefined)
-
-function useDeveloperApiSettings(appInstanceId: string) {
-  const developerApiSettingsQuery = useQuery(consoleQuery.enterprise.accessService.getDeveloperApiSettings.queryOptions({
-    input: {
-      params: { appInstanceId },
-    },
-  }))
+function useDeveloperApiSettings() {
+  const developerApiSettingsQuery = useAtomValue(developerApiSettingsQueryAtom)
   const accessChannels = developerApiSettingsQuery.data?.accessChannels
   const apiEnabled = accessChannels?.developerApiEnabled ?? false
   const environments = developerApiSettingsQuery.data?.environments ?? []
@@ -89,7 +84,7 @@ export function DeveloperApiHeaderSwitch({ appInstanceId }: {
     accessChannels,
     isLoading,
     isError,
-  } = useDeveloperApiSettings(appInstanceId)
+  } = useDeveloperApiSettings()
 
   if (isLoading)
     return <SwitchSkeleton />
@@ -175,7 +170,7 @@ export function DeveloperApiSection({
   appInstanceId: string
 }) {
   const { t } = useTranslation('deployments')
-  const [createdApiToken, setCreatedApiToken] = useAtom(createdApiTokenAtom)
+  const [createdApiToken, setCreatedApiToken] = useState<CreatedApiToken>()
   const {
     apiEnabled,
     apiUrl,
@@ -183,7 +178,7 @@ export function DeveloperApiSection({
     environments,
     isLoading,
     isError,
-  } = useDeveloperApiSettings(appInstanceId)
+  } = useDeveloperApiSettings()
   const visibleCreatedApiToken = createdApiToken?.appInstanceId === appInstanceId
     ? createdApiToken.token
     : undefined
diff --git a/web/features/deployments/detail/settings-tab/access/permissions.tsx b/web/features/deployments/detail/settings-tab/access/permissions.tsx
index 1ae3f4e0653..ed87f0ac137 100644
--- a/web/features/deployments/detail/settings-tab/access/permissions.tsx
+++ b/web/features/deployments/detail/settings-tab/access/permissions.tsx
@@ -30,6 +30,12 @@ import {
   PermissionSummaryButton,
 } from './permission-row-components'
 
+type AccessPermissionDraft = {
+  fingerprint: string
+  kind: AccessPermissionKind
+  subjects: SelectableAccessSubject[]
+}
+
 type EnvironmentPermissionRowProps = {
   appInstanceId: string
   disabled?: boolean
@@ -53,23 +59,19 @@ export function EnvironmentPermissionRow({
   const policyFingerprint = policy
     ? `${policy.mode}:${policy.subjects.map(subject => `${subject.subjectType}:${subject.subjectId}`).join(',')}`
     : 'no-policy'
-  const [draft, setDraft] = useState<{
-    fingerprint?: string
-    kind?: AccessPermissionKind
-    subjects?: SelectableAccessSubject[]
-  }>({})
+  const [draft, setDraft] = useState<AccessPermissionDraft>()
   const subjectLabelCandidates = [
-    ...(draft.subjects ?? []),
+    ...(draft?.subjects ?? []),
     ...resolvedSubjects
       .flatMap((subject) => {
         const normalizedSubject = normalizeResolvedSubject(subject)
         return normalizedSubject ? [normalizedSubject] : []
       }),
   ]
-  const hasDraft = draft.fingerprint === policyFingerprint
-  const permissionKind = hasDraft && draft.kind ? draft.kind : policyKind
+  const hasDraft = draft?.fingerprint === policyFingerprint
+  const permissionKind = hasDraft && draft ? draft.kind : policyKind
   const policySelectedSubjects = policyKind === 'specific' ? selectedSubjectsFromPolicy(policy, subjectLabelCandidates) : []
-  const subjects = hasDraft && draft.subjects ? draft.subjects : policySelectedSubjects
+  const subjects = hasDraft && draft ? draft.subjects : policySelectedSubjects
   const subjectSelection = accessControlSelectionFromSubjects(subjects)
   const isSaving = setEnvironmentAccessPolicy.isPending
   const controlsDisabled = disabled || isSaving
diff --git a/web/features/deployments/detail/settings-tab/access/state.ts b/web/features/deployments/detail/settings-tab/access/state.ts
new file mode 100644
index 00000000000..57bf97c9d99
--- /dev/null
+++ b/web/features/deployments/detail/settings-tab/access/state.ts
@@ -0,0 +1,32 @@
+'use client'
+
+import { skipToken } from '@tanstack/react-query'
+import { atomWithQuery } from 'jotai-tanstack-query'
+import { consoleQuery } from '@/service/client'
+import { deploymentRouteAppInstanceIdAtom } from '../../../route-state'
+
+export const accessSettingsQueryAtom = atomWithQuery((get) => {
+  const appInstanceId = get(deploymentRouteAppInstanceIdAtom)
+
+  return consoleQuery.enterprise.accessService.getAccessSettings.queryOptions({
+    input: appInstanceId
+      ? {
+          params: { appInstanceId },
+        }
+      : skipToken,
+    enabled: Boolean(appInstanceId),
+  })
+})
+
+export const developerApiSettingsQueryAtom = atomWithQuery((get) => {
+  const appInstanceId = get(deploymentRouteAppInstanceIdAtom)
+
+  return consoleQuery.enterprise.accessService.getDeveloperApiSettings.queryOptions({
+    input: appInstanceId
+      ? {
+          params: { appInstanceId },
+        }
+      : skipToken,
+    enabled: Boolean(appInstanceId),
+  })
+})
diff --git a/web/features/deployments/detail/state.ts b/web/features/deployments/detail/state.ts
new file mode 100644
index 00000000000..68bb24ab3a6
--- /dev/null
+++ b/web/features/deployments/detail/state.ts
@@ -0,0 +1,61 @@
+'use client'
+
+import { skipToken } from '@tanstack/react-query'
+import { atom } from 'jotai'
+import { atomWithQuery } from 'jotai-tanstack-query'
+import { consoleQuery } from '@/service/client'
+import { deploymentRouteAppInstanceIdAtom } from '../route-state'
+import { deploymentStatusPollingInterval } from '../shared/domain/runtime-status'
+
+export const deploymentSourceAppIdAtom = atom<string | undefined>(undefined)
+
+export const deploymentDetailAppInstanceQueryAtom = atomWithQuery((get) => {
+  const appInstanceId = get(deploymentRouteAppInstanceIdAtom)
+
+  return consoleQuery.enterprise.appInstanceService.getAppInstance.queryOptions({
+    input: appInstanceId
+      ? {
+          params: { appInstanceId },
+        }
+      : skipToken,
+    enabled: Boolean(appInstanceId),
+  })
+})
+
+export const deploymentDetailOverviewQueryAtom = atomWithQuery((get) => {
+  const appInstanceId = get(deploymentRouteAppInstanceIdAtom)
+
+  return consoleQuery.enterprise.appInstanceService.getAppInstanceOverview.queryOptions({
+    input: appInstanceId
+      ? {
+          params: { appInstanceId },
+        }
+      : skipToken,
+    enabled: Boolean(appInstanceId),
+  })
+})
+
+export const deploymentEnvironmentDeploymentsQueryAtom = atomWithQuery((get) => {
+  const appInstanceId = get(deploymentRouteAppInstanceIdAtom)
+
+  return consoleQuery.enterprise.deploymentService.listEnvironmentDeployments.queryOptions({
+    input: appInstanceId
+      ? {
+          params: { appInstanceId },
+        }
+      : skipToken,
+    enabled: Boolean(appInstanceId),
+    refetchInterval: query => deploymentStatusPollingInterval(query.state.data?.environmentDeployments),
+  })
+})
+
+export const deploymentSourceAppQueryAtom = atomWithQuery((get) => {
+  const sourceAppId = get(deploymentSourceAppIdAtom)
+
+  return consoleQuery.apps.byAppId.get.queryOptions({
+    input: sourceAppId
+      ? { params: { app_id: sourceAppId } }
+      : skipToken,
+    enabled: Boolean(sourceAppId),
+  })
+})
diff --git a/web/features/deployments/detail/versions-tab/__tests__/deploy-release-menu.spec.tsx b/web/features/deployments/detail/versions-tab/__tests__/deploy-release-menu.spec.tsx
index 7692cd3ad39..88692e55360 100644
--- a/web/features/deployments/detail/versions-tab/__tests__/deploy-release-menu.spec.tsx
+++ b/web/features/deployments/detail/versions-tab/__tests__/deploy-release-menu.spec.tsx
@@ -4,7 +4,6 @@ import { fireEvent, render, screen } from '@testing-library/react'
 import { describe, expect, it, vi } from 'vitest'
 import { DeployReleaseMenu } from '../deploy-release-menu'
 
-const mockUseQuery = vi.hoisted(() => vi.fn())
 const mockUseMutation = vi.hoisted(() => vi.fn())
 const mockDeleteRelease = vi.fn()
 
@@ -14,11 +13,21 @@ vi.mock('@tanstack/react-query', async (importOriginal) => {
   const actual = await importOriginal<typeof import('@tanstack/react-query')>()
   return {
     ...actual,
-    useQuery: (...args: unknown[]) => mockUseQuery(...args),
     useMutation: (...args: unknown[]) => mockUseMutation(...args),
   }
 })
 
+vi.mock('../state', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../state')>()
+  const { atom } = await import('jotai')
+
+  return {
+    ...actual,
+    deployReleaseMenuEnvironmentDeploymentsQueryAtom: atom(environmentDeploymentsErrorResult()),
+    deployReleaseMenuAppInstanceQueryAtom: atom(appInstanceResult()),
+  }
+})
+
 vi.mock('../edit-release-dialog', () => ({
   EditReleaseDialog: () => null,
 }))
@@ -69,11 +78,6 @@ function appInstanceResult() {
 describe('DeployReleaseMenu', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    mockUseQuery.mockImplementation(() => {
-      return mockUseQuery.mock.calls.length % 2 === 1
-        ? environmentDeploymentsErrorResult()
-        : appInstanceResult()
-    })
     mockUseMutation.mockReturnValue({
       isPending: false,
       mutate: mockDeleteRelease,
diff --git a/web/features/deployments/detail/versions-tab/__tests__/release-history-rows.spec.tsx b/web/features/deployments/detail/versions-tab/__tests__/release-history-rows.spec.tsx
index 30f71655110..d022542ad77 100644
--- a/web/features/deployments/detail/versions-tab/__tests__/release-history-rows.spec.tsx
+++ b/web/features/deployments/detail/versions-tab/__tests__/release-history-rows.spec.tsx
@@ -4,18 +4,25 @@ import { render, within } from '@testing-library/react'
 import { describe, expect, it, vi } from 'vitest'
 import { ReleaseHistoryRows } from '../release-history-rows'
 
-vi.mock('@tanstack/react-query', async (importOriginal) => {
-  const actual = await importOriginal<typeof import('@tanstack/react-query')>()
-  return {
-    ...actual,
-    useQuery: () => ({ data: undefined }),
-  }
-})
-
 vi.mock('../deploy-release-menu', () => ({
   DeployReleaseMenu: () => <button type="button">Actions</button>,
 }))
 
+vi.mock('../../state', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../../state')>()
+  const { atom } = await import('jotai')
+
+  return {
+    ...actual,
+    deploymentSourceAppIdAtom: atom<string | undefined>(undefined),
+    deploymentSourceAppQueryAtom: atom({
+      data: {
+        name: 'Source Workflow',
+      },
+    }),
+  }
+})
+
 function createReleaseRow(overrides: Partial<ReleaseWithSummaryDeployments> = {}): ReleaseWithSummaryDeployments {
   return {
     id: 'release-1',
@@ -82,4 +89,23 @@ describe('ReleaseHistoryRows', () => {
     expect(deploymentLabel).not.toHaveAttribute('data-base-ui-tooltip-trigger')
     expect(container.querySelector('.shadow-status-indicator-green-shadow')).toBeInTheDocument()
   })
+
+  it('should render release source app links with scoped source app state', () => {
+    const { container } = render(
+      <ReleaseHistoryRows
+        appInstanceId="app-instance-1"
+        releaseRows={[
+          createReleaseRow({
+            sourceAppId: 'source-app-1',
+          }),
+        ]}
+      />,
+    )
+
+    const table = container.querySelector('table')
+    const sourceLink = within(table!).getByRole('link', { name: /Source Workflow/ })
+
+    expect(sourceLink).toHaveAttribute('href', '/app/source-app-1/workflow')
+    expect(sourceLink).toHaveAttribute('target', '_blank')
+  })
 })
diff --git a/web/features/deployments/detail/versions-tab/__tests__/state.spec.ts b/web/features/deployments/detail/versions-tab/__tests__/state.spec.ts
new file mode 100644
index 00000000000..7feae92226a
--- /dev/null
+++ b/web/features/deployments/detail/versions-tab/__tests__/state.spec.ts
@@ -0,0 +1,143 @@
+import type { Getter } from 'jotai'
+import { skipToken } from '@tanstack/react-query'
+import { atom, createStore } from 'jotai'
+import { describe, expect, it, vi } from 'vitest'
+import { deploymentRouteAppInstanceIdAtom } from '../../../route-state'
+
+type QueryOptions = {
+  enabled?: boolean
+  input?: unknown
+  placeholderData?: unknown
+  queryKey?: readonly unknown[]
+}
+
+vi.mock('jotai-tanstack-query', () => ({
+  atomWithQuery: (createOptions: (get: Getter) => QueryOptions) => atom(get => ({
+    ...createOptions(get),
+    data: undefined,
+    isError: false,
+    isFetching: false,
+    isLoading: false,
+    isSuccess: false,
+  })),
+}))
+
+vi.mock('@/service/client', () => ({
+  consoleQuery: {
+    enterprise: {
+      appInstanceService: {
+        getAppInstance: {
+          queryOptions: (options: QueryOptions) => ({
+            ...options,
+            queryKey: ['getAppInstance', options.input],
+          }),
+        },
+      },
+      deploymentService: {
+        listEnvironmentDeployments: {
+          queryOptions: (options: QueryOptions) => ({
+            ...options,
+            queryKey: ['listEnvironmentDeployments', options.input],
+          }),
+        },
+      },
+      releaseService: {
+        listReleaseSummaries: {
+          queryOptions: (options: QueryOptions) => ({
+            ...options,
+            queryKey: ['listReleaseSummaries', options.input],
+          }),
+        },
+      },
+    },
+  },
+}))
+
+async function loadState() {
+  return await import('../state')
+}
+
+describe('versions tab state', () => {
+  it('should gate release history and menu queries until route and menu state are ready', async () => {
+    const state = await loadState()
+    const store = createStore()
+
+    expect(store.get(state.releaseHistoryQueryAtom)).toMatchObject({
+      enabled: false,
+      input: skipToken,
+    })
+    expect(store.get(state.deployReleaseMenuEnvironmentDeploymentsQueryAtom)).toMatchObject({
+      enabled: false,
+      input: skipToken,
+    })
+    expect(store.get(state.deployReleaseMenuAppInstanceQueryAtom)).toMatchObject({
+      enabled: false,
+      input: skipToken,
+    })
+  })
+
+  it('should build release history input from the current page', async () => {
+    const state = await loadState()
+    const store = createStore()
+    store.set(deploymentRouteAppInstanceIdAtom, 'app-instance-1')
+
+    store.set(state.setReleaseHistoryCurrentPageAtom, -1)
+    expect(store.get(state.releaseHistoryCurrentPageAtom)).toBe(0)
+
+    store.set(state.setReleaseHistoryCurrentPageAtom, 2)
+    expect(store.get(state.releaseHistoryQueryAtom)).toMatchObject({
+      enabled: true,
+      input: {
+        params: { appInstanceId: 'app-instance-1' },
+        query: {
+          pageNumber: 3,
+        },
+      },
+    })
+  })
+
+  it('should scope deploy menu queries to the open release id', async () => {
+    const state = await loadState()
+    const store = createStore()
+    store.set(deploymentRouteAppInstanceIdAtom, 'app-instance-1')
+
+    store.set(state.setDeployReleaseMenuOpenAtom, {
+      releaseId: 'release-1',
+      open: true,
+    })
+
+    expect(store.get(state.deployReleaseMenuOpenReleaseIdAtom)).toBe('release-1')
+    expect(store.get(state.deployReleaseMenuEnvironmentDeploymentsQueryAtom)).toMatchObject({
+      enabled: true,
+      input: { params: { appInstanceId: 'app-instance-1' } },
+    })
+    expect(store.get(state.deployReleaseMenuAppInstanceQueryAtom)).toMatchObject({
+      enabled: true,
+      input: { params: { appInstanceId: 'app-instance-1' } },
+    })
+
+    store.set(state.setDeployReleaseMenuOpenAtom, {
+      releaseId: 'release-2',
+      open: false,
+    })
+    expect(store.get(state.deployReleaseMenuOpenReleaseIdAtom)).toBe('release-1')
+
+    store.set(state.setDeployReleaseMenuOpenAtom, {
+      releaseId: 'release-1',
+      open: false,
+    })
+    expect(store.get(state.deployReleaseMenuOpenReleaseIdAtom)).toBeUndefined()
+  })
+
+  it('should adjust the release page only when deleting the last row on a later page', async () => {
+    const state = await loadState()
+    const store = createStore()
+
+    store.set(state.setReleaseHistoryCurrentPageAtom, 2)
+    store.set(state.adjustReleaseHistoryPageAfterDeleteAtom, 2)
+    expect(store.get(state.releaseHistoryCurrentPageAtom)).toBe(2)
+
+    store.set(state.adjustReleaseHistoryPageAfterDeleteAtom, 1)
+    expect(store.get(state.releaseHistoryCurrentPageAtom)).toBe(1)
+  })
+})
diff --git a/web/features/deployments/detail/versions-tab/deploy-release-menu.tsx b/web/features/deployments/detail/versions-tab/deploy-release-menu.tsx
index f12a28ff896..332ccb2f18a 100644
--- a/web/features/deployments/detail/versions-tab/deploy-release-menu.tsx
+++ b/web/features/deployments/detail/versions-tab/deploy-release-menu.tsx
@@ -9,8 +9,8 @@ import {
   DropdownMenuTrigger,
 } from '@langgenius/dify-ui/dropdown-menu'
 import { toast } from '@langgenius/dify-ui/toast'
-import { useMutation, useQuery } from '@tanstack/react-query'
-import { useSetAtom } from 'jotai'
+import { useMutation } from '@tanstack/react-query'
+import { useAtomValue, useSetAtom } from 'jotai'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import { consoleQuery } from '@/service/client'
@@ -25,6 +25,12 @@ import {
 } from './deploy-release-menu-utils'
 import { EditReleaseDialog } from './edit-release-dialog'
 import { exportReleaseDsl } from './release-dsl-export'
+import {
+  deployReleaseMenuAppInstanceQueryAtom,
+  deployReleaseMenuEnvironmentDeploymentsQueryAtom,
+  deployReleaseMenuOpenReleaseIdAtom,
+  setDeployReleaseMenuOpenAtom,
+} from './state'
 
 export function DeployReleaseMenu({ appInstanceId, releaseId, releaseRows, onDeleted }: {
   appInstanceId: string
@@ -34,29 +40,21 @@ export function DeployReleaseMenu({ appInstanceId, releaseId, releaseRows, onDel
 }) {
   const { t } = useTranslation('deployments')
   const openDeployDrawer = useSetAtom(openDeployDrawerAtom)
-  const [open, setOpen] = useState(false)
+  const openReleaseMenuId = useAtomValue(deployReleaseMenuOpenReleaseIdAtom)
+  const setDeployReleaseMenuOpen = useSetAtom(setDeployReleaseMenuOpenAtom)
   const [showEditDialog, setShowEditDialog] = useState(false)
   const [showDeleteConfirm, setShowDeleteConfirm] = useState(false)
   const [isExportingDsl, setIsExportingDsl] = useState(false)
-  const environmentDeploymentsQuery = useQuery(consoleQuery.enterprise.deploymentService.listEnvironmentDeployments.queryOptions({
-    input: {
-      params: { appInstanceId },
-    },
-    enabled: open,
-  }))
-  const { data: appInstanceData } = useQuery(consoleQuery.enterprise.appInstanceService.getAppInstance.queryOptions({
-    input: {
-      params: { appInstanceId },
-    },
-    enabled: open,
-  }))
+  const open = openReleaseMenuId === releaseId
+  const environmentDeploymentsQuery = useAtomValue(deployReleaseMenuEnvironmentDeploymentsQueryAtom)
+  const appInstanceQuery = useAtomValue(deployReleaseMenuAppInstanceQueryAtom)
   const deleteRelease = useMutation(consoleQuery.enterprise.releaseService.deleteRelease.mutationOptions())
 
   const environments = (environmentDeploymentsQuery.data?.environmentDeployments ?? [])
     .map(row => row.environment)
   const deploymentRows = environmentDeploymentsQuery.data?.environmentDeployments.filter(row => !isUndeployedDeploymentRow(row)) ?? []
   const targetRelease = releaseRows.find(release => release.id === releaseId)
-  const appInstanceName = appInstanceData?.appInstance.displayName
+  const appInstanceName = appInstanceQuery.data?.appInstance.displayName
 
   if (!targetRelease)
     return null
@@ -76,6 +74,10 @@ export function DeployReleaseMenu({ appInstanceId, releaseId, releaseRows, onDel
         : undefined
   const deleteActionDisabled = isDeletingRelease || isCheckingDeleteUsage || hasDeleteUsageCheckFailed || isReleaseInUse
 
+  function handleOpenChange(nextOpen: boolean) {
+    setDeployReleaseMenuOpen({ releaseId, open: nextOpen })
+  }
+
   const handleExportDsl = async () => {
     if (isExportingDsl)
       return
@@ -83,7 +85,7 @@ export function DeployReleaseMenu({ appInstanceId, releaseId, releaseRows, onDel
     setIsExportingDsl(true)
     try {
       await exportReleaseDsl({ release: targetRelease, releaseId, appInstanceName })
-      setOpen(false)
+      handleOpenChange(false)
     }
     catch {
       toast.error(t('versions.exportDslFailed'))
@@ -127,7 +129,7 @@ export function DeployReleaseMenu({ appInstanceId, releaseId, releaseRows, onDel
 
   return (
     <>
-      <DropdownMenu modal={false} open={open} onOpenChange={setOpen}>
+      <DropdownMenu modal={false} open={open} onOpenChange={handleOpenChange}>
         <DropdownMenuTrigger
           aria-label={t('versions.moreActions')}
           className={DETAIL_TABLE_ACTION_TRIGGER_CLASS_NAME}
@@ -139,7 +141,7 @@ export function DeployReleaseMenu({ appInstanceId, releaseId, releaseRows, onDel
             <DropdownMenuItem
               className="gap-2 px-3"
               onClick={() => {
-                setOpen(false)
+                handleOpenChange(false)
                 setShowEditDialog(true)
               }}
             >
@@ -183,7 +185,7 @@ export function DeployReleaseMenu({ appInstanceId, releaseId, releaseRows, onDel
                         onClick={() => {
                           if (isDisabled)
                             return
-                          setOpen(false)
+                          handleOpenChange(false)
                           openDeployDrawer({ appInstanceId, environmentId: row.environmentId, releaseId })
                         }}
                       >
@@ -209,7 +211,7 @@ export function DeployReleaseMenu({ appInstanceId, releaseId, releaseRows, onDel
                 onClick={() => {
                   if (deleteActionDisabled)
                     return
-                  setOpen(false)
+                  handleOpenChange(false)
                   setShowDeleteConfirm(true)
                 }}
               >
diff --git a/web/features/deployments/detail/versions-tab/edit-release-dialog.tsx b/web/features/deployments/detail/versions-tab/edit-release-dialog.tsx
index da57965ab3e..28ca0b6ff1d 100644
--- a/web/features/deployments/detail/versions-tab/edit-release-dialog.tsx
+++ b/web/features/deployments/detail/versions-tab/edit-release-dialog.tsx
@@ -152,7 +152,7 @@ export function EditReleaseDialog({
         onSuccess: (data) => {
           const updatedName = data.release.displayName
           toast.success(t('versions.editSuccess', { name: updatedName }))
-          onOpenChange(false)
+          handleOpenChange(false)
         },
         onError: () => {
           toast.error(t('versions.editFailed'))
diff --git a/web/features/deployments/detail/versions-tab/release-history-rows.tsx b/web/features/deployments/detail/versions-tab/release-history-rows.tsx
index f8bb8ce8673..60a55301fd0 100644
--- a/web/features/deployments/detail/versions-tab/release-history-rows.tsx
+++ b/web/features/deployments/detail/versions-tab/release-history-rows.tsx
@@ -4,16 +4,20 @@ import type { Release } from '@dify/contracts/enterprise/types.gen'
 import type { ReleaseWithSummaryDeployments } from './release-deployments'
 import { ReleaseSource } from '@dify/contracts/enterprise/types.gen'
 import { Tooltip, TooltipContent, TooltipTrigger } from '@langgenius/dify-ui/tooltip'
-import { useQuery } from '@tanstack/react-query'
+import { useAtomValue } from 'jotai'
+import { ScopeProvider } from 'jotai-scope'
 import { useTranslation } from 'react-i18next'
 import { useFormatTimeFromNow } from '@/hooks/use-format-time-from-now'
 import Link from '@/next/link'
-import { consoleQuery } from '@/service/client'
 import { TitleTooltip } from '../../components/title-tooltip'
 import {
   formatDate,
   releaseCommit,
 } from '../../shared/domain/release'
+import {
+  deploymentSourceAppIdAtom,
+  deploymentSourceAppQueryAtom,
+} from '../state'
 import {
   DetailTable,
   DetailTableBody,
@@ -77,10 +81,6 @@ function ReleaseSourceCell({ release }: {
 }) {
   const { t } = useTranslation('deployments')
   const sourceAppId = release.sourceAppId
-  const sourceAppQuery = useQuery(consoleQuery.apps.byAppId.get.queryOptions({
-    input: { params: { app_id: sourceAppId ?? '' } },
-    enabled: Boolean(sourceAppId),
-  }))
 
   if (!sourceAppId) {
     return (
@@ -90,6 +90,23 @@ function ReleaseSourceCell({ release }: {
     )
   }
 
+  return (
+    <ScopeProvider
+      key={sourceAppId}
+      atoms={[
+        [deploymentSourceAppIdAtom, sourceAppId],
+      ]}
+      name="DeploymentReleaseSource"
+    >
+      <ReleaseSourceLink sourceAppId={sourceAppId} />
+    </ScopeProvider>
+  )
+}
+
+function ReleaseSourceLink({ sourceAppId }: {
+  sourceAppId: string
+}) {
+  const sourceAppQuery = useAtomValue(deploymentSourceAppQueryAtom)
   const sourceAppName = sourceAppQuery.data?.name
   const label = sourceAppName || sourceAppId
   const title = sourceAppName ? `${sourceAppName} (${sourceAppId})` : sourceAppId
diff --git a/web/features/deployments/detail/versions-tab/release-history-table.tsx b/web/features/deployments/detail/versions-tab/release-history-table.tsx
index 9b402904d3a..72aa024fcf3 100644
--- a/web/features/deployments/detail/versions-tab/release-history-table.tsx
+++ b/web/features/deployments/detail/versions-tab/release-history-table.tsx
@@ -1,31 +1,28 @@
 'use client'
 
 import { Pagination } from '@langgenius/dify-ui/pagination'
-import { keepPreviousData, useQuery } from '@tanstack/react-query'
-import { useState } from 'react'
+import { useAtomValue, useSetAtom } from 'jotai'
 import { useTranslation } from 'react-i18next'
-import { consoleQuery } from '@/service/client'
 import { DeploymentEmptyState, DeploymentStateMessage } from '../../components/empty-state'
 import { RELEASE_HISTORY_PAGE_SIZE } from '../../shared/domain/pagination'
 import { ReleaseHistoryRows } from './release-history-rows'
 import { ReleaseHistoryTableSkeleton } from './release-history-table-skeleton'
 import { releaseRowFromSummary } from './release-history-types'
+import {
+  adjustReleaseHistoryPageAfterDeleteAtom,
+  releaseHistoryCurrentPageAtom,
+  releaseHistoryQueryAtom,
+  setReleaseHistoryCurrentPageAtom,
+} from './state'
 
 export function ReleaseHistoryTable({ appInstanceId }: {
   appInstanceId: string
 }) {
   const { t } = useTranslation('deployments')
-  const [currentPage, setCurrentPage] = useState(0)
-  const releaseHistoryQuery = useQuery(consoleQuery.enterprise.releaseService.listReleaseSummaries.queryOptions({
-    input: {
-      params: { appInstanceId },
-      query: {
-        pageNumber: currentPage + 1,
-        resultsPerPage: RELEASE_HISTORY_PAGE_SIZE,
-      },
-    },
-    placeholderData: keepPreviousData,
-  }))
+  const currentPage = useAtomValue(releaseHistoryCurrentPageAtom)
+  const setCurrentPage = useSetAtom(setReleaseHistoryCurrentPageAtom)
+  const adjustPageAfterDelete = useSetAtom(adjustReleaseHistoryPageAfterDeleteAtom)
+  const releaseHistoryQuery = useAtomValue(releaseHistoryQueryAtom)
   const isLoading = releaseHistoryQuery.isLoading
   const hasError = releaseHistoryQuery.isError
 
@@ -54,8 +51,7 @@ export function ReleaseHistoryTable({ appInstanceId }: {
   const totalReleasePages = Math.ceil(totalReleases / RELEASE_HISTORY_PAGE_SIZE)
 
   function handleReleaseDeleted() {
-    if (releaseRows.length === 1 && currentPage > 0)
-      setCurrentPage(page => Math.max(page - 1, 0))
+    adjustPageAfterDelete(releaseRows.length)
   }
 
   if (releaseRows.length === 0) {
diff --git a/web/features/deployments/detail/versions-tab/state.ts b/web/features/deployments/detail/versions-tab/state.ts
new file mode 100644
index 00000000000..5cf772bc54f
--- /dev/null
+++ b/web/features/deployments/detail/versions-tab/state.ts
@@ -0,0 +1,90 @@
+'use client'
+
+import type { ListReleaseSummariesResponse } from '@dify/contracts/enterprise/types.gen'
+import { keepPreviousData, skipToken } from '@tanstack/react-query'
+import { atom } from 'jotai'
+import { atomWithQuery } from 'jotai-tanstack-query'
+import { consoleQuery } from '@/service/client'
+import { deploymentRouteAppInstanceIdAtom } from '../../route-state'
+import { RELEASE_HISTORY_PAGE_SIZE } from '../../shared/domain/pagination'
+
+export const releaseHistoryCurrentPageAtom = atom(0)
+export const deployReleaseMenuOpenReleaseIdAtom = atom<string | undefined>(undefined)
+
+export const releaseHistoryQueryAtom = atomWithQuery<ListReleaseSummariesResponse>((get) => {
+  const appInstanceId = get(deploymentRouteAppInstanceIdAtom)
+  const currentPage = get(releaseHistoryCurrentPageAtom)
+
+  return consoleQuery.enterprise.releaseService.listReleaseSummaries.queryOptions({
+    input: appInstanceId
+      ? {
+          params: { appInstanceId },
+          query: {
+            pageNumber: currentPage + 1,
+            resultsPerPage: RELEASE_HISTORY_PAGE_SIZE,
+          },
+        }
+      : skipToken,
+    enabled: Boolean(appInstanceId),
+    placeholderData: keepPreviousData,
+  })
+})
+
+export const deployReleaseMenuEnvironmentDeploymentsQueryAtom = atomWithQuery((get) => {
+  const appInstanceId = get(deploymentRouteAppInstanceIdAtom)
+  const openReleaseId = get(deployReleaseMenuOpenReleaseIdAtom)
+
+  return consoleQuery.enterprise.deploymentService.listEnvironmentDeployments.queryOptions({
+    input: appInstanceId
+      ? {
+          params: { appInstanceId },
+        }
+      : skipToken,
+    enabled: Boolean(appInstanceId && openReleaseId),
+  })
+})
+
+export const deployReleaseMenuAppInstanceQueryAtom = atomWithQuery((get) => {
+  const appInstanceId = get(deploymentRouteAppInstanceIdAtom)
+  const openReleaseId = get(deployReleaseMenuOpenReleaseIdAtom)
+
+  return consoleQuery.enterprise.appInstanceService.getAppInstance.queryOptions({
+    input: appInstanceId
+      ? {
+          params: { appInstanceId },
+        }
+      : skipToken,
+    enabled: Boolean(appInstanceId && openReleaseId),
+  })
+})
+
+export const setReleaseHistoryCurrentPageAtom = atom(null, (_get, set, page: number) => {
+  set(releaseHistoryCurrentPageAtom, Math.max(page, 0))
+})
+
+export const adjustReleaseHistoryPageAfterDeleteAtom = atom(null, (get, set, remainingRowsOnPage: number) => {
+  const currentPage = get(releaseHistoryCurrentPageAtom)
+  if (remainingRowsOnPage === 1 && currentPage > 0)
+    set(releaseHistoryCurrentPageAtom, currentPage - 1)
+})
+
+export const setDeployReleaseMenuOpenAtom = atom(null, (get, set, {
+  releaseId,
+  open,
+}: {
+  releaseId: string
+  open: boolean
+}) => {
+  if (open) {
+    set(deployReleaseMenuOpenReleaseIdAtom, releaseId)
+    return
+  }
+
+  if (get(deployReleaseMenuOpenReleaseIdAtom) === releaseId)
+    set(deployReleaseMenuOpenReleaseIdAtom, undefined)
+})
+
+export const versionsTabLocalAtoms = [
+  releaseHistoryCurrentPageAtom,
+  deployReleaseMenuOpenReleaseIdAtom,
+] as const
diff --git a/web/features/deployments/list/state/index.ts b/web/features/deployments/list/state/index.ts
index 4853d131b62..0b8b91deae7 100644
--- a/web/features/deployments/list/state/index.ts
+++ b/web/features/deployments/list/state/index.ts
@@ -34,22 +34,20 @@ export const deploymentsListQueryAtom = atomWithInfiniteQuery<
   const queryKeywords = get(deploymentsListKeywordsAtom).trim()
   const queryEnvironmentId = get(deploymentsListEnvironmentIdAtom) ?? undefined
 
-  return {
-    ...consoleQuery.enterprise.appInstanceService.listAppInstanceSummaries.infiniteOptions({
-      input: pageParam => ({
-        query: {
-          pageNumber: Number(pageParam),
-          resultsPerPage: SOURCE_APPS_PAGE_SIZE,
-          ...(queryEnvironmentId ? { environmentId: queryEnvironmentId } : {}),
-          ...(queryKeywords ? { displayName: queryKeywords } : {}),
-        },
-      }),
-      getNextPageParam: lastPage => getNextPageParamFromPagination(lastPage.pagination),
-      initialPageParam: 1,
-      placeholderData: keepPreviousData,
+  return consoleQuery.enterprise.appInstanceService.listAppInstanceSummaries.infiniteOptions({
+    input: pageParam => ({
+      query: {
+        pageNumber: Number(pageParam),
+        resultsPerPage: SOURCE_APPS_PAGE_SIZE,
+        ...(queryEnvironmentId ? { environmentId: queryEnvironmentId } : {}),
+        ...(queryKeywords ? { displayName: queryKeywords } : {}),
+      },
     }),
+    getNextPageParam: lastPage => getNextPageParamFromPagination(lastPage.pagination),
+    initialPageParam: 1,
+    placeholderData: keepPreviousData,
     refetchInterval: query => listDeploymentStatusPollingInterval(query.state.data),
-  }
+  })
 })
 
 export const deploymentsListRowsAtom = atom((get) => {
diff --git a/web/features/deployments/list/ui/__tests__/instance-card-sections.spec.tsx b/web/features/deployments/list/ui/__tests__/instance-card-sections.spec.tsx
new file mode 100644
index 00000000000..d1bdfbe5c43
--- /dev/null
+++ b/web/features/deployments/list/ui/__tests__/instance-card-sections.spec.tsx
@@ -0,0 +1,64 @@
+import type { Release } from '@dify/contracts/enterprise/types.gen'
+import { ReleaseSource } from '@dify/contracts/enterprise/types.gen'
+import { act, fireEvent, render, screen } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { ReleaseMetaTooltip } from '../instance-card-sections'
+
+function createRelease(overrides: Partial<Release> = {}): Release {
+  return {
+    id: 'release-1',
+    appInstanceId: 'app-instance-1',
+    displayName: 'Initial release',
+    description: '',
+    source: ReleaseSource.RELEASE_SOURCE_SOURCE_APP,
+    sourceAppId: 'source-app-1',
+    gateCommitId: 'commit-1',
+    requiredSlots: [],
+    createdBy: {
+      id: 'user-1',
+      displayName: 'Ada',
+    },
+    createdAt: '2026-01-01T00:00:00.000Z',
+    ...overrides,
+  }
+}
+
+function closestWithClass(element: HTMLElement, className: string) {
+  let current: HTMLElement | null = element
+
+  while (current) {
+    if (current.classList.contains(className))
+      return current
+    current = current.parentElement
+  }
+
+  return null
+}
+
+describe('ReleaseMetaTooltip', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  it('should use compact typography for the release metadata preview', async () => {
+    render(
+      <ReleaseMetaTooltip release={createRelease()} deployed>
+        <a href="/deployments/app-instance-1/releases">
+          Initial release · 14 days ago
+        </a>
+      </ReleaseMetaTooltip>,
+    )
+
+    await act(async () => {
+      fireEvent.mouseEnter(screen.getByRole('link', { name: 'Initial release · 14 days ago' }))
+      await vi.advanceTimersByTimeAsync(700)
+    })
+
+    const previewValue = screen.getByText('Initial release')
+    expect(closestWithClass(previewValue, 'min-w-48')).toHaveClass('system-xs-regular')
+  })
+})
diff --git a/web/features/deployments/list/ui/instance-card-sections.tsx b/web/features/deployments/list/ui/instance-card-sections.tsx
index 821ebf63144..77502da39bc 100644
--- a/web/features/deployments/list/ui/instance-card-sections.tsx
+++ b/web/features/deployments/list/ui/instance-card-sections.tsx
@@ -50,7 +50,7 @@ export function ReleaseMetaTooltip({ release, deployed, children }: {
     <PreviewCard>
       <PreviewCardTrigger render={children} />
       <PreviewCardContent popupClassName="px-3 py-2">
-        <div className="flex min-w-48 flex-col gap-1">
+        <div className="flex min-w-48 flex-col gap-1 system-xs-regular">
           {rows.map(row => (
             <div key={row.label} className="flex justify-between gap-4">
               <span className="shrink-0 text-text-tertiary">{row.label}</span>
diff --git a/web/features/deployments/list/ui/instance-card.tsx b/web/features/deployments/list/ui/instance-card.tsx
index 4f4649c134f..17cc60d8bc1 100644
--- a/web/features/deployments/list/ui/instance-card.tsx
+++ b/web/features/deployments/list/ui/instance-card.tsx
@@ -56,7 +56,6 @@ export function InstanceCard({ summary }: {
     >
       <DeploymentActionsMenu
         appInstanceId={appInstanceId}
-        appName={appName}
         placement="bottom-end"
         sideOffset={4}
         className="pointer-events-none absolute top-3 right-3 z-10 opacity-0 transition-opacity group-focus-within:pointer-events-auto group-focus-within:opacity-100 group-hover:pointer-events-auto group-hover:opacity-100"
diff --git a/web/features/deployments/nav/__tests__/index.spec.tsx b/web/features/deployments/nav/__tests__/index.spec.tsx
new file mode 100644
index 00000000000..01e25696b55
--- /dev/null
+++ b/web/features/deployments/nav/__tests__/index.spec.tsx
@@ -0,0 +1,79 @@
+import { fireEvent, render, screen } from '@testing-library/react'
+import { atom } from 'jotai'
+import { describe, expect, it, vi } from 'vitest'
+import { DeploymentsNav } from '../index'
+
+const mockPush = vi.hoisted(() => vi.fn())
+const mockFetchNextPage = vi.hoisted(() => vi.fn())
+
+vi.mock('@/next/navigation', () => ({
+  useRouter: () => ({
+    push: mockPush,
+  }),
+}))
+
+vi.mock('@/app/components/header/nav', () => ({
+  default: ({
+    createText,
+    curNav,
+    isLoadingMore,
+    navigationItems,
+    onCreate,
+    onLoadMore,
+    text,
+  }: {
+    createText: string
+    curNav?: { name: string }
+    isLoadingMore: boolean
+    navigationItems: Array<{ name: string }>
+    onCreate: () => void
+    onLoadMore: () => void
+    text: string
+  }) => (
+    <nav aria-label={text}>
+      <span>{curNav?.name}</span>
+      {navigationItems.map(item => (
+        <span key={item.name}>{item.name}</span>
+      ))}
+      <button type="button" onClick={onCreate}>
+        {createText}
+      </button>
+      <button type="button" data-loading={String(isLoadingMore)} onClick={onLoadMore}>
+        load more
+      </button>
+    </nav>
+  ),
+}))
+
+vi.mock('../state', () => ({
+  deploymentsNavCurrentItemAtom: atom({
+    id: 'app-instance-1',
+    name: 'Deployment 1',
+  }),
+  deploymentsNavItemsAtom: atom([
+    {
+      id: 'app-instance-1',
+      name: 'Deployment 1',
+    },
+  ]),
+  deploymentsNavListQueryAtom: atom({
+    fetchNextPage: mockFetchNextPage,
+    hasNextPage: true,
+    isFetchingNextPage: false,
+  }),
+}))
+
+describe('DeploymentsNav', () => {
+  it('should render deployment navigation from atom state and forward nav actions', () => {
+    render(<DeploymentsNav />)
+
+    expect(screen.getByRole('navigation', { name: 'common.menus.deployments' })).toBeInTheDocument()
+    expect(screen.getAllByText('Deployment 1')).toHaveLength(2)
+
+    fireEvent.click(screen.getByRole('button', { name: 'deployments:list.createDeployment' }))
+    fireEvent.click(screen.getByRole('button', { name: 'load more' }))
+
+    expect(mockPush).toHaveBeenCalledWith('/deployments/create')
+    expect(mockFetchNextPage).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/web/features/deployments/nav/__tests__/state.spec.ts b/web/features/deployments/nav/__tests__/state.spec.ts
new file mode 100644
index 00000000000..7374aa7515c
--- /dev/null
+++ b/web/features/deployments/nav/__tests__/state.spec.ts
@@ -0,0 +1,187 @@
+import type {
+  AppInstance,
+  GetAppInstanceResponse,
+  ListAppInstancesResponse,
+} from '@dify/contracts/enterprise/types.gen'
+import type { Getter } from 'jotai'
+import { atom, createStore } from 'jotai'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  deploymentRouteAppInstanceIdAtom,
+  deploymentsRouteActiveAtom,
+} from '../../route-state'
+
+type QueryOptions = {
+  enabled?: boolean
+  input?: unknown
+  queryKey?: readonly unknown[]
+  select?: (data: GetAppInstanceResponse) => AppInstance
+}
+
+type InfiniteQueryOptions = QueryOptions & {
+  input?: (pageParam: number) => unknown
+}
+
+type QueryResult = {
+  data?: unknown
+}
+
+const mockQueryResults = vi.hoisted(() => ({
+  current: new Map<string, QueryResult>(),
+}))
+
+vi.mock('jotai-tanstack-query', () => ({
+  atomWithQuery: (createOptions: (get: Getter) => QueryOptions) => atom((get) => {
+    const options = createOptions(get)
+    const queryName = String(options.queryKey?.[0] ?? 'unknown')
+    const queryResult = options.enabled === false
+      ? undefined
+      : mockQueryResults.current.get(queryName)
+    const selectedData = options.select && queryResult?.data
+      ? options.select(queryResult.data as GetAppInstanceResponse)
+      : queryResult?.data
+
+    return {
+      ...options,
+      data: selectedData,
+      isError: false,
+      isFetching: false,
+      isLoading: false,
+      isSuccess: Boolean(selectedData),
+    }
+  }),
+  atomWithInfiniteQuery: (createOptions: (get: Getter) => InfiniteQueryOptions) => atom((get) => {
+    const options = createOptions(get)
+    const queryName = String(options.queryKey?.[0] ?? 'unknown')
+    const queryResult = options.enabled === false
+      ? undefined
+      : mockQueryResults.current.get(queryName)
+
+    return {
+      ...options,
+      data: queryResult?.data,
+      hasNextPage: false,
+      isError: false,
+      isFetching: false,
+      isFetchingNextPage: false,
+      isLoading: false,
+      isSuccess: Boolean(queryResult?.data),
+    }
+  }),
+}))
+
+vi.mock('@/service/client', () => ({
+  consoleQuery: {
+    enterprise: {
+      appInstanceService: {
+        getAppInstance: {
+          queryOptions: (options: QueryOptions) => ({
+            ...options,
+            queryKey: ['getAppInstance', options.input],
+          }),
+        },
+        listAppInstances: {
+          infiniteOptions: (options: InfiniteQueryOptions) => ({
+            ...options,
+            queryKey: ['listAppInstances'],
+          }),
+        },
+      },
+    },
+  },
+}))
+
+async function loadState() {
+  return await import('../state')
+}
+
+function appInstance(overrides: Partial<AppInstance> = {}): AppInstance {
+  return {
+    id: 'app-instance-1',
+    displayName: 'Deployment 1',
+    description: '',
+    sourceAppId: 'source-app-1',
+    createdAt: '2026-01-01T00:00:00.000Z',
+    updatedAt: '2026-01-01T00:00:00.000Z',
+    ...overrides,
+  } as AppInstance
+}
+
+function setListAppInstances(appInstances: AppInstance[]) {
+  mockQueryResults.current.set('listAppInstances', {
+    data: {
+      pages: [
+        {
+          appInstances,
+          pagination: {},
+        } satisfies Partial<ListAppInstancesResponse>,
+      ],
+    },
+  })
+}
+
+describe('deployments nav state', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockQueryResults.current.clear()
+  })
+
+  it('should hide deployment nav items outside deployment routes', async () => {
+    const state = await loadState()
+    const store = createStore()
+
+    expect(store.get(state.deploymentsNavItemsAtom)).toEqual([])
+    expect(store.get(state.deploymentsNavCurrentItemAtom)).toBeUndefined()
+  })
+
+  it('should append the current route item when it is missing from the list query', async () => {
+    const state = await loadState()
+    const store = createStore()
+    store.set(deploymentsRouteActiveAtom, true)
+    store.set(deploymentRouteAppInstanceIdAtom, 'app-instance-1')
+    setListAppInstances([
+      appInstance({
+        id: 'app-instance-2',
+        displayName: 'Deployment 2',
+      }),
+    ])
+    mockQueryResults.current.set('getAppInstance', {
+      data: {
+        appInstance: appInstance(),
+      },
+    })
+
+    expect(store.get(state.deploymentsNavItemsAtom)).toMatchObject([
+      {
+        id: 'app-instance-2',
+        name: 'Deployment 2',
+        link: '/deployments/app-instance-2/overview',
+      },
+      {
+        id: 'app-instance-1',
+        name: 'Deployment 1',
+        link: '/deployments/app-instance-1/overview',
+      },
+    ])
+    expect(store.get(state.deploymentsNavCurrentItemAtom)).toMatchObject({
+      id: 'app-instance-1',
+      name: 'Deployment 1',
+    })
+  })
+
+  it('should use the route id as a fallback current item name', async () => {
+    const state = await loadState()
+    const store = createStore()
+    store.set(deploymentsRouteActiveAtom, true)
+    store.set(deploymentRouteAppInstanceIdAtom, 'app-instance-1')
+    setListAppInstances([])
+
+    expect(store.get(state.deploymentsNavItemsAtom)).toMatchObject([
+      {
+        id: 'app-instance-1',
+        name: 'app-instance-1',
+        link: '/deployments/app-instance-1/overview',
+      },
+    ])
+  })
+})
diff --git a/web/features/deployments/nav/index.tsx b/web/features/deployments/nav/index.tsx
index ce5de6055d3..baa346be77a 100644
--- a/web/features/deployments/nav/index.tsx
+++ b/web/features/deployments/nav/index.tsx
@@ -1,90 +1,21 @@
 'use client'
 
-import type { AppInstance } from '@dify/contracts/enterprise/types.gen'
-import type { NavItem } from '@/app/components/header/nav/nav-selector'
-import { keepPreviousData, useInfiniteQuery, useQuery } from '@tanstack/react-query'
+import { useAtomValue } from 'jotai'
 import { useTranslation } from 'react-i18next'
 import Nav from '@/app/components/header/nav'
-import { useParams, useRouter, useSelectedLayoutSegment } from '@/next/navigation'
-import { consoleQuery } from '@/service/client'
-import { getNextPageParamFromPagination, SOURCE_APPS_PAGE_SIZE } from '../shared/domain/pagination'
-
-function navItemFromListApp(app: AppInstance): NavItem {
-  const id = app.id
-
-  return {
-    id,
-    name: app.displayName,
-    link: `/deployments/${id}/overview`,
-    icon_type: 'emoji',
-    icon: '🚀',
-    icon_background: '#E0EAFF',
-    icon_url: null,
-  }
-}
-
-function navItemFromOverview(instance?: AppInstance, fallbackId?: string): NavItem | undefined {
-  const id = instance?.id ?? fallbackId
-  if (!id)
-    return undefined
-
-  return {
-    id,
-    name: instance ? instance.displayName : id,
-    link: `/deployments/${id}/overview`,
-    icon_type: 'emoji',
-    icon: '🚀',
-    icon_background: '#E0EAFF',
-    icon_url: null,
-  }
-}
+import { useRouter } from '@/next/navigation'
+import {
+  deploymentsNavCurrentItemAtom,
+  deploymentsNavItemsAtom,
+  deploymentsNavListQueryAtom,
+} from './state'
 
 export function DeploymentsNav() {
   const { t } = useTranslation()
   const router = useRouter()
-  const selectedSegment = useSelectedLayoutSegment()
-  const isActive = selectedSegment === 'deployments'
-  const params = useParams<{ appInstanceId?: string }>()
-  const appInstanceId = params?.appInstanceId
-
-  const { data: currentInstance } = useQuery(consoleQuery.enterprise.appInstanceService.getAppInstance.queryOptions({
-    input: {
-      params: {
-        appInstanceId: appInstanceId ?? '',
-      },
-    },
-    enabled: isActive && Boolean(appInstanceId),
-    select: data => data.appInstance,
-  }))
-
-  const listQuery = useInfiniteQuery({
-    ...consoleQuery.enterprise.appInstanceService.listAppInstances.infiniteOptions({
-      input: pageParam => ({
-        query: {
-          pageNumber: Number(pageParam),
-          resultsPerPage: SOURCE_APPS_PAGE_SIZE,
-        },
-      }),
-      getNextPageParam: lastPage => getNextPageParamFromPagination(lastPage.pagination),
-      initialPageParam: 1,
-      placeholderData: keepPreviousData,
-    }),
-    enabled: isActive,
-  })
-  const appNavItems = listQuery.data?.pages.flatMap(page =>
-    page.appInstances.map(navItemFromListApp),
-  ) ?? []
-  const currentNavItem = navItemFromOverview(currentInstance, appInstanceId)
-
-  const navigationItems: NavItem[] = isActive
-    ? currentNavItem && !appNavItems.some(item => item.id === currentNavItem.id)
-      ? [...appNavItems, currentNavItem]
-      : appNavItems
-    : []
-
-  const curNav = appInstanceId
-    ? navigationItems.find(item => item.id === appInstanceId)
-    : undefined
+  const navigationItems = useAtomValue(deploymentsNavItemsAtom)
+  const curNav = useAtomValue(deploymentsNavCurrentItemAtom)
+  const listQuery = useAtomValue(deploymentsNavListQueryAtom)
 
   function handleCreate() {
     router.push('/deployments/create')
diff --git a/web/features/deployments/nav/state.ts b/web/features/deployments/nav/state.ts
new file mode 100644
index 00000000000..558c14a1a8c
--- /dev/null
+++ b/web/features/deployments/nav/state.ts
@@ -0,0 +1,112 @@
+'use client'
+
+import type {
+  AppInstance,
+  GetAppInstanceResponse,
+  ListAppInstancesResponse,
+} from '@dify/contracts/enterprise/types.gen'
+import type { InfiniteData, QueryKey } from '@tanstack/react-query'
+import type { NavItem } from '@/app/components/header/nav/nav-selector'
+import { keepPreviousData, skipToken } from '@tanstack/react-query'
+import { atom } from 'jotai'
+import { atomWithInfiniteQuery, atomWithQuery } from 'jotai-tanstack-query'
+import { consoleQuery } from '@/service/client'
+import {
+  deploymentRouteAppInstanceIdAtom,
+  deploymentsRouteActiveAtom,
+} from '../route-state'
+import { getNextPageParamFromPagination, SOURCE_APPS_PAGE_SIZE } from '../shared/domain/pagination'
+
+function navItemFromListApp(app: AppInstance): NavItem {
+  const id = app.id
+
+  return {
+    id,
+    name: app.displayName,
+    link: `/deployments/${id}/overview`,
+    icon_type: 'emoji',
+    icon: '🚀',
+    icon_background: '#E0EAFF',
+    icon_url: null,
+  }
+}
+
+function navItemFromOverview(instance?: AppInstance, fallbackId?: string): NavItem | undefined {
+  const id = instance?.id ?? fallbackId
+  if (!id)
+    return undefined
+
+  return {
+    id,
+    name: instance ? instance.displayName : id,
+    link: `/deployments/${id}/overview`,
+    icon_type: 'emoji',
+    icon: '🚀',
+    icon_background: '#E0EAFF',
+    icon_url: null,
+  }
+}
+
+const deploymentsNavCurrentInstanceQueryAtom = atomWithQuery((get) => {
+  const appInstanceId = get(deploymentRouteAppInstanceIdAtom)
+  const isActive = get(deploymentsRouteActiveAtom)
+
+  return consoleQuery.enterprise.appInstanceService.getAppInstance.queryOptions({
+    input: appInstanceId
+      ? {
+          params: {
+            appInstanceId,
+          },
+        }
+      : skipToken,
+    enabled: isActive && Boolean(appInstanceId),
+    select: (data: GetAppInstanceResponse) => data.appInstance,
+  })
+})
+
+export const deploymentsNavListQueryAtom = atomWithInfiniteQuery<
+  ListAppInstancesResponse,
+  Error,
+  InfiniteData<ListAppInstancesResponse>,
+  QueryKey,
+  number
+>((get) => {
+  const isActive = get(deploymentsRouteActiveAtom)
+
+  return consoleQuery.enterprise.appInstanceService.listAppInstances.infiniteOptions({
+    input: pageParam => ({
+      query: {
+        pageNumber: Number(pageParam),
+        resultsPerPage: SOURCE_APPS_PAGE_SIZE,
+      },
+    }),
+    getNextPageParam: lastPage => getNextPageParamFromPagination(lastPage.pagination),
+    initialPageParam: 1,
+    placeholderData: keepPreviousData,
+    enabled: isActive,
+  })
+})
+
+export const deploymentsNavItemsAtom = atom((get): NavItem[] => {
+  if (!get(deploymentsRouteActiveAtom))
+    return []
+
+  const appInstanceId = get(deploymentRouteAppInstanceIdAtom)
+  const currentInstance = get(deploymentsNavCurrentInstanceQueryAtom).data
+  const appNavItems = get(deploymentsNavListQueryAtom).data?.pages.flatMap(page =>
+    page.appInstances.map(navItemFromListApp),
+  ) ?? []
+  const currentNavItem = navItemFromOverview(currentInstance, appInstanceId)
+
+  return currentNavItem && !appNavItems.some(item => item.id === currentNavItem.id)
+    ? [...appNavItems, currentNavItem]
+    : appNavItems
+})
+
+export const deploymentsNavCurrentItemAtom = atom((get) => {
+  const appInstanceId = get(deploymentRouteAppInstanceIdAtom)
+  if (!appInstanceId)
+    return undefined
+
+  return get(deploymentsNavItemsAtom).find(item => item.id === appInstanceId)
+})
diff --git a/web/features/deployments/route-state-hydrator.tsx b/web/features/deployments/route-state-hydrator.tsx
new file mode 100644
index 00000000000..e2c6fefd44f
--- /dev/null
+++ b/web/features/deployments/route-state-hydrator.tsx
@@ -0,0 +1,35 @@
+'use client'
+
+import { useSetAtom } from 'jotai'
+import { useHydrateAtoms } from 'jotai/react/utils'
+import { useEffect } from 'react'
+import { useParams } from '@/next/navigation'
+import {
+  deploymentRouteAppInstanceIdAtom,
+  deploymentsRouteActiveAtom,
+} from './route-state'
+
+function routeAppInstanceId(params?: { appInstanceId?: string | string[] }) {
+  return typeof params?.appInstanceId === 'string' ? params.appInstanceId : undefined
+}
+
+export function DeploymentsRouteStateHydrator() {
+  const params = useParams<{ appInstanceId?: string | string[] }>()
+  const appInstanceId = routeAppInstanceId(params)
+  const setDeploymentsRouteActive = useSetAtom(deploymentsRouteActiveAtom)
+  const setRouteAppInstanceId = useSetAtom(deploymentRouteAppInstanceIdAtom)
+
+  useHydrateAtoms([
+    [deploymentsRouteActiveAtom, true],
+    [deploymentRouteAppInstanceIdAtom, appInstanceId],
+  ] as const, { dangerouslyForceHydrate: true })
+
+  useEffect(() => {
+    return () => {
+      setDeploymentsRouteActive(false)
+      setRouteAppInstanceId(undefined)
+    }
+  }, [setDeploymentsRouteActive, setRouteAppInstanceId])
+
+  return null
+}
diff --git a/web/features/deployments/route-state.ts b/web/features/deployments/route-state.ts
new file mode 100644
index 00000000000..8e1d7d5fead
--- /dev/null
+++ b/web/features/deployments/route-state.ts
@@ -0,0 +1,6 @@
+'use client'
+
+import { atom } from 'jotai'
+
+export const deploymentsRouteActiveAtom = atom(false)
+export const deploymentRouteAppInstanceIdAtom = atom<string | undefined>(undefined)
diff --git a/web/features/deployments/shared/domain/feature-flags.ts b/web/features/deployments/shared/domain/feature-flags.ts
new file mode 100644
index 00000000000..791ca6cdd73
--- /dev/null
+++ b/web/features/deployments/shared/domain/feature-flags.ts
@@ -0,0 +1,2 @@
+// Temporary kill switch for deployment DSL import flows. Flip to true to restore them.
+export const isDeploymentDslImportEnabled = false
diff --git a/web/hooks/use-credential-permissions.spec.ts b/web/hooks/use-credential-permissions.spec.ts
new file mode 100644
index 00000000000..0f2cd554422
--- /dev/null
+++ b/web/hooks/use-credential-permissions.spec.ts
@@ -0,0 +1,53 @@
+import { renderHook } from '@testing-library/react'
+import { useCredentialPermissions } from './use-credential-permissions'
+
+let mockWorkspacePermissionKeys: string[] | null = []
+
+vi.mock('@/context/app-context', () => ({
+  useSelector: (selector: (state: { workspacePermissionKeys: string[] | null }) => unknown) => selector({
+    workspacePermissionKeys: mockWorkspacePermissionKeys,
+  }),
+}))
+
+describe('useCredentialPermissions', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockWorkspacePermissionKeys = []
+  })
+
+  it('should expose separate use, create, and manage credential capabilities', () => {
+    mockWorkspacePermissionKeys = ['credential.use', 'credential.create', 'credential.manage']
+
+    const { result } = renderHook(() => useCredentialPermissions())
+
+    expect(result.current).toEqual({
+      canUseCredential: true,
+      canCreateCredential: true,
+      canManageCredential: true,
+    })
+  })
+
+  it('should not grant credential use from create or manage permissions', () => {
+    mockWorkspacePermissionKeys = ['credential.create', 'credential.manage']
+
+    const { result } = renderHook(() => useCredentialPermissions())
+
+    expect(result.current).toEqual({
+      canUseCredential: false,
+      canCreateCredential: true,
+      canManageCredential: true,
+    })
+  })
+
+  it('should handle missing workspace permissions as no credential capabilities', () => {
+    mockWorkspacePermissionKeys = null
+
+    const { result } = renderHook(() => useCredentialPermissions())
+
+    expect(result.current).toEqual({
+      canUseCredential: false,
+      canCreateCredential: false,
+      canManageCredential: false,
+    })
+  })
+})
diff --git a/web/hooks/use-credential-permissions.ts b/web/hooks/use-credential-permissions.ts
index 5766e7282b9..3f99c5e3345 100644
--- a/web/hooks/use-credential-permissions.ts
+++ b/web/hooks/use-credential-permissions.ts
@@ -5,7 +5,8 @@ export const useCredentialPermissions = () => {
   const workspacePermissionKeys = useAppContextSelector(state => state.workspacePermissionKeys)
 
   return {
-    canUseCredential: hasPermission(workspacePermissionKeys, ['credential.use', 'credential.manage']),
+    canUseCredential: hasPermission(workspacePermissionKeys, 'credential.use'),
+    canCreateCredential: hasPermission(workspacePermissionKeys, 'credential.create'),
     canManageCredential: hasPermission(workspacePermissionKeys, 'credential.manage'),
   }
 }
diff --git a/web/hooks/use-import-dsl.ts b/web/hooks/use-import-dsl.ts
index 97a1f9e93f2..0f7004048fd 100644
--- a/web/hooks/use-import-dsl.ts
+++ b/web/hooks/use-import-dsl.ts
@@ -4,6 +4,7 @@ import type {
 } from '@/models/app'
 import type { AppIconType } from '@/types/app'
 import { toast } from '@langgenius/dify-ui/toast'
+import { useSuspenseQuery } from '@tanstack/react-query'
 import {
   useCallback,
   useRef,
@@ -12,6 +13,7 @@ import {
 import { useTranslation } from 'react-i18next'
 import { useSetNeedRefreshAppList } from '@/app/components/apps/storage'
 import { usePluginDependencies } from '@/app/components/workflow/plugin-dependency/hooks'
+import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import { DSLImportStatus } from '@/models/app'
 import { useRouter } from '@/next/navigation'
 import {
@@ -42,6 +44,8 @@ export const useImportDSL = () => {
   const { handleCheckPluginDependencies } = usePluginDependencies()
   const { push } = useRouter()
   const invalidateAppList = useInvalidateAppList()
+  const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
+  const isRbacEnabled = systemFeatures.rbac_enabled
   const [versions, setVersions] = useState<{ importedVersion: string, systemVersion: string }>()
   const importIdRef = useRef<string>('')
   const setNeedRefresh = useSetNeedRefreshAppList()
@@ -91,7 +95,7 @@ export const useImportDSL = () => {
         setNeedRefresh('1')
         invalidateAppList()
         await handleCheckPluginDependencies(app_id)
-        getRedirection({ id: app_id, mode: app_mode, permission_keys }, push)
+        getRedirection({ id: app_id, mode: app_mode, permission_keys }, push, { isRbacEnabled })
       }
       else if (status === DSLImportStatus.PENDING) {
         setVersions({
@@ -113,7 +117,7 @@ export const useImportDSL = () => {
     finally {
       setIsFetching(false)
     }
-  }, [isFetching, t, handleCheckPluginDependencies, push, setNeedRefresh, invalidateAppList])
+  }, [isFetching, t, handleCheckPluginDependencies, isRbacEnabled, push, setNeedRefresh, invalidateAppList])
 
   const handleImportDSLConfirm = useCallback(async (
     {
@@ -142,7 +146,7 @@ export const useImportDSL = () => {
         await handleCheckPluginDependencies(app_id)
         setNeedRefresh('1')
         invalidateAppList()
-        getRedirection({ id: app_id, mode: app_mode, permission_keys }, push)
+        getRedirection({ id: app_id, mode: app_mode, permission_keys }, push, { isRbacEnabled })
       }
       else if (status === DSLImportStatus.FAILED) {
         toast.error(t('newApp.appCreateFailed', { ns: 'app' }))
@@ -156,7 +160,7 @@ export const useImportDSL = () => {
     finally {
       setIsFetching(false)
     }
-  }, [isFetching, t, handleCheckPluginDependencies, setNeedRefresh, push, invalidateAppList])
+  }, [isFetching, t, handleCheckPluginDependencies, isRbacEnabled, setNeedRefresh, push, invalidateAppList])
 
   return {
     handleImportDSL,
diff --git a/web/i18n/ar-TN/agent-v-2.json b/web/i18n/ar-TN/agent-v-2.json
index 0345d06d865..5cc80c512d8 100644
--- a/web/i18n/ar-TN/agent-v-2.json
+++ b/web/i18n/ar-TN/agent-v-2.json
@@ -290,6 +290,7 @@
   "agentDetail.monitoring.dateRangeLabel": "نطاق التاريخ",
   "agentDetail.monitoring.description": "تتبّع نشاط وتكلفة وجودة تفاعل الوكيل القابل لإعادة الاستخدام عبر سير العمل.",
   "agentDetail.monitoring.learnMore": "اعرف المزيد",
+  "agentDetail.monitoring.loadFailed": "تعذر تحميل بيانات المراقبة",
   "agentDetail.monitoring.metrics.activeUsers.explanation": "المستخدمون النهائيون الفريدون الذين شغّلوا سير العمل باستخدام هذا الوكيل.",
   "agentDetail.monitoring.metrics.activeUsers.title": "المستخدمون النشطون",
   "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "عدد التواصل المستمر بين المستخدم والوكيل لنقطة الوصول هذه.",
@@ -328,15 +329,17 @@
   "agentDetail.type": "وكيل",
   "agentDetail.versionHistory.active": "نشط",
   "agentDetail.versionHistory.empty": "لا توجد إصدارات بعد",
+  "agentDetail.versionHistory.exitVersions": "الخروج من الإصدارات",
   "agentDetail.versionHistory.filter": "تصفية الإصدارات",
+  "agentDetail.versionHistory.restore": "استعادة",
   "agentDetail.versionHistory.versionName": "الإصدار {{version}}",
+  "agentDetail.versionHistory.viewOnly": "عرض فقط",
   "roster.createAgent": "إنشاء وكيل",
   "roster.createAgentOptions": "خيارات إنشاء الوكيل",
   "roster.createDialog.description": "أنشئ وكيلاً قابلاً لإعادة الاستخدام في Roster مساحة العمل هذه.",
   "roster.createDialog.title": "إنشاء وكيل",
   "roster.createForm.changeIcon": "تغيير أيقونة الوكيل",
   "roster.createForm.descriptionLabel": "الوصف",
-  "roster.createForm.descriptionOptional": "(اختياري)",
   "roster.createForm.descriptionPlaceholder": "مثلاً يجمع المصادر حول موضوع ويلخص النتائج الرئيسية",
   "roster.createForm.nameLabel": "الاسم",
   "roster.createForm.namePlaceholder": "مثلاً Max",
@@ -350,7 +353,6 @@
   "roster.deleteDialog.title": "حذف {{name}}؟",
   "roster.deleteFailed": "فشل حذف الوكيل.",
   "roster.deleteSuccess": "تم حذف الوكيل.",
-  "roster.duplicateFailed": "فشل نسخ الوكيل.",
   "roster.duplicateSuccess": "تم نسخ الوكيل.",
   "roster.editAgent": "تعديل {{name}}",
   "roster.editDialog.description": "حدّث اسم Roster والوصف والدور لهذا الوكيل.",
diff --git a/web/i18n/ar-TN/app.json b/web/i18n/ar-TN/app.json
index 3a295fe102a..a019ffcedad 100644
--- a/web/i18n/ar-TN/app.json
+++ b/web/i18n/ar-TN/app.json
@@ -226,6 +226,7 @@
   "newAppFromTemplate.sidebar.Workflow": "سير العمل",
   "newAppFromTemplate.sidebar.Writing": "كتابة",
   "noAccessPermission": "لا يوجد إذن للوصول إلى تطبيق الويب",
+  "noAccessResourcePermission": "لا يوجد إذن للوصول إلى هذا المورد",
   "noUserInputNode": "عقدة إدخال المستخدم مفقودة",
   "notPublishedYet": "التطبيق لم ينشر بعد",
   "openInExplore": "فتح في الاستكشاف",
diff --git a/web/i18n/ar-TN/common.json b/web/i18n/ar-TN/common.json
index f28682d7171..350d3b10788 100644
--- a/web/i18n/ar-TN/common.json
+++ b/web/i18n/ar-TN/common.json
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "نموذج تحويل النص إلى كلام",
   "modelProvider.ttsModel.tip": "تعيين النموذج الافتراضي لإدخال تحويل النص إلى كلام في المحادثة.",
   "modelProvider.upgradeForLoadBalancing": "قم بترقية خطتك لتمكين موازنة التحميل.",
+  "navigation.skipToMain": "الانتقال إلى المحتوى الرئيسي",
   "noData": "لا توجد بيانات",
   "operation.add": "إضافة",
   "operation.added": "تمت الإضافة",
diff --git a/web/i18n/ar-TN/deployments.json b/web/i18n/ar-TN/deployments.json
index f4185138d19..9dd6ec9ebbf 100644
--- a/web/i18n/ar-TN/deployments.json
+++ b/web/i18n/ar-TN/deployments.json
@@ -613,6 +613,7 @@
   "versions.releaseDescriptionLabel": "الوصف",
   "versions.releaseDescriptionPlaceholder": "صف هذا الإصدار",
   "versions.releaseHistory": "سجل الإصدارات",
+  "versions.releaseNameConflict": "يوجد بالفعل إصدار بهذا الاسم. اختر اسمًا آخر.",
   "versions.releaseNameLabel": "اسم الإصدار",
   "versions.releaseNamePlaceholder": "اسم الإصدار",
   "versions.releaseNameRequired": "أدخل اسم الإصدار.",
diff --git a/web/i18n/de-DE/agent-v-2.json b/web/i18n/de-DE/agent-v-2.json
index 6a346017576..71b4f9c8bb7 100644
--- a/web/i18n/de-DE/agent-v-2.json
+++ b/web/i18n/de-DE/agent-v-2.json
@@ -290,6 +290,7 @@
   "agentDetail.monitoring.dateRangeLabel": "Datumsbereich",
   "agentDetail.monitoring.description": "Verfolgen Sie Aktivität, Kosten und Interaktionsqualität des wiederverwendbaren Agenten über Workflows hinweg.",
   "agentDetail.monitoring.learnMore": "Mehr erfahren",
+  "agentDetail.monitoring.loadFailed": "Monitoring-Daten konnten nicht geladen werden",
   "agentDetail.monitoring.metrics.activeUsers.explanation": "Eindeutige Endbenutzer, die Workflows mit diesem Agenten ausgelöst haben.",
   "agentDetail.monitoring.metrics.activeUsers.title": "Aktive Benutzer",
   "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "Anzahl der durchgehenden Benutzer-Agent-Kommunikationen für diesen Zugangspunkt.",
@@ -328,15 +329,17 @@
   "agentDetail.type": "AGENT",
   "agentDetail.versionHistory.active": "Aktiv",
   "agentDetail.versionHistory.empty": "Noch keine Versionen",
+  "agentDetail.versionHistory.exitVersions": "Versionen verlassen",
   "agentDetail.versionHistory.filter": "Versionen filtern",
+  "agentDetail.versionHistory.restore": "Wiederherstellen",
   "agentDetail.versionHistory.versionName": "Version {{version}}",
+  "agentDetail.versionHistory.viewOnly": "Nur anzeigen",
   "roster.createAgent": "Agent erstellen",
   "roster.createAgentOptions": "Optionen zum Erstellen eines Agenten",
   "roster.createDialog.description": "Erstellen Sie einen wiederverwendbaren Agenten im Roster dieses Workspaces.",
   "roster.createDialog.title": "Agent erstellen",
   "roster.createForm.changeIcon": "Agenten-Symbol ändern",
   "roster.createForm.descriptionLabel": "Beschreibung",
-  "roster.createForm.descriptionOptional": "(optional)",
   "roster.createForm.descriptionPlaceholder": "z. B. Sammelt Quellen zu einem Thema und fasst die wichtigsten Erkenntnisse zusammen",
   "roster.createForm.nameLabel": "Name",
   "roster.createForm.namePlaceholder": "z. B. Max",
@@ -350,7 +353,6 @@
   "roster.deleteDialog.title": "{{name}} löschen?",
   "roster.deleteFailed": "Agent konnte nicht gelöscht werden.",
   "roster.deleteSuccess": "Agent gelöscht.",
-  "roster.duplicateFailed": "Agent konnte nicht dupliziert werden.",
   "roster.duplicateSuccess": "Agent dupliziert.",
   "roster.editAgent": "{{name}} bearbeiten",
   "roster.editDialog.description": "Aktualisieren Sie Roster-Name, Beschreibung und Rolle dieses Agenten.",
diff --git a/web/i18n/de-DE/app.json b/web/i18n/de-DE/app.json
index 08d7b86f085..011c2e6ca39 100644
--- a/web/i18n/de-DE/app.json
+++ b/web/i18n/de-DE/app.json
@@ -226,6 +226,7 @@
   "newAppFromTemplate.sidebar.Workflow": "Arbeitsablauf",
   "newAppFromTemplate.sidebar.Writing": "Schrift",
   "noAccessPermission": "Keine Berechtigung zum Zugriff auf die Webanwendung",
+  "noAccessResourcePermission": "Keine Berechtigung zum Zugriff auf diese Ressource",
   "noUserInputNode": "Fehlender Benutzereingabeknoten",
   "notPublishedYet": "App ist noch nicht veröffentlicht",
   "openInExplore": "In Explore öffnen",
diff --git a/web/i18n/de-DE/common.json b/web/i18n/de-DE/common.json
index c4744db342e..84c57d8523c 100644
--- a/web/i18n/de-DE/common.json
+++ b/web/i18n/de-DE/common.json
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "Text-zu-Sprache-Modell",
   "modelProvider.ttsModel.tip": "Legen Sie das Standardmodell für die Text-zu-Sprache-Eingabe in Konversationen fest.",
   "modelProvider.upgradeForLoadBalancing": "Aktualisieren Sie Ihren Plan, um den Lastenausgleich zu aktivieren.",
+  "navigation.skipToMain": "Zum Hauptinhalt springen",
   "noData": "Keine Daten",
   "operation.add": "Hinzufügen",
   "operation.added": "Hinzugefügt",
diff --git a/web/i18n/de-DE/deployments.json b/web/i18n/de-DE/deployments.json
index 57c49caba49..88130933644 100644
--- a/web/i18n/de-DE/deployments.json
+++ b/web/i18n/de-DE/deployments.json
@@ -613,6 +613,7 @@
   "versions.releaseDescriptionLabel": "Beschreibung",
   "versions.releaseDescriptionPlaceholder": "Beschreiben Sie dieses Release",
   "versions.releaseHistory": "Release-Historie",
+  "versions.releaseNameConflict": "Ein Release mit diesem Namen existiert bereits. Wählen Sie einen anderen Namen.",
   "versions.releaseNameLabel": "Release-Name",
   "versions.releaseNamePlaceholder": "Release-Name",
   "versions.releaseNameRequired": "Geben Sie einen Release-Namen ein.",
diff --git a/web/i18n/en-US/agent-v-2.json b/web/i18n/en-US/agent-v-2.json
index 6ce81aa591e..3e75fd784a3 100644
--- a/web/i18n/en-US/agent-v-2.json
+++ b/web/i18n/en-US/agent-v-2.json
@@ -290,6 +290,7 @@
   "agentDetail.monitoring.dateRangeLabel": "Date range",
   "agentDetail.monitoring.description": "Track the reusable agent activity, cost, and interaction quality across workflows.",
   "agentDetail.monitoring.learnMore": "Learn more",
+  "agentDetail.monitoring.loadFailed": "Failed to load monitoring data",
   "agentDetail.monitoring.metrics.activeUsers.explanation": "Unique end users who triggered workflows using this agent.",
   "agentDetail.monitoring.metrics.activeUsers.title": "Active Users",
   "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "Continuous user-agent communication count for this access point.",
@@ -328,15 +329,17 @@
   "agentDetail.type": "AGENT",
   "agentDetail.versionHistory.active": "Active",
   "agentDetail.versionHistory.empty": "No versions yet",
+  "agentDetail.versionHistory.exitVersions": "Exit versions",
   "agentDetail.versionHistory.filter": "Filter versions",
+  "agentDetail.versionHistory.restore": "Restore",
   "agentDetail.versionHistory.versionName": "Version {{version}}",
+  "agentDetail.versionHistory.viewOnly": "View Only",
   "roster.createAgent": "Create agent",
   "roster.createAgentOptions": "Create agent options",
   "roster.createDialog.description": "Create a reusable agent in this workspace roster.",
   "roster.createDialog.title": "Create agent",
   "roster.createForm.changeIcon": "Change agent icon",
   "roster.createForm.descriptionLabel": "Description",
-  "roster.createForm.descriptionOptional": "(optional)",
   "roster.createForm.descriptionPlaceholder": "e.g. Gathers sources on a topic and summarizes the key findings",
   "roster.createForm.nameLabel": "Name",
   "roster.createForm.namePlaceholder": "e.g. Max",
@@ -350,7 +353,9 @@
   "roster.deleteDialog.title": "Delete {{name}}?",
   "roster.deleteFailed": "Failed to delete agent.",
   "roster.deleteSuccess": "Agent deleted.",
-  "roster.duplicateFailed": "Failed to duplicate agent.",
+  "roster.duplicateDialog.description": "Create a copy of {{name}} and customize its roster identity.",
+  "roster.duplicateDialog.title": "Duplicate agent",
+  "roster.duplicateForm.changeIcon": "Change duplicate icon for {{name}}",
   "roster.duplicateSuccess": "Agent duplicated.",
   "roster.editAgent": "Edit {{name}}",
   "roster.editDialog.description": "Update the roster name, description, and role for this agent.",
diff --git a/web/i18n/en-US/app.json b/web/i18n/en-US/app.json
index d10dfebaf3a..5ca4edbfa39 100644
--- a/web/i18n/en-US/app.json
+++ b/web/i18n/en-US/app.json
@@ -226,6 +226,7 @@
   "newAppFromTemplate.sidebar.Workflow": "Workflow",
   "newAppFromTemplate.sidebar.Writing": "Writing",
   "noAccessPermission": "No permission to access web app",
+  "noAccessResourcePermission": "No permission to access this resource",
   "noUserInputNode": "Missing user input node",
   "notPublishedYet": "App is not published yet",
   "openInExplore": "Open in Explore",
diff --git a/web/i18n/en-US/common.json b/web/i18n/en-US/common.json
index a58816d826a..ded6c07e1dc 100644
--- a/web/i18n/en-US/common.json
+++ b/web/i18n/en-US/common.json
@@ -545,6 +545,7 @@
   "modelProvider.ttsModel.key": "Text-to-Speech Model",
   "modelProvider.ttsModel.tip": "Set the default model for text-to-speech input in conversation.",
   "modelProvider.upgradeForLoadBalancing": "Upgrade your plan to enable Load Balancing.",
+  "navigation.skipToMain": "Skip to main content",
   "noData": "No data",
   "operation.add": "Add",
   "operation.added": "Added",
diff --git a/web/i18n/en-US/deployments.json b/web/i18n/en-US/deployments.json
index c557989ea42..365baacca5c 100644
--- a/web/i18n/en-US/deployments.json
+++ b/web/i18n/en-US/deployments.json
@@ -613,6 +613,7 @@
   "versions.releaseDescriptionLabel": "Description",
   "versions.releaseDescriptionPlaceholder": "Describe this release",
   "versions.releaseHistory": "Release history",
+  "versions.releaseNameConflict": "A release with this name already exists. Choose another name.",
   "versions.releaseNameLabel": "Release Name",
   "versions.releaseNamePlaceholder": "Release Name",
   "versions.releaseNameRequired": "Enter a release name.",
diff --git a/web/i18n/en-US/permission-keys.json b/web/i18n/en-US/permission-keys.json
index 8bd6ac7fd15..a5db8ef638c 100644
--- a/web/i18n/en-US/permission-keys.json
+++ b/web/i18n/en-US/permission-keys.json
@@ -16,8 +16,9 @@
   "billing.manage": "Change subscription plans",
   "billing.subscription.manage": "Manage billing and subscriptions in the billing portal",
   "billing.view": "Access Billing settings",
-  "credential.manage": "Manage credentials",
-  "credential.use": "Use credentials",
+  "credential.create": "Add credentials",
+  "credential.manage": "Edit and delete credentials",
+  "credential.use": "View and use credentials",
   "customization.manage": "Manage customization",
   "data_source.manage": "Manage data source configuration",
   "dataset.access_config": "Configure knowledge base access permissions",
diff --git a/web/i18n/en-US/permission.json b/web/i18n/en-US/permission.json
index fed93cc71b9..ddcce91e5b4 100644
--- a/web/i18n/en-US/permission.json
+++ b/web/i18n/en-US/permission.json
@@ -46,6 +46,7 @@
   "group.credential": "Credentials",
   "group.dataset": "Knowledge bases",
   "group.dataset_acl": "Knowledge base access permissions",
+  "group.integration": "Integrations",
   "group.plugin": "Plugins",
   "group.tool_mcp": "Tools and MCP",
   "group.workspace": "Workspace",
diff --git a/web/i18n/es-ES/agent-v-2.json b/web/i18n/es-ES/agent-v-2.json
index fb23b2a523e..3e74421f666 100644
--- a/web/i18n/es-ES/agent-v-2.json
+++ b/web/i18n/es-ES/agent-v-2.json
@@ -290,6 +290,7 @@
   "agentDetail.monitoring.dateRangeLabel": "Rango de fechas",
   "agentDetail.monitoring.description": "Realiza un seguimiento de la actividad, el coste y la calidad de interacción del agente reutilizable en todos los flujos de trabajo.",
   "agentDetail.monitoring.learnMore": "Más información",
+  "agentDetail.monitoring.loadFailed": "No se pudieron cargar los datos de monitoreo",
   "agentDetail.monitoring.metrics.activeUsers.explanation": "Usuarios finales únicos que activaron flujos de trabajo usando este agente.",
   "agentDetail.monitoring.metrics.activeUsers.title": "Usuarios activos",
   "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "Recuento continuo de comunicación entre usuario y agente para este punto de acceso.",
@@ -328,15 +329,17 @@
   "agentDetail.type": "AGENTE",
   "agentDetail.versionHistory.active": "Activa",
   "agentDetail.versionHistory.empty": "Aún no hay versiones",
+  "agentDetail.versionHistory.exitVersions": "Salir de versiones",
   "agentDetail.versionHistory.filter": "Filtrar versiones",
+  "agentDetail.versionHistory.restore": "Restaurar",
   "agentDetail.versionHistory.versionName": "Versión {{version}}",
+  "agentDetail.versionHistory.viewOnly": "Solo lectura",
   "roster.createAgent": "Crear agente",
   "roster.createAgentOptions": "Opciones para crear agente",
   "roster.createDialog.description": "Crea un agente reutilizable en el roster de este workspace.",
   "roster.createDialog.title": "Crear agente",
   "roster.createForm.changeIcon": "Cambiar icono del agente",
   "roster.createForm.descriptionLabel": "Descripción",
-  "roster.createForm.descriptionOptional": "(opcional)",
   "roster.createForm.descriptionPlaceholder": "p. ej. Reúne fuentes sobre un tema y resume los hallazgos clave",
   "roster.createForm.nameLabel": "Nombre",
   "roster.createForm.namePlaceholder": "p. ej. Max",
@@ -350,7 +353,6 @@
   "roster.deleteDialog.title": "¿Eliminar {{name}}?",
   "roster.deleteFailed": "Error al eliminar el agente.",
   "roster.deleteSuccess": "Agente eliminado.",
-  "roster.duplicateFailed": "Error al duplicar el agente.",
   "roster.duplicateSuccess": "Agente duplicado.",
   "roster.editAgent": "Editar {{name}}",
   "roster.editDialog.description": "Actualiza el nombre, la descripción y el rol del roster para este agente.",
diff --git a/web/i18n/es-ES/app.json b/web/i18n/es-ES/app.json
index 2fd93664c4d..e89aea906ee 100644
--- a/web/i18n/es-ES/app.json
+++ b/web/i18n/es-ES/app.json
@@ -226,6 +226,7 @@
   "newAppFromTemplate.sidebar.Workflow": "Flujo de trabajo",
   "newAppFromTemplate.sidebar.Writing": "Escritura",
   "noAccessPermission": "No se permite el acceso a la aplicación web",
+  "noAccessResourcePermission": "No tienes permiso para acceder a este recurso",
   "noUserInputNode": "Nodo de entrada de usuario faltante",
   "notPublishedYet": "La aplicación aún no está publicada",
   "openInExplore": "Abrir en Explorar",
diff --git a/web/i18n/es-ES/common.json b/web/i18n/es-ES/common.json
index f915fd3faf2..6ce03dc555e 100644
--- a/web/i18n/es-ES/common.json
+++ b/web/i18n/es-ES/common.json
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "Modelo de Texto a Voz",
   "modelProvider.ttsModel.tip": "Establece el modelo predeterminado para la entrada de texto a voz en la conversación.",
   "modelProvider.upgradeForLoadBalancing": "Actualiza tu plan para habilitar el Balanceo de Carga.",
+  "navigation.skipToMain": "Saltar al contenido principal",
   "noData": "Sin datos",
   "operation.add": "Agregar",
   "operation.added": "Agregado",
diff --git a/web/i18n/es-ES/deployments.json b/web/i18n/es-ES/deployments.json
index 5ca6cec7121..8f8f6c200a2 100644
--- a/web/i18n/es-ES/deployments.json
+++ b/web/i18n/es-ES/deployments.json
@@ -613,6 +613,7 @@
   "versions.releaseDescriptionLabel": "Descripción",
   "versions.releaseDescriptionPlaceholder": "Describe esta versión",
   "versions.releaseHistory": "Historial de versiones",
+  "versions.releaseNameConflict": "Ya existe una versión con este nombre. Elige otro nombre.",
   "versions.releaseNameLabel": "Nombre de la versión",
   "versions.releaseNamePlaceholder": "Nombre de la versión",
   "versions.releaseNameRequired": "Introduce un nombre de versión.",
diff --git a/web/i18n/fa-IR/agent-v-2.json b/web/i18n/fa-IR/agent-v-2.json
index 45b5891dc26..1913710394c 100644
--- a/web/i18n/fa-IR/agent-v-2.json
+++ b/web/i18n/fa-IR/agent-v-2.json
@@ -290,6 +290,7 @@
   "agentDetail.monitoring.dateRangeLabel": "بازه تاریخ",
   "agentDetail.monitoring.description": "فعالیت، هزینه و کیفیت تعامل عامل قابل استفاده مجدد را در گردش‌های کار دنبال کنید.",
   "agentDetail.monitoring.learnMore": "اطلاعات بیشتر",
+  "agentDetail.monitoring.loadFailed": "بارگیری داده‌های پایش ناموفق بود",
   "agentDetail.monitoring.metrics.activeUsers.explanation": "کاربران نهایی منحصربه‌فردی که با استفاده از این عامل گردش کارها را راه‌اندازی کرده‌اند.",
   "agentDetail.monitoring.metrics.activeUsers.title": "کاربران فعال",
   "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "تعداد ارتباط مداوم کاربر-عامل برای این نقطه دسترسی.",
@@ -328,15 +329,17 @@
   "agentDetail.type": "عامل",
   "agentDetail.versionHistory.active": "فعال",
   "agentDetail.versionHistory.empty": "هنوز نسخه‌ای وجود ندارد",
+  "agentDetail.versionHistory.exitVersions": "خروج از نسخه‌ها",
   "agentDetail.versionHistory.filter": "فیلتر نسخه‌ها",
+  "agentDetail.versionHistory.restore": "بازیابی",
   "agentDetail.versionHistory.versionName": "نسخه {{version}}",
+  "agentDetail.versionHistory.viewOnly": "فقط نمایش",
   "roster.createAgent": "ایجاد عامل",
   "roster.createAgentOptions": "گزینه‌های ایجاد عامل",
   "roster.createDialog.description": "یک عامل قابل استفاده مجدد در Roster این فضای کاری ایجاد کنید.",
   "roster.createDialog.title": "ایجاد عامل",
   "roster.createForm.changeIcon": "تغییر آیکون عامل",
   "roster.createForm.descriptionLabel": "توضیحات",
-  "roster.createForm.descriptionOptional": "(اختیاری)",
   "roster.createForm.descriptionPlaceholder": "مثلاً منابعی درباره یک موضوع جمع‌آوری می‌کند و یافته‌های کلیدی را خلاصه می‌کند",
   "roster.createForm.nameLabel": "نام",
   "roster.createForm.namePlaceholder": "مثلاً Max",
@@ -350,7 +353,6 @@
   "roster.deleteDialog.title": "حذف {{name}}؟",
   "roster.deleteFailed": "حذف عامل ناموفق بود.",
   "roster.deleteSuccess": "عامل حذف شد.",
-  "roster.duplicateFailed": "تکثیر عامل ناموفق بود.",
   "roster.duplicateSuccess": "عامل تکثیر شد.",
   "roster.editAgent": "ویرایش {{name}}",
   "roster.editDialog.description": "نام، توضیحات و نقش Roster این عامل را به‌روزرسانی کنید.",
diff --git a/web/i18n/fa-IR/app.json b/web/i18n/fa-IR/app.json
index c69a52adebe..0263f42ebdb 100644
--- a/web/i18n/fa-IR/app.json
+++ b/web/i18n/fa-IR/app.json
@@ -226,6 +226,7 @@
   "newAppFromTemplate.sidebar.Workflow": "گردش",
   "newAppFromTemplate.sidebar.Writing": "نوشتن",
   "noAccessPermission": "دسترسی به برنامه وب مجاز نیست",
+  "noAccessResourcePermission": "مجوز دسترسی به این منبع را ندارید",
   "noUserInputNode": "ورودی کاربر پیدا نشد",
   "notPublishedYet": "اپ هنوز منتشر نشده است",
   "openInExplore": "باز کردن در کاوش",
diff --git a/web/i18n/fa-IR/common.json b/web/i18n/fa-IR/common.json
index 10f74e2afc4..5ed801fe2a2 100644
--- a/web/i18n/fa-IR/common.json
+++ b/web/i18n/fa-IR/common.json
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "مدل تبدیل متن به گفتار",
   "modelProvider.ttsModel.tip": "مدل پیش‌فرض را برای ورودی متن به گفتار در مکالمه تنظیم کنید.",
   "modelProvider.upgradeForLoadBalancing": "برای فعال کردن تعادل بار، طرح خود را ارتقا دهید.",
+  "navigation.skipToMain": "پرش به محتوای اصلی",
   "noData": "بدون داده",
   "operation.add": "افزودن",
   "operation.added": "اضافه شد",
diff --git a/web/i18n/fa-IR/deployments.json b/web/i18n/fa-IR/deployments.json
index 263949a3b49..1cd4ec7aba2 100644
--- a/web/i18n/fa-IR/deployments.json
+++ b/web/i18n/fa-IR/deployments.json
@@ -613,6 +613,7 @@
   "versions.releaseDescriptionLabel": "توضیحات",
   "versions.releaseDescriptionPlaceholder": "این نسخه را توصیف کنید",
   "versions.releaseHistory": "تاریخچه نسخه",
+  "versions.releaseNameConflict": "نسخه‌ای با این نام از قبل وجود دارد. نام دیگری انتخاب کنید.",
   "versions.releaseNameLabel": "نام نسخه",
   "versions.releaseNamePlaceholder": "نام نسخه",
   "versions.releaseNameRequired": "یک نام نسخه وارد کنید.",
diff --git a/web/i18n/fr-FR/agent-v-2.json b/web/i18n/fr-FR/agent-v-2.json
index 804b2624f44..d3a86dc1f04 100644
--- a/web/i18n/fr-FR/agent-v-2.json
+++ b/web/i18n/fr-FR/agent-v-2.json
@@ -290,6 +290,7 @@
   "agentDetail.monitoring.dateRangeLabel": "Plage de dates",
   "agentDetail.monitoring.description": "Suivez l’activité, le coût et la qualité d’interaction de l’agent réutilisable dans tous les workflows.",
   "agentDetail.monitoring.learnMore": "En savoir plus",
+  "agentDetail.monitoring.loadFailed": "Échec du chargement des données de surveillance",
   "agentDetail.monitoring.metrics.activeUsers.explanation": "Utilisateurs finaux uniques ayant déclenché des workflows utilisant cet agent.",
   "agentDetail.monitoring.metrics.activeUsers.title": "Utilisateurs actifs",
   "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "Nombre de communications continues entre utilisateur et agent pour ce point d’accès.",
@@ -328,15 +329,17 @@
   "agentDetail.type": "AGENT",
   "agentDetail.versionHistory.active": "Actif",
   "agentDetail.versionHistory.empty": "Pas encore de versions",
+  "agentDetail.versionHistory.exitVersions": "Quitter les versions",
   "agentDetail.versionHistory.filter": "Filtrer les versions",
+  "agentDetail.versionHistory.restore": "Restaurer",
   "agentDetail.versionHistory.versionName": "Version {{version}}",
+  "agentDetail.versionHistory.viewOnly": "Lecture seule",
   "roster.createAgent": "Créer un agent",
   "roster.createAgentOptions": "Options de création d’agent",
   "roster.createDialog.description": "Créez un agent réutilisable dans le roster de cet espace de travail.",
   "roster.createDialog.title": "Créer un agent",
   "roster.createForm.changeIcon": "Changer l’icône de l’agent",
   "roster.createForm.descriptionLabel": "Description",
-  "roster.createForm.descriptionOptional": "(facultatif)",
   "roster.createForm.descriptionPlaceholder": "p. ex. Rassemble des sources sur un sujet et résume les principales conclusions",
   "roster.createForm.nameLabel": "Nom",
   "roster.createForm.namePlaceholder": "p. ex. Max",
@@ -350,7 +353,6 @@
   "roster.deleteDialog.title": "Supprimer {{name}} ?",
   "roster.deleteFailed": "Échec de la suppression de l’agent.",
   "roster.deleteSuccess": "Agent supprimé.",
-  "roster.duplicateFailed": "Échec de la duplication de l’agent.",
   "roster.duplicateSuccess": "Agent dupliqué.",
   "roster.editAgent": "Modifier {{name}}",
   "roster.editDialog.description": "Mettez à jour le nom, la description et le rôle de cet agent dans le roster.",
diff --git a/web/i18n/fr-FR/app.json b/web/i18n/fr-FR/app.json
index 58309a1dfbd..24ba5206f31 100644
--- a/web/i18n/fr-FR/app.json
+++ b/web/i18n/fr-FR/app.json
@@ -226,6 +226,7 @@
   "newAppFromTemplate.sidebar.Workflow": "Flux de travail",
   "newAppFromTemplate.sidebar.Writing": "Écriture",
   "noAccessPermission": "Pas de permission d'accéder à l'application web",
+  "noAccessResourcePermission": "Aucune autorisation pour accéder à cette ressource",
   "noUserInputNode": "Nœud d'entrée utilisateur manquant",
   "notPublishedYet": "L'application n'est pas encore publiée",
   "openInExplore": "Ouvrir dans Explorer",
diff --git a/web/i18n/fr-FR/common.json b/web/i18n/fr-FR/common.json
index 9f1a640874d..bec097fe0f7 100644
--- a/web/i18n/fr-FR/common.json
+++ b/web/i18n/fr-FR/common.json
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "Modèle de Texte-à-Parole",
   "modelProvider.ttsModel.tip": "Définissez le modèle par défaut pour l'entrée de texte à la parole dans une conversation.",
   "modelProvider.upgradeForLoadBalancing": "Mettez à niveau votre plan pour activer l’équilibrage de charge.",
+  "navigation.skipToMain": "Aller au contenu principal",
   "noData": "Aucune donnée",
   "operation.add": "Ajouter",
   "operation.added": "Ajouté",
diff --git a/web/i18n/fr-FR/deployments.json b/web/i18n/fr-FR/deployments.json
index 90dafb5dee7..2e41f4137f8 100644
--- a/web/i18n/fr-FR/deployments.json
+++ b/web/i18n/fr-FR/deployments.json
@@ -613,6 +613,7 @@
   "versions.releaseDescriptionLabel": "Description",
   "versions.releaseDescriptionPlaceholder": "Décrivez cette version",
   "versions.releaseHistory": "Historique des versions",
+  "versions.releaseNameConflict": "Une version portant ce nom existe déjà. Choisissez un autre nom.",
   "versions.releaseNameLabel": "Nom de la version",
   "versions.releaseNamePlaceholder": "Nom de la version",
   "versions.releaseNameRequired": "Entrez un nom de version.",
diff --git a/web/i18n/hi-IN/agent-v-2.json b/web/i18n/hi-IN/agent-v-2.json
index ba5f7df6d58..86c0c2e5be2 100644
--- a/web/i18n/hi-IN/agent-v-2.json
+++ b/web/i18n/hi-IN/agent-v-2.json
@@ -290,6 +290,7 @@
   "agentDetail.monitoring.dateRangeLabel": "दिनांक सीमा",
   "agentDetail.monitoring.description": "वर्कफ़्लो में पुनः उपयोग योग्य एजेंट गतिविधि, लागत और इंटरैक्शन गुणवत्ता को ट्रैक करें।",
   "agentDetail.monitoring.learnMore": "और अधिक जानें",
+  "agentDetail.monitoring.loadFailed": "मॉनिटरिंग डेटा लोड नहीं हो सका",
   "agentDetail.monitoring.metrics.activeUsers.explanation": "अद्वितीय अंतिम-उपयोगकर्ता जिन्होंने इस एजेंट का उपयोग करके वर्कफ़्लो ट्रिगर किए।",
   "agentDetail.monitoring.metrics.activeUsers.title": "सक्रिय उपयोगकर्ता",
   "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "इस एक्सेस पॉइंट के लिए निरंतर उपयोगकर्ता-एजेंट संचार गणना।",
@@ -328,15 +329,17 @@
   "agentDetail.type": "एजेंट",
   "agentDetail.versionHistory.active": "सक्रिय",
   "agentDetail.versionHistory.empty": "अभी तक कोई संस्करण नहीं",
+  "agentDetail.versionHistory.exitVersions": "संस्करणों से बाहर निकलें",
   "agentDetail.versionHistory.filter": "संस्करण फ़िल्टर करें",
+  "agentDetail.versionHistory.restore": "रीस्टोर करें",
   "agentDetail.versionHistory.versionName": "संस्करण {{version}}",
+  "agentDetail.versionHistory.viewOnly": "केवल देखें",
   "roster.createAgent": "एजेंट बनाएँ",
   "roster.createAgentOptions": "एजेंट बनाने के विकल्प",
   "roster.createDialog.description": "इस कार्यक्षेत्र Roster में एक पुनः उपयोग योग्य एजेंट बनाएँ।",
   "roster.createDialog.title": "एजेंट बनाएँ",
   "roster.createForm.changeIcon": "एजेंट आइकन बदलें",
   "roster.createForm.descriptionLabel": "विवरण",
-  "roster.createForm.descriptionOptional": "(वैकल्पिक)",
   "roster.createForm.descriptionPlaceholder": "उदा. किसी विषय पर स्रोत एकत्र करता है और मुख्य निष्कर्षों का सारांश देता है",
   "roster.createForm.nameLabel": "नाम",
   "roster.createForm.namePlaceholder": "उदा. Max",
@@ -350,7 +353,6 @@
   "roster.deleteDialog.title": "{{name}} हटाएँ?",
   "roster.deleteFailed": "एजेंट हटाने में विफल।",
   "roster.deleteSuccess": "एजेंट हटा दिया गया।",
-  "roster.duplicateFailed": "एजेंट डुप्लिकेट करने में विफल।",
   "roster.duplicateSuccess": "एजेंट डुप्लिकेट किया गया।",
   "roster.editAgent": "{{name}} संपादित करें",
   "roster.editDialog.description": "इस एजेंट का Roster नाम, विवरण और भूमिका अपडेट करें।",
diff --git a/web/i18n/hi-IN/app.json b/web/i18n/hi-IN/app.json
index ea4b2f070d4..faf28b6ced3 100644
--- a/web/i18n/hi-IN/app.json
+++ b/web/i18n/hi-IN/app.json
@@ -226,6 +226,7 @@
   "newAppFromTemplate.sidebar.Workflow": "कार्यप्रवाह",
   "newAppFromTemplate.sidebar.Writing": "कृतियाँ",
   "noAccessPermission": "वेब एप्लिकेशन तक पहुँचने की अनुमति नहीं है",
+  "noAccessResourcePermission": "इस संसाधन तक पहुँचने की अनुमति नहीं है",
   "noUserInputNode": "उपयोगकर्ता इनपुट नोड गायब है",
   "notPublishedYet": "ऐप अभी प्रकाशित नहीं हुआ है",
   "openInExplore": "एक्सप्लोर में खोलें",
diff --git a/web/i18n/hi-IN/common.json b/web/i18n/hi-IN/common.json
index a254bee5b07..d85b715e1cc 100644
--- a/web/i18n/hi-IN/common.json
+++ b/web/i18n/hi-IN/common.json
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "पाठ-से-भाषण मॉडल",
   "modelProvider.ttsModel.tip": "संवाद में पाठ-से-भाषण इनपुट के लिए डिफ़ॉल्ट मॉडल सेट करें।",
   "modelProvider.upgradeForLoadBalancing": "लोड बैलेंसिंग सक्षम करने के लिए अपनी योजना अपग्रेड करें।",
+  "navigation.skipToMain": "मुख्य सामग्री पर जाएं",
   "noData": "कोई डेटा नहीं",
   "operation.add": "जोड़ें",
   "operation.added": "जोड़ा गया",
diff --git a/web/i18n/hi-IN/deployments.json b/web/i18n/hi-IN/deployments.json
index 89d4b6a49d3..97c91a0e040 100644
--- a/web/i18n/hi-IN/deployments.json
+++ b/web/i18n/hi-IN/deployments.json
@@ -613,6 +613,7 @@
   "versions.releaseDescriptionLabel": "विवरण",
   "versions.releaseDescriptionPlaceholder": "इस रिलीज़ का वर्णन करें",
   "versions.releaseHistory": "रिलीज़ इतिहास",
+  "versions.releaseNameConflict": "इस नाम वाली रिलीज़ पहले से मौजूद है। कोई दूसरा नाम चुनें।",
   "versions.releaseNameLabel": "रिलीज़ नाम",
   "versions.releaseNamePlaceholder": "रिलीज़ नाम",
   "versions.releaseNameRequired": "एक रिलीज़ नाम दर्ज करें।",
diff --git a/web/i18n/id-ID/agent-v-2.json b/web/i18n/id-ID/agent-v-2.json
index f2827f73016..bf0cb2e2323 100644
--- a/web/i18n/id-ID/agent-v-2.json
+++ b/web/i18n/id-ID/agent-v-2.json
@@ -290,6 +290,7 @@
   "agentDetail.monitoring.dateRangeLabel": "Rentang tanggal",
   "agentDetail.monitoring.description": "Lacak aktivitas, biaya, dan kualitas interaksi agen yang dapat digunakan kembali di seluruh alur kerja.",
   "agentDetail.monitoring.learnMore": "Pelajari lebih lanjut",
+  "agentDetail.monitoring.loadFailed": "Gagal memuat data pemantauan",
   "agentDetail.monitoring.metrics.activeUsers.explanation": "Pengguna akhir unik yang memicu alur kerja menggunakan agen ini.",
   "agentDetail.monitoring.metrics.activeUsers.title": "Pengguna Aktif",
   "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "Hitungan komunikasi pengguna-agen yang berkelanjutan untuk titik akses ini.",
@@ -328,15 +329,17 @@
   "agentDetail.type": "AGEN",
   "agentDetail.versionHistory.active": "Aktif",
   "agentDetail.versionHistory.empty": "Belum ada versi",
+  "agentDetail.versionHistory.exitVersions": "Keluar versi",
   "agentDetail.versionHistory.filter": "Filter versi",
+  "agentDetail.versionHistory.restore": "Pulihkan",
   "agentDetail.versionHistory.versionName": "Versi {{version}}",
+  "agentDetail.versionHistory.viewOnly": "Hanya lihat",
   "roster.createAgent": "Buat agen",
   "roster.createAgentOptions": "Opsi buat agen",
   "roster.createDialog.description": "Buat agen yang dapat digunakan kembali di Roster ruang kerja ini.",
   "roster.createDialog.title": "Buat agen",
   "roster.createForm.changeIcon": "Ubah ikon agen",
   "roster.createForm.descriptionLabel": "Deskripsi",
-  "roster.createForm.descriptionOptional": "(opsional)",
   "roster.createForm.descriptionPlaceholder": "mis. Mengumpulkan sumber tentang suatu topik dan merangkum temuan utama",
   "roster.createForm.nameLabel": "Nama",
   "roster.createForm.namePlaceholder": "mis. Max",
@@ -350,7 +353,6 @@
   "roster.deleteDialog.title": "Hapus {{name}}?",
   "roster.deleteFailed": "Gagal menghapus agen.",
   "roster.deleteSuccess": "Agen dihapus.",
-  "roster.duplicateFailed": "Gagal menduplikasi agen.",
   "roster.duplicateSuccess": "Agen diduplikasi.",
   "roster.editAgent": "Edit {{name}}",
   "roster.editDialog.description": "Perbarui nama, deskripsi, dan peran Roster untuk agen ini.",
diff --git a/web/i18n/id-ID/app.json b/web/i18n/id-ID/app.json
index f1a27e2f9c1..1c8e21a9207 100644
--- a/web/i18n/id-ID/app.json
+++ b/web/i18n/id-ID/app.json
@@ -226,6 +226,7 @@
   "newAppFromTemplate.sidebar.Workflow": "Alur Kerja",
   "newAppFromTemplate.sidebar.Writing": "Tulisan",
   "noAccessPermission": "Tidak ada izin untuk mengakses aplikasi web",
+  "noAccessResourcePermission": "Tidak ada izin untuk mengakses sumber daya ini",
   "noUserInputNode": "Node input pengguna hilang",
   "notPublishedYet": "Aplikasi belum diterbitkan",
   "openInExplore": "Buka di Jelajahi",
diff --git a/web/i18n/id-ID/common.json b/web/i18n/id-ID/common.json
index 8b5a1dc5a39..c11b0233b8f 100644
--- a/web/i18n/id-ID/common.json
+++ b/web/i18n/id-ID/common.json
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "Model Teks-ke-Ucapan",
   "modelProvider.ttsModel.tip": "Atur model default untuk input teks-ke-ucapan dalam percakapan.",
   "modelProvider.upgradeForLoadBalancing": "Tingkatkan paket Anda untuk mengaktifkan Penyeimbangan Beban.",
+  "navigation.skipToMain": "Lewati ke konten utama",
   "noData": "Tidak ada data",
   "operation.add": "Tambah",
   "operation.added": "Ditambahkan",
diff --git a/web/i18n/id-ID/deployments.json b/web/i18n/id-ID/deployments.json
index 068c3f9b031..858e8391957 100644
--- a/web/i18n/id-ID/deployments.json
+++ b/web/i18n/id-ID/deployments.json
@@ -613,6 +613,7 @@
   "versions.releaseDescriptionLabel": "Deskripsi",
   "versions.releaseDescriptionPlaceholder": "Jelaskan rilis ini",
   "versions.releaseHistory": "Riwayat rilis",
+  "versions.releaseNameConflict": "Rilis dengan nama ini sudah ada. Pilih nama lain.",
   "versions.releaseNameLabel": "Nama Rilis",
   "versions.releaseNamePlaceholder": "Nama Rilis",
   "versions.releaseNameRequired": "Masukkan nama rilis.",
diff --git a/web/i18n/it-IT/agent-v-2.json b/web/i18n/it-IT/agent-v-2.json
index a38e2808ab7..8fd2023d472 100644
--- a/web/i18n/it-IT/agent-v-2.json
+++ b/web/i18n/it-IT/agent-v-2.json
@@ -290,6 +290,7 @@
   "agentDetail.monitoring.dateRangeLabel": "Intervallo di date",
   "agentDetail.monitoring.description": "Monitora l’attività, il costo e la qualità dell’interazione dell’agente riutilizzabile in tutti i workflow.",
   "agentDetail.monitoring.learnMore": "Scopri di più",
+  "agentDetail.monitoring.loadFailed": "Impossibile caricare i dati di monitoraggio",
   "agentDetail.monitoring.metrics.activeUsers.explanation": "Utenti finali unici che hanno attivato workflow utilizzando questo agente.",
   "agentDetail.monitoring.metrics.activeUsers.title": "Utenti attivi",
   "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "Conteggio della comunicazione continua tra utente e agente per questo punto di accesso.",
@@ -328,15 +329,17 @@
   "agentDetail.type": "AGENTE",
   "agentDetail.versionHistory.active": "Attiva",
   "agentDetail.versionHistory.empty": "Nessuna versione al momento",
+  "agentDetail.versionHistory.exitVersions": "Esci dalle versioni",
   "agentDetail.versionHistory.filter": "Filtra versioni",
+  "agentDetail.versionHistory.restore": "Ripristina",
   "agentDetail.versionHistory.versionName": "Versione {{version}}",
+  "agentDetail.versionHistory.viewOnly": "Sola lettura",
   "roster.createAgent": "Crea agente",
   "roster.createAgentOptions": "Opzioni di creazione agente",
   "roster.createDialog.description": "Crea un agente riutilizzabile nel roster di questo workspace.",
   "roster.createDialog.title": "Crea agente",
   "roster.createForm.changeIcon": "Cambia icona dell’agente",
   "roster.createForm.descriptionLabel": "Descrizione",
-  "roster.createForm.descriptionOptional": "(facoltativo)",
   "roster.createForm.descriptionPlaceholder": "ad es. Raccoglie fonti su un argomento e riassume i risultati chiave",
   "roster.createForm.nameLabel": "Nome",
   "roster.createForm.namePlaceholder": "ad es. Max",
@@ -350,7 +353,6 @@
   "roster.deleteDialog.title": "Eliminare {{name}}?",
   "roster.deleteFailed": "Impossibile eliminare l’agente.",
   "roster.deleteSuccess": "Agente eliminato.",
-  "roster.duplicateFailed": "Impossibile duplicare l’agente.",
   "roster.duplicateSuccess": "Agente duplicato.",
   "roster.editAgent": "Modifica {{name}}",
   "roster.editDialog.description": "Aggiorna il nome, la descrizione e il ruolo del roster per questo agente.",
diff --git a/web/i18n/it-IT/app.json b/web/i18n/it-IT/app.json
index c35f6be9aae..785ed4ca848 100644
--- a/web/i18n/it-IT/app.json
+++ b/web/i18n/it-IT/app.json
@@ -226,6 +226,7 @@
   "newAppFromTemplate.sidebar.Workflow": "Flusso di lavoro",
   "newAppFromTemplate.sidebar.Writing": "Scrittura",
   "noAccessPermission": "Nessun permesso per accedere all'app web",
+  "noAccessResourcePermission": "Nessuna autorizzazione per accedere a questa risorsa",
   "noUserInputNode": "Nodo di input utente mancante",
   "notPublishedYet": "L'app non è ancora pubblicata",
   "openInExplore": "Apri in Esplora",
diff --git a/web/i18n/it-IT/common.json b/web/i18n/it-IT/common.json
index 6e3b1454ae8..8513ffd7c3d 100644
--- a/web/i18n/it-IT/common.json
+++ b/web/i18n/it-IT/common.json
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "Modello da Testo a Voce",
   "modelProvider.ttsModel.tip": "Imposta il modello predefinito per l'input da testo a voce nella conversazione.",
   "modelProvider.upgradeForLoadBalancing": "Aggiorna il tuo piano per abilitare il Bilanciamento del Carico.",
+  "navigation.skipToMain": "Vai al contenuto principale",
   "noData": "Nessun dato",
   "operation.add": "Aggiungi",
   "operation.added": "Aggiunto",
diff --git a/web/i18n/it-IT/deployments.json b/web/i18n/it-IT/deployments.json
index 867c3cfad4b..5cf328d2f45 100644
--- a/web/i18n/it-IT/deployments.json
+++ b/web/i18n/it-IT/deployments.json
@@ -613,6 +613,7 @@
   "versions.releaseDescriptionLabel": "Descrizione",
   "versions.releaseDescriptionPlaceholder": "Descrivi questa release",
   "versions.releaseHistory": "Cronologia release",
+  "versions.releaseNameConflict": "Esiste già una release con questo nome. Scegli un altro nome.",
   "versions.releaseNameLabel": "Nome release",
   "versions.releaseNamePlaceholder": "Nome release",
   "versions.releaseNameRequired": "Inserisci un nome per la release.",
diff --git a/web/i18n/ja-JP/agent-v-2.json b/web/i18n/ja-JP/agent-v-2.json
index 2fd910cdb64..eb014461bc2 100644
--- a/web/i18n/ja-JP/agent-v-2.json
+++ b/web/i18n/ja-JP/agent-v-2.json
@@ -290,6 +290,7 @@
   "agentDetail.monitoring.dateRangeLabel": "日付範囲",
   "agentDetail.monitoring.description": "ワークフロー全体での再利用可能なエージェントのアクティビティ、コスト、対話品質を追跡します。",
   "agentDetail.monitoring.learnMore": "詳細を見る",
+  "agentDetail.monitoring.loadFailed": "モニタリングデータの読み込みに失敗しました",
   "agentDetail.monitoring.metrics.activeUsers.explanation": "このエージェントを使ったワークフローをトリガーしたユニークエンドユーザー数。",
   "agentDetail.monitoring.metrics.activeUsers.title": "アクティブユーザー",
   "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "このアクセスポイントにおけるユーザーとエージェントの連続通信回数。",
@@ -328,15 +329,17 @@
   "agentDetail.type": "エージェント",
   "agentDetail.versionHistory.active": "アクティブ",
   "agentDetail.versionHistory.empty": "バージョンはまだありません",
+  "agentDetail.versionHistory.exitVersions": "バージョンを終了",
   "agentDetail.versionHistory.filter": "バージョンをフィルター",
+  "agentDetail.versionHistory.restore": "復元",
   "agentDetail.versionHistory.versionName": "バージョン {{version}}",
+  "agentDetail.versionHistory.viewOnly": "表示のみ",
   "roster.createAgent": "エージェントを作成",
   "roster.createAgentOptions": "エージェント作成オプション",
   "roster.createDialog.description": "このワークスペース Roster に再利用可能なエージェントを作成します。",
   "roster.createDialog.title": "エージェントを作成",
   "roster.createForm.changeIcon": "エージェントアイコンを変更",
   "roster.createForm.descriptionLabel": "説明",
-  "roster.createForm.descriptionOptional": "（任意）",
   "roster.createForm.descriptionPlaceholder": "例: トピックのソースを収集し、主要な発見を要約する",
   "roster.createForm.nameLabel": "名前",
   "roster.createForm.namePlaceholder": "例: Max",
@@ -350,7 +353,6 @@
   "roster.deleteDialog.title": "{{name}} を削除しますか？",
   "roster.deleteFailed": "エージェントの削除に失敗しました。",
   "roster.deleteSuccess": "エージェントを削除しました。",
-  "roster.duplicateFailed": "エージェントの複製に失敗しました。",
   "roster.duplicateSuccess": "エージェントを複製しました。",
   "roster.editAgent": "{{name}} を編集",
   "roster.editDialog.description": "このエージェントの Roster 名、説明、ロールを更新します。",
diff --git a/web/i18n/ja-JP/app.json b/web/i18n/ja-JP/app.json
index d2f338a84de..600c75509ba 100644
--- a/web/i18n/ja-JP/app.json
+++ b/web/i18n/ja-JP/app.json
@@ -226,6 +226,7 @@
   "newAppFromTemplate.sidebar.Workflow": "ワークフロー",
   "newAppFromTemplate.sidebar.Writing": "ライティング",
   "noAccessPermission": "Web アプリにアクセス権限がありません",
+  "noAccessResourcePermission": "このリソースにアクセスする権限がありません",
   "noUserInputNode": "ユーザー入力ノードが見つかりません",
   "notPublishedYet": "アプリはまだ公開されていません",
   "openInExplore": "\"探索\" で開く",
diff --git a/web/i18n/ja-JP/common.json b/web/i18n/ja-JP/common.json
index 7b8b37a8f56..9922049861a 100644
--- a/web/i18n/ja-JP/common.json
+++ b/web/i18n/ja-JP/common.json
@@ -544,6 +544,7 @@
   "modelProvider.ttsModel.key": "テキスト-to-音声モデル",
   "modelProvider.ttsModel.tip": "会話でのテキスト-to-音声入力に使用するデフォルトモデルを設定します。",
   "modelProvider.upgradeForLoadBalancing": "負荷分散を利用するには、プランのアップグレードが必要です。",
+  "navigation.skipToMain": "メインコンテンツへスキップ",
   "noData": "データなし",
   "operation.add": "追加",
   "operation.added": "追加済み",
diff --git a/web/i18n/ja-JP/deployments.json b/web/i18n/ja-JP/deployments.json
index 4e27e96a2c3..60ccea33e26 100644
--- a/web/i18n/ja-JP/deployments.json
+++ b/web/i18n/ja-JP/deployments.json
@@ -613,6 +613,7 @@
   "versions.releaseDescriptionLabel": "説明",
   "versions.releaseDescriptionPlaceholder": "このリリースを説明してください",
   "versions.releaseHistory": "リリース履歴",
+  "versions.releaseNameConflict": "このリリース名は既に存在します。別の名前を選択してください。",
   "versions.releaseNameLabel": "リリース名",
   "versions.releaseNamePlaceholder": "リリース名",
   "versions.releaseNameRequired": "リリース名を入力してください。",
diff --git a/web/i18n/ja-JP/permission-keys.json b/web/i18n/ja-JP/permission-keys.json
index d91764df177..c4d67d83c9b 100644
--- a/web/i18n/ja-JP/permission-keys.json
+++ b/web/i18n/ja-JP/permission-keys.json
@@ -16,8 +16,9 @@
   "billing.manage": "サブスクリプションプランを変更",
   "billing.subscription.manage": "請求ポータルで請求とサブスクリプションを管理",
   "billing.view": "設定の請求ページにアクセス",
-  "credential.manage": "認証情報を管理",
-  "credential.use": "認証情報を使用",
+  "credential.create": "認証情報を追加",
+  "credential.manage": "認証情報を編集・削除",
+  "credential.use": "認証情報を表示して使用",
   "customization.manage": "カスタマイズを管理",
   "data_source.manage": "データソース設定を管理",
   "dataset.access_config": "ナレッジベースのアクセス権限を設定",
diff --git a/web/i18n/ja-JP/permission.json b/web/i18n/ja-JP/permission.json
index 5a30f5c4d2e..e38e07d5b06 100644
--- a/web/i18n/ja-JP/permission.json
+++ b/web/i18n/ja-JP/permission.json
@@ -46,6 +46,7 @@
   "group.credential": "認証情報",
   "group.dataset": "ナレッジベース",
   "group.dataset_acl": "ナレッジベースアクセス権限",
+  "group.integration": "インテグレーション",
   "group.plugin": "プラグイン",
   "group.tool_mcp": "ツールとMCP",
   "group.workspace": "ワークスペース",
diff --git a/web/i18n/ko-KR/agent-v-2.json b/web/i18n/ko-KR/agent-v-2.json
index 2356cdcef67..e4121a0b38c 100644
--- a/web/i18n/ko-KR/agent-v-2.json
+++ b/web/i18n/ko-KR/agent-v-2.json
@@ -290,6 +290,7 @@
   "agentDetail.monitoring.dateRangeLabel": "날짜 범위",
   "agentDetail.monitoring.description": "워크플로 전반에 걸친 재사용 가능한 에이전트의 활동, 비용 및 상호 작용 품질을 추적합니다.",
   "agentDetail.monitoring.learnMore": "자세히 알아보기",
+  "agentDetail.monitoring.loadFailed": "모니터링 데이터를 불러오지 못했습니다",
   "agentDetail.monitoring.metrics.activeUsers.explanation": "이 에이전트를 사용하는 워크플로를 트리거한 고유 최종 사용자 수.",
   "agentDetail.monitoring.metrics.activeUsers.title": "활성 사용자",
   "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "이 액세스 지점에서의 사용자-에이전트 연속 통신 횟수.",
@@ -328,15 +329,17 @@
   "agentDetail.type": "에이전트",
   "agentDetail.versionHistory.active": "활성",
   "agentDetail.versionHistory.empty": "아직 버전이 없습니다",
+  "agentDetail.versionHistory.exitVersions": "버전 나가기",
   "agentDetail.versionHistory.filter": "버전 필터",
+  "agentDetail.versionHistory.restore": "복원",
   "agentDetail.versionHistory.versionName": "버전 {{version}}",
+  "agentDetail.versionHistory.viewOnly": "보기 전용",
   "roster.createAgent": "에이전트 만들기",
   "roster.createAgentOptions": "에이전트 만들기 옵션",
   "roster.createDialog.description": "이 워크스페이스 Roster 에 재사용 가능한 에이전트를 만듭니다.",
   "roster.createDialog.title": "에이전트 만들기",
   "roster.createForm.changeIcon": "에이전트 아이콘 변경",
   "roster.createForm.descriptionLabel": "설명",
-  "roster.createForm.descriptionOptional": "(선택 사항)",
   "roster.createForm.descriptionPlaceholder": "예: 주제에 대한 소스를 수집하고 핵심 결과를 요약",
   "roster.createForm.nameLabel": "이름",
   "roster.createForm.namePlaceholder": "예: Max",
@@ -350,7 +353,6 @@
   "roster.deleteDialog.title": "{{name}}을(를) 삭제하시겠습니까?",
   "roster.deleteFailed": "에이전트 삭제에 실패했습니다.",
   "roster.deleteSuccess": "에이전트가 삭제되었습니다.",
-  "roster.duplicateFailed": "에이전트 복제에 실패했습니다.",
   "roster.duplicateSuccess": "에이전트가 복제되었습니다.",
   "roster.editAgent": "{{name}} 편집",
   "roster.editDialog.description": "이 에이전트의 Roster 이름, 설명 및 역할을 업데이트합니다.",
diff --git a/web/i18n/ko-KR/app.json b/web/i18n/ko-KR/app.json
index a1995c21b46..c8e294277d7 100644
--- a/web/i18n/ko-KR/app.json
+++ b/web/i18n/ko-KR/app.json
@@ -226,6 +226,7 @@
   "newAppFromTemplate.sidebar.Workflow": "워크플로",
   "newAppFromTemplate.sidebar.Writing": "쓰기",
   "noAccessPermission": "웹 앱에 대한 접근 권한이 없습니다.",
+  "noAccessResourcePermission": "이 리소스에 액세스할 권한이 없습니다",
   "noUserInputNode": "사용자 입력 노드가 없습니다",
   "notPublishedYet": "앱이 아직 출시되지 않았습니다",
   "openInExplore": "Explore 에서 열기",
diff --git a/web/i18n/ko-KR/common.json b/web/i18n/ko-KR/common.json
index 64db784d138..88a95f576d5 100644
--- a/web/i18n/ko-KR/common.json
+++ b/web/i18n/ko-KR/common.json
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "텍스트-to-음성 모델",
   "modelProvider.ttsModel.tip": "대화에서의 텍스트-to-음성 입력에 사용되는 기본 모델을 설정합니다.",
   "modelProvider.upgradeForLoadBalancing": "로드 밸런싱을 사용하도록 계획을 업그레이드합니다.",
+  "navigation.skipToMain": "본문으로 건너뛰기",
   "noData": "데이터 없음",
   "operation.add": "추가",
   "operation.added": "추가됨",
diff --git a/web/i18n/ko-KR/deployments.json b/web/i18n/ko-KR/deployments.json
index aa001e8e5e5..b61f85ba526 100644
--- a/web/i18n/ko-KR/deployments.json
+++ b/web/i18n/ko-KR/deployments.json
@@ -613,6 +613,7 @@
   "versions.releaseDescriptionLabel": "설명",
   "versions.releaseDescriptionPlaceholder": "이 릴리스를 설명하세요",
   "versions.releaseHistory": "릴리스 기록",
+  "versions.releaseNameConflict": "이 릴리스 이름은 이미 존재합니다. 다른 이름을 선택하세요.",
   "versions.releaseNameLabel": "릴리스 이름",
   "versions.releaseNamePlaceholder": "릴리스 이름",
   "versions.releaseNameRequired": "릴리스 이름을 입력하세요.",
diff --git a/web/i18n/nl-NL/agent-v-2.json b/web/i18n/nl-NL/agent-v-2.json
index 9209a7ed773..7681b56bca4 100644
--- a/web/i18n/nl-NL/agent-v-2.json
+++ b/web/i18n/nl-NL/agent-v-2.json
@@ -290,6 +290,7 @@
   "agentDetail.monitoring.dateRangeLabel": "Datumbereik",
   "agentDetail.monitoring.description": "Volg de activiteit, kosten en interactiekwaliteit van de herbruikbare agent over workflows heen.",
   "agentDetail.monitoring.learnMore": "Meer informatie",
+  "agentDetail.monitoring.loadFailed": "Monitoringgegevens laden mislukt",
   "agentDetail.monitoring.metrics.activeUsers.explanation": "Unieke eindgebruikers die workflows met deze agent hebben getriggerd.",
   "agentDetail.monitoring.metrics.activeUsers.title": "Actieve gebruikers",
   "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "Aaneengesloten communicatie tussen gebruiker en agent voor dit toegangspunt.",
@@ -328,15 +329,17 @@
   "agentDetail.type": "AGENT",
   "agentDetail.versionHistory.active": "Actief",
   "agentDetail.versionHistory.empty": "Nog geen versies",
+  "agentDetail.versionHistory.exitVersions": "Versies verlaten",
   "agentDetail.versionHistory.filter": "Versies filteren",
+  "agentDetail.versionHistory.restore": "Herstellen",
   "agentDetail.versionHistory.versionName": "Versie {{version}}",
+  "agentDetail.versionHistory.viewOnly": "Alleen bekijken",
   "roster.createAgent": "Agent aanmaken",
   "roster.createAgentOptions": "Opties voor agent aanmaken",
   "roster.createDialog.description": "Maak een herbruikbare agent in het roster van deze werkruimte.",
   "roster.createDialog.title": "Agent aanmaken",
   "roster.createForm.changeIcon": "Agentpictogram wijzigen",
   "roster.createForm.descriptionLabel": "Beschrijving",
-  "roster.createForm.descriptionOptional": "(optioneel)",
   "roster.createForm.descriptionPlaceholder": "bv. Verzamelt bronnen over een onderwerp en vat de belangrijkste bevindingen samen",
   "roster.createForm.nameLabel": "Naam",
   "roster.createForm.namePlaceholder": "bv. Max",
@@ -350,7 +353,6 @@
   "roster.deleteDialog.title": "{{name}} verwijderen?",
   "roster.deleteFailed": "Verwijderen van agent mislukt.",
   "roster.deleteSuccess": "Agent verwijderd.",
-  "roster.duplicateFailed": "Dupliceren van agent mislukt.",
   "roster.duplicateSuccess": "Agent gedupliceerd.",
   "roster.editAgent": "{{name}} bewerken",
   "roster.editDialog.description": "Werk de rosternaam, beschrijving en rol van deze agent bij.",
diff --git a/web/i18n/nl-NL/app.json b/web/i18n/nl-NL/app.json
index e62ead85e82..cbaa3641cf7 100644
--- a/web/i18n/nl-NL/app.json
+++ b/web/i18n/nl-NL/app.json
@@ -226,6 +226,7 @@
   "newAppFromTemplate.sidebar.Workflow": "Workflow",
   "newAppFromTemplate.sidebar.Writing": "Writing",
   "noAccessPermission": "No permission to access web app",
+  "noAccessResourcePermission": "Geen toestemming om deze resource te openen",
   "noUserInputNode": "Missing user input node",
   "notPublishedYet": "App is not published yet",
   "openInExplore": "Open in Explore",
diff --git a/web/i18n/nl-NL/common.json b/web/i18n/nl-NL/common.json
index 8c03f8fd4d2..48ac771291a 100644
--- a/web/i18n/nl-NL/common.json
+++ b/web/i18n/nl-NL/common.json
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "Text-to-Speech Model",
   "modelProvider.ttsModel.tip": "Set the default model for text-to-speech input in conversation.",
   "modelProvider.upgradeForLoadBalancing": "Upgrade your plan to enable Load Balancing.",
+  "navigation.skipToMain": "Naar hoofdinhoud springen",
   "noData": "No data",
   "operation.add": "Add",
   "operation.added": "Added",
diff --git a/web/i18n/nl-NL/deployments.json b/web/i18n/nl-NL/deployments.json
index cee62004197..2311ec9bba0 100644
--- a/web/i18n/nl-NL/deployments.json
+++ b/web/i18n/nl-NL/deployments.json
@@ -613,6 +613,7 @@
   "versions.releaseDescriptionLabel": "Beschrijving",
   "versions.releaseDescriptionPlaceholder": "Beschrijf deze release",
   "versions.releaseHistory": "Releasegeschiedenis",
+  "versions.releaseNameConflict": "Er bestaat al een release met deze naam. Kies een andere naam.",
   "versions.releaseNameLabel": "Releasenaam",
   "versions.releaseNamePlaceholder": "Releasenaam",
   "versions.releaseNameRequired": "Voer een releasenaam in.",
diff --git a/web/i18n/pl-PL/agent-v-2.json b/web/i18n/pl-PL/agent-v-2.json
index 077cb79e70c..a5c06bbe9d1 100644
--- a/web/i18n/pl-PL/agent-v-2.json
+++ b/web/i18n/pl-PL/agent-v-2.json
@@ -290,6 +290,7 @@
   "agentDetail.monitoring.dateRangeLabel": "Zakres dat",
   "agentDetail.monitoring.description": "Śledź aktywność, koszt i jakość interakcji reużywalnego agenta w workflow.",
   "agentDetail.monitoring.learnMore": "Dowiedz się więcej",
+  "agentDetail.monitoring.loadFailed": "Nie udało się wczytać danych monitorowania",
   "agentDetail.monitoring.metrics.activeUsers.explanation": "Unikalni użytkownicy końcowi, którzy uruchomili workflow z tym agentem.",
   "agentDetail.monitoring.metrics.activeUsers.title": "Aktywni użytkownicy",
   "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "Liczba ciągłych interakcji użytkownik-agent dla tego punktu dostępu.",
@@ -328,15 +329,17 @@
   "agentDetail.type": "AGENT",
   "agentDetail.versionHistory.active": "Aktywna",
   "agentDetail.versionHistory.empty": "Brak wersji",
+  "agentDetail.versionHistory.exitVersions": "Opuść wersje",
   "agentDetail.versionHistory.filter": "Filtruj wersje",
+  "agentDetail.versionHistory.restore": "Przywróć",
   "agentDetail.versionHistory.versionName": "Wersja {{version}}",
+  "agentDetail.versionHistory.viewOnly": "Tylko podgląd",
   "roster.createAgent": "Utwórz agenta",
   "roster.createAgentOptions": "Opcje tworzenia agenta",
   "roster.createDialog.description": "Utwórz reużywalnego agenta w Roster tego workspace.",
   "roster.createDialog.title": "Utwórz agenta",
   "roster.createForm.changeIcon": "Zmień ikonę agenta",
   "roster.createForm.descriptionLabel": "Opis",
-  "roster.createForm.descriptionOptional": "(opcjonalnie)",
   "roster.createForm.descriptionPlaceholder": "np. Zbiera źródła na dany temat i podsumowuje kluczowe ustalenia",
   "roster.createForm.nameLabel": "Nazwa",
   "roster.createForm.namePlaceholder": "np. Max",
@@ -350,7 +353,6 @@
   "roster.deleteDialog.title": "Usunąć {{name}}?",
   "roster.deleteFailed": "Nie udało się usunąć agenta.",
   "roster.deleteSuccess": "Agent usunięty.",
-  "roster.duplicateFailed": "Nie udało się zduplikować agenta.",
   "roster.duplicateSuccess": "Agent zduplikowany.",
   "roster.editAgent": "Edytuj {{name}}",
   "roster.editDialog.description": "Zaktualizuj nazwę w Roster, opis i rolę tego agenta.",
diff --git a/web/i18n/pl-PL/app.json b/web/i18n/pl-PL/app.json
index 58156671cf7..024f71be62e 100644
--- a/web/i18n/pl-PL/app.json
+++ b/web/i18n/pl-PL/app.json
@@ -226,6 +226,7 @@
   "newAppFromTemplate.sidebar.Workflow": "Przepływ pracy",
   "newAppFromTemplate.sidebar.Writing": "Pismo",
   "noAccessPermission": "Brak uprawnień do dostępu do aplikacji internetowej",
+  "noAccessResourcePermission": "Brak uprawnień dostępu do tego zasobu",
   "noUserInputNode": "Brak węzła wejściowego użytkownika",
   "notPublishedYet": "Aplikacja nie została jeszcze opublikowana",
   "openInExplore": "Otwieranie w obszarze Eksploruj",
diff --git a/web/i18n/pl-PL/common.json b/web/i18n/pl-PL/common.json
index b156c28448f..cd22faf232c 100644
--- a/web/i18n/pl-PL/common.json
+++ b/web/i18n/pl-PL/common.json
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "Model tekstu na mowę",
   "modelProvider.ttsModel.tip": "Ustaw domyślny model dla konwersji tekstu na mowę w rozmowach.",
   "modelProvider.upgradeForLoadBalancing": "Uaktualnij swój plan, aby włączyć równoważenie obciążenia.",
+  "navigation.skipToMain": "Przejdź do głównej treści",
   "noData": "Brak danych",
   "operation.add": "Dodaj",
   "operation.added": "Dodano",
diff --git a/web/i18n/pl-PL/deployments.json b/web/i18n/pl-PL/deployments.json
index 7d171fdca05..83e21ad8e1f 100644
--- a/web/i18n/pl-PL/deployments.json
+++ b/web/i18n/pl-PL/deployments.json
@@ -613,6 +613,7 @@
   "versions.releaseDescriptionLabel": "Opis",
   "versions.releaseDescriptionPlaceholder": "Opisz to wydanie",
   "versions.releaseHistory": "Historia wydań",
+  "versions.releaseNameConflict": "Wydanie o tej nazwie już istnieje. Wybierz inną nazwę.",
   "versions.releaseNameLabel": "Nazwa Wydania",
   "versions.releaseNamePlaceholder": "Nazwa Wydania",
   "versions.releaseNameRequired": "Wprowadź nazwę wydania.",
diff --git a/web/i18n/pt-BR/agent-v-2.json b/web/i18n/pt-BR/agent-v-2.json
index 4e65b52b3c6..60cfa801115 100644
--- a/web/i18n/pt-BR/agent-v-2.json
+++ b/web/i18n/pt-BR/agent-v-2.json
@@ -290,6 +290,7 @@
   "agentDetail.monitoring.dateRangeLabel": "Intervalo de datas",
   "agentDetail.monitoring.description": "Acompanhe a atividade, o custo e a qualidade de interação do agente reutilizável em todos os workflows.",
   "agentDetail.monitoring.learnMore": "Saiba mais",
+  "agentDetail.monitoring.loadFailed": "Falha ao carregar dados de monitoramento",
   "agentDetail.monitoring.metrics.activeUsers.explanation": "Usuários finais únicos que acionaram workflows usando este agente.",
   "agentDetail.monitoring.metrics.activeUsers.title": "Usuários ativos",
   "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "Contagem de comunicação contínua entre usuário e agente para este ponto de acesso.",
@@ -328,15 +329,17 @@
   "agentDetail.type": "AGENTE",
   "agentDetail.versionHistory.active": "Ativa",
   "agentDetail.versionHistory.empty": "Ainda não há versões",
+  "agentDetail.versionHistory.exitVersions": "Sair das versões",
   "agentDetail.versionHistory.filter": "Filtrar versões",
+  "agentDetail.versionHistory.restore": "Restaurar",
   "agentDetail.versionHistory.versionName": "Versão {{version}}",
+  "agentDetail.versionHistory.viewOnly": "Somente leitura",
   "roster.createAgent": "Criar agente",
   "roster.createAgentOptions": "Opções de criação de agente",
   "roster.createDialog.description": "Crie um agente reutilizável no roster deste workspace.",
   "roster.createDialog.title": "Criar agente",
   "roster.createForm.changeIcon": "Alterar ícone do agente",
   "roster.createForm.descriptionLabel": "Descrição",
-  "roster.createForm.descriptionOptional": "(opcional)",
   "roster.createForm.descriptionPlaceholder": "ex.: Reúne fontes sobre um tópico e resume as principais descobertas",
   "roster.createForm.nameLabel": "Nome",
   "roster.createForm.namePlaceholder": "ex.: Max",
@@ -350,7 +353,6 @@
   "roster.deleteDialog.title": "Excluir {{name}}?",
   "roster.deleteFailed": "Falha ao excluir o agente.",
   "roster.deleteSuccess": "Agente excluído.",
-  "roster.duplicateFailed": "Falha ao duplicar o agente.",
   "roster.duplicateSuccess": "Agente duplicado.",
   "roster.editAgent": "Editar {{name}}",
   "roster.editDialog.description": "Atualize o nome, a descrição e a função deste agente no roster.",
diff --git a/web/i18n/pt-BR/app.json b/web/i18n/pt-BR/app.json
index 21e2437d1d2..a558fbb5d48 100644
--- a/web/i18n/pt-BR/app.json
+++ b/web/i18n/pt-BR/app.json
@@ -226,6 +226,7 @@
   "newAppFromTemplate.sidebar.Workflow": "Fluxo de trabalho",
   "newAppFromTemplate.sidebar.Writing": "Escrita",
   "noAccessPermission": "Sem permissão para acessar o aplicativo web",
+  "noAccessResourcePermission": "Sem permissão para acessar este recurso",
   "noUserInputNode": "Nodo de entrada do usuário ausente",
   "notPublishedYet": "O aplicativo ainda não foi publicado",
   "openInExplore": "Abrir no Explore",
diff --git a/web/i18n/pt-BR/common.json b/web/i18n/pt-BR/common.json
index ce04750e3c5..5ff10fe8629 100644
--- a/web/i18n/pt-BR/common.json
+++ b/web/i18n/pt-BR/common.json
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "Modelo de Texto para Fala",
   "modelProvider.ttsModel.tip": "Defina o modelo padrão para entrada de texto para fala na conversa.",
   "modelProvider.upgradeForLoadBalancing": "Atualize seu plano para habilitar o balanceamento de carga.",
+  "navigation.skipToMain": "Pular para o conteúdo principal",
   "noData": "Sem dados",
   "operation.add": "Adicionar",
   "operation.added": "Adicionado",
diff --git a/web/i18n/pt-BR/deployments.json b/web/i18n/pt-BR/deployments.json
index b2e15f64cb9..32e4b37bf08 100644
--- a/web/i18n/pt-BR/deployments.json
+++ b/web/i18n/pt-BR/deployments.json
@@ -613,6 +613,7 @@
   "versions.releaseDescriptionLabel": "Descrição",
   "versions.releaseDescriptionPlaceholder": "Descreva esta versão",
   "versions.releaseHistory": "Histórico de versões",
+  "versions.releaseNameConflict": "Já existe uma versão com este nome. Escolha outro nome.",
   "versions.releaseNameLabel": "Nome da versão",
   "versions.releaseNamePlaceholder": "Nome da versão",
   "versions.releaseNameRequired": "Insira um nome de versão.",
diff --git a/web/i18n/ro-RO/agent-v-2.json b/web/i18n/ro-RO/agent-v-2.json
index f53d4f4c201..bc8919e89a4 100644
--- a/web/i18n/ro-RO/agent-v-2.json
+++ b/web/i18n/ro-RO/agent-v-2.json
@@ -290,6 +290,7 @@
   "agentDetail.monitoring.dateRangeLabel": "Interval de date",
   "agentDetail.monitoring.description": "Urmăriți activitatea, costul și calitatea interacțiunii agentului reutilizabil în toate workflow-urile.",
   "agentDetail.monitoring.learnMore": "Aflați mai multe",
+  "agentDetail.monitoring.loadFailed": "Nu s-au putut încărca datele de monitorizare",
   "agentDetail.monitoring.metrics.activeUsers.explanation": "Utilizatori finali unici care au declanșat workflow-uri folosind acest agent.",
   "agentDetail.monitoring.metrics.activeUsers.title": "Utilizatori activi",
   "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "Numărul de comunicări continue utilizator-agent pentru acest punct de acces.",
@@ -328,15 +329,17 @@
   "agentDetail.type": "AGENT",
   "agentDetail.versionHistory.active": "Activă",
   "agentDetail.versionHistory.empty": "Nicio versiune încă",
+  "agentDetail.versionHistory.exitVersions": "Ieși din versiuni",
   "agentDetail.versionHistory.filter": "Filtrați versiunile",
+  "agentDetail.versionHistory.restore": "Restaurează",
   "agentDetail.versionHistory.versionName": "Versiunea {{version}}",
+  "agentDetail.versionHistory.viewOnly": "Doar vizualizare",
   "roster.createAgent": "Creează agent",
   "roster.createAgentOptions": "Opțiuni de creare agent",
   "roster.createDialog.description": "Creați un agent reutilizabil în roster-ul acestui workspace.",
   "roster.createDialog.title": "Creează agent",
   "roster.createForm.changeIcon": "Schimbă pictograma agentului",
   "roster.createForm.descriptionLabel": "Descriere",
-  "roster.createForm.descriptionOptional": "(opțional)",
   "roster.createForm.descriptionPlaceholder": "de ex. Adună surse pe o temă și rezumă principalele constatări",
   "roster.createForm.nameLabel": "Nume",
   "roster.createForm.namePlaceholder": "de ex. Max",
@@ -350,7 +353,6 @@
   "roster.deleteDialog.title": "Ștergeți {{name}}?",
   "roster.deleteFailed": "Ștergerea agentului a eșuat.",
   "roster.deleteSuccess": "Agent șters.",
-  "roster.duplicateFailed": "Duplicarea agentului a eșuat.",
   "roster.duplicateSuccess": "Agent duplicat.",
   "roster.editAgent": "Editați {{name}}",
   "roster.editDialog.description": "Actualizați numele, descrierea și rolul din roster pentru acest agent.",
diff --git a/web/i18n/ro-RO/app.json b/web/i18n/ro-RO/app.json
index a434a8e1a01..bbec39538c4 100644
--- a/web/i18n/ro-RO/app.json
+++ b/web/i18n/ro-RO/app.json
@@ -226,6 +226,7 @@
   "newAppFromTemplate.sidebar.Workflow": "Flux de lucru",
   "newAppFromTemplate.sidebar.Writing": "Scriere",
   "noAccessPermission": "Nici o permisiune pentru a accesa aplicația web",
+  "noAccessResourcePermission": "Nu ai permisiunea de a accesa această resursă",
   "noUserInputNode": "Lipsă nod de intrare pentru utilizator",
   "notPublishedYet": "Aplicația nu este încă publicată",
   "openInExplore": "Deschide în Explorează",
diff --git a/web/i18n/ro-RO/common.json b/web/i18n/ro-RO/common.json
index 50216e7108b..9f2c4269b91 100644
--- a/web/i18n/ro-RO/common.json
+++ b/web/i18n/ro-RO/common.json
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "Model de conversie vorbire-la-text",
   "modelProvider.ttsModel.tip": "Setați modelul implicit pentru intrarea de conversie vorbire-la-text în conversație.",
   "modelProvider.upgradeForLoadBalancing": "Actualizați-vă planul pentru a activa Load Balancing.",
+  "navigation.skipToMain": "Sări la conținutul principal",
   "noData": "Fără date",
   "operation.add": "Adaugă",
   "operation.added": "Adăugat",
diff --git a/web/i18n/ro-RO/deployments.json b/web/i18n/ro-RO/deployments.json
index 89561b59467..7c457fd79ed 100644
--- a/web/i18n/ro-RO/deployments.json
+++ b/web/i18n/ro-RO/deployments.json
@@ -613,6 +613,7 @@
   "versions.releaseDescriptionLabel": "Descriere",
   "versions.releaseDescriptionPlaceholder": "Descrie această versiune",
   "versions.releaseHistory": "Istoric versiuni",
+  "versions.releaseNameConflict": "Există deja o versiune cu acest nume. Alege alt nume.",
   "versions.releaseNameLabel": "Nume versiune",
   "versions.releaseNamePlaceholder": "Nume versiune",
   "versions.releaseNameRequired": "Introdu un nume pentru versiune.",
diff --git a/web/i18n/ru-RU/agent-v-2.json b/web/i18n/ru-RU/agent-v-2.json
index aec1fc7d82a..3a1575b5dc0 100644
--- a/web/i18n/ru-RU/agent-v-2.json
+++ b/web/i18n/ru-RU/agent-v-2.json
@@ -290,6 +290,7 @@
   "agentDetail.monitoring.dateRangeLabel": "Диапазон дат",
   "agentDetail.monitoring.description": "Отслеживайте активность переиспользуемого агента, затраты и качество взаимодействия в рабочих процессах.",
   "agentDetail.monitoring.learnMore": "Подробнее",
+  "agentDetail.monitoring.loadFailed": "Не удалось загрузить данные мониторинга",
   "agentDetail.monitoring.metrics.activeUsers.explanation": "Уникальные конечные пользователи, запустившие рабочие процессы с этим агентом.",
   "agentDetail.monitoring.metrics.activeUsers.title": "Активные пользователи",
   "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "Количество непрерывных взаимодействий пользователя с агентом для этой точки доступа.",
@@ -328,15 +329,17 @@
   "agentDetail.type": "АГЕНТ",
   "agentDetail.versionHistory.active": "Активная",
   "agentDetail.versionHistory.empty": "Версий пока нет",
+  "agentDetail.versionHistory.exitVersions": "Выйти из версий",
   "agentDetail.versionHistory.filter": "Фильтровать версии",
+  "agentDetail.versionHistory.restore": "Восстановить",
   "agentDetail.versionHistory.versionName": "Версия {{version}}",
+  "agentDetail.versionHistory.viewOnly": "Только просмотр",
   "roster.createAgent": "Создать агента",
   "roster.createAgentOptions": "Варианты создания агента",
   "roster.createDialog.description": "Создайте переиспользуемого агента в Roster этого рабочего пространства.",
   "roster.createDialog.title": "Создать агента",
   "roster.createForm.changeIcon": "Сменить иконку агента",
   "roster.createForm.descriptionLabel": "Описание",
-  "roster.createForm.descriptionOptional": "(необязательно)",
   "roster.createForm.descriptionPlaceholder": "напр. Собирает источники по теме и резюмирует ключевые выводы",
   "roster.createForm.nameLabel": "Имя",
   "roster.createForm.namePlaceholder": "напр. Max",
@@ -350,7 +353,6 @@
   "roster.deleteDialog.title": "Удалить {{name}}?",
   "roster.deleteFailed": "Не удалось удалить агента.",
   "roster.deleteSuccess": "Агент удалён.",
-  "roster.duplicateFailed": "Не удалось продублировать агента.",
   "roster.duplicateSuccess": "Агент продублирован.",
   "roster.editAgent": "Редактировать {{name}}",
   "roster.editDialog.description": "Обновите имя в Roster, описание и роль этого агента.",
diff --git a/web/i18n/ru-RU/app.json b/web/i18n/ru-RU/app.json
index 07ad6215a45..113f175ea95 100644
--- a/web/i18n/ru-RU/app.json
+++ b/web/i18n/ru-RU/app.json
@@ -226,6 +226,7 @@
   "newAppFromTemplate.sidebar.Workflow": "Рабочий процесс",
   "newAppFromTemplate.sidebar.Writing": "Пишущий",
   "noAccessPermission": "Нет разрешения на доступ к веб-приложению",
+  "noAccessResourcePermission": "Нет разрешения на доступ к этому ресурсу",
   "noUserInputNode": "Отсутствует узел ввода пользователя",
   "notPublishedYet": "Приложение ещё не опубликовано",
   "openInExplore": "Открыть в разделе «Обзор»",
diff --git a/web/i18n/ru-RU/common.json b/web/i18n/ru-RU/common.json
index 23b8625b756..c102589aa8e 100644
--- a/web/i18n/ru-RU/common.json
+++ b/web/i18n/ru-RU/common.json
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "Модель преобразования текста в речь",
   "modelProvider.ttsModel.tip": "Установите модель по умолчанию для ввода текста в речь в разговоре.",
   "modelProvider.upgradeForLoadBalancing": "Обновите свой тарифный план, чтобы включить балансировку нагрузки.",
+  "navigation.skipToMain": "Перейти к основному содержанию",
   "noData": "Нет данных",
   "operation.add": "Добавить",
   "operation.added": "Добавлено",
diff --git a/web/i18n/ru-RU/deployments.json b/web/i18n/ru-RU/deployments.json
index a894cdd9540..e4068ec7cd6 100644
--- a/web/i18n/ru-RU/deployments.json
+++ b/web/i18n/ru-RU/deployments.json
@@ -613,6 +613,7 @@
   "versions.releaseDescriptionLabel": "Описание",
   "versions.releaseDescriptionPlaceholder": "Опишите этот Релиз",
   "versions.releaseHistory": "История Релизов",
+  "versions.releaseNameConflict": "Релиз с таким именем уже существует. Выберите другое имя.",
   "versions.releaseNameLabel": "Имя Релиза",
   "versions.releaseNamePlaceholder": "Имя Релиза",
   "versions.releaseNameRequired": "Введите имя Релиза.",
diff --git a/web/i18n/sl-SI/agent-v-2.json b/web/i18n/sl-SI/agent-v-2.json
index 676c86c29df..ba905a3f3ef 100644
--- a/web/i18n/sl-SI/agent-v-2.json
+++ b/web/i18n/sl-SI/agent-v-2.json
@@ -290,6 +290,7 @@
   "agentDetail.monitoring.dateRangeLabel": "Datumsko obdobje",
   "agentDetail.monitoring.description": "Sledite aktivnosti, stroškom in kakovosti interakcije ponovno uporabnega agenta v potekih dela.",
   "agentDetail.monitoring.learnMore": "Več informacij",
+  "agentDetail.monitoring.loadFailed": "Podatkov spremljanja ni bilo mogoče naložiti",
   "agentDetail.monitoring.metrics.activeUsers.explanation": "Edinstveni končni uporabniki, ki so sprožili poteke dela s tem agentom.",
   "agentDetail.monitoring.metrics.activeUsers.title": "Aktivni uporabniki",
   "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "Število neprekinjenih interakcij med uporabnikom in agentom za to dostopno točko.",
@@ -328,15 +329,17 @@
   "agentDetail.type": "AGENT",
   "agentDetail.versionHistory.active": "Aktivna",
   "agentDetail.versionHistory.empty": "Še ni različic",
+  "agentDetail.versionHistory.exitVersions": "Zapusti različice",
   "agentDetail.versionHistory.filter": "Filtriraj različice",
+  "agentDetail.versionHistory.restore": "Obnovi",
   "agentDetail.versionHistory.versionName": "Različica {{version}}",
+  "agentDetail.versionHistory.viewOnly": "Samo ogled",
   "roster.createAgent": "Ustvari agenta",
   "roster.createAgentOptions": "Možnosti ustvarjanja agenta",
   "roster.createDialog.description": "Ustvarite ponovno uporabnega agenta v Roster tega delovnega prostora.",
   "roster.createDialog.title": "Ustvari agenta",
   "roster.createForm.changeIcon": "Spremeni ikono agenta",
   "roster.createForm.descriptionLabel": "Opis",
-  "roster.createForm.descriptionOptional": "(neobvezno)",
   "roster.createForm.descriptionPlaceholder": "npr. Zbira vire o določeni temi in povzame ključne ugotovitve",
   "roster.createForm.nameLabel": "Ime",
   "roster.createForm.namePlaceholder": "npr. Max",
@@ -350,7 +353,6 @@
   "roster.deleteDialog.title": "Izbrišem {{name}}?",
   "roster.deleteFailed": "Agenta ni bilo mogoče izbrisati.",
   "roster.deleteSuccess": "Agent izbrisan.",
-  "roster.duplicateFailed": "Agenta ni bilo mogoče podvojiti.",
   "roster.duplicateSuccess": "Agent podvojen.",
   "roster.editAgent": "Uredi {{name}}",
   "roster.editDialog.description": "Posodobite ime v Roster, opis in vlogo za tega agenta.",
diff --git a/web/i18n/sl-SI/app.json b/web/i18n/sl-SI/app.json
index f4599524d71..f9b21e2169f 100644
--- a/web/i18n/sl-SI/app.json
+++ b/web/i18n/sl-SI/app.json
@@ -226,6 +226,7 @@
   "newAppFromTemplate.sidebar.Workflow": "Potek dela",
   "newAppFromTemplate.sidebar.Writing": "Pisanje",
   "noAccessPermission": "Brez dovoljenja za dostop do spletne aplikacije",
+  "noAccessResourcePermission": "Ni dovoljenja za dostop do tega vira",
   "noUserInputNode": "Manjka vozel uporabniškega vnosa",
   "notPublishedYet": "Aplikacija še ni objavljena",
   "openInExplore": "Odpri v razišči",
diff --git a/web/i18n/sl-SI/common.json b/web/i18n/sl-SI/common.json
index b1a1726d195..f0bf2b62e9c 100644
--- a/web/i18n/sl-SI/common.json
+++ b/web/i18n/sl-SI/common.json
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "Model za pretvorbo besedila v govor",
   "modelProvider.ttsModel.tip": "Nastavite privzeti model za pretvorbo besedila v govor v pogovoru.",
   "modelProvider.upgradeForLoadBalancing": "Nadgradite svoj načrt, da omogočite uravnoteženje obremenitev.",
+  "navigation.skipToMain": "Preskoči na glavno vsebino",
   "noData": "Ni podatkov",
   "operation.add": "Dodaj",
   "operation.added": "Dodano",
diff --git a/web/i18n/sl-SI/deployments.json b/web/i18n/sl-SI/deployments.json
index 772292ad84e..23ab97ac897 100644
--- a/web/i18n/sl-SI/deployments.json
+++ b/web/i18n/sl-SI/deployments.json
@@ -613,6 +613,7 @@
   "versions.releaseDescriptionLabel": "Opis",
   "versions.releaseDescriptionPlaceholder": "Opišite to izdajo",
   "versions.releaseHistory": "Zgodovina izdaj",
+  "versions.releaseNameConflict": "Izdaja s tem imenom že obstaja. Izberite drugo ime.",
   "versions.releaseNameLabel": "Ime izdaje",
   "versions.releaseNamePlaceholder": "Ime izdaje",
   "versions.releaseNameRequired": "Vnesite ime izdaje.",
diff --git a/web/i18n/th-TH/agent-v-2.json b/web/i18n/th-TH/agent-v-2.json
index 9f29760392a..125a5c67e19 100644
--- a/web/i18n/th-TH/agent-v-2.json
+++ b/web/i18n/th-TH/agent-v-2.json
@@ -290,6 +290,7 @@
   "agentDetail.monitoring.dateRangeLabel": "ช่วงวันที่",
   "agentDetail.monitoring.description": "ติดตามกิจกรรม ค่าใช้จ่าย และคุณภาพการโต้ตอบของตัวแทนที่นำกลับมาใช้ใหม่ในเวิร์กโฟลว์ต่าง ๆ",
   "agentDetail.monitoring.learnMore": "เรียนรู้เพิ่มเติม",
+  "agentDetail.monitoring.loadFailed": "โหลดข้อมูลการมอนิเตอร์ไม่สำเร็จ",
   "agentDetail.monitoring.metrics.activeUsers.explanation": "ผู้ใช้ปลายทางที่ไม่ซ้ำกันซึ่งทริกเกอร์เวิร์กโฟลว์โดยใช้ตัวแทนนี้",
   "agentDetail.monitoring.metrics.activeUsers.title": "ผู้ใช้ที่ใช้งานอยู่",
   "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "จำนวนการสื่อสารต่อเนื่องระหว่างผู้ใช้กับตัวแทนสำหรับจุดเข้าถึงนี้",
@@ -328,15 +329,17 @@
   "agentDetail.type": "ตัวแทน",
   "agentDetail.versionHistory.active": "ใช้งานอยู่",
   "agentDetail.versionHistory.empty": "ยังไม่มีเวอร์ชัน",
+  "agentDetail.versionHistory.exitVersions": "ออกจากเวอร์ชัน",
   "agentDetail.versionHistory.filter": "กรองเวอร์ชัน",
+  "agentDetail.versionHistory.restore": "กู้คืน",
   "agentDetail.versionHistory.versionName": "เวอร์ชัน {{version}}",
+  "agentDetail.versionHistory.viewOnly": "ดูเท่านั้น",
   "roster.createAgent": "สร้างตัวแทน",
   "roster.createAgentOptions": "ตัวเลือกการสร้างตัวแทน",
   "roster.createDialog.description": "สร้างตัวแทนที่นำกลับมาใช้ใหม่ได้ใน Roster ของเวิร์กสเปซนี้",
   "roster.createDialog.title": "สร้างตัวแทน",
   "roster.createForm.changeIcon": "เปลี่ยนไอคอนตัวแทน",
   "roster.createForm.descriptionLabel": "คำอธิบาย",
-  "roster.createForm.descriptionOptional": "(ตัวเลือก)",
   "roster.createForm.descriptionPlaceholder": "เช่น รวบรวมแหล่งข้อมูลในหัวข้อหนึ่งและสรุปผลสำคัญ",
   "roster.createForm.nameLabel": "ชื่อ",
   "roster.createForm.namePlaceholder": "เช่น Max",
@@ -350,7 +353,6 @@
   "roster.deleteDialog.title": "ลบ {{name}} หรือไม่",
   "roster.deleteFailed": "ลบตัวแทนไม่สำเร็จ",
   "roster.deleteSuccess": "ลบตัวแทนแล้ว",
-  "roster.duplicateFailed": "ทำสำเนาตัวแทนไม่สำเร็จ",
   "roster.duplicateSuccess": "ทำสำเนาตัวแทนแล้ว",
   "roster.editAgent": "แก้ไข {{name}}",
   "roster.editDialog.description": "อัปเดตชื่อ คำอธิบาย และบทบาทใน Roster สำหรับตัวแทนนี้",
diff --git a/web/i18n/th-TH/app.json b/web/i18n/th-TH/app.json
index a6f5034b80c..ad7df05fccc 100644
--- a/web/i18n/th-TH/app.json
+++ b/web/i18n/th-TH/app.json
@@ -226,6 +226,7 @@
   "newAppFromTemplate.sidebar.Workflow": "เวิร์กโฟลว์",
   "newAppFromTemplate.sidebar.Writing": "การเขียน",
   "noAccessPermission": "ไม่มีสิทธิ์เข้าถึงเว็บแอป",
+  "noAccessResourcePermission": "ไม่มีสิทธิ์เข้าถึงทรัพยากรนี้",
   "noUserInputNode": "ไม่มีโหนดป้อนข้อมูลผู้ใช้",
   "notPublishedYet": "แอปยังไม่ได้เผยแพร่",
   "openInExplore": "เปิดใน Explore",
diff --git a/web/i18n/th-TH/common.json b/web/i18n/th-TH/common.json
index d05b8b38a08..89776e7e116 100644
--- a/web/i18n/th-TH/common.json
+++ b/web/i18n/th-TH/common.json
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "โมเดลการแปลงข้อความเป็นคําพูด",
   "modelProvider.ttsModel.tip": "ตั้งค่าโมเดลเริ่มต้นสําหรับการป้อนข้อมูลเป็นข้อความเป็นคําพูดในการสนทนา",
   "modelProvider.upgradeForLoadBalancing": "อัปเกรดแผนของคุณเพื่อเปิดใช้งานการปรับสมดุลโหลด",
+  "navigation.skipToMain": "ข้ามไปยังเนื้อหาหลัก",
   "noData": "ไม่มีข้อมูล",
   "operation.add": "เพิ่ม",
   "operation.added": "เพิ่ม",
diff --git a/web/i18n/th-TH/deployments.json b/web/i18n/th-TH/deployments.json
index 0f3d06073df..a4dd323b269 100644
--- a/web/i18n/th-TH/deployments.json
+++ b/web/i18n/th-TH/deployments.json
@@ -613,6 +613,7 @@
   "versions.releaseDescriptionLabel": "คำอธิบาย",
   "versions.releaseDescriptionPlaceholder": "อธิบายรีลีสนี้",
   "versions.releaseHistory": "ประวัติรีลีส",
+  "versions.releaseNameConflict": "มีรีลีสชื่อนี้อยู่แล้ว โปรดเลือกชื่ออื่น",
   "versions.releaseNameLabel": "ชื่อรีลีส",
   "versions.releaseNamePlaceholder": "ชื่อรีลีส",
   "versions.releaseNameRequired": "ป้อนชื่อรีลีส",
diff --git a/web/i18n/tr-TR/agent-v-2.json b/web/i18n/tr-TR/agent-v-2.json
index 6c307a360ef..12fe5d5f6c3 100644
--- a/web/i18n/tr-TR/agent-v-2.json
+++ b/web/i18n/tr-TR/agent-v-2.json
@@ -290,6 +290,7 @@
   "agentDetail.monitoring.dateRangeLabel": "Tarih aralığı",
   "agentDetail.monitoring.description": "İş akışlarındaki yeniden kullanılabilir ajan etkinliğini, maliyetini ve etkileşim kalitesini izleyin.",
   "agentDetail.monitoring.learnMore": "Daha fazla bilgi",
+  "agentDetail.monitoring.loadFailed": "İzleme verileri yüklenemedi",
   "agentDetail.monitoring.metrics.activeUsers.explanation": "Bu ajanı kullanarak iş akışlarını tetikleyen benzersiz son kullanıcılar.",
   "agentDetail.monitoring.metrics.activeUsers.title": "Aktif Kullanıcılar",
   "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "Bu erişim noktası için sürekli kullanıcı-ajan iletişim sayısı.",
@@ -328,15 +329,17 @@
   "agentDetail.type": "AJAN",
   "agentDetail.versionHistory.active": "Aktif",
   "agentDetail.versionHistory.empty": "Henüz sürüm yok",
+  "agentDetail.versionHistory.exitVersions": "Sürümlerden çık",
   "agentDetail.versionHistory.filter": "Sürümleri filtrele",
+  "agentDetail.versionHistory.restore": "Geri yükle",
   "agentDetail.versionHistory.versionName": "Sürüm {{version}}",
+  "agentDetail.versionHistory.viewOnly": "Yalnızca görüntüle",
   "roster.createAgent": "Ajan oluştur",
   "roster.createAgentOptions": "Ajan oluşturma seçenekleri",
   "roster.createDialog.description": "Bu çalışma alanı Roster'ında yeniden kullanılabilir bir ajan oluşturun.",
   "roster.createDialog.title": "Ajan oluştur",
   "roster.createForm.changeIcon": "Ajan simgesini değiştir",
   "roster.createForm.descriptionLabel": "Açıklama",
-  "roster.createForm.descriptionOptional": "(isteğe bağlı)",
   "roster.createForm.descriptionPlaceholder": "örn. Bir konuda kaynak toplar ve temel bulguları özetler",
   "roster.createForm.nameLabel": "Ad",
   "roster.createForm.namePlaceholder": "örn. Max",
@@ -350,7 +353,6 @@
   "roster.deleteDialog.title": "{{name}} silinsin mi?",
   "roster.deleteFailed": "Ajan silinemedi.",
   "roster.deleteSuccess": "Ajan silindi.",
-  "roster.duplicateFailed": "Ajan çoğaltılamadı.",
   "roster.duplicateSuccess": "Ajan çoğaltıldı.",
   "roster.editAgent": "{{name}} düzenle",
   "roster.editDialog.description": "Bu ajan için Roster adı, açıklaması ve rolünü güncelleyin.",
diff --git a/web/i18n/tr-TR/app.json b/web/i18n/tr-TR/app.json
index ffb77396d3c..df83be5099d 100644
--- a/web/i18n/tr-TR/app.json
+++ b/web/i18n/tr-TR/app.json
@@ -226,6 +226,7 @@
   "newAppFromTemplate.sidebar.Workflow": "İş Akışı",
   "newAppFromTemplate.sidebar.Writing": "Yazı",
   "noAccessPermission": "Web uygulamasına erişim izni yok",
+  "noAccessResourcePermission": "Bu kaynağa erişim izniniz yok",
   "noUserInputNode": "Eksik kullanıcı girdi düğümü",
   "notPublishedYet": "Uygulama henüz yayımlanmadı",
   "openInExplore": "Keşfet'te Aç",
diff --git a/web/i18n/tr-TR/common.json b/web/i18n/tr-TR/common.json
index 5b0fb47bdb8..e629e783b23 100644
--- a/web/i18n/tr-TR/common.json
+++ b/web/i18n/tr-TR/common.json
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "Metinden Konuşmaya Modeli",
   "modelProvider.ttsModel.tip": "Konuşmada metinden konuşmaya giriş için varsayılan modeli ayarlayın.",
   "modelProvider.upgradeForLoadBalancing": "Yük Dengelemeyi etkinleştirmek için planınızı yükseltin.",
+  "navigation.skipToMain": "Ana içeriğe geç",
   "noData": "Veri yok",
   "operation.add": "Ekle",
   "operation.added": "Eklendi",
diff --git a/web/i18n/tr-TR/deployments.json b/web/i18n/tr-TR/deployments.json
index 644659f9dc9..3110f29c77d 100644
--- a/web/i18n/tr-TR/deployments.json
+++ b/web/i18n/tr-TR/deployments.json
@@ -613,6 +613,7 @@
   "versions.releaseDescriptionLabel": "Açıklama",
   "versions.releaseDescriptionPlaceholder": "Bu sürümü açıklayın",
   "versions.releaseHistory": "Sürüm geçmişi",
+  "versions.releaseNameConflict": "Bu ada sahip bir sürüm zaten var. Başka bir ad seçin.",
   "versions.releaseNameLabel": "Sürüm Adı",
   "versions.releaseNamePlaceholder": "Sürüm Adı",
   "versions.releaseNameRequired": "Bir sürüm adı girin.",
diff --git a/web/i18n/uk-UA/agent-v-2.json b/web/i18n/uk-UA/agent-v-2.json
index 09c78652bd0..be0e55dc89a 100644
--- a/web/i18n/uk-UA/agent-v-2.json
+++ b/web/i18n/uk-UA/agent-v-2.json
@@ -290,6 +290,7 @@
   "agentDetail.monitoring.dateRangeLabel": "Діапазон дат",
   "agentDetail.monitoring.description": "Відстежуйте активність перевикористовного агента, вартість і якість взаємодії в робочих процесах.",
   "agentDetail.monitoring.learnMore": "Дізнатися більше",
+  "agentDetail.monitoring.loadFailed": "Не вдалося завантажити дані моніторингу",
   "agentDetail.monitoring.metrics.activeUsers.explanation": "Унікальні кінцеві користувачі, що запускали робочі процеси з цим агентом.",
   "agentDetail.monitoring.metrics.activeUsers.title": "Активні користувачі",
   "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "Кількість безперервних взаємодій користувача з агентом для цієї точки доступу.",
@@ -328,15 +329,17 @@
   "agentDetail.type": "АГЕНТ",
   "agentDetail.versionHistory.active": "Активна",
   "agentDetail.versionHistory.empty": "Поки що немає версій",
+  "agentDetail.versionHistory.exitVersions": "Вийти з версій",
   "agentDetail.versionHistory.filter": "Фільтрувати версії",
+  "agentDetail.versionHistory.restore": "Відновити",
   "agentDetail.versionHistory.versionName": "Версія {{version}}",
+  "agentDetail.versionHistory.viewOnly": "Лише перегляд",
   "roster.createAgent": "Створити агента",
   "roster.createAgentOptions": "Варіанти створення агента",
   "roster.createDialog.description": "Створіть перевикористовного агента в Roster цього робочого простору.",
   "roster.createDialog.title": "Створити агента",
   "roster.createForm.changeIcon": "Змінити іконку агента",
   "roster.createForm.descriptionLabel": "Опис",
-  "roster.createForm.descriptionOptional": "(необов'язково)",
   "roster.createForm.descriptionPlaceholder": "напр. Збирає джерела за темою та підсумовує ключові висновки",
   "roster.createForm.nameLabel": "Ім'я",
   "roster.createForm.namePlaceholder": "напр. Max",
@@ -350,7 +353,6 @@
   "roster.deleteDialog.title": "Видалити {{name}}?",
   "roster.deleteFailed": "Не вдалося видалити агента.",
   "roster.deleteSuccess": "Агента видалено.",
-  "roster.duplicateFailed": "Не вдалося продублювати агента.",
   "roster.duplicateSuccess": "Агента продубльовано.",
   "roster.editAgent": "Редагувати {{name}}",
   "roster.editDialog.description": "Оновіть ім'я в Roster, опис і роль для цього агента.",
diff --git a/web/i18n/uk-UA/app.json b/web/i18n/uk-UA/app.json
index 2bdcb3b71bb..8e094f1a976 100644
--- a/web/i18n/uk-UA/app.json
+++ b/web/i18n/uk-UA/app.json
@@ -226,6 +226,7 @@
   "newAppFromTemplate.sidebar.Workflow": "Робочий процес",
   "newAppFromTemplate.sidebar.Writing": "Написання",
   "noAccessPermission": "Немає дозволу на доступ до веб-додатку",
+  "noAccessResourcePermission": "Немає дозволу на доступ до цього ресурсу",
   "noUserInputNode": "Відсутній вузол введення користувача",
   "notPublishedYet": "Додаток ще не опублікований",
   "openInExplore": "Відкрити в Огляді",
diff --git a/web/i18n/uk-UA/common.json b/web/i18n/uk-UA/common.json
index 9c10c3a9610..c9876452149 100644
--- a/web/i18n/uk-UA/common.json
+++ b/web/i18n/uk-UA/common.json
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "Модель перетворення тексту в мовлення",
   "modelProvider.ttsModel.tip": "Встановіть модель за замовчуванням для введення тексту в мовлення в розмові.",
   "modelProvider.upgradeForLoadBalancing": "Оновіть свій план, щоб увімкнути балансування навантаження.",
+  "navigation.skipToMain": "Перейти до основного вмісту",
   "noData": "Немає даних",
   "operation.add": "Додати",
   "operation.added": "Додано",
diff --git a/web/i18n/uk-UA/deployments.json b/web/i18n/uk-UA/deployments.json
index 7742e37e0fa..be4d773dcba 100644
--- a/web/i18n/uk-UA/deployments.json
+++ b/web/i18n/uk-UA/deployments.json
@@ -613,6 +613,7 @@
   "versions.releaseDescriptionLabel": "Опис",
   "versions.releaseDescriptionPlaceholder": "Опишіть цей реліз",
   "versions.releaseHistory": "Історія релізів",
+  "versions.releaseNameConflict": "Реліз із такою назвою вже існує. Виберіть іншу назву.",
   "versions.releaseNameLabel": "Назва Релізу",
   "versions.releaseNamePlaceholder": "Назва Релізу",
   "versions.releaseNameRequired": "Введіть назву релізу.",
diff --git a/web/i18n/vi-VN/agent-v-2.json b/web/i18n/vi-VN/agent-v-2.json
index e0cfb6a2112..49f68791572 100644
--- a/web/i18n/vi-VN/agent-v-2.json
+++ b/web/i18n/vi-VN/agent-v-2.json
@@ -290,6 +290,7 @@
   "agentDetail.monitoring.dateRangeLabel": "Khoảng ngày",
   "agentDetail.monitoring.description": "Theo dõi hoạt động, chi phí và chất lượng tương tác của tác nhân có thể tái sử dụng trên các quy trình làm việc.",
   "agentDetail.monitoring.learnMore": "Tìm hiểu thêm",
+  "agentDetail.monitoring.loadFailed": "Không tải được dữ liệu giám sát",
   "agentDetail.monitoring.metrics.activeUsers.explanation": "Số người dùng cuối duy nhất đã kích hoạt các quy trình làm việc sử dụng tác nhân này.",
   "agentDetail.monitoring.metrics.activeUsers.title": "Người dùng đang hoạt động",
   "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "Số lần giao tiếp liên tục giữa người dùng và tác nhân cho điểm truy cập này.",
@@ -328,15 +329,17 @@
   "agentDetail.type": "TÁC NHÂN",
   "agentDetail.versionHistory.active": "Đang hoạt động",
   "agentDetail.versionHistory.empty": "Chưa có phiên bản nào",
+  "agentDetail.versionHistory.exitVersions": "Thoát phiên bản",
   "agentDetail.versionHistory.filter": "Lọc phiên bản",
+  "agentDetail.versionHistory.restore": "Khôi phục",
   "agentDetail.versionHistory.versionName": "Phiên bản {{version}}",
+  "agentDetail.versionHistory.viewOnly": "Chỉ xem",
   "roster.createAgent": "Tạo tác nhân",
   "roster.createAgentOptions": "Tùy chọn tạo tác nhân",
   "roster.createDialog.description": "Tạo một tác nhân có thể tái sử dụng trong Roster của không gian làm việc này.",
   "roster.createDialog.title": "Tạo tác nhân",
   "roster.createForm.changeIcon": "Đổi biểu tượng tác nhân",
   "roster.createForm.descriptionLabel": "Mô tả",
-  "roster.createForm.descriptionOptional": "(tùy chọn)",
   "roster.createForm.descriptionPlaceholder": "ví dụ: Thu thập nguồn về một chủ đề và tóm tắt các phát hiện chính",
   "roster.createForm.nameLabel": "Tên",
   "roster.createForm.namePlaceholder": "ví dụ: Max",
@@ -350,7 +353,6 @@
   "roster.deleteDialog.title": "Xóa {{name}}?",
   "roster.deleteFailed": "Xóa tác nhân thất bại.",
   "roster.deleteSuccess": "Đã xóa tác nhân.",
-  "roster.duplicateFailed": "Nhân bản tác nhân thất bại.",
   "roster.duplicateSuccess": "Đã nhân bản tác nhân.",
   "roster.editAgent": "Chỉnh sửa {{name}}",
   "roster.editDialog.description": "Cập nhật tên, mô tả và vai trò Roster cho tác nhân này.",
diff --git a/web/i18n/vi-VN/app.json b/web/i18n/vi-VN/app.json
index 41ca574c10b..7f24485445a 100644
--- a/web/i18n/vi-VN/app.json
+++ b/web/i18n/vi-VN/app.json
@@ -226,6 +226,7 @@
   "newAppFromTemplate.sidebar.Workflow": "Quy trình làm việc",
   "newAppFromTemplate.sidebar.Writing": "Văn",
   "noAccessPermission": "Không được phép truy cập ứng dụng web",
+  "noAccessResourcePermission": "Không có quyền truy cập tài nguyên này",
   "noUserInputNode": "Thiếu nút nhập liệu của người dùng",
   "notPublishedYet": "Ứng dụng chưa được phát hành",
   "openInExplore": "Mở trong Khám phá",
diff --git a/web/i18n/vi-VN/common.json b/web/i18n/vi-VN/common.json
index 6f9566bf197..2f2f3b1a5c4 100644
--- a/web/i18n/vi-VN/common.json
+++ b/web/i18n/vi-VN/common.json
@@ -516,6 +516,7 @@
   "modelProvider.ttsModel.key": "Mô hình Văn bản thành Tiếng nói",
   "modelProvider.ttsModel.tip": "Thiết lập mô hình mặc định cho đầu vào văn bản thành tiếng nói trong cuộc trò chuyện.",
   "modelProvider.upgradeForLoadBalancing": "Nâng cấp gói của bạn để bật Cân bằng tải.",
+  "navigation.skipToMain": "Chuyển đến nội dung chính",
   "noData": "Không có dữ liệu",
   "operation.add": "Thêm",
   "operation.added": "Đã thêm",
diff --git a/web/i18n/vi-VN/deployments.json b/web/i18n/vi-VN/deployments.json
index 30fa31f5605..8667456a7b1 100644
--- a/web/i18n/vi-VN/deployments.json
+++ b/web/i18n/vi-VN/deployments.json
@@ -613,6 +613,7 @@
   "versions.releaseDescriptionLabel": "Mô tả",
   "versions.releaseDescriptionPlaceholder": "Mô tả bản phát hành này",
   "versions.releaseHistory": "Lịch sử bản phát hành",
+  "versions.releaseNameConflict": "Tên bản phát hành này đã tồn tại. Hãy chọn tên khác.",
   "versions.releaseNameLabel": "Tên bản phát hành",
   "versions.releaseNamePlaceholder": "Tên bản phát hành",
   "versions.releaseNameRequired": "Vui lòng nhập tên bản phát hành.",
diff --git a/web/i18n/zh-Hans/agent-v-2.json b/web/i18n/zh-Hans/agent-v-2.json
index 32a51de221d..4ffb014a409 100644
--- a/web/i18n/zh-Hans/agent-v-2.json
+++ b/web/i18n/zh-Hans/agent-v-2.json
@@ -290,6 +290,7 @@
   "agentDetail.monitoring.dateRangeLabel": "日期范围",
   "agentDetail.monitoring.description": "跟踪可复用智能体在工作流中的活跃度、成本和交互质量。",
   "agentDetail.monitoring.learnMore": "了解更多",
+  "agentDetail.monitoring.loadFailed": "监控数据加载失败",
   "agentDetail.monitoring.metrics.activeUsers.explanation": "触发过使用此智能体的工作流的独立终端用户数。",
   "agentDetail.monitoring.metrics.activeUsers.title": "活跃用户",
   "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "此访问入口下用户与智能体的连续沟通次数。",
@@ -328,15 +329,17 @@
   "agentDetail.type": "智能体",
   "agentDetail.versionHistory.active": "当前",
   "agentDetail.versionHistory.empty": "暂无版本",
+  "agentDetail.versionHistory.exitVersions": "退出版本",
   "agentDetail.versionHistory.filter": "筛选版本",
+  "agentDetail.versionHistory.restore": "还原",
   "agentDetail.versionHistory.versionName": "版本 {{version}}",
+  "agentDetail.versionHistory.viewOnly": "只读",
   "roster.createAgent": "创建智能体",
   "roster.createAgentOptions": "创建智能体选项",
   "roster.createDialog.description": "在当前工作区 Roster 中创建一个可复用智能体。",
   "roster.createDialog.title": "创建智能体",
   "roster.createForm.changeIcon": "更换智能体图标",
   "roster.createForm.descriptionLabel": "描述",
-  "roster.createForm.descriptionOptional": "（可选）",
   "roster.createForm.descriptionPlaceholder": "例如：收集某个主题的来源资料并总结关键发现",
   "roster.createForm.nameLabel": "名称",
   "roster.createForm.namePlaceholder": "例如：Max",
@@ -350,7 +353,9 @@
   "roster.deleteDialog.title": "删除 {{name}}？",
   "roster.deleteFailed": "智能体删除失败。",
   "roster.deleteSuccess": "智能体已删除。",
-  "roster.duplicateFailed": "智能体复制失败。",
+  "roster.duplicateDialog.description": "创建 {{name}} 的副本，并自定义它在 Roster 中的身份信息。",
+  "roster.duplicateDialog.title": "复制智能体",
+  "roster.duplicateForm.changeIcon": "更换 {{name}} 副本的图标",
   "roster.duplicateSuccess": "智能体已复制。",
   "roster.editAgent": "编辑 {{name}}",
   "roster.editDialog.description": "更新此智能体在 Roster 中的名称、描述和角色。",
diff --git a/web/i18n/zh-Hans/app.json b/web/i18n/zh-Hans/app.json
index 640b54e0987..7ccfc67174e 100644
--- a/web/i18n/zh-Hans/app.json
+++ b/web/i18n/zh-Hans/app.json
@@ -226,6 +226,7 @@
   "newAppFromTemplate.sidebar.Workflow": "工作流",
   "newAppFromTemplate.sidebar.Writing": "写作",
   "noAccessPermission": "没有权限访问 web 应用",
+  "noAccessResourcePermission": "当前无权限访问该资源",
   "noUserInputNode": "缺少用户输入节点",
   "notPublishedYet": "应用暂未发布",
   "openInExplore": "在“探索”中打开",
diff --git a/web/i18n/zh-Hans/common.json b/web/i18n/zh-Hans/common.json
index ec6c72cc701..b7886a2c11b 100644
--- a/web/i18n/zh-Hans/common.json
+++ b/web/i18n/zh-Hans/common.json
@@ -544,6 +544,7 @@
   "modelProvider.ttsModel.key": "文本转语音模型",
   "modelProvider.ttsModel.tip": "设置对话中文字转语音输出的默认使用模型。",
   "modelProvider.upgradeForLoadBalancing": "升级以解锁负载均衡功能",
+  "navigation.skipToMain": "跳转到主要内容",
   "noData": "暂无数据",
   "operation.add": "添加",
   "operation.added": "已添加",
diff --git a/web/i18n/zh-Hans/deployments.json b/web/i18n/zh-Hans/deployments.json
index 9d80044e6f8..86588f33674 100644
--- a/web/i18n/zh-Hans/deployments.json
+++ b/web/i18n/zh-Hans/deployments.json
@@ -613,6 +613,7 @@
   "versions.releaseDescriptionLabel": "描述",
   "versions.releaseDescriptionPlaceholder": "描述这个版本",
   "versions.releaseHistory": "版本历史",
+  "versions.releaseNameConflict": "此版本名称已存在，请选择其他名称。",
   "versions.releaseNameLabel": "版本名称",
   "versions.releaseNamePlaceholder": "版本名称",
   "versions.releaseNameRequired": "请输入版本名称。",
diff --git a/web/i18n/zh-Hans/permission-keys.json b/web/i18n/zh-Hans/permission-keys.json
index 08154da397a..2c6f06ffc12 100644
--- a/web/i18n/zh-Hans/permission-keys.json
+++ b/web/i18n/zh-Hans/permission-keys.json
@@ -16,8 +16,9 @@
   "billing.manage": "更换订阅套餐",
   "billing.subscription.manage": "在账单门户管理账单与订阅方案",
   "billing.view": "在设置中访问账单页面",
-  "credential.manage": "管理凭据",
-  "credential.use": "使用凭据",
+  "credential.create": "添加凭据",
+  "credential.manage": "编辑和删除凭据",
+  "credential.use": "查看和使用凭据",
   "customization.manage": "管理定制",
   "data_source.manage": "管理数据来源",
   "dataset.access_config": "配置知识库访问权限",
diff --git a/web/i18n/zh-Hans/permission.json b/web/i18n/zh-Hans/permission.json
index 4229276f1ac..21c308de084 100644
--- a/web/i18n/zh-Hans/permission.json
+++ b/web/i18n/zh-Hans/permission.json
@@ -46,6 +46,7 @@
   "group.credential": "凭据",
   "group.dataset": "知识库",
   "group.dataset_acl": "知识库访问权限",
+  "group.integration": "集成",
   "group.plugin": "插件",
   "group.tool_mcp": "工具与MCP",
   "group.workspace": "工作空间",
diff --git a/web/i18n/zh-Hant/agent-v-2.json b/web/i18n/zh-Hant/agent-v-2.json
index 4144843418c..063ca6d516e 100644
--- a/web/i18n/zh-Hant/agent-v-2.json
+++ b/web/i18n/zh-Hant/agent-v-2.json
@@ -290,6 +290,7 @@
   "agentDetail.monitoring.dateRangeLabel": "日期範圍",
   "agentDetail.monitoring.description": "追蹤可複用智能體在工作流程中的活躍度、成本和互動品質。",
   "agentDetail.monitoring.learnMore": "了解更多",
+  "agentDetail.monitoring.loadFailed": "監控資料載入失敗",
   "agentDetail.monitoring.metrics.activeUsers.explanation": "觸發過使用此智能體的工作流程的獨立終端使用者數。",
   "agentDetail.monitoring.metrics.activeUsers.title": "活躍使用者",
   "agentDetail.monitoring.metrics.avgSessionInteractions.explanation": "此存取入口下使用者與智能體的連續溝通次數。",
@@ -328,15 +329,17 @@
   "agentDetail.type": "智能體",
   "agentDetail.versionHistory.active": "目前",
   "agentDetail.versionHistory.empty": "暫無版本",
+  "agentDetail.versionHistory.exitVersions": "退出版本",
   "agentDetail.versionHistory.filter": "篩選版本",
+  "agentDetail.versionHistory.restore": "還原",
   "agentDetail.versionHistory.versionName": "版本 {{version}}",
+  "agentDetail.versionHistory.viewOnly": "唯讀",
   "roster.createAgent": "建立智能體",
   "roster.createAgentOptions": "建立智能體選項",
   "roster.createDialog.description": "在目前工作區 Roster 中建立一個可複用智能體。",
   "roster.createDialog.title": "建立智能體",
   "roster.createForm.changeIcon": "更換智能體圖示",
   "roster.createForm.descriptionLabel": "描述",
-  "roster.createForm.descriptionOptional": "（選用）",
   "roster.createForm.descriptionPlaceholder": "例如：收集某個主題的來源資料並總結關鍵發現",
   "roster.createForm.nameLabel": "名稱",
   "roster.createForm.namePlaceholder": "例如：Max",
@@ -350,7 +353,6 @@
   "roster.deleteDialog.title": "刪除 {{name}}？",
   "roster.deleteFailed": "智能體刪除失敗。",
   "roster.deleteSuccess": "智能體已刪除。",
-  "roster.duplicateFailed": "智能體複製失敗。",
   "roster.duplicateSuccess": "智能體已複製。",
   "roster.editAgent": "編輯 {{name}}",
   "roster.editDialog.description": "更新此智能體在 Roster 中的名稱、描述和角色。",
diff --git a/web/i18n/zh-Hant/app.json b/web/i18n/zh-Hant/app.json
index b989a327960..5d5dc6e26a1 100644
--- a/web/i18n/zh-Hant/app.json
+++ b/web/i18n/zh-Hant/app.json
@@ -226,6 +226,7 @@
   "newAppFromTemplate.sidebar.Workflow": "工作流",
   "newAppFromTemplate.sidebar.Writing": "寫作",
   "noAccessPermission": "沒有權限訪問網絡應用程式",
+  "noAccessResourcePermission": "目前沒有權限訪問此資源",
   "noUserInputNode": "缺少使用者輸入節點",
   "notPublishedYet": "應用程式尚未發布",
   "openInExplore": "在“探索”中打開",
diff --git a/web/i18n/zh-Hant/common.json b/web/i18n/zh-Hant/common.json
index 9a9aae7746b..ec0a0c86c9c 100644
--- a/web/i18n/zh-Hant/common.json
+++ b/web/i18n/zh-Hant/common.json
@@ -544,6 +544,7 @@
   "modelProvider.ttsModel.key": "文字轉語音模型",
   "modelProvider.ttsModel.tip": "設定對話中文字轉語音輸出的預設使用模型。",
   "modelProvider.upgradeForLoadBalancing": "升級您的計劃以啟用 Load Balancing。",
+  "navigation.skipToMain": "跳至主要內容",
   "noData": "無資料",
   "operation.add": "新增",
   "operation.added": "已新增",
diff --git a/web/i18n/zh-Hant/deployments.json b/web/i18n/zh-Hant/deployments.json
index a396b0dd230..b9f29a25fbd 100644
--- a/web/i18n/zh-Hant/deployments.json
+++ b/web/i18n/zh-Hant/deployments.json
@@ -613,6 +613,7 @@
   "versions.releaseDescriptionLabel": "描述",
   "versions.releaseDescriptionPlaceholder": "描述此版本",
   "versions.releaseHistory": "版本歷史",
+  "versions.releaseNameConflict": "此版本名稱已存在，請選擇其他名稱。",
   "versions.releaseNameLabel": "版本名稱",
   "versions.releaseNamePlaceholder": "版本名稱",
   "versions.releaseNameRequired": "請輸入版本名稱。",
diff --git a/web/i18n/zh-Hant/permission-keys.json b/web/i18n/zh-Hant/permission-keys.json
index 08830764bf1..92058d576c9 100644
--- a/web/i18n/zh-Hant/permission-keys.json
+++ b/web/i18n/zh-Hant/permission-keys.json
@@ -16,8 +16,9 @@
   "billing.manage": "更換訂閱套餐",
   "billing.subscription.manage": "在帳單入口網站管理帳單與訂閱方案",
   "billing.view": "在設定中訪問帳單頁面",
-  "credential.manage": "管理憑據",
-  "credential.use": "使用憑據",
+  "credential.create": "新增憑據",
+  "credential.manage": "編輯和刪除憑據",
+  "credential.use": "檢視和使用憑據",
   "customization.manage": "管理自訂",
   "data_source.manage": "管理資料來源配置",
   "dataset.access_config": "配置知識庫訪問權限",
diff --git a/web/i18n/zh-Hant/permission.json b/web/i18n/zh-Hant/permission.json
index 098c432bd10..28e90a4b902 100644
--- a/web/i18n/zh-Hant/permission.json
+++ b/web/i18n/zh-Hant/permission.json
@@ -46,6 +46,7 @@
   "group.credential": "憑據",
   "group.dataset": "知識庫",
   "group.dataset_acl": "知識庫訪問權限",
+  "group.integration": "整合",
   "group.plugin": "插件",
   "group.tool_mcp": "工具與MCP",
   "group.workspace": "工作空間",
diff --git a/web/package.json b/web/package.json
index 686bc5b04b1..e23b638d3ee 100644
--- a/web/package.json
+++ b/web/package.json
@@ -73,6 +73,7 @@
     "@svgdotjs/svg.js": "catalog:",
     "@t3-oss/env-nextjs": "catalog:",
     "@tailwindcss/typography": "catalog:",
+    "@tanstack/form-core": "catalog:",
     "@tanstack/query-core": "catalog:",
     "@tanstack/react-form": "catalog:",
     "@tanstack/react-hotkeys": "catalog:",
@@ -106,6 +107,7 @@
     "immer": "catalog:",
     "jotai": "catalog:",
     "jotai-scope": "catalog:",
+    "jotai-tanstack-form": "workspace:*",
     "jotai-tanstack-query": "catalog:",
     "js-audio-recorder": "catalog:",
     "js-cookie": "catalog:",
diff --git a/web/scripts/gen-doc-paths.ts b/web/scripts/gen-doc-paths.ts
index c972a33a08f..5eb3c29db17 100644
--- a/web/scripts/gen-doc-paths.ts
+++ b/web/scripts/gen-doc-paths.ts
@@ -11,7 +11,8 @@ import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
-const DOCS_JSON_URL = 'https://raw.githubusercontent.com/langgenius/dify-docs/refs/heads/main/docs.json'
+const DEFAULT_DOCS_JSON_URL = 'https://raw.githubusercontent.com/langgenius/dify-docs/refs/heads/main/docs.json'
+const DOCS_JSON_URL = process.env.DOCS_JSON_URL || DEFAULT_DOCS_JSON_URL
 const OUTPUT_PATH = path.resolve(__dirname, '../types/doc-paths.ts')
 
 type NavItem = string | NavObject | NavItem[]
@@ -21,6 +22,9 @@ type NavObject = {
   groups?: NavItem[]
   dropdowns?: NavItem[]
   languages?: NavItem[]
+  products?: NavItem[]
+  tabs?: NavItem[]
+  menu?: NavItem[]
   versions?: NavItem[]
   openapi?: string
   [key: string]: unknown
@@ -58,7 +62,15 @@ type DocsJson = {
   [key: string]: unknown
 }
 
-const OPENAPI_BASE_URL = 'https://raw.githubusercontent.com/langgenius/dify-docs/refs/heads/main/'
+const OPENAPI_BASE_URL = (process.env.DOCS_OPENAPI_BASE_URL || new URL('.', DOCS_JSON_URL).toString()).replace(/\/?$/, '/')
+const DOCS_PRODUCTS = ['cloud', 'self-host'] as const
+
+type DocsProduct = typeof DOCS_PRODUCTS[number]
+type ProductAvailability = Record<string, Set<DocsProduct>>
+
+function isDocsProduct(segment: string): segment is DocsProduct {
+  return DOCS_PRODUCTS.includes(segment as DocsProduct)
+}
 
 /**
  * Convert summary to URL slug
@@ -112,6 +124,15 @@ function extractOpenAPIPaths(item: NavItem | undefined, paths: Set<string> = new
     if (item.languages)
       extractOpenAPIPaths(item.languages, paths)
 
+    if (item.products)
+      extractOpenAPIPaths(item.products, paths)
+
+    if (item.tabs)
+      extractOpenAPIPaths(item.tabs, paths)
+
+    if (item.menu)
+      extractOpenAPIPaths(item.menu, paths)
+
     if (item.versions)
       extractOpenAPIPaths(item.versions, paths)
   }
@@ -199,6 +220,15 @@ function extractPaths(item: NavItem | undefined, paths: Set<string> = new Set())
     if (item.languages)
       extractPaths(item.languages, paths)
 
+    if (item.products)
+      extractPaths(item.products, paths)
+
+    if (item.tabs)
+      extractPaths(item.tabs, paths)
+
+    if (item.menu)
+      extractPaths(item.menu, paths)
+
     // Handle versions in navigation
     if (item.versions)
       extractPaths(item.versions, paths)
@@ -207,33 +237,68 @@ function extractPaths(item: NavItem | undefined, paths: Set<string> = new Set())
   return paths
 }
 
+function addPathToGroup(groups: Record<string, Set<string>>, pathWithoutLang: string): void {
+  const parts = pathWithoutLang.split('/')
+  const section = parts[0]
+  if (!section)
+    return
+
+  if (!groups[section])
+    groups[section] = new Set()
+
+  groups[section]!.add(pathWithoutLang)
+}
+
+function getProductPathInfo(pathWithoutLang: string): { product: DocsProduct, pathWithoutProduct: string } | undefined {
+  const parts = pathWithoutLang.split('/')
+  const [product, ...rest] = parts
+
+  if (!product || !isDocsProduct(product) || rest.length === 0)
+    return undefined
+
+  return {
+    product,
+    pathWithoutProduct: rest.join('/'),
+  }
+}
+
 /**
  * Group paths by their prefix structure
  */
-function groupPathsBySection(paths: Set<string>): Record<string, Set<string>> {
+function groupPathsBySection(paths: Set<string>): { groups: Record<string, Set<string>>, productAvailability: ProductAvailability } {
   const groups: Record<string, Set<string>> = {}
+  const productAvailability: ProductAvailability = {}
 
   for (const fullPath of paths) {
-    // Skip non-doc paths (like .json files for OpenAPI)
-    if (fullPath.endsWith('.json'))
-      continue
-
     // Remove language prefix (en/, zh/, ja/)
     const withoutLang = fullPath.replace(/^(en|zh|ja)\//, '')
     if (!withoutLang || withoutLang === fullPath)
       continue
 
-    // Get section (first part of path)
-    const parts = withoutLang.split('/')
-    const section = parts[0]
+    // Skip non-doc paths (like .json files for OpenAPI)
+    if (withoutLang.endsWith('.json') || withoutLang === 'None')
+      continue
 
-    if (!groups[section!])
-      groups[section!] = new Set()
+    addPathToGroup(groups, withoutLang)
 
-    groups[section!]!.add(withoutLang)
+    const productPathInfo = getProductPathInfo(withoutLang)
+    if (productPathInfo) {
+      const productlessPath = productPathInfo.pathWithoutProduct
+      const normalizedPath = `/${productlessPath}`
+
+      addPathToGroup(groups, productlessPath)
+
+      if (!productAvailability[normalizedPath])
+        productAvailability[normalizedPath] = new Set()
+
+      productAvailability[normalizedPath]!.add(productPathInfo.product)
+    }
   }
 
-  return groups
+  return {
+    groups,
+    productAvailability,
+  }
 }
 
 /**
@@ -251,6 +316,7 @@ function sectionToTypeName(section: string): string {
  */
 function generateTypeDefinitions(
   groups: Record<string, Set<string>>,
+  productAvailability: ProductAvailability,
   apiReferencePaths: string[],
   apiPathTranslations: Record<string, { zh?: string, ja?: string }>,
 ): string {
@@ -258,11 +324,12 @@ function generateTypeDefinitions(
     '// GENERATE BY script',
     '// DON NOT EDIT IT MANUALLY',
     '//',
-    '// Generated from: https://raw.githubusercontent.com/langgenius/dify-docs/refs/heads/main/docs.json',
+    `// Generated from: ${DOCS_JSON_URL}`,
     `// Generated at: ${new Date().toISOString()}`,
     '',
     '// Language prefixes',
     'export type DocLanguage = \'en\' | \'zh\' | \'ja\'',
+    'export type DocsProduct = \'cloud\' | \'self-host\'',
     '',
   ]
 
@@ -321,10 +388,14 @@ function generateTypeDefinitions(
   lines.push('  | `${DocPathWithoutLangBase}#${string}`')
   lines.push('')
 
-  // Generate full path type with language prefix
-  lines.push('// Full documentation path with language prefix')
-  // eslint-disable-next-line no-template-curly-in-string
-  lines.push('export type DifyDocPath = `${DocLanguage}/${DocPathWithoutLang}`')
+  // Generate product availability map for productless runtime links.
+  lines.push('// Product availability for productless docs paths')
+  lines.push('export const docPathProductAvailability: Record<string, readonly DocsProduct[]> = {')
+  for (const path of Object.keys(productAvailability).sort()) {
+    const products = [...productAvailability[path]!].sort((a, b) => DOCS_PRODUCTS.indexOf(a) - DOCS_PRODUCTS.indexOf(b))
+    lines.push(`  '${path}': [${products.map(product => `'${product}'`).join(', ')}],`)
+  }
+  lines.push('}')
   lines.push('')
 
   // Generate API reference path translations map
@@ -423,12 +494,13 @@ async function main(): Promise<void> {
   console.log(`Generated ${Object.keys(apiPathTranslations).length} API path translations`)
 
   // Group by section
-  const groups = groupPathsBySection(allPaths)
+  const { groups, productAvailability } = groupPathsBySection(allPaths)
 
   console.log(`Grouped into ${Object.keys(groups).length} sections:`, Object.keys(groups))
+  console.log(`Found ${Object.keys(productAvailability).length} product-aware paths`)
 
   // Generate TypeScript
-  const tsContent = generateTypeDefinitions(groups, uniqueEnApiPaths, apiPathTranslations)
+  const tsContent = generateTypeDefinitions(groups, productAvailability, uniqueEnApiPaths, apiPathTranslations)
 
   // Write to file
   await writeFile(OUTPUT_PATH, tsContent, 'utf-8')
diff --git a/web/types/doc-paths.ts b/web/types/doc-paths.ts
index f97883d4d4f..a50afc87261 100644
--- a/web/types/doc-paths.ts
+++ b/web/types/doc-paths.ts
@@ -1,28 +1,127 @@
 // GENERATE BY script
 // DON NOT EDIT IT MANUALLY
 //
-// Generated from: https://raw.githubusercontent.com/langgenius/dify-docs/refs/heads/main/docs.json
-// Generated at: 2026-03-25T03:18:49.626Z
+// Generated from: https://raw.githubusercontent.com/langgenius/dify-docs/feat/audience-products/docs.json
+// Generated at: 2026-06-17T04:42:51.293Z
 
 // Language prefixes
 export type DocLanguage = 'en' | 'zh' | 'ja'
+export type DocsProduct = 'cloud' | 'self-host'
+
+// Cloud paths
+type CloudPath =
+  | '/cloud/use-dify/build/additional-features'
+  | '/cloud/use-dify/build/agent'
+  | '/cloud/use-dify/build/chatbot'
+  | '/cloud/use-dify/build/mcp'
+  | '/cloud/use-dify/build/orchestrate-node'
+  | '/cloud/use-dify/build/predefined-error-handling-logic'
+  | '/cloud/use-dify/build/shortcut-key'
+  | '/cloud/use-dify/build/text-generator'
+  | '/cloud/use-dify/build/version-control'
+  | '/cloud/use-dify/build/workflow-chatflow'
+  | '/cloud/use-dify/build/workflow-collaboration'
+  | '/cloud/use-dify/debug/error-type'
+  | '/cloud/use-dify/debug/history-and-logs'
+  | '/cloud/use-dify/debug/step-run'
+  | '/cloud/use-dify/debug/variable-inspect'
+  | '/cloud/use-dify/getting-started/introduction'
+  | '/cloud/use-dify/knowledge/connect-external-knowledge-base'
+  | '/cloud/use-dify/knowledge/create-knowledge/chunking-and-cleaning-text'
+  | '/cloud/use-dify/knowledge/create-knowledge/import-text-data/readme'
+  | '/cloud/use-dify/knowledge/create-knowledge/import-text-data/sync-from-notion'
+  | '/cloud/use-dify/knowledge/create-knowledge/import-text-data/sync-from-website'
+  | '/cloud/use-dify/knowledge/create-knowledge/introduction'
+  | '/cloud/use-dify/knowledge/create-knowledge/setting-indexing-methods'
+  | '/cloud/use-dify/knowledge/external-knowledge-api'
+  | '/cloud/use-dify/knowledge/integrate-knowledge-within-application'
+  | '/cloud/use-dify/knowledge/knowledge-pipeline/authorize-data-source'
+  | '/cloud/use-dify/knowledge/knowledge-pipeline/create-knowledge-pipeline'
+  | '/cloud/use-dify/knowledge/knowledge-pipeline/knowledge-pipeline-orchestration'
+  | '/cloud/use-dify/knowledge/knowledge-pipeline/manage-knowledge-base'
+  | '/cloud/use-dify/knowledge/knowledge-pipeline/publish-knowledge-pipeline'
+  | '/cloud/use-dify/knowledge/knowledge-pipeline/readme'
+  | '/cloud/use-dify/knowledge/knowledge-pipeline/upload-files'
+  | '/cloud/use-dify/knowledge/knowledge-request-rate-limit'
+  | '/cloud/use-dify/knowledge/manage-knowledge/introduction'
+  | '/cloud/use-dify/knowledge/manage-knowledge/maintain-dataset-via-api'
+  | '/cloud/use-dify/knowledge/manage-knowledge/maintain-knowledge-documents'
+  | '/cloud/use-dify/knowledge/metadata'
+  | '/cloud/use-dify/knowledge/readme'
+  | '/cloud/use-dify/knowledge/test-retrieval'
+  | '/cloud/use-dify/monitor/analysis'
+  | '/cloud/use-dify/monitor/annotation-reply'
+  | '/cloud/use-dify/monitor/integrations/integrate-aliyun'
+  | '/cloud/use-dify/monitor/integrations/integrate-arize'
+  | '/cloud/use-dify/monitor/integrations/integrate-langfuse'
+  | '/cloud/use-dify/monitor/integrations/integrate-langsmith'
+  | '/cloud/use-dify/monitor/integrations/integrate-opik'
+  | '/cloud/use-dify/monitor/integrations/integrate-phoenix'
+  | '/cloud/use-dify/monitor/integrations/integrate-weave'
+  | '/cloud/use-dify/monitor/logs'
+  | '/cloud/use-dify/nodes/agent'
+  | '/cloud/use-dify/nodes/answer'
+  | '/cloud/use-dify/nodes/code'
+  | '/cloud/use-dify/nodes/doc-extractor'
+  | '/cloud/use-dify/nodes/http-request'
+  | '/cloud/use-dify/nodes/human-input'
+  | '/cloud/use-dify/nodes/ifelse'
+  | '/cloud/use-dify/nodes/iteration'
+  | '/cloud/use-dify/nodes/knowledge-retrieval'
+  | '/cloud/use-dify/nodes/list-operator'
+  | '/cloud/use-dify/nodes/llm'
+  | '/cloud/use-dify/nodes/loop'
+  | '/cloud/use-dify/nodes/output'
+  | '/cloud/use-dify/nodes/parameter-extractor'
+  | '/cloud/use-dify/nodes/question-classifier'
+  | '/cloud/use-dify/nodes/template'
+  | '/cloud/use-dify/nodes/tools'
+  | '/cloud/use-dify/nodes/trigger/overview'
+  | '/cloud/use-dify/nodes/trigger/plugin-trigger'
+  | '/cloud/use-dify/nodes/trigger/schedule-trigger'
+  | '/cloud/use-dify/nodes/trigger/webhook-trigger'
+  | '/cloud/use-dify/nodes/user-input'
+  | '/cloud/use-dify/nodes/variable-aggregator'
+  | '/cloud/use-dify/nodes/variable-assigner'
+  | '/cloud/use-dify/publish/README'
+  | '/cloud/use-dify/publish/developing-with-apis'
+  | '/cloud/use-dify/publish/publish-mcp'
+  | '/cloud/use-dify/publish/publish-to-marketplace'
+  | '/cloud/use-dify/publish/webapp/chatflow-webapp'
+  | '/cloud/use-dify/publish/webapp/embedding-in-websites'
+  | '/cloud/use-dify/publish/webapp/web-app-settings'
+  | '/cloud/use-dify/publish/webapp/workflow-webapp'
+  | '/cloud/use-dify/workspace/api-extension/api-extension'
+  | '/cloud/use-dify/workspace/api-extension/cloudflare-worker'
+  | '/cloud/use-dify/workspace/api-extension/external-data-tool-api-extension'
+  | '/cloud/use-dify/workspace/api-extension/moderation-api-extension'
+  | '/cloud/use-dify/workspace/app-management'
+  | '/cloud/use-dify/workspace/model-providers'
+  | '/cloud/use-dify/workspace/personal-account-management'
+  | '/cloud/use-dify/workspace/plugins'
+  | '/cloud/use-dify/workspace/readme'
+  | '/cloud/use-dify/workspace/subscription-management'
+  | '/cloud/use-dify/workspace/team-members-management'
+  | '/cloud/use-dify/workspace/tools'
 
 // UseDify paths
 type UseDifyPath =
   | '/use-dify/build/additional-features'
-  | '/use-dify/build/goto-anything'
+  | '/use-dify/build/agent'
+  | '/use-dify/build/chatbot'
   | '/use-dify/build/mcp'
   | '/use-dify/build/orchestrate-node'
   | '/use-dify/build/predefined-error-handling-logic'
   | '/use-dify/build/shortcut-key'
+  | '/use-dify/build/text-generator'
   | '/use-dify/build/version-control'
+  | '/use-dify/build/workflow-chatflow'
+  | '/use-dify/build/workflow-collaboration'
   | '/use-dify/debug/error-type'
   | '/use-dify/debug/history-and-logs'
   | '/use-dify/debug/step-run'
   | '/use-dify/debug/variable-inspect'
   | '/use-dify/getting-started/introduction'
-  | '/use-dify/getting-started/key-concepts'
-  | '/use-dify/getting-started/quick-start'
   | '/use-dify/knowledge/connect-external-knowledge-base'
   | '/use-dify/knowledge/create-knowledge/chunking-and-cleaning-text'
   | '/use-dify/knowledge/create-knowledge/import-text-data/readme'
@@ -86,24 +185,8 @@ type UseDifyPath =
   | '/use-dify/publish/publish-to-marketplace'
   | '/use-dify/publish/webapp/chatflow-webapp'
   | '/use-dify/publish/webapp/embedding-in-websites'
-  | '/use-dify/publish/webapp/web-app-access'
   | '/use-dify/publish/webapp/web-app-settings'
   | '/use-dify/publish/webapp/workflow-webapp'
-  | '/use-dify/tutorials/article-reader'
-  | '/use-dify/tutorials/build-ai-image-generation-app'
-  | '/use-dify/tutorials/customer-service-bot'
-  | '/use-dify/tutorials/simple-chatbot'
-  | '/use-dify/tutorials/twitter-chatflow'
-  | '/use-dify/tutorials/workflow-101/lesson-01'
-  | '/use-dify/tutorials/workflow-101/lesson-02'
-  | '/use-dify/tutorials/workflow-101/lesson-03'
-  | '/use-dify/tutorials/workflow-101/lesson-04'
-  | '/use-dify/tutorials/workflow-101/lesson-05'
-  | '/use-dify/tutorials/workflow-101/lesson-06'
-  | '/use-dify/tutorials/workflow-101/lesson-07'
-  | '/use-dify/tutorials/workflow-101/lesson-08'
-  | '/use-dify/tutorials/workflow-101/lesson-09'
-  | '/use-dify/tutorials/workflow-101/lesson-10'
   | '/use-dify/workspace/api-extension/api-extension'
   | '/use-dify/workspace/api-extension/cloudflare-worker'
   | '/use-dify/workspace/api-extension/external-data-tool-api-extension'
@@ -115,25 +198,42 @@ type UseDifyPath =
   | '/use-dify/workspace/readme'
   | '/use-dify/workspace/subscription-management'
   | '/use-dify/workspace/team-members-management'
+  | '/use-dify/workspace/tools'
 
 // UseDify node paths (without prefix)
 type ExtractNodesPath<T> = T extends `/use-dify/nodes/${infer Path}` ? Path : never
 export type UseDifyNodesPath = ExtractNodesPath<UseDifyPath>
 
-// SelfHost paths
-type SelfHostPath =
-  | '/self-host/advanced-deployments/local-source-code'
-  | '/self-host/advanced-deployments/start-the-frontend-docker-container'
-  | '/self-host/configuration/environments'
-  | '/self-host/platform-guides/bt-panel'
-  | '/self-host/platform-guides/dify-premium'
-  | '/self-host/quick-start/docker-compose'
-  | '/self-host/quick-start/faqs'
-  | '/self-host/troubleshooting/common-issues'
-  | '/self-host/troubleshooting/docker-issues'
-  | '/self-host/troubleshooting/integrations'
-  | '/self-host/troubleshooting/storage-and-migration'
-  | '/self-host/troubleshooting/weaviate-v4-migration'
+// Home paths
+type HomePath =
+  | '/home'
+
+// Learn paths
+type LearnPath =
+  | '/learn/key-concepts'
+  | '/learn/tutorials/article-reader'
+  | '/learn/tutorials/build-ai-image-generation-app'
+  | '/learn/tutorials/customer-service-bot'
+  | '/learn/tutorials/simple-chatbot'
+  | '/learn/tutorials/twitter-chatflow'
+  | '/learn/tutorials/workflow-101/lesson-01'
+  | '/learn/tutorials/workflow-101/lesson-02'
+  | '/learn/tutorials/workflow-101/lesson-03'
+  | '/learn/tutorials/workflow-101/lesson-04'
+  | '/learn/tutorials/workflow-101/lesson-05'
+  | '/learn/tutorials/workflow-101/lesson-06'
+  | '/learn/tutorials/workflow-101/lesson-07'
+  | '/learn/tutorials/workflow-101/lesson-08'
+  | '/learn/tutorials/workflow-101/lesson-09'
+  | '/learn/tutorials/workflow-101/lesson-10'
+
+// QuickStart paths
+type QuickStartPath =
+  | '/quick-start'
+
+// Cli paths
+type CliPath =
+  | '/cli/coming-soon'
 
 // DevelopPlugin paths
 type DevelopPluginPath =
@@ -165,6 +265,7 @@ type DevelopPluginPath =
   | '/develop-plugin/features-and-specs/plugin-types/plugin-logging'
   | '/develop-plugin/features-and-specs/plugin-types/remote-debug-a-plugin'
   | '/develop-plugin/features-and-specs/plugin-types/tool'
+  | '/develop-plugin/getting-started/choose-plugin-type'
   | '/develop-plugin/getting-started/cli'
   | '/develop-plugin/getting-started/getting-started-dify-plugin'
   | '/develop-plugin/publishing/faq/faq'
@@ -177,6 +278,129 @@ type DevelopPluginPath =
   | '/develop-plugin/publishing/standards/privacy-protection-guidelines'
   | '/develop-plugin/publishing/standards/third-party-signature-verification'
 
+// SelfHost paths
+type SelfHostPath =
+  | '/self-host/deploy/advanced-deployments/local-source-code'
+  | '/self-host/deploy/advanced-deployments/start-the-frontend-docker-container'
+  | '/self-host/deploy/configuration/environments'
+  | '/self-host/deploy/overview'
+  | '/self-host/deploy/platform-guides/bt-panel'
+  | '/self-host/deploy/platform-guides/dify-premium'
+  | '/self-host/deploy/quick-start/docker-compose'
+  | '/self-host/deploy/quick-start/faqs'
+  | '/self-host/deploy/troubleshooting/common-issues'
+  | '/self-host/deploy/troubleshooting/docker-issues'
+  | '/self-host/deploy/troubleshooting/integrations'
+  | '/self-host/deploy/troubleshooting/storage-and-migration'
+  | '/self-host/deploy/troubleshooting/weaviate-v4-migration'
+  | '/self-host/use-dify/build/additional-features'
+  | '/self-host/use-dify/build/agent'
+  | '/self-host/use-dify/build/chatbot'
+  | '/self-host/use-dify/build/mcp'
+  | '/self-host/use-dify/build/orchestrate-node'
+  | '/self-host/use-dify/build/predefined-error-handling-logic'
+  | '/self-host/use-dify/build/shortcut-key'
+  | '/self-host/use-dify/build/text-generator'
+  | '/self-host/use-dify/build/version-control'
+  | '/self-host/use-dify/build/workflow-chatflow'
+  | '/self-host/use-dify/build/workflow-collaboration'
+  | '/self-host/use-dify/debug/error-type'
+  | '/self-host/use-dify/debug/history-and-logs'
+  | '/self-host/use-dify/debug/step-run'
+  | '/self-host/use-dify/debug/variable-inspect'
+  | '/self-host/use-dify/getting-started/introduction'
+  | '/self-host/use-dify/knowledge/connect-external-knowledge-base'
+  | '/self-host/use-dify/knowledge/create-knowledge/chunking-and-cleaning-text'
+  | '/self-host/use-dify/knowledge/create-knowledge/import-text-data/readme'
+  | '/self-host/use-dify/knowledge/create-knowledge/import-text-data/sync-from-notion'
+  | '/self-host/use-dify/knowledge/create-knowledge/import-text-data/sync-from-website'
+  | '/self-host/use-dify/knowledge/create-knowledge/introduction'
+  | '/self-host/use-dify/knowledge/create-knowledge/setting-indexing-methods'
+  | '/self-host/use-dify/knowledge/external-knowledge-api'
+  | '/self-host/use-dify/knowledge/integrate-knowledge-within-application'
+  | '/self-host/use-dify/knowledge/knowledge-pipeline/authorize-data-source'
+  | '/self-host/use-dify/knowledge/knowledge-pipeline/create-knowledge-pipeline'
+  | '/self-host/use-dify/knowledge/knowledge-pipeline/knowledge-pipeline-orchestration'
+  | '/self-host/use-dify/knowledge/knowledge-pipeline/manage-knowledge-base'
+  | '/self-host/use-dify/knowledge/knowledge-pipeline/publish-knowledge-pipeline'
+  | '/self-host/use-dify/knowledge/knowledge-pipeline/readme'
+  | '/self-host/use-dify/knowledge/knowledge-pipeline/upload-files'
+  | '/self-host/use-dify/knowledge/manage-knowledge/introduction'
+  | '/self-host/use-dify/knowledge/manage-knowledge/maintain-dataset-via-api'
+  | '/self-host/use-dify/knowledge/manage-knowledge/maintain-knowledge-documents'
+  | '/self-host/use-dify/knowledge/metadata'
+  | '/self-host/use-dify/knowledge/readme'
+  | '/self-host/use-dify/knowledge/test-retrieval'
+  | '/self-host/use-dify/monitor/analysis'
+  | '/self-host/use-dify/monitor/annotation-reply'
+  | '/self-host/use-dify/monitor/integrations/integrate-aliyun'
+  | '/self-host/use-dify/monitor/integrations/integrate-arize'
+  | '/self-host/use-dify/monitor/integrations/integrate-langfuse'
+  | '/self-host/use-dify/monitor/integrations/integrate-langsmith'
+  | '/self-host/use-dify/monitor/integrations/integrate-opik'
+  | '/self-host/use-dify/monitor/integrations/integrate-phoenix'
+  | '/self-host/use-dify/monitor/integrations/integrate-weave'
+  | '/self-host/use-dify/monitor/logs'
+  | '/self-host/use-dify/nodes/agent'
+  | '/self-host/use-dify/nodes/answer'
+  | '/self-host/use-dify/nodes/code'
+  | '/self-host/use-dify/nodes/doc-extractor'
+  | '/self-host/use-dify/nodes/http-request'
+  | '/self-host/use-dify/nodes/human-input'
+  | '/self-host/use-dify/nodes/ifelse'
+  | '/self-host/use-dify/nodes/iteration'
+  | '/self-host/use-dify/nodes/knowledge-retrieval'
+  | '/self-host/use-dify/nodes/list-operator'
+  | '/self-host/use-dify/nodes/llm'
+  | '/self-host/use-dify/nodes/loop'
+  | '/self-host/use-dify/nodes/output'
+  | '/self-host/use-dify/nodes/parameter-extractor'
+  | '/self-host/use-dify/nodes/question-classifier'
+  | '/self-host/use-dify/nodes/template'
+  | '/self-host/use-dify/nodes/tools'
+  | '/self-host/use-dify/nodes/trigger/overview'
+  | '/self-host/use-dify/nodes/trigger/plugin-trigger'
+  | '/self-host/use-dify/nodes/trigger/schedule-trigger'
+  | '/self-host/use-dify/nodes/trigger/webhook-trigger'
+  | '/self-host/use-dify/nodes/user-input'
+  | '/self-host/use-dify/nodes/variable-aggregator'
+  | '/self-host/use-dify/nodes/variable-assigner'
+  | '/self-host/use-dify/publish/README'
+  | '/self-host/use-dify/publish/developing-with-apis'
+  | '/self-host/use-dify/publish/publish-mcp'
+  | '/self-host/use-dify/publish/publish-to-marketplace'
+  | '/self-host/use-dify/publish/webapp/chatflow-webapp'
+  | '/self-host/use-dify/publish/webapp/embedding-in-websites'
+  | '/self-host/use-dify/publish/webapp/web-app-settings'
+  | '/self-host/use-dify/publish/webapp/workflow-webapp'
+  | '/self-host/use-dify/workspace/api-extension/api-extension'
+  | '/self-host/use-dify/workspace/api-extension/cloudflare-worker'
+  | '/self-host/use-dify/workspace/api-extension/external-data-tool-api-extension'
+  | '/self-host/use-dify/workspace/api-extension/moderation-api-extension'
+  | '/self-host/use-dify/workspace/app-management'
+  | '/self-host/use-dify/workspace/model-providers'
+  | '/self-host/use-dify/workspace/personal-account-management'
+  | '/self-host/use-dify/workspace/plugins'
+  | '/self-host/use-dify/workspace/readme'
+  | '/self-host/use-dify/workspace/team-members-management'
+  | '/self-host/use-dify/workspace/tools'
+
+// Deploy paths
+type DeployPath =
+  | '/deploy/advanced-deployments/local-source-code'
+  | '/deploy/advanced-deployments/start-the-frontend-docker-container'
+  | '/deploy/configuration/environments'
+  | '/deploy/overview'
+  | '/deploy/platform-guides/bt-panel'
+  | '/deploy/platform-guides/dify-premium'
+  | '/deploy/quick-start/docker-compose'
+  | '/deploy/quick-start/faqs'
+  | '/deploy/troubleshooting/common-issues'
+  | '/deploy/troubleshooting/docker-issues'
+  | '/deploy/troubleshooting/integrations'
+  | '/deploy/troubleshooting/storage-and-migration'
+  | '/deploy/troubleshooting/weaviate-v4-migration'
+
 // API Reference paths (English, use apiReferencePathTranslations for other languages)
 type ApiReferencePath =
   | '/api-reference/annotations/configure-annotation-reply'
@@ -189,6 +413,12 @@ type ApiReferencePath =
   | '/api-reference/applications/get-app-meta'
   | '/api-reference/applications/get-app-parameters'
   | '/api-reference/applications/get-app-webapp-settings'
+  | '/api-reference/chatflows/get-next-suggested-questions'
+  | '/api-reference/chatflows/get-workflow-run-detail'
+  | '/api-reference/chatflows/list-workflow-logs'
+  | '/api-reference/chatflows/send-chat-message'
+  | '/api-reference/chatflows/stop-chat-message-generation'
+  | '/api-reference/chatflows/stream-workflow-events'
   | '/api-reference/chats/get-next-suggested-questions'
   | '/api-reference/chats/send-chat-message'
   | '/api-reference/chats/stop-chat-message-generation'
@@ -225,6 +455,8 @@ type ApiReferencePath =
   | '/api-reference/feedback/submit-message-feedback'
   | '/api-reference/files/download-file'
   | '/api-reference/files/upload-file'
+  | '/api-reference/human-input/get-human-input-form'
+  | '/api-reference/human-input/submit-human-input-form'
   | '/api-reference/knowledge-bases/create-an-empty-knowledge-base'
   | '/api-reference/knowledge-bases/delete-knowledge-base'
   | '/api-reference/knowledge-bases/get-knowledge-base'
@@ -252,19 +484,24 @@ type ApiReferencePath =
   | '/api-reference/tags/update-knowledge-tag'
   | '/api-reference/tts/convert-audio-to-text'
   | '/api-reference/tts/convert-text-to-audio'
-  | '/api-reference/workflow-runs/get-workflow-run-detail'
-  | '/api-reference/workflow-runs/list-workflow-logs'
   | '/api-reference/workflows/get-workflow-run-detail'
   | '/api-reference/workflows/list-workflow-logs'
   | '/api-reference/workflows/run-workflow'
   | '/api-reference/workflows/run-workflow-by-id'
   | '/api-reference/workflows/stop-workflow-task'
+  | '/api-reference/workflows/stream-workflow-events'
 
 // Base path without language prefix
 type DocPathWithoutLangBase =
+  | CloudPath
   | UseDifyPath
-  | SelfHostPath
+  | HomePath
+  | LearnPath
+  | QuickStartPath
+  | CliPath
   | DevelopPluginPath
+  | SelfHostPath
+  | DeployPath
   | ApiReferencePath
 
 // Combined path without language prefix (supports optional #anchor)
@@ -272,6 +509,116 @@ export type DocPathWithoutLang =
   | DocPathWithoutLangBase
   | `${DocPathWithoutLangBase}#${string}`
 
+// Product availability for productless docs paths
+export const docPathProductAvailability: Record<string, readonly DocsProduct[]> = {
+  '/deploy/advanced-deployments/local-source-code': ['self-host'],
+  '/deploy/advanced-deployments/start-the-frontend-docker-container': ['self-host'],
+  '/deploy/configuration/environments': ['self-host'],
+  '/deploy/overview': ['self-host'],
+  '/deploy/platform-guides/bt-panel': ['self-host'],
+  '/deploy/platform-guides/dify-premium': ['self-host'],
+  '/deploy/quick-start/docker-compose': ['self-host'],
+  '/deploy/quick-start/faqs': ['self-host'],
+  '/deploy/troubleshooting/common-issues': ['self-host'],
+  '/deploy/troubleshooting/docker-issues': ['self-host'],
+  '/deploy/troubleshooting/integrations': ['self-host'],
+  '/deploy/troubleshooting/storage-and-migration': ['self-host'],
+  '/deploy/troubleshooting/weaviate-v4-migration': ['self-host'],
+  '/use-dify/build/additional-features': ['cloud', 'self-host'],
+  '/use-dify/build/agent': ['cloud', 'self-host'],
+  '/use-dify/build/chatbot': ['cloud', 'self-host'],
+  '/use-dify/build/mcp': ['cloud', 'self-host'],
+  '/use-dify/build/orchestrate-node': ['cloud', 'self-host'],
+  '/use-dify/build/predefined-error-handling-logic': ['cloud', 'self-host'],
+  '/use-dify/build/shortcut-key': ['cloud', 'self-host'],
+  '/use-dify/build/text-generator': ['cloud', 'self-host'],
+  '/use-dify/build/version-control': ['cloud', 'self-host'],
+  '/use-dify/build/workflow-chatflow': ['cloud', 'self-host'],
+  '/use-dify/build/workflow-collaboration': ['cloud', 'self-host'],
+  '/use-dify/debug/error-type': ['cloud', 'self-host'],
+  '/use-dify/debug/history-and-logs': ['cloud', 'self-host'],
+  '/use-dify/debug/step-run': ['cloud', 'self-host'],
+  '/use-dify/debug/variable-inspect': ['cloud', 'self-host'],
+  '/use-dify/getting-started/introduction': ['cloud', 'self-host'],
+  '/use-dify/knowledge/connect-external-knowledge-base': ['cloud', 'self-host'],
+  '/use-dify/knowledge/create-knowledge/chunking-and-cleaning-text': ['cloud', 'self-host'],
+  '/use-dify/knowledge/create-knowledge/import-text-data/readme': ['cloud', 'self-host'],
+  '/use-dify/knowledge/create-knowledge/import-text-data/sync-from-notion': ['cloud', 'self-host'],
+  '/use-dify/knowledge/create-knowledge/import-text-data/sync-from-website': ['cloud', 'self-host'],
+  '/use-dify/knowledge/create-knowledge/introduction': ['cloud', 'self-host'],
+  '/use-dify/knowledge/create-knowledge/setting-indexing-methods': ['cloud', 'self-host'],
+  '/use-dify/knowledge/external-knowledge-api': ['cloud', 'self-host'],
+  '/use-dify/knowledge/integrate-knowledge-within-application': ['cloud', 'self-host'],
+  '/use-dify/knowledge/knowledge-pipeline/authorize-data-source': ['cloud', 'self-host'],
+  '/use-dify/knowledge/knowledge-pipeline/create-knowledge-pipeline': ['cloud', 'self-host'],
+  '/use-dify/knowledge/knowledge-pipeline/knowledge-pipeline-orchestration': ['cloud', 'self-host'],
+  '/use-dify/knowledge/knowledge-pipeline/manage-knowledge-base': ['cloud', 'self-host'],
+  '/use-dify/knowledge/knowledge-pipeline/publish-knowledge-pipeline': ['cloud', 'self-host'],
+  '/use-dify/knowledge/knowledge-pipeline/readme': ['cloud', 'self-host'],
+  '/use-dify/knowledge/knowledge-pipeline/upload-files': ['cloud', 'self-host'],
+  '/use-dify/knowledge/knowledge-request-rate-limit': ['cloud'],
+  '/use-dify/knowledge/manage-knowledge/introduction': ['cloud', 'self-host'],
+  '/use-dify/knowledge/manage-knowledge/maintain-dataset-via-api': ['cloud', 'self-host'],
+  '/use-dify/knowledge/manage-knowledge/maintain-knowledge-documents': ['cloud', 'self-host'],
+  '/use-dify/knowledge/metadata': ['cloud', 'self-host'],
+  '/use-dify/knowledge/readme': ['cloud', 'self-host'],
+  '/use-dify/knowledge/test-retrieval': ['cloud', 'self-host'],
+  '/use-dify/monitor/analysis': ['cloud', 'self-host'],
+  '/use-dify/monitor/annotation-reply': ['cloud', 'self-host'],
+  '/use-dify/monitor/integrations/integrate-aliyun': ['cloud', 'self-host'],
+  '/use-dify/monitor/integrations/integrate-arize': ['cloud', 'self-host'],
+  '/use-dify/monitor/integrations/integrate-langfuse': ['cloud', 'self-host'],
+  '/use-dify/monitor/integrations/integrate-langsmith': ['cloud', 'self-host'],
+  '/use-dify/monitor/integrations/integrate-opik': ['cloud', 'self-host'],
+  '/use-dify/monitor/integrations/integrate-phoenix': ['cloud', 'self-host'],
+  '/use-dify/monitor/integrations/integrate-weave': ['cloud', 'self-host'],
+  '/use-dify/monitor/logs': ['cloud', 'self-host'],
+  '/use-dify/nodes/agent': ['cloud', 'self-host'],
+  '/use-dify/nodes/answer': ['cloud', 'self-host'],
+  '/use-dify/nodes/code': ['cloud', 'self-host'],
+  '/use-dify/nodes/doc-extractor': ['cloud', 'self-host'],
+  '/use-dify/nodes/http-request': ['cloud', 'self-host'],
+  '/use-dify/nodes/human-input': ['cloud', 'self-host'],
+  '/use-dify/nodes/ifelse': ['cloud', 'self-host'],
+  '/use-dify/nodes/iteration': ['cloud', 'self-host'],
+  '/use-dify/nodes/knowledge-retrieval': ['cloud', 'self-host'],
+  '/use-dify/nodes/list-operator': ['cloud', 'self-host'],
+  '/use-dify/nodes/llm': ['cloud', 'self-host'],
+  '/use-dify/nodes/loop': ['cloud', 'self-host'],
+  '/use-dify/nodes/output': ['cloud', 'self-host'],
+  '/use-dify/nodes/parameter-extractor': ['cloud', 'self-host'],
+  '/use-dify/nodes/question-classifier': ['cloud', 'self-host'],
+  '/use-dify/nodes/template': ['cloud', 'self-host'],
+  '/use-dify/nodes/tools': ['cloud', 'self-host'],
+  '/use-dify/nodes/trigger/overview': ['cloud', 'self-host'],
+  '/use-dify/nodes/trigger/plugin-trigger': ['cloud', 'self-host'],
+  '/use-dify/nodes/trigger/schedule-trigger': ['cloud', 'self-host'],
+  '/use-dify/nodes/trigger/webhook-trigger': ['cloud', 'self-host'],
+  '/use-dify/nodes/user-input': ['cloud', 'self-host'],
+  '/use-dify/nodes/variable-aggregator': ['cloud', 'self-host'],
+  '/use-dify/nodes/variable-assigner': ['cloud', 'self-host'],
+  '/use-dify/publish/README': ['cloud', 'self-host'],
+  '/use-dify/publish/developing-with-apis': ['cloud', 'self-host'],
+  '/use-dify/publish/publish-mcp': ['cloud', 'self-host'],
+  '/use-dify/publish/publish-to-marketplace': ['cloud', 'self-host'],
+  '/use-dify/publish/webapp/chatflow-webapp': ['cloud', 'self-host'],
+  '/use-dify/publish/webapp/embedding-in-websites': ['cloud', 'self-host'],
+  '/use-dify/publish/webapp/web-app-settings': ['cloud', 'self-host'],
+  '/use-dify/publish/webapp/workflow-webapp': ['cloud', 'self-host'],
+  '/use-dify/workspace/api-extension/api-extension': ['cloud', 'self-host'],
+  '/use-dify/workspace/api-extension/cloudflare-worker': ['cloud', 'self-host'],
+  '/use-dify/workspace/api-extension/external-data-tool-api-extension': ['cloud', 'self-host'],
+  '/use-dify/workspace/api-extension/moderation-api-extension': ['cloud', 'self-host'],
+  '/use-dify/workspace/app-management': ['cloud', 'self-host'],
+  '/use-dify/workspace/model-providers': ['cloud', 'self-host'],
+  '/use-dify/workspace/personal-account-management': ['cloud', 'self-host'],
+  '/use-dify/workspace/plugins': ['cloud', 'self-host'],
+  '/use-dify/workspace/readme': ['cloud', 'self-host'],
+  '/use-dify/workspace/subscription-management': ['cloud'],
+  '/use-dify/workspace/team-members-management': ['cloud', 'self-host'],
+  '/use-dify/workspace/tools': ['cloud', 'self-host'],
+}
+
 // API Reference path translations (English -> other languages)
 export const apiReferencePathTranslations: Record<string, { zh?: string; ja?: string }> = {
   '/api-reference/annotations/configure-annotation-reply': { zh: '/api-reference/标注管理/配置标注回复', ja: '/api-reference/アノテーション管理/アノテーション返信を設定' },
@@ -284,6 +631,12 @@ export const apiReferencePathTranslations: Record<string, { zh?: string; ja?: st
   '/api-reference/applications/get-app-meta': { zh: '/api-reference/应用配置/获取应用元数据', ja: '/api-reference/アプリケーション設定/アプリケーションのメタ情報を取得' },
   '/api-reference/applications/get-app-parameters': { zh: '/api-reference/应用配置/获取应用参数', ja: '/api-reference/アプリケーション設定/アプリケーションのパラメータ情報を取得' },
   '/api-reference/applications/get-app-webapp-settings': { zh: '/api-reference/应用配置/获取应用-webapp-设置', ja: '/api-reference/アプリケーション設定/アプリの-webapp-設定を取得' },
+  '/api-reference/chatflows/get-next-suggested-questions': { zh: '/api-reference/对话流/获取下一轮建议问题列表', ja: '/api-reference/チャットフロー/次の推奨質問を取得' },
+  '/api-reference/chatflows/get-workflow-run-detail': { zh: '/api-reference/对话流/获取工作流执行情况', ja: '/api-reference/チャットフロー/ワークフロー実行詳細を取得' },
+  '/api-reference/chatflows/list-workflow-logs': { zh: '/api-reference/对话流/获取工作流日志', ja: '/api-reference/チャットフロー/ワークフローログ一覧を取得' },
+  '/api-reference/chatflows/send-chat-message': { zh: '/api-reference/对话流/发送对话消息', ja: '/api-reference/チャットフロー/チャットメッセージを送信' },
+  '/api-reference/chatflows/stop-chat-message-generation': { zh: '/api-reference/对话流/停止响应', ja: '/api-reference/チャットフロー/生成を停止' },
+  '/api-reference/chatflows/stream-workflow-events': { zh: '/api-reference/对话流/流式获取工作流事件', ja: '/api-reference/チャットフロー/ワークフローイベントをストリーム' },
   '/api-reference/chats/get-next-suggested-questions': { zh: '/api-reference/对话消息/获取下一轮建议问题列表', ja: '/api-reference/チャットメッセージ/次の推奨質問を取得' },
   '/api-reference/chats/send-chat-message': { zh: '/api-reference/对话消息/发送对话消息', ja: '/api-reference/チャットメッセージ/チャットメッセージを送信' },
   '/api-reference/chats/stop-chat-message-generation': { zh: '/api-reference/对话消息/停止响应', ja: '/api-reference/チャットメッセージ/生成を停止' },
@@ -320,6 +673,8 @@ export const apiReferencePathTranslations: Record<string, { zh?: string; ja?: st
   '/api-reference/feedback/submit-message-feedback': { zh: '/api-reference/消息反馈/提交消息反馈', ja: '/api-reference/メッセージフィードバック/メッセージフィードバックを送信' },
   '/api-reference/files/download-file': { zh: '/api-reference/文件操作/下载文件', ja: '/api-reference/ファイル操作/ファイルをダウンロード' },
   '/api-reference/files/upload-file': { zh: '/api-reference/文件操作/上传文件', ja: '/api-reference/ファイル操作/ファイルをアップロード' },
+  '/api-reference/human-input/get-human-input-form': { zh: '/api-reference/人工介入/获取人工介入表单', ja: '/api-reference/人間の入力/人間の入力フォームを取得' },
+  '/api-reference/human-input/submit-human-input-form': { zh: '/api-reference/人工介入/提交人工介入表单', ja: '/api-reference/人間の入力/人間の入力フォームを送信' },
   '/api-reference/knowledge-bases/create-an-empty-knowledge-base': { zh: '/api-reference/知识库/创建空知识库', ja: '/api-reference/データセット/空のナレッジベースを作成' },
   '/api-reference/knowledge-bases/delete-knowledge-base': { zh: '/api-reference/知识库/删除知识库', ja: '/api-reference/データセット/ナレッジベースを削除' },
   '/api-reference/knowledge-bases/get-knowledge-base': { zh: '/api-reference/知识库/获取知识库详情', ja: '/api-reference/データセット/ナレッジベース詳細を取得' },
@@ -347,11 +702,10 @@ export const apiReferencePathTranslations: Record<string, { zh?: string; ja?: st
   '/api-reference/tags/update-knowledge-tag': { zh: '/api-reference/标签/修改知识库标签', ja: '/api-reference/タグ管理/ナレッジベースタグを変更' },
   '/api-reference/tts/convert-audio-to-text': { zh: '/api-reference/语音与文字转换/语音转文字', ja: '/api-reference/音声・テキスト変換/音声をテキストに変換' },
   '/api-reference/tts/convert-text-to-audio': { zh: '/api-reference/语音与文字转换/文字转语音', ja: '/api-reference/音声・テキスト変換/テキストを音声に変換' },
-  '/api-reference/workflow-runs/get-workflow-run-detail': { zh: '/api-reference/工作流执行/获取工作流执行情况', ja: '/api-reference/ワークフロー実行/ワークフロー実行詳細を取得' },
-  '/api-reference/workflow-runs/list-workflow-logs': { zh: '/api-reference/工作流执行/获取工作流日志', ja: '/api-reference/ワークフロー実行/ワークフローログ一覧を取得' },
   '/api-reference/workflows/get-workflow-run-detail': { zh: '/api-reference/工作流/获取工作流执行情况', ja: '/api-reference/ワークフロー/ワークフロー実行詳細を取得' },
   '/api-reference/workflows/list-workflow-logs': { zh: '/api-reference/工作流/获取工作流日志', ja: '/api-reference/ワークフロー/ワークフローログ一覧を取得' },
   '/api-reference/workflows/run-workflow': { zh: '/api-reference/工作流/执行工作流', ja: '/api-reference/ワークフロー/ワークフローを実行' },
   '/api-reference/workflows/run-workflow-by-id': { zh: '/api-reference/工作流/按-id-执行工作流', ja: '/api-reference/ワークフロー/id-でワークフローを実行' },
   '/api-reference/workflows/stop-workflow-task': { zh: '/api-reference/工作流/停止工作流任务', ja: '/api-reference/ワークフロー/ワークフロータスクを停止' },
+  '/api-reference/workflows/stream-workflow-events': { zh: '/api-reference/工作流/流式获取工作流事件', ja: '/api-reference/ワークフロー/ワークフローイベントをストリーム' },
 }
diff --git a/web/utils/app-redirection.spec.ts b/web/utils/app-redirection.spec.ts
index d3d9cb02b9f..944cc893e3a 100644
--- a/web/utils/app-redirection.spec.ts
+++ b/web/utils/app-redirection.spec.ts
@@ -71,7 +71,13 @@ describe('app-redirection', () => {
     it('returns access config path when app ACL can only configure access', () => {
       const app = { id: 'app-123', mode: AppModeEnum.CHAT, permission_keys: [AppACLPermission.AccessConfig] }
 
-      expect(getRedirectionPath(app)).toBe('/app/app-123/access-config')
+      expect(getRedirectionPath(app, { isRbacEnabled: true })).toBe('/app/app-123/access-config')
+    })
+
+    it('returns develop path for access config only apps when RBAC is disabled', () => {
+      const app = { id: 'app-123', mode: AppModeEnum.CHAT, permission_keys: [AppACLPermission.AccessConfig] }
+
+      expect(getRedirectionPath(app, { isRbacEnabled: false })).toBe('/app/app-123/develop')
     })
 
     it('returns overview path when app ACL can only monitor the app', () => {
diff --git a/web/utils/permission.spec.ts b/web/utils/permission.spec.ts
index 311796cc14c..b6f8447ffc5 100644
--- a/web/utils/permission.spec.ts
+++ b/web/utils/permission.spec.ts
@@ -9,6 +9,8 @@ import {
   getAppACLCapabilities,
   getDatasetACLCapabilities,
   hasEditPermissionForDataset,
+  hasOnlyAppPreviewPermission,
+  hasOnlyDatasetPreviewPermission,
   hasPermission,
 } from './permission'
 
@@ -132,6 +134,32 @@ describe('permission', () => {
     })
   })
 
+  describe('hasOnlyAppPreviewPermission', () => {
+    it('should return true when app ACL contains only preview permission', () => {
+      expect(hasOnlyAppPreviewPermission([AppACLPermission.Preview])).toBe(true)
+    })
+
+    it('should return false when app ACL contains preview permission and another permission', () => {
+      expect(hasOnlyAppPreviewPermission([
+        AppACLPermission.Preview,
+        AppACLPermission.ViewLayout,
+      ])).toBe(false)
+    })
+  })
+
+  describe('hasOnlyDatasetPreviewPermission', () => {
+    it('should return true when dataset ACL contains only preview permission', () => {
+      expect(hasOnlyDatasetPreviewPermission([DatasetACLPermission.Preview])).toBe(true)
+    })
+
+    it('should return false when dataset ACL contains preview permission and another permission', () => {
+      expect(hasOnlyDatasetPreviewPermission([
+        DatasetACLPermission.Preview,
+        DatasetACLPermission.Readonly,
+      ])).toBe(false)
+    })
+  })
+
   describe('app maintainer capabilities', () => {
     it('grants all app ACL capabilities without injecting app ACL permission keys', () => {
       const permissionKeys: string[] = []
@@ -139,6 +167,7 @@ describe('permission', () => {
         currentUserId: 'user-1',
         resourceMaintainer: 'user-1',
         workspacePermissionKeys: ['app.create_and_management'],
+        isRbacEnabled: true,
       })
 
       expect(capabilities.canViewLayout).toBe(true)
@@ -163,6 +192,14 @@ describe('permission', () => {
       expect(capabilities.canEdit).toBe(false)
       expect(capabilities.canDelete).toBe(false)
     })
+
+    it('does not grant app access config when RBAC is disabled', () => {
+      const capabilities = getAppACLCapabilities([AppACLPermission.AccessConfig], {
+        isRbacEnabled: false,
+      })
+
+      expect(capabilities.canAccessConfig).toBe(false)
+    })
   })
 
   describe('dataset maintainer capabilities', () => {
@@ -172,6 +209,7 @@ describe('permission', () => {
         currentUserId: 'user-1',
         resourceMaintainer: 'user-1',
         workspacePermissionKeys: ['dataset.create_and_management'],
+        isRbacEnabled: true,
       })
 
       expect(capabilities.canReadonly).toBe(true)
@@ -199,5 +237,13 @@ describe('permission', () => {
       expect(capabilities.canEdit).toBe(false)
       expect(capabilities.canDelete).toBe(false)
     })
+
+    it('does not grant dataset access config when RBAC is disabled', () => {
+      const capabilities = getDatasetACLCapabilities([DatasetACLPermission.AccessConfig], {
+        isRbacEnabled: false,
+      })
+
+      expect(capabilities.canAccessConfig).toBe(false)
+    })
   })
 })
diff --git a/web/utils/permission.ts b/web/utils/permission.ts
index 733e58611ce..ddc3d7b2864 100644
--- a/web/utils/permission.ts
+++ b/web/utils/permission.ts
@@ -2,6 +2,7 @@ import type { PermissionKey } from '@/models/access-control'
 import { DatasetPermission } from '@/models/datasets'
 
 export const AppACLPermission = {
+  Preview: 'app.acl.preview',
   ViewLayout: 'app.acl.view_layout',
   TestAndRun: 'app.acl.test_and_run',
   Edit: 'app.acl.edit',
@@ -13,6 +14,7 @@ export const AppACLPermission = {
 } as const
 
 export const DatasetACLPermission = {
+  Preview: 'dataset.acl.preview',
   Readonly: 'dataset.acl.readonly',
   Edit: 'dataset.acl.edit',
   ImportExportDSL: 'dataset.acl.import_export_dsl',
@@ -36,6 +38,7 @@ export type ResourceMaintainerPermissionOptions = {
   currentUserId?: string | null
   resourceMaintainer?: string | null
   workspacePermissionKeys?: readonly PermissionKey[] | null
+  isRbacEnabled?: boolean
 }
 
 type AppACLCapabilities = {
@@ -94,6 +97,14 @@ export const hasPermission = (permissionKeys: readonly PermissionKey[] | null |
   return permissionKeys.includes(singlePermissionKey)
 }
 
+export const hasOnlyAppPreviewPermission = (permissionKeys: readonly PermissionKey[] | null | undefined) => {
+  return permissionKeys?.length === 1 && permissionKeys[0] === AppACLPermission.Preview
+}
+
+export const hasOnlyDatasetPreviewPermission = (permissionKeys: readonly PermissionKey[] | null | undefined) => {
+  return permissionKeys?.length === 1 && permissionKeys[0] === DatasetACLPermission.Preview
+}
+
 const shouldGrantMaintainerPermissions = (
   options: ResourceMaintainerPermissionOptions | undefined,
   createPermissionKey: PermissionKey,
@@ -131,7 +142,7 @@ export const getAppACLCapabilities = (
     canDelete: hasResourcePermission(permissionKeys, AppACLPermission.Delete, hasMaintainerPermissions),
     canReleaseAndVersion: hasResourcePermission(permissionKeys, AppACLPermission.ReleaseAndVersion, hasMaintainerPermissions),
     canMonitor: hasResourcePermission(permissionKeys, AppACLPermission.Monitor, hasMaintainerPermissions),
-    canAccessConfig: hasResourcePermission(permissionKeys, AppACLPermission.AccessConfig, hasMaintainerPermissions),
+    canAccessConfig: Boolean(options?.isRbacEnabled) && hasResourcePermission(permissionKeys, AppACLPermission.AccessConfig, hasMaintainerPermissions),
   }
 }
 
@@ -152,6 +163,6 @@ export const getDatasetACLCapabilities = (
     canDeleteFile: hasResourcePermission(permissionKeys, DatasetACLPermission.DeleteFile, hasMaintainerPermissions),
     canPipelineRelease: hasResourcePermission(permissionKeys, DatasetACLPermission.PipelineRelease, hasMaintainerPermissions),
     canDelete: hasResourcePermission(permissionKeys, DatasetACLPermission.Delete, hasMaintainerPermissions),
-    canAccessConfig: hasResourcePermission(permissionKeys, DatasetACLPermission.AccessConfig, hasMaintainerPermissions),
+    canAccessConfig: Boolean(options?.isRbacEnabled) && hasResourcePermission(permissionKeys, DatasetACLPermission.AccessConfig, hasMaintainerPermissions),
   }
 }